d8df40a7ad601f3da524640b2859bc0957959434908ebf96b5a1fb30dc504b9f

Analysis

user interaction
yes
max time kernel
212s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vape421Native.dll
Size 15.8MB
Sample260731-2bd4easdpf
SHA256 d8df40a7ad601f3da524640b2859bc0957959434908ebf96b5a1fb30dc504b9f
MD5 71acb4e900589a274bc9b999a86d6cc2
SHA1 4a57de1828540296dac6ae367df4dd4a82d3c8b0
SHA512 f9126515efed18b39328a0f5711bbf42c75e3d9dc7563690c3bb9a7e73024702124d7b7fae236f8cf5edf75d10332f494c9a1f848778d7c2e745a9bd57f8316e
SSDEEP 393216:VpkcVGnKiKR8XvY4aQQa6vi5f55oijBqVH5:VycVHR8XTQhqNsiIH
TLSH
T1B3F612A3EAE8643EE6BB5132639402377E3E87C8E10750D514B879D258B7C8D6F503AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
131	3716	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
5948	Vape421Injector.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
107	api.gofile.io
125	api.gofile.io
126	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3716	chrome.exe
3388	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300103670486148"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
5948	Vape421Injector.exe
6064	chrome.exe
6064	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3308	5004	chrome.exe	113
PID 5004 wrote to memory of 3716	5004	chrome.exe	115
PID 5004 wrote to memory of 4032	5004	chrome.exe	116
PID 5004 wrote to memory of 4032	5004	chrome.exe	116
PID 5004 wrote to memory of 2532	5004	chrome.exe	118
PID 5004 wrote to memory of 2532	5004	chrome.exe	118
PID 5004 wrote to memory of 3628	5004	chrome.exe	119
PID 5004 wrote to memory of 3628	5004	chrome.exe	119
PID 5004 wrote to memory of 4612	5004	chrome.exe	120
PID 5004 wrote to memory of 4612	5004	chrome.exe	120
PID 5004 wrote to memory of 1152	5004	chrome.exe	121
PID 5004 wrote to memory of 1152	5004	chrome.exe	121
PID 5004 wrote to memory of 4424	5004	chrome.exe	122
PID 5004 wrote to memory of 4424	5004	chrome.exe	122
PID 5004 wrote to memory of 3852	5004	chrome.exe	123
PID 5004 wrote to memory of 1988	5004	chrome.exe	126
PID 5004 wrote to memory of 5044	5004	chrome.exe	127
PID 5004 wrote to memory of 2792	5004	chrome.exe	128
PID 5004 wrote to memory of 2208	5004	chrome.exe	129
PID 5004 wrote to memory of 2208	5004	chrome.exe	129
PID 5004 wrote to memory of 1264	5004	chrome.exe	130
PID 5004 wrote to memory of 1264	5004	chrome.exe	130
PID 5004 wrote to memory of 4788	5004	chrome.exe	136
PID 5004 wrote to memory of 4788	5004	chrome.exe	136
PID 5004 wrote to memory of 4584	5004	chrome.exe	137
PID 2560 wrote to memory of 4416	2560	msedge.exe	140
PID 4416 wrote to memory of 4924	4416	msedge.exe	141
PID 4416 wrote to memory of 4340	4416	msedge.exe	142
PID 4416 wrote to memory of 3388	4416	msedge.exe	143
PID 4416 wrote to memory of 4340	4416	msedge.exe	142
PID 4416 wrote to memory of 4340	4416	msedge.exe	142
PID 4416 wrote to memory of 2556	4416	msedge.exe	144
PID 4416 wrote to memory of 2556	4416	msedge.exe	144
PID 4416 wrote to memory of 4080	4416	msedge.exe	145
PID 4416 wrote to memory of 4080	4416	msedge.exe	145
PID 4416 wrote to memory of 4080	4416	msedge.exe	145
PID 4416 wrote to memory of 3432	4416	msedge.exe	146
PID 4416 wrote to memory of 3432	4416	msedge.exe	146
PID 4416 wrote to memory of 3432	4416	msedge.exe	146
PID 4416 wrote to memory of 1984	4416	msedge.exe	147
PID 4416 wrote to memory of 1984	4416	msedge.exe	147
PID 4416 wrote to memory of 1984	4416	msedge.exe	147
PID 4416 wrote to memory of 716	4416	msedge.exe	148
PID 4416 wrote to memory of 716	4416	msedge.exe	148
PID 4416 wrote to memory of 716	4416	msedge.exe	148
PID 4416 wrote to memory of 3256	4416	msedge.exe	150
PID 4416 wrote to memory of 3256	4416	msedge.exe	150
PID 4416 wrote to memory of 3256	4416	msedge.exe	150
PID 4416 wrote to memory of 3324	4416	msedge.exe	152
PID 4416 wrote to memory of 3324	4416	msedge.exe	152
PID 4416 wrote to memory of 4856	4416	msedge.exe	153
PID 4416 wrote to memory of 4856	4416	msedge.exe	153
PID 4416 wrote to memory of 3864	4416	msedge.exe	155
PID 4416 wrote to memory of 3864	4416	msedge.exe	155
PID 4416 wrote to memory of 3864	4416	msedge.exe	155
PID 4416 wrote to memory of 3548	4416	msedge.exe	156
PID 4416 wrote to memory of 4088	4416	msedge.exe	157
PID 4416 wrote to memory of 3548	4416	msedge.exe	156
PID 4416 wrote to memory of 4088	4416	msedge.exe	157
PID 5888 wrote to memory of 5948	5888	cmd.exe	161
PID 5004 wrote to memory of 6064	5004	chrome.exe	162

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Vape421Native.dll,#1
1⤵
PID:2576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffebe72c728,0x7ffebe72c734,0x7ffebe72c740
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,821433245591227051,2045160498633692416,524288 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,13339171192962243068,12477207954560920842,262144 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,16484635628713959432,5505343076193302343,524288 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,8140245358859564484,8434076456957557446,2097152 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3316,i,7696886379829774746,14234764834058550965,2097152 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2660 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,4493983066189912646,2862119450688853747,2097152 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,6320195636066080189,2766190466814548843,2097152 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,17620978848716708035,2571048372352749494,524288 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,3125674235738015057,1175707563475065147,524288 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,897661081365785935,6505085108753262527,524288 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,16074357128321947255,10435809945117351671,524288 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4508,i,2955507924840714549,8845675677533651208,2097152 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4896,i,17040334665138984375,12202071081242877953,2097152 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3336,i,8323719848493259494,1765824467073452651,2097152 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3544,i,15898824722150853715,4579709693833554930,524288 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4764,i,1922893195349465970,6225424600656310285,262144 --field-trial-handle=2104,i,7839168063910344285,14802262775537279375,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://c;d/
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://c;d/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x208,0x260,0x7ffebcf9c188,0x7ffebcf9c194,0x7ffebcf9c1a0
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,3431594821605973745,6630424423641924567,262144 --field-trial-handle=3092,i,7788504768998406308,16573364417182305589,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:2
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,16200366102461395337,4527939933962105405,524288 --field-trial-handle=3092,i,7788504768998406308,16573364417182305589,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,17654046688637544490,18084957385776848708,524288 --field-trial-handle=3092,i,7788504768998406308,16573364417182305589,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:8
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,6934255898186881750,12864575280125239263,2097152 --field-trial-handle=3092,i,7788504768998406308,16573364417182305589,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,8677977347706055623,5259876170128558231,2097152 --field-trial-handle=3092,i,7788504768998406308,16573364417182305589,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,16739806526695785489,3046048300960823297,2097152 --field-trial-handle=3092,i,7788504768998406308,16573364417182305589,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,8560510467857513934,11737059610677387692,2097152 --field-trial-handle=3092,i,7788504768998406308,16573364417182305589,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
    3⤵
    PID:716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3756,i,15713205496381063782,13660341090615054633,2097152 --field-trial-handle=3092,i,7788504768998406308,16573364417182305589,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,15788008335930103307,16058818372976417383,524288 --field-trial-handle=3092,i,7788504768998406308,16573364417182305589,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,7081115591865786439,13895774016636541288,524288 --field-trial-handle=3092,i,7788504768998406308,16573364417182305589,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3596,i,9516467790482335762,18382982013365409199,2097152 --field-trial-handle=3092,i,7788504768998406308,16573364417182305589,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,8484248627910958687,11842367231360163038,524288 --field-trial-handle=3092,i,7788504768998406308,16573364417182305589,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,6609048445763761626,11842111310924438096,524288 --field-trial-handle=3092,i,7788504768998406308,16573364417182305589,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
    3⤵
    PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Users\Admin\AppData\Local\Temp\Vape421Injector.exe
  Vape421Injector.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 576416ff516262cc474d378b96f562de14933f8f3f7f2a1cd20adf42b5e6ec5d
MD5 c3012ba8986367336368b01b504da9fc
SHA1 de4f97fff98cd6baf8231e467c099ff20eb55b56
SHA512 d1fcceafed8a345c310ea33ba46f76f1092660c7ee6b712fbd24af4c9c423c08fcf7c5c339d0b61ecd77123d117bc78cc2c4e22003a09cc27408beccf2ff18f0
TLSH
T1E0E02B6DCC21AC3708FE076860154749E750135F2A80955F773E510CCFB0A3791C6C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 58cda320b945a856508df1989022d16dc30add6984e2e7e6da5e353c41f3376b
MD5 41199c6bd3748cbd64765bd0b128612a
SHA1 94e0b43ee6aee4b10ad888fe9e189e6474af27c5
SHA512 a8dbb61e11d0e1dfeb7fdeba76663e831bb01870a8a4c01779e3001f849c6663b80b750b45145b23754f0639ac8d907814faa87365124bcd34c2e69f256536d5
TLSH
T16501AB1E47A5E3E1E350AF38A2D4F6A73077332106074CE2903650F15528394270939C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ee5217d9a0b9d41c2675b9d989163eee7d8275a8d3371df24c33f8dac41b1d2d
MD5 383fff161940fe0385a5b5d982ba1eb3
SHA1 bc72860ba43267c97c3f76ca7dc5e92760347d23
SHA512 418aa8e71ee042205d4fa28a1d48e46b2636fab6492454ffc9c169eaf6df4485d41918498408e177915665eb9a56f7716fae6df149d6ffac7108aae2135327f5
TLSH
T10751DDF7C3E4866D892592F4EB156E1FDD6D0A24032C3C66C8D4AE1B53E2872D24175E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d80c45e892b7cbc24238ecdc840590663cebe6354ffcffe8d400a194185903d6
MD5 340c50b2555319b39d2f17a1c681f03e
SHA1 71467c5b4a8a563cfbd147077ff1da117b88df3e
SHA512 1b822bfad8e970ae03d5fdc1562a65abde5d41131c963f43a326f504e668c7a1ded6f6d78d4660a274e1b2a0262114270938deb9d9b2ac096324035be1adb80e
SSDEEP 192:iRVs+8OGfjWv7spAPRp223lg9wHsb+WNnYnMZ3/12lm1fkwFwxVyIsnAUgraJ:iRVs+pciYUX/+KwYMZ92s1f2Xe
TLSH
T19052D73EB914693B9CDBD62AFA227B17D7F6102161D01E94E6FC892C04D7ACD321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 95ec9f92a6f330a88f3b5d191e6a5aa1eec1f3247b69341ee99a5ff79e468461
MD5 b2a2ee5121e2568010bd216934fafd30
SHA1 b4919ed306c8c6e3a8f4b7f0b72120fb9c8e84b4
SHA512 b8dec808a11514e1fa1f62a216abb3c18efa521f4a9d3b24cfb32587943f73d29404db29f7f519cc46d96ae82516c9a1a2b89f439618f038e6091447b474d12e
SSDEEP 192:iRVs48OGfjQv7spqPRp/23lg9wHsb+WNnYnMZ3VreNm1fkwF8xVyIsnAUgraJ:iRVs4pcMYmXe+KwYMZ5eE1fiXe
TLSH
T18652E72EB914693B9CCBD62AFA627F17D7F5102121D01E94E6FC892C05E7ACD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f2f1fab05bdef3586b19457fab9964d2ab5855da08fe9066e5ea2a3c38942280
MD5 458f7d631ea9c8e1081d27ce2dd8336a
SHA1 b430731638bc016959089f44d8fc9cfd1da95f45
SHA512 f82e48b925a34fb95f792534c65df55085f52cc07ce6a6da58e103d0df96cc390cbb4f13abdcc30eb4d5994adfcfe67d9d71c4e3a57a68a6fa05a5b2a57751cf
SSDEEP 192:iRVs+8OGfaEv7spAPRp22F9wHsb+WNnYnMZ0+Pm1fkwFYVyIsnAUgtaJ:iRVs+pvgYUX/FKwYMZ0++1fK8
TLSH
T12442D63EB914693B9CCBD22AFE227B53D7F5102161942E94E6FC892C04DB9CD322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ef37a6702a131433eed373996b2b3c63748846df253dac01ed4d9d9ef2c06f4a
MD5 aa492efb1721f7e27f111cb44563b9b1
SHA1 03ae2a15a722bfd2ea520ee7f9d69ef122e7e960
SHA512 f010df17794570ed077614e53e4fd8a79efd27c6197ca099382763ff89d329cce006491bbfd5bd33397d7f3a719d14055a0b63e245a4c6e2bbc4ebc62489b908
SSDEEP 192:iRVs+8OGfF7v7spAPRp22F9wHsb+WNnYnMZ0+nm1fkwFwxVyIsnAUgraJ:iRVs+puDYUX/FKwYMZ0+m1f2Xe
TLSH
T1BB42D63EB915693B9CCBD62AFE227B17D7F5102121901E94E6FC892C05EB9CD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 dd97ddbab22676ffa3bdff5e9c7a72146ba753db35a7d44c8a9ea17598380678
MD5 098a26e8cedab1404455d75d97a703cc
SHA1 7bbfb49d23b2c6367220c7f2740fe7eef864c972
SHA512 84849557b58e7e215466678572b4fc0281ef1d4c027577bd25efb81fbcd04eb39d271dbf843d468856daa86aa015ce79a3485bd5852bc3305954506e341ba12e
SSDEEP 192:iRVs+8OGfjQv7spqPRp/23lg9wHsb+WNnYnMZ3VreNm1fkwF8xVyIsnAUgraJ:iRVs+pcMYmXe+KwYMZ5eE1fiXe
TLSH
T18152E72EB914693B9CDBD62AFA627F17D7F5102161D01E94E6FC892C04D7ACD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 be8a14ce8658718bc5ea7b66d98f9d512c9f1f60d149d82ddc8a1417cdb7a7a2
MD5 61f55fd6267258ba773fc65ebbb9844c
SHA1 fc1c8a6b340d2b5e83fd23b4abfdde61f544c9c4
SHA512 5a8521b188aacae0f9d927f452fc98c71f18f2ed6ad89f2986fcc3b3d5a66a87f45e1d6f324d9a4e3b2705fc5586f71aa1847898c959921707fae8555ce1e962
TLSH
T1BDB0121580415101C04213B4119624C872185F109A0A1F0943F46922D8351618415050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e296.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e296.TMP
Size 96B
SHA256 402c19d5c0876ac1df22a57d6b764092a54a2fbe1eb11615c276c5265e30a584
MD5 072d8e97510febabcc894dabac06400f
SHA1 28762d2194e5e5227edc7ab3593e5d446955b5f2
SHA512 cb9bee1a496fe96779accd0d50febad6db5dc9d6a318d7c90ffa37b6dc8fd7eda40bbbd81b755b081428edc1ead23d08fa58a88ca0284ff6985fc6ec60fd7cbd
TLSH
T1C5B02222C0033222C00203B0328BA2EC3030CF2AC2030203B3F02A33CC202308822030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 936f570e7471b8387cc1632e46b0274b45f7f0f98d46d80557fb68821d1624ca
MD5 020aad571fdd0b9e13a169ae5d19bb25
SHA1 08ad67ec0d8151c834a3cda1d9d4f782d2a17098
SHA512 0715ee327a7c83a9fa1d30e01e04399a8906808c2c7f6c824175886b3845e9c7d16153015c67b89b68ea91d5684e3b18fad5ea8037d7b3436726e60ee53f4f13
SSDEEP 3072:apyC8UQ/DMUbFStDv+JW6x0zVHolaT9TlFkOrGm7D5Lk17ox1tIpud63U8BehbCB:BaNsODv+aO8RTlkm7Rkm1tYpBeh2BAo1
TLSH
T12934133F5EA97932A9B68309305F251E3FF38CB686109D93DAD16B4816C5AEC1F43874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 465358985428c1cdd299ce9506b18cc0cf4e50097cbccc13efcc6c2b466b999c
MD5 801d4fc9d86eda8bab45a8cabc8a6d32
SHA1 f0d3461c2df21f688e778b4cd7defcd478bc200f
SHA512 c25274a09c32a0546d6e19fe92c976f6e22480d4ddd86f3b108ca2dbb96f277d6860f1c6b9ef9549d9cd5bdbf7ffbc8bb0ce1dbc6c922102cd31a4255353ef41
SSDEEP 3072:3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:2m7Rkm1tYpBeh2BAoK
TLSH
T160C3123B5D65E9779979BB0EB08E0B1F1EF149A2C920DE52C8D86B0437E97C90A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 356814a448497c318e3ce75a703d6fd2a66860e382d9ea428810778d216bc7d4
MD5 ae42ea2c0173efe4007890db463da2a2
SHA1 de0f6421d7163f14f31c28de8f9b6c2ee17c1124
SHA512 773c5962fff5166c968787a6d4be2bcc11c4646d77cd6f41c71a130879072103d1c894f31aebd0d598edac576000ea3e9c11fee8ba885f8812cf9159a0f0f88a
SSDEEP 6144:cUaNsODv+aO8RTlkm7Rkm1tYpBeh2BAo1:jaNsO4EH9oBGcAo1
TLSH
T18734123F5D957832AAB6830D304F241E3FF29977CB10DD86D9C56B4816CAAAC5E43874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 ca94a7f46d2401bff2b815a025dbd09f9836178ba1ffcb19c060c6850dfcaa72
MD5 43729afeea85be874cf44e2825a968c5
SHA1 9996e4edadc38f9f48c0213696ffb23bb1ae4e90
SHA512 02dc342ebe04b60a9c050f25ea5857c2a3fb9070175cdb84329d8a697fa5aa9befec74e4c3e9b6ba7a337c19b0c39e627005bfab231ab1acf20a6908c8da7c1e
SSDEEP 3072:fpyC8UQ/DMUbFStDv+JW6x0zVHolaT9TlFkOrGm7D5Lk17ox1tIpud63U8BehbCB:AaNsODv+aO8RTlkm7Rkm1tYpBeh2BAo1
TLSH
T13C34133F5E997932A9B68309305F241E3FF38CB686109D93DAD16B4816C6AEC1F43874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a895ecc70e62c0cc44d96e85b38d98b87999a7f1296fd399c8e031e2e4832d19
MD5 2c80da3b5b47c680991173695531b743
SHA1 ba17235d5cab8a747d277aae835b1317833cd5c8
SHA512 35534a30a61be947d6864aa0f91e0e1b7755359b6de081f7e89fed530d2c3ffb2d262dfab14ee5678428727d2675390e56bd9a15ff0f2290bc932950670f9b80
TLSH
T18F81A63F110248B7E7911237C0F333867A73AAEBF9236E561374797BA525395B88512C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b0329.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b0329.TMP
Size 3KB
SHA256 3b3edf6d01e5a75f79ebe0ab154a2cc9394995d132a198dfe320c3643d0e0c4b
MD5 d5850a05d8dea46226ce425f13ed336d
SHA1 ccdb8b6d6de786b3e4c5766e57e943de53aa114a
SHA512 fbf64bb60698eb136eb32c3f0452f7b7aeef4c2e8698383f52e07f6331f35e53fe32cb92a6a069f4e9429b01c5a72c68d1db5b39cf1715a56243b440863b1bec
TLSH
T10381A53E110248B7D7911237C0F333867A73AAEBF9236E561374797AA525395B88512C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 769B
SHA256 5d3d181b2a36676ba5581216fa2fc778e945784304de88433385b5064abc5b16
MD5 ae7b8f9dfd9210998776a76325d369f9
SHA1 4dc913caae62c1de2c1b23d1821b18e9583dc22f
SHA512 499d70da0007ee09d68461d54983a6673eda5962a24420f4c71bdff6a7d222786a3d5cd052dc627e809b3fa749a4d273139120b79c97c64119fe54d752029d88
TLSH
T12701B8F7C2E4957D8A0542F4E604AE1FCE7D0A05431C3C6AC9E8BE2B93E2461E04459F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 096ade29650fa7507e3d81149c92741cf99917a47b5b6373cf33d2fccc042b4b
MD5 3703c491f6e9c7e2a7dd1edaaef98185
SHA1 e816f91478fbd47c8b3ec400ad436a770cffa139
SHA512 300e89e28ccc58fe7625935a6209bdba656739da7941ff20c43dd54387f368b44b240487c3bb73832aeb54a050a249ad4edc92d1e6dd74002b6fc24947ebeea3
SSDEEP 192:sxZVC8/yM/jK1Ml8ijJ/fBs1AWpVbpvEdpC9HW6+WNGYAi4rJIgEJ:sxZ885vJ/fBsCWvbp8+HbGBZI
TLSH
T10A42F815AA34697BCCCBD20DFA957F53D6F90463A2900E549AFCDA1C01F6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da38bfe8-127d-468d-bce1-6cca67e8832c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\da38bfe8-127d-468d-bce1-6cca67e8832c.tmp
Size 30KB
SHA256 5480d2cc35a51542b692a24e7f7c9e851e55a9fae95e7d1bbdf79d02dbbfd03a
MD5 b3a77dea8a6d94b89233e39608398dfa
SHA1 00f3ad7ec80ce5d3abd37fe3b4de5aa6427a270f
SHA512 1e6ecea7e3e0eb3003d448926f981f8d9246fe6da417138cd38a73b9053ff92511c93da773f70c1052c8b7bc6c5fe5ffc7b4110aa2879ff1aedba79026e915e9
SSDEEP 768:+wsqxAlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9Zro6hCU:+wsqxAlWvJD6Tu1ja54LAs9S6hf
TLSH
T1DCE21C3B694CC77E4F840E5DEC26AFD76ED801CB66988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 93206e04634991b8477e600df868d180b633a53631766e34a652edd848a3370e
MD5 1a4ac9c8af8ed3c9bc7befd43c5b89fa
SHA1 23dbbc0a0fe5df57af6bc9f7cdcd5656baec4785
SHA512 0a1e75b56d33542e20e140a873ff18fe81eaaebc2b8a11b94d32feccc48cb63440a74080fb3112e8cc93f3b97ac0849a523f8f5f87c956c9dc35c0dc26c4d516
SSDEEP 192:tONR6JkRtQmiUyDmW+RNDXOmj+Oh3ofRiU6:tONR6UrRW+RNDXOI+mJU6
TLSH
T12402D9357D382C7B9EE26D06B58B37175FA8207BBA856F80D6E81F1C01D765C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 7a85ca596d9864880489c663f7ededbb69cadbbafa3569fb7c1073904938beeb
MD5 bd6e937cd2c6ea5a54b599df81c56306
SHA1 7f42f96c25a19ee31958bae9da8befb6ad39cf19
SHA512 79815e13e0cc0e0838444e4e33d66c430c661e37fc381fe6c4149e41391df24cbdc0dbe38b83af5a8e0167044f843c8e8f2856a757a532efee56eb028622a4c6
SSDEEP 384:zqTsNY2TA1bsvKVRNDXOI+W9ZvdacA8tQI1oN5mkczbU8:eSA0YH7OIL93s8MN5UPU8
TLSH
T151723AB1E8645CE74895E9CA658BF9132EB41037CA4D5A4CE2F87A3C309F8FC5342C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f9fd0b172b1ab7c1f5c49a5f507c25c7534ae457cae5eabe34e6dd3053a5c724
MD5 ec207c78854270e951f0ab6e2af2a3ee
SHA1 2886c77c32a5060607ed659aa35bd77a1e5240c5
SHA512 3553c1b98bd183209155edd8c0d59f629f37c39efdc051ceb31c6b8298660eb818ba955194bb16b9b9b412e588e9ba6faa400031d078381dccf5a56bb4a4939e
SSDEEP 192:bONx6JkRUQmiUySm9+RNDXOmj+P+9TFvCVcoEqBAcGU6:bONx6UkW9+RNDXOI+W9ZvleyU6
TLSH
T17C121B35AC385C775EE26855F48B36179FA55137EF896F90D1DC2E0C01EFA9C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

545b569c-ac90-4a6d-87b8-2153b65b82a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\545b569c-ac90-4a6d-87b8-2153b65b82a0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a9dfdfffebdcd39831abfc9d15e39de9241fd6b999ade11e5340dce16deafc36
MD5 2710b7456aab92f21e7c6d181798a43c
SHA1 18389115865e6eba85fea9d295d9956c1c765e0f
SHA512 503a10ddb27fb1c0935b6427d3a632dbfd5d0dedff4eb9eac1d1a8ee6d0ec8f9dc4abab265ffb5c4c395f3e10e05a6ae0ed3d57862d4bb7ccb48a13486fc119a
TLSH
T12D412F59BBF51148B3B36F5AABF6946D587EB8772F0AD49D10110E4E0A23B41C8A2733
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 539677.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 539677.crdownload
Size 19KB
SHA256 ac1e3956ac4fb34ea4ff0b66f493028eb8dc6626070b45c7cfedaabd15e2ddab
MD5 6d2ba6a03bd1b7267956981c104db739
SHA1 419fa588b58a34cfe62a31142bc0a21c48ed27ed
SHA512 4f2fc677fca067ca5d1b84278886d7e41d5d72c9aad7a69d2b474caaa738fdafe64bc7ba2c50564e1748cb1570c46e0a5f65f84320718485cd238f5a72d77e15
SSDEEP 384:/A/ECKdlD2yMHBax+MeUhWNGHb7trkUewdfnz7e91Fz:/A/GdlavBk+MeUTJfnk1
TLSH
T1B99239467BF525D9E17BE6368832B136E671B8165B33C68F0358801C0EB2B90AD79F47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download