darksiderat | daaf92150b19d49f0f1e937b44ff21ba1bea525522fedc270ab472d44e636c28

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
1800s
max time network
1788s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
craftrise_(2).exe.html
Size 38KB
Sample260804-tcb2fatfqb
SHA256 daaf92150b19d49f0f1e937b44ff21ba1bea525522fedc270ab472d44e636c28
MD5 b12b007ad295665d0ad2dc814310aba8
SHA1 13b89b866d0e14c1599f02d76b7bae4dd745c643
SHA512 b91671ddb5d377f8f1cbab172a8edec44a269f4c4fde45ade26404c11a1b1c2de67b82a619e2a26eacef05a34f1f05fd78a13b3c798ca53a294f23778c127fd7
SSDEEP 768:33+43DZVtXYcw6EGJGDFsqkWR5gA6FSGLE/a9:H+43DZVtv0gA6FSGLr9
TLSH
T148032B8968F31026A95359DC37630B5D76458643DA02ED67BBDD02B0DFCEFA268A334C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution darksiderat spyware stealer trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 17 IoCs

resource	yara_rule
behavioral1/memory/5780-2224-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5780-2220-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5444-2307-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5780-2318-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5444-2317-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/6068-2362-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5300-2406-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/6068-2408-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5300-2409-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5024-3349-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/5024-3419-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/3432-3423-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/3432-3424-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/2676-3462-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/2696-3533-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/2676-3534-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/2696-3535-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\Vboxguest.sys	craftrise (2).exe
File opened (read-only)	C:\Windows\System32\drivers\Vboxguest.sys	craftrise (2).exe
File opened (read-only)	C:\Windows\System32\drivers\Vboxguest.sys	craftrise (2).exe
File opened (read-only)	C:\Windows\System32\drivers\Vboxguest.sys	craftrise (2).exe

Downloads MZ/PE file 5 IoCs

flow	pid	Process
608	4964	msedge.exe
894	800	chrome.exe
894	800	chrome.exe
688	5008	chrome.exe
688	5008	chrome.exe

Looks for VMWare drivers on disk 2 TTPs 8 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\Vmmouse.sys	craftrise (2).exe
File opened (read-only)	C:\Windows\System32\drivers\vmmemctl.sys	craftrise (2).exe
File opened (read-only)	C:\Windows\System32\drivers\Vmmouse.sys	craftrise (2).exe
File opened (read-only)	C:\Windows\System32\drivers\vmmemctl.sys	craftrise (2).exe
File opened (read-only)	C:\Windows\System32\drivers\Vmmouse.sys	craftrise (2).exe
File opened (read-only)	C:\Windows\System32\drivers\vmmemctl.sys	craftrise (2).exe
File opened (read-only)	C:\Windows\System32\drivers\Vmmouse.sys	craftrise (2).exe
File opened (read-only)	C:\Windows\System32\drivers\vmmemctl.sys	craftrise (2).exe

Executes dropped EXE 18 IoCs

pid	Process
2320	craftrise (2).exe
5780	craftrise (2).exe
5348	craftrise (2).exe
5444	craftrise (2).exe
2012	craftrise (2).exe
6068	craftrise (2).exe
4784	craftrise (2).exe
5300	craftrise (2).exe
5564	CraftRise (3).exe
4676	craftrise (2).exe
5024	craftrise (2).exe
1484	craftrise (2).exe
3432	craftrise (2).exe
4604	craftrise (2).exe
2676	craftrise (2).exe
3364	craftrise (2).exe
2696	craftrise (2).exe
5668	CraftRise (3).exe

Loads dropped DLL 64 IoCs

pid	Process
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5444	craftrise (2).exe
5444	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
5300	craftrise (2).exe
5300	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
5348	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
4784	craftrise (2).exe
1484	craftrise (2).exe
1484	craftrise (2).exe
3432	craftrise (2).exe
3432	craftrise (2).exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
170	discord.com
617	discord.com
618	discord.com
811	discord.com
813	discord.com

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
616	api.ipify.org
810	api.ipify.org
812	api.ipify.org
9	api.ipify.org
615	api.ipify.org

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
800	tasklist.exe
3320	tasklist.exe
2268	tasklist.exe
4844	tasklist.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 5780	2320	craftrise (2).exe	136
PID 5348 set thread context of 5444	5348	craftrise (2).exe	140
PID 2012 set thread context of 6068	2012	craftrise (2).exe	147
PID 4784 set thread context of 5300	4784	craftrise (2).exe	152
PID 4676 set thread context of 5024	4676	craftrise (2).exe	238
PID 1484 set thread context of 3432	1484	craftrise (2).exe	243
PID 4604 set thread context of 2676	4604	craftrise (2).exe	271
PID 3364 set thread context of 2696	3364	craftrise (2).exe	275

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\craftrise (2).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CraftRise (3).exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\python-3.15.0rc1-amd64.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 28 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1648	cmd.exe
4028	cmd.exe
3652	cmd.exe
716	cmd.exe
6056	cmd.exe
6020	cmd.exe
2268	cmd.exe
2440	cmd.exe
2564	cmd.exe
1068	cmd.exe
1488	cmd.exe
2276	cmd.exe
5892	cmd.exe
2248	cmd.exe
5060	cmd.exe
4816	cmd.exe
1184	cmd.exe
72	cmd.exe
5968	cmd.exe
3860	cmd.exe
4268	cmd.exe
4224	cmd.exe
4936	cmd.exe
3480	cmd.exe
5012	cmd.exe
2908	cmd.exe
4700	cmd.exe
2940	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
800	chrome.exe
4964	msedge.exe
5008	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Detects videocard installed 1 TTPs 4 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4624	WMIC.exe
4512	WMIC.exe
1348	WMIC.exe
5932	WMIC.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 16 IoCs

defense_evasion

pid	Process
3044	taskkill.exe
5680	taskkill.exe
1828	taskkill.exe
4340	taskkill.exe
852	taskkill.exe
4532	taskkill.exe
3708	taskkill.exe
4824	taskkill.exe
1160	taskkill.exe
3468	taskkill.exe
3632	taskkill.exe
2236	taskkill.exe
2312	taskkill.exe
5772	taskkill.exe
1844	taskkill.exe
5052	taskkill.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303325462328948"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 58 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{497D8A15-CA98-4CA1-8BA3-3C66A777CCA9}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{D725B338-515F-4222-9E39-81A88107F0CE}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000001b7f92d230e3dc01e87d944337e3dc0124efedaf2a24dd0114000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{CDEAF492-A5E4-46B5-A4E0-F516D313650C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\python-3.15.0rc1-amd64.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\craftrise (2).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CraftRise (3).exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
5084	chrome.exe
5084	chrome.exe
3924	LocalBridge.exe
3924	LocalBridge.exe
3924	LocalBridge.exe
3924	LocalBridge.exe
3924	LocalBridge.exe
3924	LocalBridge.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
3912	chrome.exe
3912	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	800	tasklist.exe
Token: SeDebugPrivilege	4340	taskkill.exe
Token: SeDebugPrivilege	3320	tasklist.exe
Token: SeDebugPrivilege	3468	taskkill.exe
Token: SeDebugPrivilege	5052	taskkill.exe
Token: SeDebugPrivilege	4824	taskkill.exe
Token: SeDebugPrivilege	852	taskkill.exe
Token: SeDebugPrivilege	3632	taskkill.exe
Token: SeDebugPrivilege	4532	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5932	WMIC.exe
Token: SeSecurityPrivilege	5932	WMIC.exe
Token: SeTakeOwnershipPrivilege	5932	WMIC.exe
Token: SeLoadDriverPrivilege	5932	WMIC.exe
Token: SeSystemProfilePrivilege	5932	WMIC.exe
Token: SeSystemtimePrivilege	5932	WMIC.exe
Token: SeProfSingleProcessPrivilege	5932	WMIC.exe
Token: SeIncBasePriorityPrivilege	5932	WMIC.exe
Token: SeCreatePagefilePrivilege	5932	WMIC.exe
Token: SeBackupPrivilege	5932	WMIC.exe
Token: SeRestorePrivilege	5932	WMIC.exe
Token: SeShutdownPrivilege	5932	WMIC.exe
Token: SeDebugPrivilege	5932	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5932	WMIC.exe
Token: SeRemoteShutdownPrivilege	5932	WMIC.exe
Token: SeUndockPrivilege	5932	WMIC.exe
Token: SeManageVolumePrivilege	5932	WMIC.exe
Token: 33	5932	WMIC.exe
Token: 34	5932	WMIC.exe
Token: 35	5932	WMIC.exe
Token: 36	5932	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5932	WMIC.exe
Token: SeSecurityPrivilege	5932	WMIC.exe
Token: SeTakeOwnershipPrivilege	5932	WMIC.exe
Token: SeLoadDriverPrivilege	5932	WMIC.exe
Token: SeSystemProfilePrivilege	5932	WMIC.exe
Token: SeSystemtimePrivilege	5932	WMIC.exe
Token: SeProfSingleProcessPrivilege	5932	WMIC.exe
Token: SeIncBasePriorityPrivilege	5932	WMIC.exe
Token: SeCreatePagefilePrivilege	5932	WMIC.exe
Token: SeBackupPrivilege	5932	WMIC.exe
Token: SeRestorePrivilege	5932	WMIC.exe
Token: SeShutdownPrivilege	5932	WMIC.exe
Token: SeDebugPrivilege	5932	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5932	WMIC.exe
Token: SeRemoteShutdownPrivilege	5932	WMIC.exe
Token: SeUndockPrivilege	5932	WMIC.exe
Token: SeManageVolumePrivilege	5932	WMIC.exe
Token: 33	5932	WMIC.exe
Token: 34	5932	WMIC.exe
Token: 35	5932	WMIC.exe
Token: 36	5932	WMIC.exe
Token: SeDebugPrivilege	2236	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5116	WMIC.exe
Token: SeSecurityPrivilege	5116	WMIC.exe
Token: SeTakeOwnershipPrivilege	5116	WMIC.exe
Token: SeLoadDriverPrivilege	5116	WMIC.exe
Token: SeSystemProfilePrivilege	5116	WMIC.exe
Token: SeSystemtimePrivilege	5116	WMIC.exe
Token: SeProfSingleProcessPrivilege	5116	WMIC.exe
Token: SeIncBasePriorityPrivilege	5116	WMIC.exe
Token: SeCreatePagefilePrivilege	5116	WMIC.exe
Token: SeBackupPrivilege	5116	WMIC.exe
Token: SeRestorePrivilege	5116	WMIC.exe
Token: SeShutdownPrivilege	5116	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2816	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 3292	4336	msedge.exe	81
PID 4336 wrote to memory of 4964	4336	msedge.exe	82
PID 4336 wrote to memory of 1248	4336	msedge.exe	85
PID 4336 wrote to memory of 1248	4336	msedge.exe	85
PID 4336 wrote to memory of 3000	4336	msedge.exe	83
PID 4336 wrote to memory of 3000	4336	msedge.exe	83
PID 4336 wrote to memory of 3000	4336	msedge.exe	83
PID 4336 wrote to memory of 5968	4336	msedge.exe	86
PID 4336 wrote to memory of 5968	4336	msedge.exe	86
PID 4336 wrote to memory of 5968	4336	msedge.exe	86
PID 4336 wrote to memory of 6064	4336	msedge.exe	87
PID 4336 wrote to memory of 6064	4336	msedge.exe	87
PID 4336 wrote to memory of 6064	4336	msedge.exe	87
PID 4336 wrote to memory of 5752	4336	msedge.exe	89
PID 4336 wrote to memory of 5764	4336	msedge.exe	90
PID 4336 wrote to memory of 5132	4336	msedge.exe	91
PID 4336 wrote to memory of 1652	4336	msedge.exe	92
PID 4336 wrote to memory of 1652	4336	msedge.exe	92
PID 4336 wrote to memory of 1652	4336	msedge.exe	92
PID 4336 wrote to memory of 5336	4336	msedge.exe	93
PID 4336 wrote to memory of 5104	4336	msedge.exe	94
PID 4336 wrote to memory of 5336	4336	msedge.exe	93
PID 4336 wrote to memory of 5104	4336	msedge.exe	94
PID 4336 wrote to memory of 1312	4336	msedge.exe	96
PID 4336 wrote to memory of 5952	4336	msedge.exe	97
PID 5952 wrote to memory of 2492	5952	msedge.exe	98
PID 4336 wrote to memory of 1140	4336	msedge.exe	101
PID 4336 wrote to memory of 1140	4336	msedge.exe	101
PID 4336 wrote to memory of 4580	4336	msedge.exe	115
PID 4336 wrote to memory of 3044	4336	msedge.exe	120
PID 4336 wrote to memory of 3044	4336	msedge.exe	120
PID 4336 wrote to memory of 3044	4336	msedge.exe	120
PID 4336 wrote to memory of 4644	4336	msedge.exe	121
PID 4336 wrote to memory of 4644	4336	msedge.exe	121
PID 4336 wrote to memory of 4644	4336	msedge.exe	121
PID 4336 wrote to memory of 3364	4336	msedge.exe	122
PID 4336 wrote to memory of 3364	4336	msedge.exe	122
PID 4336 wrote to memory of 4548	4336	msedge.exe	123
PID 4336 wrote to memory of 4548	4336	msedge.exe	123
PID 4336 wrote to memory of 4548	4336	msedge.exe	123
PID 4336 wrote to memory of 4324	4336	msedge.exe	124
PID 4336 wrote to memory of 4324	4336	msedge.exe	124
PID 4336 wrote to memory of 4324	4336	msedge.exe	124
PID 4336 wrote to memory of 4160	4336	msedge.exe	125
PID 4336 wrote to memory of 4160	4336	msedge.exe	125
PID 4336 wrote to memory of 4160	4336	msedge.exe	125
PID 4336 wrote to memory of 5764	4336	msedge.exe	126
PID 4336 wrote to memory of 5764	4336	msedge.exe	126
PID 4336 wrote to memory of 424	4336	msedge.exe	127
PID 4336 wrote to memory of 424	4336	msedge.exe	127
PID 4336 wrote to memory of 424	4336	msedge.exe	127
PID 4336 wrote to memory of 3272	4336	msedge.exe	128
PID 4336 wrote to memory of 3272	4336	msedge.exe	128
PID 4336 wrote to memory of 1624	4336	msedge.exe	129
PID 4336 wrote to memory of 3272	4336	msedge.exe	128
PID 4336 wrote to memory of 1624	4336	msedge.exe	129
PID 4336 wrote to memory of 1624	4336	msedge.exe	129
PID 4336 wrote to memory of 5104	4336	msedge.exe	130
PID 4336 wrote to memory of 5104	4336	msedge.exe	130
PID 4336 wrote to memory of 4588	4336	msedge.exe	131
PID 4336 wrote to memory of 4588	4336	msedge.exe	131
PID 4336 wrote to memory of 4588	4336	msedge.exe	131
PID 4336 wrote to memory of 5208	4336	msedge.exe	134
PID 2320 wrote to memory of 5780	2320	craftrise (2).exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\craftrise_(2).exe.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ffe8468c188,0x7ffe8468c194,0x7ffe8468c1a0
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1644,i,9873930548224435436,13623734872833960188,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1516,i,12263045356568580205,14401791930363944745,262144 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,1869413170586355205,14454511051147222702,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,16835949175635544922,2876253871317335527,2097152 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,190035356881458003,12556023615615359144,2097152 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,1309802205598762601,2256684261226017195,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,6100364970112707367,14545361199652860139,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5670801450103392282,2133177731755434799,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5228,i,17573934715692242363,1941672902346164171,2097152 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,194308822755335320,16640432490886194436,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,7114823018101610397,14104454218761159578,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,4713116331096358494,17723051922001462624,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,4713116331096358494,17723051922001462624,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,1278610404851062134,13364049549073602382,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,11674808862545000778,12013206887642962807,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6480,i,6655092824333554806,272376266733561417,262144 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6472,i,5296627353644937600,10238801561039580003,2097152 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5680,i,17874746717397003946,4385296652188928734,2097152 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,10825555743221459805,8137224935870235206,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6408,i,17651067415055989069,3533267324766914817,2097152 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3508,i,2265568796232920683,12739383438409308269,2097152 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5736,i,5002011661047196268,15392707901145303656,2097152 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,11633045287523841446,14999445629139452712,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5160,i,3133648841061196263,14208063617829143876,2097152 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6460,i,10631115063575844408,4166750044836441379,2097152 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5704,i,5836416743656244860,13880263140493242795,2097152 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7484,i,17025723148356940321,12366171352780848136,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:14
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7580,i,3948031233444193881,8795641073153391137,2097152 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8168,i,8046421723167093048,1304122532672834144,524288 --field-trial-handle=2080,i,4919849347686874941,13593179044233260044,262144 --variations-seed-version --mojo-platform-channel-handle=8112 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1168

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4612

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:3308

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc
1⤵
PID:4652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5064

C:\Users\Admin\Downloads\craftrise (2).exe
"C:\Users\Admin\Downloads\craftrise (2).exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\Downloads\craftrise (2).exe
  "C:\Users\Admin\Downloads\craftrise (2).exe"
  2⤵
  - Executes dropped EXE
  PID:5780
- C:\Users\Admin\Downloads\craftrise (2).exe
  "C:\Users\Admin\Downloads\craftrise (2).exe"
  2⤵
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare drivers on disk
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  PID:5348
- - C:\Users\Admin\Downloads\craftrise (2).exe
    "C:\Users\Admin\Downloads\craftrise (2).exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    PID:2940
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1648
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4028
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5060
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3652
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:1184
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:5932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    PID:2564
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5116

C:\Users\Admin\Downloads\craftrise (2).exe
"C:\Users\Admin\Downloads\craftrise (2).exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2012
- C:\Users\Admin\Downloads\craftrise (2).exe
  "C:\Users\Admin\Downloads\craftrise (2).exe"
  2⤵
  - Executes dropped EXE
  PID:6068
- C:\Users\Admin\Downloads\craftrise (2).exe
  "C:\Users\Admin\Downloads\craftrise (2).exe"
  2⤵
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare drivers on disk
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  PID:4784
- - C:\Users\Admin\Downloads\craftrise (2).exe
    "C:\Users\Admin\Downloads\craftrise (2).exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    PID:4936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2440
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3480
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4816
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:72
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:5012
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    PID:1068
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe846ac728,0x7ffe846ac734,0x7ffe846ac740
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,4373299275553708249,8527621093579976846,262144 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,7989180124222746318,3849925705787405030,524288 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,15159108028695116933,11687458759098709675,524288 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2528 /prefetch:13
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,3183238368696412343,940049711129048451,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,2562610422325539383,7298198719939714215,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,7290866073109637062,11164639215976647399,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4520 /prefetch:9
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,17407643632785936774,12594561300927437423,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,7573461066956734126,17689181256913257346,524288 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5492,i,7163376614665857376,6423202108264049325,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=2888,i,13983341203283621701,8821203618818473130,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3492,i,4551967589019443405,9023076892900355660,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3348,i,16513635212309611764,9804274928007900736,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5836,i,7010184035959317228,14729996476870250146,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3380,i,7761249263868510772,7862236050769624904,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,7718089990162290168,532647103003566407,524288 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6360 /prefetch:14
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6328,i,12448488992686454595,4048053579817213551,524288 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6280,i,10967689319810046902,550553158438884292,524288 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:5264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4532,i,16323952503063045765,11663825860541760610,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3372,i,594074543287969211,1155477628814482890,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5836,i,8555584973585134119,6394522593050435832,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,15116392392760898627,15663800777150558847,524288 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:6064
- C:\Users\Admin\Downloads\CraftRise (3).exe
  "C:\Users\Admin\Downloads\CraftRise (3).exe"
  2⤵
  - Executes dropped EXE
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5504,i,10885960418997718145,10545903664192586870,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7344,i,2144635026958416590,5102238805949612672,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7264,i,3966229546252212237,17694555017186756480,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5816,i,17461946612850785200,16041345797766910224,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3464,i,15978274271526460013,14679157300106341806,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7640,i,8514388018804460806,3308265503706931154,524288 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7656 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7612,i,5537851467878955254,12027339892293571467,524288 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7616 /prefetch:12
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7836,i,5126029638348737113,12884025835696092770,262144 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7848,i,2365962729036054445,7963394800559852788,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7840 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7340,i,5620508142517070471,6064344464560309157,524288 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6948 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6872,i,13652042991555322164,13164900368405894424,2097152 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8144,i,17222093927340936391,670665099044593082,524288 --field-trial-handle=1916,i,5486524408785270397,17606071081515020201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8112 /prefetch:14
  2⤵
  PID:856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4932

C:\Users\Admin\Downloads\craftrise (2).exe
"C:\Users\Admin\Downloads\craftrise (2).exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4676
- C:\Users\Admin\Downloads\craftrise (2).exe
  "C:\Users\Admin\Downloads\craftrise (2).exe"
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Users\Admin\Downloads\craftrise (2).exe
  "C:\Users\Admin\Downloads\craftrise (2).exe"
  2⤵
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare drivers on disk
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  PID:1484
- - C:\Users\Admin\Downloads\craftrise (2).exe
    "C:\Users\Admin\Downloads\craftrise (2).exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    PID:5968
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:2268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2908
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1488
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:5772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2276
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:3044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4700
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:5892
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    PID:716
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:5656

C:\Users\Admin\Downloads\craftrise (2).exe
"C:\Users\Admin\Downloads\craftrise (2).exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4604
- C:\Users\Admin\Downloads\craftrise (2).exe
  "C:\Users\Admin\Downloads\craftrise (2).exe"
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Users\Admin\Downloads\craftrise (2).exe
  "C:\Users\Admin\Downloads\craftrise (2).exe"
  2⤵
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare drivers on disk
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3364
- - C:\Users\Admin\Downloads\craftrise (2).exe
    "C:\Users\Admin\Downloads\craftrise (2).exe"
    3⤵
    - Executes dropped EXE
    PID:2696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    PID:3860
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4268
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:1160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4224
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:1828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6056
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:1844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2248
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:3708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:6020
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    PID:2268
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:1292

C:\Users\Admin\Desktop\CraftRise (3).exe
"C:\Users\Admin\Desktop\CraftRise (3).exe"
1⤵
- Executes dropped EXE
PID:5668

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:6092

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2412

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffe880fc728,0x7ffe880fc734,0x7ffe880fc740
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1564,i,12778128396200078017,3838559934526749322,262144 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,11383737175292783758,3563479142577580671,524288 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,5692735732048828658,9659783814852364821,524288 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=2528 /prefetch:13
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,9988980145309948135,13036017389268893868,2097152 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,7882743910531717776,1632197828261297869,2097152 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,5178283318469247521,13561378319403877753,2097152 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,9798557387906185391,11761978069291748811,524288 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5572,i,15597778942002300350,17417445873499616238,2097152 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,18225897502439133850,1289571023489266014,524288 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3484 /prefetch:12
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,1497089391600174216,8027728597172295561,524288 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3308 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3356,i,13602813485702751502,8516369986010350485,2097152 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5784,i,3465280158041032596,12322411353586766784,2097152 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,16768306121962538317,11586786562902611717,524288 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4676 /prefetch:14
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4548,i,741889438413173155,5546453299821185522,524288 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4604 /prefetch:14
  2⤵
  PID:340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4532,i,9865098550783792544,3628712966990281176,524288 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4656 /prefetch:14
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4676,i,4717048172491725720,16279016353286368327,2097152 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4584,i,3781834849328161500,3868207426131473445,2097152 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6072,i,17190298797513516443,14553286063563550023,2097152 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6160,i,14206087092979251589,11081227079961807466,2097152 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3240,i,18000011693084275097,15514619093816382125,524288 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6500 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5940,i,5522809996813423725,4861059671901683117,262144 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=6612 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7108,i,2173670451294626584,2101636586144334871,524288 --field-trial-handle=2028,i,2209689073770147256,6935195555176648995,262144 --variations-seed-version=20260804-010031.369000-production --mojo-platform-channel-handle=4448 /prefetch:14
  2⤵
  PID:5072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

File and Directory Discovery

T1083

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 62943e86a1df19d3b3008bc9f5468bf708a204376798193da8120ab1ea31c435
MD5 9e7234efee55692aa3877233e769f1d6
SHA1 821b9927ed54b4123aced604e85481b1b7de4b5e
SHA512 b636b177b9b6f361dac911cd716f2f2cb3e76bf334c788a6a3753c0989ab2b204785e6259c4a8539139703711e220e4ce2b3aa6711b79aebe25daa8fb77ba1cb
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 03f672a10ea95a285df523e11b8baea052fbe829cee422fb4dcb878ef8e7d63e
MD5 844f4cea2ca78417a05d1673f23de92c
SHA1 603f67a77e1ff9bd9f74645b7a79ed6524c01d20
SHA512 acf91334f4fd48414d39258f6b50296b286547fd5d54c0a7daf9966b8e8cbf578ae51eaa45ec382662320de584786bc331f7f70635f59449654e2e8bab319a81
TLSH
T1D6E02BA5C861BC270CFE2F2C61911349E76013272B819E1F3B3C911C8FB1A3E4545C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 21KB
SHA256 de772f8e3ac182a446d62b202a5ad7889b3099e39dcfc0ca5505014c842dc6b3
MD5 3e73b21097fd8484f54f7ae2319c0022
SHA1 53aea255aabf3b4c6f3b83470e2eddcddcfddf38
SHA512 7a2c1b87a79b80027bd3b560be9f5ad11acc4bf5d52e2a54d50545bcfd8d6d7865543374e5e17c5bfd378c0c1cf0f3aa9cd4f41ac7f640b1b73a594f805a3019
SSDEEP 384:BHxam1SlIC1+6y5nkzx6QEZl+7D5FjybwjkXREYlkPfHnqYpba4UL:BsTN+lnkzx6QEZl+f5Zys9Y+nqYp+7L
TLSH
T1C4A2E1283936D4083205C778C1D4304E8B68FFB57DAD27D65A930CD43AB6ACB62ABF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039
Size 911KB
SHA256 8faf0eac419869dd76d6930f47539b8d3c4d2a5d0c8afb8d1ff167261b183eba
MD5 f20ba267bb3a57ceede30ea71fa9318a
SHA1 e45de1d008d4d9d519b03f68b700886a8ca5f6b4
SHA512 67f14b0b5af37a6fe9a60b4316771cf8657ecdca0bd8043cf8a521db849546e5912aabd3565c1e4367670df06bb662778ddc8d0218cf2530a0624e3f91814160
SSDEEP 24576:VxskkRrmrcdHzECs4y2OcMVqJdcrhtfSy:VxsTBmCs2OcMVg6r5
TLSH
T1C215E0CA30BB9284E54A6CBF36B27D2811F5AF1D0ADFDE36C9EC664D4470EA17880457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000082
Size 32KB
SHA256 04c7f19e1ae294cc641f6c497653b5c13c41b258559f5f05b790032ccca16c82
MD5 b582b2eca79a750948dbb3777aeaaadb
SHA1 bf0ea1c8a7b4a55779cbb3df1f1d75cc19910e9f
SHA512 35cfd88afe4e4e8091d3a5c53f0f3e2dcd92aa58b7544b94d4d9d7cdf508d429c5292aa97b813c9c8ad18e4d121d4e6595c49f5ddafbeab7b39f3a7c9d0b58dd
SSDEEP 768:S5rsd4sFCihE6OYoEs/5pn7A8o690DW1d3zt0OG:+4d4CbdOjEQp7ho6x1djPG
TLSH
T143E2E2F9A6319A3CC9E9F3C983459F40F75EA449A50C11CA70A8FCE465824CD5F7AA0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000083
Size 66KB
SHA256 274befc7b39609fed270e69335bc92b3d8251545594636eb408d5d93e0ae1a4f
MD5 33411bb179575dfc40cc62c61899664f
SHA1 d03c06d5893d632e1a7f826a6ffd9768ba885e11
SHA512 dc830766c928ac84df16d094fc92586b9c2c25f819123dc9b5ec259220b4b1c45e2af28c89a710f047c00c9dcf7df8dd859a9a7a2d2228703f616df13caef2c7
SSDEEP 1536:DQFVtT8CbB1R8u7uT2yW7tLkpVmWYK9XoTEPnq0K+XeooPpcmgK:6gI1kT2PiiuXoBSuoohKK
TLSH
T1706301B43270DBF4E089C49924E62B1CD4D3606FEABF94E4B146DEDD922BC773198848
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00008a
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00008e
Size 206KB
SHA256 d118191627119a87cb0a01066aa871811cfb5290bfe053b11b21cbb900b15b92
MD5 65d9719f2b6d3e8e4be353b38bcf2d6c
SHA1 29a4b7598d4e9051644787e9f13bf55ccff12171
SHA512 0784f72397833cf83df45ddd38498200413425ecf6ba7da950918f1a91fd21b11e46c1a4f0909292afa14206472944313be206a56eb73d0d2d491b822a952dea
SSDEEP 1536:7Cp36lIFnOvJYVbh9avZtXFRRKPRh8t7DV/aJYRnmIx:xIFndbCvoPVO
TLSH
T1AF247A47E4FA903A423191CBA18D1339B5D381AFC2D4DA39317D2969EFBAE317403A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

518e3ef2246f5e66_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\518e3ef2246f5e66_0
Size 148KB
SHA256 91a76ce7bdf622d22130163e5f5f60756f5dae4503c12ae797cce1ecc4dc58c4
MD5 c06ca2ef2383294b5118fd9e112709a5
SHA1 fc08d233a060920334c76d89b667d3571d54573a
SHA512 dbedb789fd661bc3f1a8557fba5633e900c60f94cbb54530db1c2f63f65aa9bc8ee3fc7fb8a67b872d47a0a08e58ad74b2aa68961b62704f1f3aee2095f6fc25
SSDEEP 1536:dr7VpoH4FjGWwkSUrMNuvBZfIOxzMXrJ7Hbq73bM9wIlO4GbeMeO/+Fbld3mBuKf:dr7VpoH47yUrn/wOW1CPMMBe6obl9
TLSH
T125E372766BB45C72CB3BAFB501038A6B577284183EC3974BB1B88535188E5DD1FB0D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5aea88de95af6156_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\5aea88de95af6156_0
Size 144KB
SHA256 4a9efb49ce43d01274310c47208cddc0f0706bac6c2dc01a43cce898e6531a39
MD5 9ced7df29730593283e0003e4b172be5
SHA1 bc65e67ce28a78021d86c73f2be05147efdd7e80
SHA512 1ad255583a74757861b357ad51d6514503588b26f5f3d206cf3c138398165ca1cbb87926e9e3a0000de917f7aa33e175cd546d45551565a1f163b0a0280f1044
SSDEEP 3072:/66OvuyLxTrpf3HUnWrOcGBZgcUVaC6Q4wGawec0:cH1TN30iMlUVv
TLSH
T171E319755BA09E36CA799BF4425388173636441C3FC7830F62B0E336185D6EA5FB2C9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

741c0cf17afc5cc7_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\741c0cf17afc5cc7_0
Size 269B
SHA256 6d97dbd521498bb9f38048f2bfa06f77422f776c2d96eeefa98e3daeead5a24c
MD5 51e51d8d90f8a6cc90f27171085dc49b
SHA1 0ff28a334c13c6e430696e6ef918d492da3c64de
SHA512 4057a2dad9ea316f80ee07deb9a7b0c37b7f4d36bb0a4f72155bbc4a70e5d0a531e57bacbc263cdfeef44dc7576fbd5f6da5146a54f823340808393a112e144a
TLSH
T18DD02BD3D02D1C57EA1F9BB0D642096E433A919A1748EF4584508172AD2126544A0706
MD5 SHA1 SHA512 TLSH

Submit Download

d00786f0acc290a4_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d00786f0acc290a4_0
Size 275B
SHA256 ecc3b1a139b4ebb81b17b1f4b32073d6958765af7543516528e0ceb22a8a35fe
MD5 203ff15a0f2909065ad44751979b4363
SHA1 db086be5ff873db6e27b4d9ee52dd2aba861be0a
SHA512 7956ef680320a58f98b73ff65f81ea93d80c30d81b2f23699aae053f3f54dbd895bb7723172d9cd78d38abf91897f315f4deb0e9a6f55681ac602f204081d1e3
TLSH
T1D3D02BC75C2C482ED7158AF5CB7A56D6C6B371682B5A85994032823494241709A16405
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 768B
SHA256 5b9737d5bb38789a6b4bac77012ca30a124309dbee631c6d9a0295a6cee959da
MD5 6a0d733e863d1b63b124f3143c7451d6
SHA1 ed01ae11839e587d9a4c732d0263bbc832fb99e2
SHA512 25ccb1e641966123ccf80cb8d9c17f974bc924ea6c6b13b944e0603756c8348ffee4e765861f8f24c495f43f165c2e83cc63d8e6c96d9b6fff75e1e514dd1a67
TLSH
T1E0018BD16141C8FDDFF406F149F98D141BDE0F18AF310FBA25145F946C8753AA6C8114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 57daa96c289afde5ef3dbe0f6e9776f518bf93997824b51e35ecbc6f7d93ce95
MD5 299898dd32e5d31e4dd11934c974afe3
SHA1 604cce490644c9f4329557e04a03dc78f55aa722
SHA512 c2fdd7cf77dc1e59f216bfc74ab55c390502b0db0ff26dd23e4076776766525fd2bdeade843a7853df22b39990fd413a7100e7ca1896a355a36e568c23ccaf8b
TLSH
T1C22159C170809BADDFE006F44FF88D102BED2B786B320FF6E7145BE069D6A75A685114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 054b24b4f2a2a8de2c0c04501f8212b160b9e6b3b00bef8b79d9623d9f1adc30
MD5 a68cfd86b2f9240d42e0c243acd5d925
SHA1 1c382d7741f58f91e875e5d678520435d7a00690
SHA512 72125bd620f7366e3b6866752861a0952babfacd8b9a79563befe72da8eae9f87dff02fd8fa9e8c6c8f514f84f08a11418bb1149885c0e9defb4471f0717e5f1
TLSH
T1C251BCF12182AAAEDFE901B4C9F9081037FE6BB612330EF65D485BF4108B7A5C5740C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 690bc1d90f6810d8d6a92bdafb37d5feec49aceb8a78b2baced456784e3946e0
MD5 e8c7dc7630e3563687bcbf149af3b923
SHA1 51511f96b31a3493f8cf563c2a6212bdc2a08b20
SHA512 4e72a99db3c6873a385af3e962571111af9431ac0b5d5e83b516acfb7730915999d7263cc8da33e5d831f619979490d1fedaa678ce292016d258448486952e2b
TLSH
T17571FCF0618AAABACBD441B089F919153BBE67A753330FF259C84BF050C77A185B10CA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 1a27ae2e40904bc89287d121ac13446c3b011b44d7930d1495857e8639eb6c7f
MD5 f1eb4b8ae03e96903ca436a026de5e92
SHA1 64499c42a8ef708f9aefe33787168e65694d5242
SHA512 db55db8da24aee1b5076b510f07546312dbf0421fe9a1193bdae7e2a728ed51eb8f2ea285d07d981218bbf2e1c2cec3f7bfcc17cb9dcb8fa06c475dbdfa71caf
SSDEEP 384:DOaD2rJqJ8vKmtPx74aILpBspI10pCGBpEO1grNuEn5ZH5ucSXegqIQ9aACfxTzz:WoOD1h15n1
TLSH
T13142AEF7C3E8CA6D891157F8AB146E1FCD290A18532C3D26C8D9AE0B93E3471D25568E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 fc9540854af1641fb183a4960bf7476f776110b0c48f908d3276955d232392a2
MD5 bb3ba4c777394d59c4d8195d7ab77932
SHA1 021c9e42c19e8699be587c17413503d31cbcd5ec
SHA512 e74e3b86acafa9bebda09684d756c7c3c85172240147a03f27a679786195c17b84211c1853cdfc46a25c977081a85c9483d0def0f2fbf797b0993e67414d30da
SSDEEP 384:DOaD2rJqJ8vKmtPx78RoH8JFazVPowo2aILpBspI10pCGBpEO1grwn5ZH5ucSXef:WonrD1y15npg
TLSH
T15882AFF7C3E8CA6DC80167F4AB247E1BCD2A092853283D26C9D5EF4B93E2471D25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 7b4711009dc24511064e1bbcaa52442db2b988d04d020b20d2f3a4f154eb45e9
MD5 bcf485cf1a352be1fa10b54e44a97683
SHA1 14ac57d6645be60d6a5ac5c55d7830133dc6d11a
SHA512 f60c34cef777ac7f6fc5343225f3b12818fccbc48351a194738a58044bd92885a12af7864686913710f0957ea46eeab9184315c69e247496867ec0492acdd491
SSDEEP 192:DOaD2rJqJ8vKuaILFpddebmBWQaPIvtfP+aNPAQqspI10pCGBqLppRU:DOaD2rJqJ8vKuaILFpddebmBWQaAFf2A
TLSH
T19512CFF7C3E8C96D890157F8A7116F1FCE290A18032C3D66C9D5AE0B93E3871D25569E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 6f92353e32385ce93f80580eab927bf0f731b05d0ebb151620ab92c28ac13ff4
MD5 cfa33f45a9067de8dfff6bab284b6976
SHA1 3d423d5989d82e747e0094dd429a9750e6b285a4
SHA512 7f041cd157d85186710fd613556cc1633d8f0bf6d56f588180592c65a1b0ca96acc6ed1c3634e818fa6fc3ce1ad2b386022473baada69db5e5c4855dc800cedb
SSDEEP 384:DiJJ5JkgDoeyZkUAW/lSPDxqrxT+mjf6z/L67eLxJaILpBspI10pQG+pE6dgeqZ2:mDWD4CSF1x7V
TLSH
T15192A1F7C3E4CA6EC90166F49B25AE1FCE190928132C3D76C9D4AE4B93E2472D25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 39015cc201bf27a443a82bf28ad3c9c8497673609037b48f590b4db123e90dc1
MD5 a60c1bc3dfce5fd9e7cf6511b1ee44ec
SHA1 5ac99c87a5d78280b3ff7dbaa9ae1c72681b178e
SHA512 5780c1fcef62da4afb592dbdc1e32a8eb0d0a54883103bba93a4f323f29967336dd9f7176b5cb0542295f6575c068b4aa8b318e1f479f469d87d0e36012748a8
SSDEEP 384:DiJJ5JkgDoeyZkUAW/lSPDxqrxTsAjfxW/Lqge7aILpBspI10pQG+pE6dgrbqZYI:mDlD4dNF1T7J
TLSH
T1D192B0F7C3E4CA2EC90166F49B256E2FCE190928132C3D76C9D4AE4B93E2472D25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 7a1265d1b5b5c596dfd5385fe26ad1b583c28d098695f4a3eeeecb2405063cc2
MD5 92b79c5243471eb22daa29d82292e394
SHA1 cb061e29c5da554409bea4b0152578b5f204822d
SHA512 b310fa4f43d19a736de5b3f53acd0a40ae54c10a02dc2bbc8335521432b820b119adef6d74ad9d40a16723dcc6414e0ae81d6386ba7dad2e44d0efbbdb72cfb7
TLSH
T1CF31C2D7967FF497106D096B4E857C0924BAA83712826CF4DFAB807DF0855F70F0A062
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4314cd25c09e8cb0301aa53711524d9fcf555b429eaaa1128179eb58bf5c5919
MD5 b8cc048b48cb853513fb96227953b306
SHA1 8dc41b2aead131f893f56bed4cf8cb61609fbd70
SHA512 f42e9a08f6c360e9dd0985fce2d3da27d885dc76f6ff1d1ac1c92ed2920d95bb8a5043d424621c63882a005a49b4d05b499087a515a0b4ea4d9c9ad70498d3fc
SSDEEP 192:ZRXcBzVvYivd4lDQ5nfv7HpAPRp2TDp9DHsb+WNn9f14td2ox/anIIUtVyIsnAU/:ZRXmz17Kls3jUXE5wbs22aW8
TLSH
T1DB52D72EA9507A3B5CCAC329F9657757D7F6202220D42E88FAFC892C18E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 25259fddbcf80baa710c0b14a49518ab9340035b467b248a25708c83d52c6790
MD5 b91f56ce76afd5a752bd6ae91b21e943
SHA1 d9c97676bba935af399159ee6a045af277613f4f
SHA512 6f31692358e60193693502f651aef948e3013402b3faf08cfbaefdeb475b395d97c8e05a22b1de1ea94831bb06ac26d3be5cca0376ea1a5101841b3d407e3b8f
SSDEEP 192:ZRXcBzVvYivd4lDQ5ndv7HpAPRp2PM7rp9DHsb+WNOPL9f14td2Kx/anIIUZVyI6:ZRXmz17KlsdjUXJ5wKXs2gaie
TLSH
T15A52E72AA9503A3B5CC6D329F9557767E7F5202220C42E88FAFC892C19E79DC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 36b3296a6215cc9c833de5edc7bdb0cd665aec218b6fd9d4366e7bee7f2983c9
MD5 d813933d5927a9a4fc4ebdce5df97f50
SHA1 4b7df0a99c34520261cdea1e3bf16c5dabc14354
SHA512 d66c7eb4b3b4102c2fb6a30126ced045dc2381bcecc7ea5eb2100fa1da4e6411f236b0ea411c78bfc03a56fed98c7f9715bbddc318d80bb7c78f09417ccfd65e
SSDEEP 192:ZRXcBzFvYivd4lDQ5nKv7HpOPRp0PM7dp9DHsb+WNOPL9f1g2i+td2zx/anIIUdJ:ZRXmzF7KlsGjOXR5wKXku2RaQvL
TLSH
T18462E86AE8502A7B5CD6D329F9557B67D7F5203220D42E8CF6FC892C19E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e88c4ad5c079071bcf3fe731604d33d50e6fd76d9d818f99fa230d96d579c838
MD5 f903093276f9b0b2494ce11c2fb721b6
SHA1 f301433d2dd2257e613fb4ecb91ecffeac7c8d86
SHA512 6184036b361003cff231b42e2b72cfb2feb7e1cfca83f23d3e41441671c7219d42e684b85fbd7071d2335ed1542d5b77402371e8aeb04bf7f3b4ec7cae370b6b
SSDEEP 192:bRXcBzFvYivd4lDQ5EmNv7wpOPRp0PModrq9DHsb+WNXh4ueuZAYQ/htWEx/anId:bRXmzF7KljQMOXj5wXSa5wWaaQvL
TLSH
T14062D76AB8503A7F9CDAC329F9957B57D7F6202221D02E88B6FC892C19D76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 37712f362600dffcf95a60cfd20bfab0b9ce9ce90f8ae748ee0b3fbb3aae9449
MD5 c0000748cef24f4da365742bded615dc
SHA1 07088814602f0d6732a27290522aa9fe4776b411
SHA512 b865223e265c3e706c1945e8d210541445bcbb8474f1e652ef81911a60c8af9eecc092253b4b3e185b8494e9364ce18a233b191b7fd47d951c1a926885a2d579
SSDEEP 192:gRXcBzMvYivd4lDQ5+Yav7wp3KsePRp04CMLdg9q9DHsb+WNpcmmpi6L46gAYQ/+:gRXmz07KlpY2MF+XF5w+9VkXlA2Ga1vL
TLSH
T17272C86AE8602A7B9CDAC325F9A5B757D7F6302261C02D88BBFC992C14D76DC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 1f2e2347d89fbac88194b65b542856fc4bb9b79798a297b025ba46880c594dae
MD5 e8e301ca462c56d1b8deaa416d0b31ab
SHA1 46b2e05e498959272c6ea88aa9aaafe5bd1b4233
SHA512 f2fa234007f41381fe332e6dd32f96a8ee087568c54efdbac139e715ce92480619b2815cea8c5568e7b0dbc92e49799869b7cb9e42907ab8b83d4ce1948cbb0e
SSDEEP 192:gRXcBz/vYivd4lDQ5+Ytv7wp3KsePRp04CMLdg9q9DHsb+WNpcmmpi6L46gAYQ/7:gRXmzH7KlpYNMF+XF5w+9VkXV62va1vL
TLSH
T11972D86AE8602A7B9CDAC325F9A5B797D7F6302260C01D88BBFC8D2C14D76DC2213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 613a2081d55382db881e65d8d6d9877a188588a1be4e5c551cea13cc944c6094
MD5 74ad307e349bd5d939049a86ea9d04ee
SHA1 f26dbf64a6da858ccc5ea8787732f32b89d356ea
SHA512 7622e74215fdbd178c815ba1b8fbe6c3d86402fe0b68f1c735286314f7c2a44d10c2e663a27897411072c11d00ea296c6209fb61910700bbf299d9ba42f5b864
SSDEEP 192:gRXcBzFvYivd4lDQ5+Rjv7wp3KsePRp04CMjdUIMq9DHsb+WNpc+Ig6L46gAYQ/i:gRXmzF7KlpRbMF+XL5w+rVkPK2aa1vL
TLSH
T1B672C86AE8602E7B9CDAC325F9A5B767D7F6302260C41D88BBFC992C14D36DC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 09618ef136c810ab5d2648b46e12c3c530e5146ee3327934575b2a1ece14f6c5
MD5 d26d1bb523d6022e24b9f9c238d6ee5e
SHA1 cccd01384e579bc5b9f240166f42115239f0e2ea
SHA512 14b53fe7b9444dd9573413f29b2a22aa297a44c133e66da930bfbe573b8f3cef87a64276a699579c708e7053a9fb32ed3d33c56e5cf79f62971c4be8901972ee
SSDEEP 192:ZRXcBzVvYivd4lDQ5nRv7HpAPRp2PM7rp9DHsb+WNOPL9f14td2ox/anIIUtVyII:ZRXmz17KlsBjUXJ5wKXs22aW8
TLSH
T11E52D72AA9503A3B5CDAC329F9657767D7F6203120D42E88FAFC992C18E79DC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 1799030ef6f8a880d22f08add27e6dc389287b875b0cad3ab127d4d8ded4e968
MD5 4674540776c28510ecfc0ce6b8c63179
SHA1 8e470ece616fe92a553ebf1ffca566de13461695
SHA512 049b1fb5dcba22010824e832d3da483e144d2cc4ecbdb4fd68c65ad744657d586ec6fba32370fb62a1608fd14920f371df59bdc75b1410b2f17f718965972422
SSDEEP 192:gRXcBzMvYivd4lDQ5+Rav7wp3KsePRp04CMLdgjq9DHsb+WNpcmmpi6L46gAYQ/D:gRXmz07KlpR2MF+Xf5w+9VkXhA2Na1vL
TLSH
T1CA72C76AE8602A7B9CDAC325F9A5B797D7F6302261C01D88BBFC892C14D76DC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 deed1c8d7b963acda8538a76d3a1e2fbc29b47f5dc19cecaf3e84b2295f8faf6
MD5 f0c850c5947dfcb6991cdf92f4d1a18a
SHA1 77d39bf5f6e4f238a1b45d8a4bbe229eb640c5b8
SHA512 0a7615a3a681ac213d278d07cae1749f937dc1cbacfc0e065ae2e802b8b80f87483d83f26f5905331e77c39e871ac080b567e0d7fb9f71bd292804b63c94edae
SSDEEP 384:gRXmzF7KlpRaMF+Xb5w+JSpVkPK2aa1vL:KmzFoPi5w+gp291L
TLSH
T17372D86AE8602A7B9CDAC325F9A5B757D7F6302260C42D88BBFC992C15D36DC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 48f6d569149c42018ce4658a6626b7ec0dce061c651a167fbea6be51ad7d4ad9
MD5 75a8aeca3eb2741ee534c895fcccbd6e
SHA1 5fcf91cf0c3b1c2b4074dabf2002506db6e548c3
SHA512 ce85902cdae3073aa858d905d2df382593260e5ddfe12d5ceb101d189043beb075e1150d16b0b652c74d9f961d6b78638c3e229ccff2883f4ad64c7058807d11
SSDEEP 192:gRXcBzFvYivd4lDQ5+Rav7wp3KsePRp04CMjdUSq9DHsb+WNpc+Ig6L46gAYQ/9k:gRXmzF7KlpR2MF+Xg5w+rVkPhA2aa1vL
TLSH
T1B572C86AE8602E7B9CDAC325F9A5B767D7F6302261C41D88BBFC992C14D36DC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 7de1b0e9ba2f952f7ef978528afb16f1a749e2595029f64a37d684b63f2e2aec
MD5 dcc268cbf3f74f72019d67c31f02f6dd
SHA1 c6dba697a5ec0eb91fc953b0a62a7ede97621cbf
SHA512 55605d702b128f10c997a3c5026f6c89b10d019c0252b55c8785af64d522be982cca6b84fcdc657d26b2f01d00baa7e68048096afd015d02d4e3589c7b61a979
SSDEEP 192:gRXcBz/vYivd4lDQ5+Yav7wp3KsePRp04CMLdg9q9DHsb+WNpcmmpi6L46gAYQ/+:gRXmzH7KlpY2MF+XF5w+9VkXlA2Ga1vL
TLSH
T14072C86AE8602A7B9CDAC325F9A5B757D7F6302261C02D88BBFC992C14D76DC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d4a5c35484cc64ee7234d6b092144621929058946bfa6ad2f9df46b9db5b82a0
MD5 21ad44e8cea95f855d820b922659830d
SHA1 c31cdeab31ac87cbfc5c9895ae62fc5d54c4f60a
SHA512 4c45da3ee23e8ae334812893c42612d4f2d52e66f5c58a26ac744e56abf10da6b9eae4c04c678d397cbc0257c8e2b25a7902024a8562c6d0c305ae7380e66fe9
TLSH
T10CB012808841A101C05202F813422588B1549F209A0A2B1143E06F77CC2615080142A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 75fd1ad17609329e5b8f68deabfcbfba6e9f8b0bcb157f1e107cb3c643bd774c
MD5 838c857740127dacceeb863ad257f8b9
SHA1 ea8076c8d2c2dbfc17b52bbc295c6572bdf882bf
SHA512 f37d907771d86253b596f9d67c3eb20c120f17ed4cce45a679eebd3a39e9cdb16337aaf42c8b9b1cc0d36346152a48a6e23429ca0769d64b81c7671b3c4e912b
TLSH
T1F5C01243C4016101C45E03BC169794BC7134DF24DA1B139983E46E26D83A231C0251D1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 8675a1d6067f1069960561d98a1e4af7043d26fcd2cef4a1f3180c3dd3531a60
MD5 0c8cd0ecb40571da4e3bc99926ec4783
SHA1 a2505e4a2faf00430cca0733fe451cd2a09860a7
SHA512 83b109e26f3eeae80faba27f76087c13fb2144ee400be14b294574aa94a8989ae71921dccb350c5c9c049a9ca0748e5865b39ad75f32119046f4bf514cf68b85
TLSH
T166C09B558501A011C41743755E73555C72185FEC9A1E374946E86E17B4752324114155
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5df753.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5df753.TMP
Size 96B
SHA256 4a87b5eac8b2641f1184efd65e65f4c94006c97d254e7496e0d69c318fbb5f3a
MD5 8c4fa11072f0ee63345e3b3ab3b8b813
SHA1 e6239040826adbc98d97e315b01074d25da6471d
SHA512 02690c8fa7704c2bdee279e11996abe2563609fb6f973a05f1e85a41010fc973c299de624b1af95a1cd89f8a2d3943437ebc35e28569ca9368d0c3857c87de55
TLSH
T188B02280C082332BC08203F0288888C830A0FF2FC203230AA2F00F22CC222200C200A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 181d2e3af63ce5e482b4e1e97a316b4debc38352c9f1ae02de83a725bf32353c
MD5 5caf0042cb5b8e5ae3668dbb74a47872
SHA1 45b859c3733a72ae66a03c30bff53050cf0dad9b
SHA512 73d6ff5a46e2229a598834fef2b53c4c0c66cd66e3ad9bda59942c6ecf3a10b467a520d2eb34d3049f99077a91c69e36206e8f90880f92474ca0e2de7d9a165c
TLSH
T17BA002654BD00065C38E1BB27491219422509A504981530544D40654DAD0765C539C1E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 957dc90876e90226f3e75aff4a91b106246f1446937e8c2a835da1ee53a9dbac
MD5 82c5292186a29b89a144271de2bf1aae
SHA1 8a1b33cd7404eacf851631a8943c715d9b221348
SHA512 47e7525d137e9b9517b4583b1f27a9f5e2c9eaf317f3877bcfe43e98011de85a8539fa9d094f600fe9db27eef2304135f1c7121bb21ec5b042bd6dc0d5bf2ce3
TLSH
T1BDB024743750540DC71703F110C340D435111D100573D30510F00134C0433413331CCF
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\index.txt
Size 150B
SHA256 26d36f92b77f15672da8441353b2876bd44635dadcd7140c4f66ebc565bcbfec
MD5 4a8ea1c83c4fa58665b6aa1f450f4b2d
SHA1 2ac35ac9b4888c26a479d0792d8a0c272a133749
SHA512 abd6b9b24afdc0f74d75ac8a625654e13f90b71e7a82d6022e7a615649bf587a05759fabeafa10575ed0df42c9829703c5daac32068b00ac15b3fa539a170ee3
TLSH
T195C04CEB6614459B0A749ADC1028723DD59B665C8CD4CCE8944D801A2574A374C4197D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe6e2a9a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\index.txt~RFe6e2a9a.TMP
Size 157B
SHA256 0d5784d67d689177d88ab63669c60c14fdfbb732ce87cc3cfeb9dd4fcefa67d8
MD5 7158b470c8109f9954c1716fced33264
SHA1 bebb10e852847de6e91acdeb67c868b9d79d16db
SHA512 e73db11a5a8678c3d730511ac00e1cdcb07e9edd1f8f6813dfdbd521c6c378c2d0a099555e68fb69fd90fc64d8fdc5b031c3e435ab046f901b5d9635041a0ded
TLSH
T169C08CE36620048B0B7099D91028322CC0AB5E1C8CC4CCE8900EB00E3134A338C0093C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 62cf7c6c0656919a63fc0005bbd853c8845818807ec368fbb409e410ee26d5f6
MD5 fea46c8dd188e7bcb2072cbb2534c33d
SHA1 ff7eb8140f7c9587b63214900f06ba620820ad94
SHA512 bf6f9ba058a8122e4445d7beb96e766b7c7485bcea3e618c415f6a4ac2a4e337cd9ded8ec8d04d92a06be38867a0b3be7b3439921feb993971e36cd3284fdd9c
SSDEEP 6144:AOlsPQCfjiXVzoJHg6JOMxheoPzm7Rkm1tYpBeh2BAoq:AOlsIejilEJAkbza9oBGcAoq
TLSH
T15E34122B9D306D7F5C74BB0E704D4E0F7BE08DA9E6099EA1C6C52644236E1C45F47638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 169KB
SHA256 e716b1e424e662b966408d6a2da62e956a6788a2f648ff81323257b3c4de31c8
MD5 c1c78463ef1243dc471317f634328c58
SHA1 2a3e01ba4c89e5456c5de287bd3389b46b82c915
SHA512 5d1136c3616b6a1218aa06f2464952ba9110a0fe82914c02c8b28f458f79bba41425963d90b9ef5d59f4781f20586acfc8b2693067d2df4804f2d8869174111b
SSDEEP 3072:YTOUK6M8LANbnXONOOYvPsX/QCMKxc2iXV1FoJHg60gOMxheoP0L+v72E:YTOU3DOlsPQCfjiXVzoJHg6JOMxheoPp
TLSH
T1A1041259DD292D7F4D79A60960198E4FF7844C9DA2CA6EA183C23B8D132F0D0AF0772D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 812931c9f9476f4637147cd01cb8693d221ff9b7f4e7e674073c899219a8ac67
MD5 eac3cd7a626cee8a226047988e45b404
SHA1 57e48014896b68c5a2cc27f68cb1c6b130538fff
SHA512 0e1ea340ed3390d3ca3fbb038e795b7d53b43a0fb85592ebd55c82c2bcccf5ade002b3f10959ff5d1599df1b7517c7216f611ade71d44bee23a0b426ec5456f7
SSDEEP 6144:aHOlsPQCfjiXVzoJHg6JOMxheoPzm7Rkm1tYpBeh2BAoq:SOlsIejilEJAkbza9oBGcAoq
TLSH
T17D34123B8D246D7B5D74BB0E704D4E0B6EE08D9AEB09AE91C5C02B44236E5D85F47A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 1ce6195b3f5c3eb73f2f4f07ee797bf44dc41ce35d8d1cc317227a3a40e243e7
MD5 072b73bfd4dc18e2ca08001a017b5bea
SHA1 e23ea3ecb00633e414db82e11bb719d37ff9ccd1
SHA512 40d5e56106476920a9986755b910899ac6062d3972af346f1ab9c7de883fb6e12503f0e7034f1e334922148808e01769cb91646baac6ebe51c1b13624d23842d
SSDEEP 3072:96NbnXONOOYvPsX/QCMKxc2iXV1FoJHg60gOMxheoP0L+v72E:9ROlsPQCfjiXVzoJHg6JOMxheoPp
TLSH
T105C30276CD241DBF5D756A0A71198E47FEC4889EAB896EA087C13B8A131F0D06F4371E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 308KB
SHA256 1ca5f5b289db198a96b5f6501a374ca9a0bb6b0a4af1ccd40730cdc4470a6100
MD5 3b6db645ce7b1e55c179230e412a1544
SHA1 8ad38f7e2ce3fdf75e2fa6c2d6564b0b1ff2372d
SHA512 6e284c721d156d502c007846777ea3dc3c841d0467588b62691324b32f1cff3b955f08d1dd031fca86153cc0f394377c4794011d2018858882cdf32b4766122b
SSDEEP 6144:aCe0WO+KY3dNOlsPQCfjiXVzoJHg6JOMxheoPzm7Rkm1tYpBeh2BAoq:aCe0WKknOlsIejilEJAkbza9oBGcAoq
TLSH
T1516412768C352D7B0CB8B60E700A5F4FAEE18DEADB457EA182C03B44535B9D55E0BA34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 46205fe44e936f06837cb4e568e79e6ae3020163cd4c41b940001225017d1c0d
MD5 4ac1b9e49f1e73f73a6ca9cd3c2661ef
SHA1 619132262240d15d1123833db518a826e55a8177
SHA512 96ca11e3a67ac655a0c5d6bf61445b6f6e112e38a97d7eb9d9de6eb569ff0c97636e7cda047bcba96d09e5d14ca21234843c528ebff290a354d80aaa323d16b1
SSDEEP 6144:w4OlsPQCfjiXVzoJHg6JOMxheoPzm7Rkm1tYpBeh2BAoq:bOlsIejilEJAkbza9oBGcAoq
TLSH
T17F34123B8D246D7F5D74BB0A704D4E0B7EE08C9AEB09AE91C5C42B44236E1D85F47A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 a563eddce3c7211344acb1d243ecc3685825427118d8c993ce630b441061986e
MD5 5d26056dc781c6eb193a1ce9d340fbfb
SHA1 7fc178dc280994a0edd3fe7a04288bfcd08052a7
SHA512 2a3ea2df8fa44a3a9d430c03ea766f42cb227835043e524d48058a2c4211649f72b34e884cfe35ca79ffae879987d07dde37732ff4b72ba638cda296b23bffc6
SSDEEP 6144:rOlsPQCfjiXVzoJHg6JOMxheoPzm7Rkm1tYpBeh2BAoq:rOlsIejilEJAkbza9oBGcAoq
TLSH
T18034122B9D306D7F5C74BB0E704D4E0F7BE08DA9E6099EA2C6C52A4423AE1C45F47638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 eabbad8186a8ed068e584b535da5952bd327bc70f96fe07d29cd7af3b71f1170
MD5 f3d75999d37ece604023c3bf2eced211
SHA1 9c24337a73c172341fc72b9230584264cac56f36
SHA512 8996e399becd55e3f97d4781f7240c9d5d4280a001dca4bfe93de4a56d8c7cb47a54cae626828ee24cc99d27d2529b5bc7c3e28e7258d1bf755ffeef63b18b7b
SSDEEP 3072:MGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:/m7Rkm1tYpBeh2BAo+
TLSH
T134C3122B5D71A93758B5B74EB08E0B1F1EF149A6C930DE92C8D86B0477F66CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b3d3b5aa264af080a057be24321b9ebdb107be5a93bf565307fe46235b5f0cde
MD5 e2653fcb022415d566e974b9af71be96
SHA1 b2860e50537fe945b7f5508916c0afd4b5269ce3
SHA512 c039ea98b22f52dc50d99fc4778b9411cf6feec3a6cb02c2647f431cf0a4198317dbb8195a46c532025cec3b65e9273b8162e6d9877327419cea235d3d82f60f
SSDEEP 3:MsEllllkEthXllkl2zEglt1ut:/M/xT02zj
TLSH
T1E0440445FFD44D45C5011730C431C3501374D7540557D753745D0D33DDC55530C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cc9cf848cfc6b3cee74946413693dcbab33b7117cdf781cb992582df418645f
MD5 14141a7d178e0786f91c9ad8dacf07e1
SHA1 fabc9c7a5dbbaad876d2bed6abb9152b8422f73f
SHA512 6078f06bf8c4dffcfc7a6f23965bcdf1d0461c3c7e7cfc74c942267c36ac233010e3c1c1630fa84941de31a52daa22eb896e4044ee8d8228e4d836bc3d5dcfde
TLSH
T1D9D023B4783675D3C22C003940D06603321606322993E3421081D80CDE74481E2EECD2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 941ca821c06783b95e7d69ce7249379a9302d12ab3093d6f3fb26777a560a578
MD5 42f6004a92ce28978438590a3ce13c3b
SHA1 44d60b7f01ffe8539e8321f31edc7eeaded98e80
SHA512 e1ca6acb17838691c9a272840bb2fdc3f77267c1cc0f0e78e056f923aaf8c6b2691e38eb46fa585b3db619d027585731d2999f7429b7cbc04e33ca04c92fe7ab
TLSH
T19FE0DF4502CBD3A40A0AA447A3689B180185710FEEC8D9E93A3AE189255564897DBCB8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 1bde510a8acdd1d135fbd1d26695a7177a38cad7616e7840b7d88ef57f9430b8
MD5 2445f38166b3efa1b0ad6e117099c9af
SHA1 b3f93bf435f496b755324d28eaa543af6048af19
SHA512 2035296a44e12f4683e79ba3ae34e02da77a1dcb85b7bcc0a7e8be1f00a770d159e4d9feb7582f35800ffa0c18b03c501aace9b79d531548b2faf5089f6c5f8c
TLSH
T177D02B9AFDEC9E8EC7E44ABD57A9B4000A4802A3840B9B1310347EC034956F01E35030
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8f90b65c5fc952391310b01f10b64a7158d05a459aacaddb280d3646e71a021b
MD5 9e6d4c5817ec8b2825cc3f8da38c2c61
SHA1 1b87216326784c41e3e0c44014330cc9b6136d66
SHA512 513eb589577d2db84159e1885185ed0a79ea4b371a8cf0009004e3b16d1fe8160a4421c77987fa49ee715aed2f108508d5cd1c1b95b335a9ee2ca2a6d29ef981
TLSH
T1F2E02BAAC921AC3719FD4B1EA0A51B89EA5053572680956F3A3D951C8FB073A1686C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 203KB
SHA256 11572351f3b1cf6fa63ea140a47a164c74fa1c7d162e6d75cfc32a9df22cc57c
MD5 3314a6f401f9a0871c40aea9773a5917
SHA1 90171336e11bcf024c59c3a6a6549e637a4e0084
SHA512 95f9a3fb619cebb054fa4ce6013e3d8015232aced65ee6c4844d0cc677809f55918650c58f1681ca81080b4eefa8b054d0c8fed1639b9e353e00457eda5f7503
SSDEEP 6144:7i59q6rY/c0okmFeMkYgNu0Ws0n37pbX0s0/L:chMcAm0GggTsQ3dyL
TLSH
T13E1412BF708F4F2CD45E2638DF2BA61202641CEAAF7845FB8D8E1775D9019A304D8667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 512KB
SHA256 02b0a8ad7f3e9727b28cebc2ee1663712b990da7cc10dd96025420be6315dc94
MD5 9c4994ee71ed65500105b3f15520946a
SHA1 d2b907a0d4e91781e6a84acc400658e2244d9c12
SHA512 6e23ab30afb45947f85feaeae82cdb3603b250f0175a346820ea9a125bffbd3d57d5140a92b8c0af36e6cb60aca2f51fedbaf0796a6834cff95b953658bf71fc
SSDEEP 6144:LOudzRoFS0/wxHqywh0aNqbi3oCKImWcbL5MSRSMzc1DN1cGexAlfE:3dzRiwC2at3OIYbzRSWc5N1cGexwfE
TLSH
T136B4E0B0FBC3DB80C74326BDA0BD3E371B1204C161D94A0789537D519461FA6AB2BA7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 256KB
SHA256 f3fdb11faee00508cfab853c284debb72a6054ce7a437005f271fdaa419c8c9a
MD5 be569398e0e595dd2f72e1bc4cb2e4c7
SHA1 a7a59eddb0ea2dacb98ff03113480327c1805c9c
SHA512 475d255ae27e373971a32efb3c28faaa9aba5e3b6790329c211e038d1258f84b826b88aed8c7451749a608dad9aa433b9454520314c20339fe6527872bb15f61
SSDEEP 6144:oxQsrSL1TgnPaBehiQ0tlOw49YjoCrT3:eQESLNMaBeGyS7
TLSH
T14644BDB4FBC3D782CB132BBDA43D3D374BA852C561D05A0744639D26A598B26E30727E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 256KB
SHA256 adb7287fc26c0521616bb69adf7889e9318a0c1e00398825c51c01d2a06f4c05
MD5 81d44a31aedf4fb57ee9d944ea23dfe0
SHA1 9c1bc458e74d05c7ae5dc59dac6cc4a6dd67c43b
SHA512 d17ddff7df8373d8fb4acde11c43d00ee9bf701959e330cd4a14c1558a83ad445aa6263b3ee98e5de3daf98b431210ee149e7ffac763c6d50c06e93126b00a5f
SSDEEP 3072:zANhizEqXhXHWDRs2JZuEDBy2MoZLyBa09819SQql9jGdrTBvGoVR00I4QzUlW:zACcdZZJM2HZ+0nYjGbB00I4VW
TLSH
T1AB44F1B4FB829740CB036ABCD07C2E374B9A54E672C40E1B0B669D212684765EB17E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 32KB
SHA256 1d42f867c230212cca1e6d17681c2c73c2e18aa00996fa7cf5e64681aa31073f
MD5 c20c0e4bd70df4977af5d08cc3714b3b
SHA1 f1c1332455720f312ad657e4a3a658185d1b7d23
SHA512 eb2d74a09647460c00cf5012d0514057929072048e25eb04ff15258312763c4cbbfae866a45ea587fce169a9eb8a58b9af0d2fe0fbb89a7cd7bcc36ff2c596a4
SSDEEP 768:+ZjenZYTbIoZYLpTzUNqpMjDoc518PYGoHhQQCIkBGK9F8m:+IK8HzUNnjsc51rhQ4kB3F8m
TLSH
T16AE202C0F74A4BBC3C624E598A1331B43253F8039AF8AB851494736566F1F9ACF179AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 18KB
SHA256 ad2483a56557a1ca259dccec7279591abc39b9565f3513c676384dfe060fde4b
MD5 15fac14dedb96ecf1077775671d31141
SHA1 58e8b251869ab8d9c32ea3c297d6f438eed16dcd
SHA512 8eb98407a0afba6b2aec5188883bd129d00e3559a6705e1b1843bd4cae9081a4faed6af5984a29f38f9c4a0cfd548ebe5f29f3aab6942c34e21dcf1e33c065aa
SSDEEP 384:1p/7GUPciEEd227+e8A/cMYIxK82an8b1LUFQVUGLbT46tBKdG8rD:37GUPDEEdlKe8AEs7zfQT3EqBK0Y
TLSH
T1F882D0B84EBC3B5673618B7E42C4B251A87668C30AE4AE38EB35DC337C125469D25353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 dd48aaa76da4aefcf739c0c9fc46c17efe1ee5131942d1dd08ecfa62b1b0448e
MD5 c59e031a1f244d9eb1f07529ee614bae
SHA1 c258b2c236b860e168256b889eefa6f7cf0c66aa
SHA512 2aca7a3eb00f825160a8e142b9d2760c4891a7efb4562eb5fdd1b3bc9efea5e5f82919c2f851dcc4d6200d82a9384ee4a4265b2ed6576113b16dfa8da46e16a4
SSDEEP 96:P2Kd6pi/QaaLhVtdLTEfZNcO6fkmPOeFlqkhWELzURRUtcoHsQGB:Pf4ayduvoskh1URRUtDG
TLSH
T11EB1D620C9A72177FB312A3FA5E64FF5367082455A1F6EA309C024F1680A3F9D1B716E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 2d4dc9200234d8cbc0be88223b0a1a02af2740fe76237f1b295c30ba88677039
MD5 ad587df7c55d2652c0140b871c06ed64
SHA1 66ed0f347998fdd1cd4508ace06a2de7dc1a08aa
SHA512 196a99d5c2fb801f261dee926162a9ee635cb7aa83393a0572e77abd774a4334281fa86870255b70f28a5e335cc73a74e147ae6642a756bd53fd45f83f7f0974
SSDEEP 96:FRgKAyKao/zNav+K08QdsEiXtfnP18PO6vjPwtRpvzRMqk1WrTUGL5IRKUsj7adf:jgJa4nmfnt8mBzTk1qIRKUsj77hkj
TLSH
T10902B7C184963463E73217BF90E65EF1753047892A5F1FFF0A801BBB250A3E9D26725A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 c2860997235042236e68e9f20749950bfbaeec986bb28e402b856bac6a58f53d
MD5 899cb1a32c7b8fa0d60b550fe97353c5
SHA1 9b54b91246f9d7a2be55e6f2561754fa5dcd8e4b
SHA512 b6431803fba57334404276344052ee9fb5a59a4b0863bcb23bcd3b111816516a2f3a20ca69befaf050db8e420bc26965816cb99df4d6f6349f804ca2f8ff113f
SSDEEP 96:62Kd6pkmo/zxaaLlkVtdLTEfZsHO6fkmPOeFTOqkhWrTUMLzURRUtq9aroNsPvJO:6Ptaldu5oLkhWURRUtq9rp
TLSH
T159C1E910C8E72567FB312A7FA0E64FF1357083065A5B6FA306C028F5280A3F9D16716E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5997e1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5997e1.TMP
Size 3KB
SHA256 54a6a7e6ce9511a9484711a369eea65de456c568ba82f583326fba591250ee2f
MD5 fa073e512aca901d59c489bb56606e6a
SHA1 a39ad4c80a2d0f2f9146004da3ef6937c69215e1
SHA512 b951d3b11c1d2d0bb95b01a5f377c5e501abbe57f0a01ddb85e6b89da1e7e3e45f2b45d7661e33e9655e9c7f6a5fba3cc89c8e51e88d69b363aea3fe5d1d6d3f
TLSH
T17F71604501A20937F330327FB9E14FF1B5B087469A5F8E6A105468FA281A7FCE1B759B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 17KB
SHA256 5dbfd2f6facf4294f8b3e43353854b91030afbf09fa3c5dc97f0ecbbdbead432
MD5 2a2a16bb0ac9873491da64a92c2e36c5
SHA1 a72028fea048e1f49a60d152c40686d374621af1
SHA512 407836c8148fda30d18c3ea4b4fa2ca51ac83c2970e80a390b4d3b037570e925cd17483941732b046492da53a7e626a968c953bdc458ac9ac92f119870716c19
SSDEEP 384:fBuCHQAPyyaFao4V6a6+9apawaMaPaMalaPaPakSx7IpkMBMA0i40:JuCHQAPyyaFao4Vq+KSx7IpkMBMA0i40
TLSH
T1F9827716B5F9061AF2BB5FBBA8761B91497ABE452D04DC1E68A0620D4C31F40CD73B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old
Size 343B
SHA256 615b6ff3d0ae94d2976d1e6241f5835fb59f5c7168bae26bc817836faef19b2d
MD5 243fbb415ca2c5975deab9a4b751c8c2
SHA1 3cdcef37a25b7f56ea98cf50ab7a9b6b1c8b23a6
SHA512 268ff886cd24bd02156972fac4c89b06cbb32f0a224907f6f7e81c8728364af1a005f0e03fbe754acb30d03891b88bb492f44a811b1d86fe17a0b275c0bb5b50
TLSH
T12BE0D879C9C9C31B915450E61635FF09D5A7260FAE88BD861E5EC8047442044F4BF9B1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 572deae413ae6ee79edd6ce868fb72ee34acb51e16d92b274d020047533c5a66
MD5 ed5c8efdb58f47d5b87d79e8fb642298
SHA1 3b954211006ef081c1920171f874c65a6eba6897
SHA512 323816a1d616d70366e24f7f045b574e6133c09ef12aa062239811af49795f1cfcc8909b0a4f5edfd4b381eca80adb799017faa6c260c092877aef5772515a3a
SSDEEP 96:D1AJIO61Narbaaij6BnyVbtJzAZOnJOxFj5GO7gHzRXp3Gtcw2x:D1AJz61Narbaaij6xyptJ8ZOnJOxFj5g
TLSH
T161C19BF7C3E5466DC91192F0AA146F1BCE190556436C3D5A88E4AF1BA3F28B1E14278F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b57ef5c51604a72fb04882d99e7e973414433893bb4d3da663b10d710035f455
MD5 b13ca0de517af5160894a7eeb70cfd25
SHA1 e21c8160878a8019f16acaee09e3f4c59583fac1
SHA512 5b2acc101b92590bd0515f3674ecb7d539aae04201b0a364947315f92036be04d9547d4d4bc481408c8f86417c9c76b60643a557131a51054f792425d23965d5
SSDEEP 192:D1AJz61NarnKaaij6xyptJ8ZOnJOxF577gb/cYG5ttqjeQyqYqfywbGSx:D1Mz61NarnKaaiGxyB8ZOnJOxF577gb/
TLSH
T15EF1DFF783F5866ECA1192F0AA147F1FCE591556436C3C5988E4AE1BA3F2471E101B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 c70cee76adc511c01d8013eeb32c13708c4ce2c73826849f537365bf933c68a0
MD5 079e278e09483b29a938861a4f1e9fe5
SHA1 c47eaba788436ef9f73bada1cd5de104b7cc2c3b
SHA512 bbc9ce50f796e37d560497c7ca33d015dd41cea1bde1df6dadf64dac75b789bbca5c1484610e52a7ebf84b759b23f266fd5411734ba2485d65221bf1ecf30f9a
SSDEEP 96:D1AJIO61Narbaaij6BnyVbtJzAZOnh7g5G6Oc1+/FHz9CGwBk:D1AJz61Narbaaij6xyptJ8ZOnh7g5XON
TLSH
T18CC18AF7C3E5466DC91192F0AE146E1BCE290556436C3D5A88E4AF1BA3F28B1E14278F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0ef0e3b051d6e4aa42d55d758020132e9615399ec3dc579c2b74c18529d8b56c
MD5 dd2595417f03352041c009ff1972fbce
SHA1 37d6ab681371fbc8a74afa6cf98e88a0532cdff1
SHA512 d360d343ab2a93b1e5bc9098adcf53c023e29dbd51f339739606ed740929e0582401b34b9d6af95515a4affe5916c15c0328ab82486cd33ead36c26895012baf
TLSH
T1B63180F783F4856ECA0195F0BA18AE2BCE2D0515432C7D9A85E4EF1B93E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 b3b5d37bc6ba219536b4f7dc6a21e8b146dab8967dfe492bd2d3ee9be26ee2a8
MD5 5acbbe609ef6f8e5cf1aad6413a256b6
SHA1 81d7a97c67ba04a3d9cfc6bb1274c03dda22fb05
SHA512 0a68d795115ef6f5c529640cfdd5e5eefe3c922a8b94847150dd1fe534caf381fe26cd28ffce17a0bc027d50a24846d3d3f11d3bb14dfb5251f421f2c12ce1c7
SSDEEP 384:D1Fz/1NarnSPdflM3KJvrqIdeZRaaiGxuB1ZOnJOxFHkqeQyqYqfywbGbu96igAX:QdydfBhbPOU
TLSH
T1A372ACF7C3F4866EC91192F4AA246F1FCE2D0516436C3D5AC5E4AE4BA3F2470E151A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 788872b8dcfdba593b0c49faa114e9e7ef83dfe57640bb7a36a55f107cd174c9
MD5 ebd04d37532a96b8f285682d133e3034
SHA1 19bb2dc070eb940985deca43191ff0dde182c88e
SHA512 0d0b8d375f80fa574dad8bc3a37df8bdeac4087e891d7d4e6c79b7daadb1ec589b31963261967526697c532806d4d05b632f4028a1f0c598ca17c008c5106315
TLSH
T16AD022231B0030F5A96E3FA5906AAC8FC33A10234803EDD828E09CAC053A4AC093F984
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 f8a3f31410e78ec715e01266425e9ce0745cb0659e409d4464680851668e83d6
MD5 bba5c55a98fb4c677024002a583d24c8
SHA1 21c6c30f9cc89ae59718cabafcfde9fbf276437f
SHA512 55ff369d93981edcb565a4e1187a19ce52e6f8e61527a949696230ad1b2ec3b15d370b5ef74962184ddf7d2cda89875fbff04626bcab20c37700759f01665800
SSDEEP 384:sxZYnAcqeOP/f/s4+70LQtfgp2G/bZX5FIsTWn:sKArpP/fb+70cdY/bF5F6
TLSH
T194821916AA64593BDCEBD229F9457B93D2F91063D5504E48A5FCCE0C04E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a32301eaeb770fb54fb562e180c247fe35604e9d77d1d6139a1559b4bcd3d09e
MD5 542ec5990fd1e4c43ddb78004bc0e9d3
SHA1 078cba6241cab6aa205ef28ec18f86133d794aba
SHA512 e5833decbb316a3e3e9f5e45c0ba38f98b6a8d8b2b1dc8f4df9b109886aa96f575bb6b2fa42bc59c0e7812aefdb96b2955ed4e391f86622b923bf96c8a801fe7
SSDEEP 192:sxZTRDyMqZjK1Ml8MFP/f/s8rmxIxE0CXU73zodpER/W6+WNGY0dgWmVIgjdJ:sxZT8dP/f/s8mI60LY0/bG5jsjn
TLSH
T1B662F716AB345977CCDBD219FA457F93D2F91563A2504E48A9FCCA1C04E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 66e2f078acae0f7e83f5192328fb1987da21f0f9872d013252a9077bfa1c10ad
MD5 cbff00272a396d5fb11656c2c8879d75
SHA1 bb144b67ea85ced8960f6b299f2dd4234301ef86
SHA512 ebcf974ab8481e7594dc312dd77810abd205abc1787084a979ce1eafec247c7c5dd94eb504442f918ab7acb085136339a1951cb9cb7273e7eadd1e02fba534b8
SSDEEP 384:sxZbnicEOP/f/s4+70L9tppw/I/bW/5EsTWn:sDi0P/fb+70BH/bM5m
TLSH
T155721816AA24597BDDDBD329F9457B93D2F91573D1904E48A5FC8A0C04EAAEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 fc421151358b7bc4c13c8c0d865694ecaa07f97ea7d3949b855875df6e6fdd47
MD5 027d13545c8199c1251b34fd1aa96b53
SHA1 09731bcd49b16675dccbe3d186b7e5f91d4a0943
SHA512 c9969da1c56de965b7f7e9fb613550ee10c7d063f51b83431bca39a2bfe2d9cfb973a0d609e53f7757749beefbfcd8296e8841eea94e489d93641688a18c0f07
SSDEEP 384:sxZYnJcqeOP/f/s4+70Lht/gpBud/b40xd5QJsTWn:sKJrpP/fb+701lzd/b4A5Qh
TLSH
T1A1821912AA70597BDCEBD229F945BBA3D6F91063D5504E48A5FC8E1C04E6BED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 4d88ca57b2646d26b746241549f8270bcd7a2752a170e417c05e54450f414f18
MD5 58caecf481b7d8017a9ac5839760f843
SHA1 3aba27491fe6ecf6fb0e51bae7c291aa518cfbb6
SHA512 449641f28a2a5f1544d2c760a2662fd597f67979e7fdf4459ced7530a6ca2614f99771cf33886fb9eabb9229b06f6fd022746e83562d9ca65ff8aa7fb7a91695
SSDEEP 384:sxZYnscq/m1P/f/s4+70LrtdbpB1d/b40xq/5TJsTWA/8memC:sKsr/m1P/fb+70XDNd/b475Tc8memC
TLSH
T1D7A2F8126620997BCDDBD619F9617FA2D6FA146389504E4CA6FCCD0C04EA6FD2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 3bacc5186acf3e9a289fbb6b17ca19bd1223c6461ea168af227c57e9da977e81
MD5 41ea94c072d7df3517ab3015c1a69d80
SHA1 58bc4d42c53bf32d62916c1f07732bafdfe625b3
SHA512 deabfc67344803c26fb28ba5f2497b2e76fea2e2c78fef601d91ea27410af4ffa8a004a9a8a78e49b6d033be6b09eb4eb4c4cfc5f5e67eafcab43d879d422df6
SSDEEP 384:sxZYnDcq/m4P/f/s4+70LQ9tsMp/1d/b40xq/5T1sTplA/8memC:sKDr/m4P/fb+70q+md/b475TEo8memC
TLSH
T161A2F812A6209977CCD7D619F9657F92D7FA106399504E4CA9FCCD0C04EB6ED2207C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index
Size 3KB
SHA256 fe8136b290ef668c9cab89239460f7472f81c3e9f16251a72b2106424dd5d57a
MD5 1277b99bc3b3eba27059db7c6a13b936
SHA1 48c64b791b445cf7d815ab1cf39e72addfad07ed
SHA512 335d58baa8ddc9554b8ba77dec7cda4b65c135d437dc2d5b9bb626a1afd238dbb00e26589c2684c9ab01fabb36ed121724b6185c3a7e5feeb46fc7e3ea2bc42c
TLSH
T1CB51E70E4C432B6BDEBC127358F70458377A70CC56D9AA1BB46CA038BCC332939A8275
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index
Size 2KB
SHA256 d1c1043c4c0d82c8e0a6b096ecd0339b578c39d6b17e463e3fe73c98bbd2a8b1
MD5 8d434e3976bf3da12196f2b53fa8d5c4
SHA1 e3f5037143173af5b5f2752eff1ae65032e26a9e
SHA512 433eb8a0ca50a83cd1b5be634430a76e39ec50d5390ccf98959156079a40c832e209ff7b1547c549f92113a85e9e1c3bb88cf1b4501ab561b380799e376487b1
TLSH
T14541FC8E4E818A2EE89440B30DF364F43335580087157F4378FCA235AC927AD3E5D1D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index
Size 2KB
SHA256 de6648d0ca7e43fde889523de7bd8e739725065c4ecf933cd27c6d11530ae456
MD5 b3c740cdeda7b51394adcb4ba520d960
SHA1 e72831a7872144aeeef0b2f4eaeb89dd36ee6a8a
SHA512 c3039d72c5534fee21e0adf87fbcb558ff9b78495beb77f2aa6a9fe0f020fc0eb60884679404b15609e05fc986c3e8b1b3fc7eb10d7340b6982eda5881456b65
TLSH
T1D941B68C4D428B6FE96801B318F354E833B068CD17645653ACBC3339AD1776E2A5B2EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c9e1899c-70b0-4de4-bc2d-fc4cf6eeb53a\index-dir\the-real-index
Size 72B
SHA256 d4d339b5217eb6c2e1d88c4b39472e7c076a2cc39228304c60163f92f4e55af0
MD5 4a813ca3a627d2a51d221e3e9765edb3
SHA1 581931c98bec88b8a354613b50bfe6750e4b8f1d
SHA512 d5d15a4ead8dbb2fe95009b5393c5c09bba3a124c4ffb553d0997eef6d5f23f27e5765b1a3a423cb09d0243f8516e3b728c05bb40d5d64343f656938fabe82e6
TLSH
T1ADA0023C5D410341C16717F61DA1914172706D656141220192E450BC9CB8D5989A735D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c9e1899c-70b0-4de4-bc2d-fc4cf6eeb53a\index-dir\the-real-index
Size 72B
SHA256 af1695ec5d750eab77255d90092fad062b9cfe949ef4c61fa4e48c2e503a2e40
MD5 01cbff4b151ac1f82436dd734d106a37
SHA1 c839c37be6e10cfd8dbd7f6b1dbed89d7f7785d0
SHA512 d4fe87b595eab816cb91c7cbf9f2a263e5cd0fd239d776cc917609cfb076d3713066a4d2195a54c69798bc2279a527c01073edcce41db202aa48753cc17edb4d
TLSH
T199A0026C85636286C6D513F91156835533649C506122330541F0525D99687649553018
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598c67.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c9e1899c-70b0-4de4-bc2d-fc4cf6eeb53a\index-dir\the-real-index~RFe598c67.TMP
Size 48B
SHA256 d41119c005aa1b9656d8d2df70761b6103d706c0299ad46f6ab8dc13cdff3c09
MD5 866e32f09b64d03c2379d4be5d642da6
SHA1 0e7c9baf6d663422dd77f97b9c5ab80a2af6649b
SHA512 74ad6f7defe2dd525279925d84a9eefa20f7bdebfc30bde285ac13ef6600da51dfb6cdf1fa01b439f7cd4dbdeb456878ca146d374395ed57030881b17c874ced
MD5 SHA1 SHA512

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d54a3707-cb0e-4bb5-ad36-fae9c8c805ea\623cd082b6202da0_0
Size 60KB
SHA256 1da9c8abc18f214b913b9a9567632338f1a9966f53456db7a4da7b2d7149a5cd
MD5 6d640a19d18cdce30c70101780126695
SHA1 428a701f8ae4650c4c2593f5ae72d2a8ff753918
SHA512 0f0ed6cce0d508721eaa2d80a9ede0c985f028c031bc789f8e967a1e9ecf5a329a9cc820b73be7fd8ee2d0058c4e9759c5dc673118652562d46883e46a7ebd33
SSDEEP 1536:VsFOZ4JfCS+ksYyiApR+M0DpbarcNVAuFUf5HPwqpzGF/E:Ga48bC6Rx0DNDAM/E
TLSH
T1DD5329A7A262613587AD22D6A45A7F00F11B17561444C9ECF0BC76913F08E8B63B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d54a3707-cb0e-4bb5-ad36-fae9c8c805ea\index-dir\the-real-index
Size 72B
SHA256 2822b8bc946ee2b60f53724e7d40dddd3672364877265de1f3207c5b8919cccf
MD5 6f5e0f8e7f3b05cf11d753548cb6f016
SHA1 66244463f0073dafdefeca1b2006dfc41193e225
SHA512 a6b611017fe1796c1571efe651b896205b5c0857d5ae43c5fa7dfbc3e5ea6c0b91539a865f88e9a35acaaf1b9cbe35fb6d00211a0958f2744221089cf360e79d
TLSH
T17EA002350A800017C44232BBB5E6054337D05D107759238741D8018DC8A05D55D5145C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d54a3707-cb0e-4bb5-ad36-fae9c8c805ea\index-dir\the-real-index
Size 72B
SHA256 04c5c27bf7e7c7c4533551f40307db430b25054931c518db32399cd8646b72f5
MD5 6ca9f414664f4b6d92e18c3392c752c5
SHA1 32b73f99e5c65f997a73e4ec10558ba904e9905d
SHA512 0622f38413ad2e9e24ca096a73e4b78dd47cc6cec02554f7aa74b2c001509c050978cd9ea916ef9c9f5a6bf657cb4768dc98b9db408e7d11828b414ebacf0bc2
TLSH
T146A0021103D4C006D15A1BB99D5203917300C8D09110130B41D9115CCD658804EC110F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d54a3707-cb0e-4bb5-ad36-fae9c8c805ea\index-dir\the-real-index
Size 72B
SHA256 2c1aa616e311f21663745a0117472041b12de66f1ca696a9b5145045a377ac0a
MD5 12f60c08a5c3e4ed8780005ca7593281
SHA1 420b7fc8ac21888c29b0ebbc92fbbb7761773dc1
SHA512 76aaffd3b74bb8c18d7e16a9dbafb6cb05a62e9c3f69965914b79d19772975c201fe42eb462a64203e3800e5023804a909ce39b70283f0a758ddf41568e135fd
TLSH
T189A002A036C11109D57763B0A9D34949A252D8248202660B829366A5C8E8685864190C
MD5 SHA1 SHA512 TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\efa5fb9a-837b-409b-b4ae-b9ffdff33476\4f2277ea2139c475_0
Size 60KB
SHA256 fc31c7f0db23ee145ffceb230c6d8e05bc9d7152d269ca155dd2d3f8d77f09d3
MD5 3ea886bfa5449359c8de27445262ce01
SHA1 936f8596346b9056818d0e85470fe125d4e43a21
SHA512 608922f9126ae5a905519f8c48265f6c4d3fbb043d123dd4a51428898abe30358453697092de88d9337a667a6e4524b849d58b1304bd780f3bc8641751ba2f45
SSDEEP 1536:cZ6F6O4JfCS+ksYyiApR+M0Dpbarc4mZt8B05HPwqpzGh/6:ccJ48bC6Rx0DND3o/6
TLSH
T1BE533AA7B262613587AD21D5A49A7F00F12B17561404C9ECF0BC76913B18E8B67B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\efa5fb9a-837b-409b-b4ae-b9ffdff33476\index-dir\the-real-index
Size 72B
SHA256 4709d3877971e972433d0a7e6dffca77262bf5516405e1347522d2daad472af0
MD5 7fadec0d66c28de58bb9a78bf25c2f75
SHA1 e410f0bdcce2d556dc0dc985dd211a178c985267
SHA512 e7a2d56976aceeb3df181cc9dc88e72eb8e513452bce9fb520a2a69f8ab8b0ccb1fa18cd65f11ba21cce2d078d1e440636854e9cf7b9243f21b4aab1ccc28846
TLSH
T13CA00230A6E44082C92106B5554321A82326DD19C90143A7D4D73C95C86A1A87603D4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\efa5fb9a-837b-409b-b4ae-b9ffdff33476\index-dir\the-real-index
Size 72B
SHA256 33bce7e6234a476b4d3a3be13de3228822deb8d003b760146f78e9bcd48fe5ba
MD5 b7c4c6da7f95aaef49a784424b7100f6
SHA1 61a1469c01e682cd6d2422ce75a4d77acb177132
SHA512 03315dfdc080582bd08b0c18ddd24cf0c8ff866191b5a736f5c1adfd28b2d6fecb14a15057966ff5ac936cc0c3ac62c71ae99c108a02720b9f595f61557b3d91
TLSH
T1D4A0026025EA2141C12907B0725751683326DC39C201439F41D3A556A97919C4701849
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 8765148595f2d768d3d68acc3ab9a0137785c4dbbe06e763704330e72190393d
MD5 5d19ad162fd3eef1f4511c48ac05c1a1
SHA1 099c0bd6a1b49f29ff74d40667bc1732eaa617f5
SHA512 e4ac283af6c4578dd27a06a9e35ceb8e367dcc55b2d9492b221d7f3d635396fbe78137661ac140e34117f5746684553dab7cc35155c3d7e5dbd528acf705f09c
TLSH
T178F027733DE72818FC6B93DA507114940420FC98D456FD4FA52B75E7E0B136A141ECA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 c3d7cc338de1a2ac8f7f6308c83cacef3984d3e377af961dc66452a4a7e208e0
MD5 71972eba1acd2dbfed52c464603bfd54
SHA1 e715e7242370faf4de9011fbca8d465bd8339255
SHA512 f03d3f102ea4b6185ee2f0699ee2fa22669bd9f3c7eebe2500822cda1771b786bcaa03e0bda049b89bdf695cccaabd53ca769c0cac1bc5490b7fa2c4eb3cafbf
TLSH
T117F027733EE72818FC6BD3EA107114A00450B898D465FD8F652B65E7A0B136A141ACA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 6c20b25edf33577faeb714ff5f826aac8ae5286a97aa2bdcb5d6d330927683f4
MD5 b7779ccb49fb748052f2a3b387a91435
SHA1 d1d9b4994f5e8fb3e058b5dac4fd22ced04465af
SHA512 f0b07153c02165b3c0339d0d35cb66db6042e04f78614530eae6244e3a1bba7ac5119bb3698f8a9cf5637c249180afcdbad4cb137bb805f416f4c019a45fa251
TLSH
T194F027773DE72818FC6BD3D9107214A00020B898D465FD8F652A75E7A0B136A141ACA2
MD5 SHA1 SHA512 TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 127KB
SHA256 a4c759f02d5e6a397bc72662631f57e8012c4944566658d4a9b49ff29d0562a7
MD5 756629339f25e37b82c089114d9c2d86
SHA1 ee03b952bfeddf6c63ff3c0726d1c7248a94bc88
SHA512 30c05d0d0fc305ff60b5ddb6ed33dd92a227989f945103144d23851c65a16855408de949a64c1dea7a617dead5f943c9808245b96e2df0305d948c06fe7a676e
SSDEEP 3072:1Hw59B4xPCx1C4Ue3ThL/Al5UAx0gL/tL/dL/wL/yL/nbe2Lv:1HwtthL/4iAx0gL/tL/dL/wL/yL/ndD
TLSH
T1BBD3AA33769D50AB0E8ABAA45116B50392BD7467B8449038F244A7FC15DBFB013FBEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 222KB
SHA256 4c299242cb4ceccd0addcacd8d7f2389943e6c40b4b88081b29fcdba8b8e367e
MD5 82f6606383162868df9d497fb1eb03c2
SHA1 f12b5ef17b38ee915dc16b52464936b9f2ee695d
SHA512 aaa3a3bc435e44db503651269ea3a7974394de174afdaa9225b7ca3aa3ab355e1de558fc40dac49735833a343d22bd47261c276c2a0bcd47bd45f85283ba1863
SSDEEP 6144:qB8bel6hSCzfMU9yG+HnPfCVUm9J9vYre+zL/qFW9GFHqUnEqQKcGg5f9GDRL/Xp:qHuQL/hUe9GDRL/XL/NL/ML/mL/j9
TLSH
T171242B22235520EFCE1977FA1123EA13B7B8404A7EC3D26995419334186FBF35ADBD62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 807fdc36dda3a24286764b025d990796853806dfe6f2ef6a1ed81729763b6d50
MD5 a2e8b141907d17df1d03779678c0315e
SHA1 1657c4d03f501356bde79d68585b104c1586279c
SHA512 61859b3a4374d281462f21ff817314e2bf8cc8a528593fba154da2691708eb34e1edbcc7f0fd16d3a7db263fb8bda604de106c441bf6d78b398052d14d85de14
TLSH
T17AA002768E6D9089C5004B7150A5754037B0CCA92106136349DF92AACDD514055CA505
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5950e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5950e5.TMP
Size 48B
SHA256 916ca1e4af062dfbdb40e99ac2815768f5f0af80c994e4fbc3eeceeb75e38ed5
MD5 cd3e2b70e0b22e53c9fa4e87863435c7
SHA1 785fe269b61abef5b3364622e0f5e15aac58c67d
SHA512 b7558f5de65972030d3038048f5d53059f6023736af1e35e9d1fc03b4432b605e331bfe2d3d107a02caf69e8a2309d9bb4971fb28f475c5722cbb205a31abdad
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3ffedd9d6e71325a1c26f66858bba5411113eabb5a733a7b70f1db724a5cdaa7
MD5 2353cf97c935a74fddafcbc20cd54580
SHA1 634870a02ccbb2580041942ce54bcff678711777
SHA512 d4e8433a449f66cfd8c04aed97dcb94cc864f1b9b2945111d4385f3e48ebe5d6c4c7cf1bdd75eab70d671a89926c4af1a1719d6a1f050fe222970da42b1c8a44
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv72j7:AFBHhTofhno2mB21q3Llbfe3sLDdeEpE
TLSH
T15BB29F52717B12023C3E291CA7A29B370E4272A3345CA56F77B900BA4E67E615DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c662fb7e8dc615e3eb1f8dd4bda5a07e75e476cdde3223518dd9017daa625f87
MD5 40e53cfce0a7596affd002aeda40604a
SHA1 698999da44be810a7b616a78ab51d2c5fb4cac1e
SHA512 343643926f9e95700d4c8f8e53557d92b2cff8f575ccc4a69a60645ab30eb7ddf4a9fe1d0b7177e78d7d342e10c46568f4551aa3c3291a031c7c057804d3176a
SSDEEP 768:wFyD3nwgNckSoug95vTwy8KLtrAo4KC13GZU0:dD3D95kJCAo4k20
TLSH
T121D25B32DCA0DA7BBCE78BD6B74A7A47DEE0816386CC4AD4D9D85D1C009B19E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0c526aeae38fcaba4db48f944ee75c8a6fc831472488230812cd547ddca7b9a0
MD5 24c695830c72b4f4b4be1d634b050712
SHA1 9b5fcd0def6243040fc0fce661c51585319b85a2
SHA512 4c84eea43f49b9fd1e9d68d98f325903bbe2007116d9dccf0bef6fe1521334ee7016ffb01f49a26ad2eba7fc7ef5d62f77d38841fc18b1cb403905c2e7885226
SSDEEP 768:wFHl3QbwgN4kSoug95vTw38KLtrAo4KC13GZU0:ul3QvJ5ksCAo4k20
TLSH
T1E9D25B32DCA0DA7BBCE78BD6B74A7A47DEE08123868C4AD4D9DC5D1D009B19E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b4da57573965329fa1477a8ecacdfb836b2ea43acf38390a5bcfe1d0b2f83274
MD5 3c0fa191b82c4ec032bb356d3ea3a414
SHA1 612a058cce5c919c092c125b6c113149fa6c385c
SHA512 dac5c6dd58961cde7cdc842369bfaa91c94233de41844798db012af763a34b2d7f86473619ed819073f525230ae711d67e92cb02583031bfb9ea2a3be4503ff4
SSDEEP 768:wFrl3QbwgN4kSoug95vTwn8KLtrAo4KC13GZU0:4l3QvJ5k8CAo4k20
TLSH
T1E2D25B31DCA0DABBBCE79BD6B74A7A47DEE08123868C4AD4D9D85D1C009B1DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8157299b11236f122baaed0fdbe423732a4e2c679ce4d8241248877882b9d647
MD5 35deab531f02697173eec5babb0a4884
SHA1 644500fef9b691762bc374f15f48b696b2f64507
SHA512 c5e197cdd9226887230a57fb8de61788f9213624ab2326644cd640d235472c9273585d086aa70fddf2d85558c2f42cbaa32d3a8280e823388e50c4f8aeddeadb
SSDEEP 384:n5ziF9CcmyWCs38N08TUNTUlIxBydEBwdjf+8oug9FfggF1wKB8hkP+lFYS/r1lz:YFccps33wgLwoug95vTwq8hkoFYS/fz
TLSH
T113C25B32E894CABBECE64BD9F70A3547DEE04163868C9AD4DAC81D5D00DB1EE570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 815304c431ee60c4a7c661ab969123564de3c552820ca8e9a6e6314b4dc935d4
MD5 34e37a6d1a3f233fe92d0d5190ad5aa6
SHA1 6cee32e95cd2a2588163ac839596969e70984c1c
SHA512 c0be8fa1a91c097798d20d7af8018c45fa7f5f0df727dbdaff4d8a58604a3c13c2bee6234ed679bca22b28c5921dcbb46decae0c1f116ef6883f3c130440ba38
SSDEEP 384:n9iF9CcmyWCs38NY8TUNTUlIRUy4vDdjf+8oug9FfggF1wKH8RZFHy/7Iga:0Fccps3nwgYToug95vTwG8RZL
TLSH
T1A7B23B32ECA4CAB7ECE65BD9F75A3603DEE04153868C99E4DAD91D0D009B1AE470BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b72293c8ac32b365cf11e4497af4389a4c32314d59b5e8892c8fd8afdd738ffa
MD5 7c4768fb947c9e6cf7d48fc0845eb21e
SHA1 9b7d208c088a6f0ad6535824de9da5857551cdb6
SHA512 55d440460ecb3dfae1af0a5f15d4ae9b3d9621604f7d1bfbeca19a3773dd711990ad0e4d16658b854012ab9b9cb5e61cb426f123448a37223df5b36101a68eee
SSDEEP 384:n5TiF9CcmyWCs38NY8TUNTUlIRUy4vDdjf+8oug9FfggF1wKH8RZFHy/7Iga:gFccps3nwgYToug95vTwG8RZL
TLSH
T1E8B23B32ECA4CAB7ECE65BD9F75A3603DEE04153868C99E4DAD91D0D009B1AE470BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5ba6cf1a9ac2ddea439d0efa98dbd1a81a20854c626ca4ac918183739fb1faab
MD5 63da688d5f7af1a872d914cf8ed96c0b
SHA1 3a083c0adf1f79fb67b2a4f7aaa60a91447e18e1
SHA512 390f5d96897f1c046a170ef29080e18c144ea887c06e20bae6f2228e8955bfb7b43cd7fb3147ad95d12a2692e578d4af3b6ac29e1b27cc86edbdd2a6498c2a87
SSDEEP 768:wFKb3QbwgNWHoug95vTwF8KLtrAo4KC13GZU0:tb3QvX5kaCAo4k20
TLSH
T1DFD25B32DCA0DA7BBCE78BD6B74A7A47DEE08123868C4AD4D9DC5D1C009B19E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f79be64f5525eb64b7d4ce0885078a741dde4810a3caee520f2f6c9ffed40c65
MD5 680b4c71aafd308dc84a2b8b82fe517d
SHA1 75a93770cf6a2b60666cbd821b72f3aa8e0d6494
SHA512 b97f62572095d622004637a0bfd687e434104fb496c15e023b6e309448c472343023a73b65f5e1b990952538ecbfbccdbd8abe7fe23273a81aad2511f296551d
SSDEEP 384:n56iF9CcmyWCs38N88TUNTUlIxBydvgoVadjf+8oug9FfggF1wRvhkP+lFYS/r15:jFccps3/wg9YOoug95vTwRvhkoFYS/fz
TLSH
T149B26B32ECA4DABBFCE64F89F74A7A07EEE10163858889D4DAD81D5D008B19E1707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ad161528f22b2b4dfc2b8c8ae0e61bcab78ef9bacd338b906ed7f86a7ede3798
MD5 524a2f285254dbf66b5a76fd35dd4d17
SHA1 1b197434baf09892aadd93c95f983ce2ba645b2f
SHA512 2106f69fa1a3f0042270829e2aefb5c85216eb1c48a910d0e3c587509543a4af7e5519f43259f6856b09b018ba7eb22079be15d8a3b0e6e7f6299aea7ec871a3
SSDEEP 768:wFTF3QbwgN2yHoug95vTw38KLtrAo4KC13GZU0:8F3QvC5ksCAo4k20
TLSH
T15ED25B31DCA0DA7BBCE75BD6B74A7A47DEE08123868C5AD4D9DC5D1C009B19D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2273df283b71d0a9cef168309ba39a17e5ed7c7e81ac071cdaa1f4ff2b9237dc
MD5 939023145b1eeb803470f6b0113a4c7f
SHA1 1c687e0ce29c246b4b18af508820e38c1155f42a
SHA512 5830501d95489a76f11a398c97e8614aa590deae7441a054b1981af29ded11b5fb0b7b79e6ef1911ad482daa327f4cfce8a94bfb36c02297e09fd71b06a35fab
TLSH
T182E00206D7970076C414033000C31B1079F15020037712054A31017838237052530B40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1455fdc4de5a95f8d2f301fc03a0f13e3a1f3b40dd4c006fa21ca1e749db31c4
MD5 278ef7aaf77d7f14ed9f9ea28d750ee8
SHA1 81e830a8eae300eaa3bb49fc01b5acf3e1e2ac68
SHA512 10c3fc83dde20942c0662c95a00e1c2ba9041fbc4ab616e46e9dd2fd9afa2aa3f0d1a98e77bc0f1f555ebf80fc3f8ce30f329123154e7b8384ebbc6f1b4fb942
TLSH
T158E00916A79A1077C858033004C32F107BF6A46053FB13064A3501786C637093D35F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5aeef5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5aeef5.TMP
Size 392B
SHA256 0c3b30372e93fb7152a7c67c7588e3ae728bb4566407a011e1f9e01b8def0961
MD5 dd166f7b8d67232a1fc85bc20151edae
SHA1 14165b913e056b07302d0e87f4f05e19dbf68499
SHA512 4b493eb5bb4e314e70d3099d00b531701293998d76d24a36eed3c9e1cf22bc339da3868f13c567351536d1b1667b8848610c3eb9f234a78acc1122581d7f3025
TLSH
T14CE0040557D70035C41403300043171075D0501003751305453101541C137051130F40
MD5 SHA1 SHA512 TLSH

Submit Download

FileCoAuth-2026-8-4.1555.3048.1.odl

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-8-4.1555.3048.1.odl
Size 706B
SHA256 6bdbe99c56f7c6fb3a083be37fb83296c4612eeb6b2120ad84763f0d942ba8e2
MD5 4190ae93e2f5b8e4eb5e444213bfe488
SHA1 0e34a43f800287d311aae8f4ce4120c0071762ff
SHA512 99239acead18a204c56a0327e16113dc6c6bc609ccfef12ac5364aa9b22721a9b7a8c3340e26bad04c5aac073f96c50b73024d61e1cba4ad4a189e007afaa89a
TLSH
T161012E67FD575875DE3D017CC40CF20ADD0679523C5D646186C90795550FBD0624AE72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_asyncio.pyd
Size 76KB
SHA256 dc6db118862ab3298e55e0f7c44c2c0dae4af9e810d2578271280202d6aa098a
MD5 1a44ebfcf46c66c29212b0063f68c9fc
SHA1 927408b5ccd9af96f1311d9d2cf87a9e65fc98e5
SHA512 fc3a1c9bfdaf3f587e0c06eb97f549b7c802cc1ee40461709b65f91117fb47d9f98b7d15d90c4b38969da0c9c6e9893b4469edc9c6d322328edc999956b8b157
SSDEEP 1536:ybpJfNBXdvQSvyhoIGDnMPy1Ni9EfILaqn:ybp1XdvQSvGoIGDnSzn
TLSH
T12A735B8792A44186EEB79178CF536FD3FBB0F1855A00935F5194C18E2F533A18BBA322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_bz2.pyd
Size 85KB
SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
MD5 207d4a4b7a113ef494514918f2dccdf3
SHA1 74b59453b5bb6194e0d2587d26d499d0f7e1aed5
SHA512 f7e5a2608ee19fd400d4bfe27e8603289a219af6a4a4a9e65ebb76c715d926fb9b08293fc2a3fed2195784804764265fa0b356547f23c501ec8ff9487c948b27
SSDEEP 1536:xtMtz7eksNCb6YVVEFxO2RqOyuzotWw8pRbIiQIG3VTy1Ni9QfIY6utw:PMtzSqurjOqqfgotWrplIiQIG3VtKtw
TLSH
T14A837E86B3B462B6F59B81B496910353F730FF960710A3BFB25482863F13B91AF58365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_cffi_backend.cp314-win_amd64.pyd
Size 177KB
SHA256 2011ed3465ee2b732588c443c246f9c857288b8a0c59ea737100d230a5f8e346
MD5 4602c944a730c8c1405e5766414e293d
SHA1 2d0a3a8ea13b9cefec438d5f46c383fc6ac2f25a
SHA512 b2771b13fb58cba2da29cf99dea7fd94e716771f09670f90a872982c3c3a1c8a1a52116ce0b4ab3570f85bb5e2173e1d10f7106a57ff75fa5c85b0a0c089ddfa
SSDEEP 3072:0pRFTWFsUf+5WcuCXwtzqEXfUMaAUUjjYG1HH0DJ2LOAkHvP7+lSTLkKSCYlRjK:0p/4UWcuCAtv8MaAUUjsG1HH0DJ4OPa0
TLSH
T1A5045B5A329C10B2D5A64178CA579A83E3B3B461175097CF0160C7B62F1FBE67A7FB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_ctypes.pyd
Size 139KB
SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
MD5 eeabc0c7756ed7a29e33e467c398737f
SHA1 ec5c401946a9df4e4ab764ddb4639e4e33e1ce40
SHA512 5e1e93545e1be34880fc680ca12004792076e88baa6cac4512fdbbdb90091a9ae441a16b8d24f64c6b03bf14903babddecfa783ce5c016759ed790c0eabc189b
SSDEEP 3072:G/n1qQ8/27N56EBZrGwrb1OzIJswKRW2r7rw8IGGPzoGc:wn1JDT6wrszIJfUDwtc
TLSH
T1A3D38F4B336841E6DA678138C6739E47FBB1F4511A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_decimal.pyd
Size 283KB
SHA256 8d41a84db20a9b985e98c802ad6833cf9625c744ad35478dd346f54f81488706
MD5 4bebc4da7d6319283a8c664bfc55408e
SHA1 4dc69a8105272711673afa5f712af982a18532e1
SHA512 411cd0ee4189654e836579efb4df509a02cba39cd9793e6d7250aa4e239449dafb6936ac57cb8ee7bd97cf2fb178beea17f658bf6ae7149ed8ed927a7c47bdf3
SSDEEP 6144:ASM9SUWXvOOiSx1u8llV6zeGqqM43fIWeA9O8O8OOT6MPgz/:ASM9SUWfQSx1ucapLIz/
TLSH
T1D5547C52A3490CA4EF7384388A479A57F7B2B8414360D78F47A48A972F933E3677E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_elementtree.pyd
Size 135KB
SHA256 16f4d30a50fc25950762a8bbef9dd6c5750729345539c224d489be33e6d6f340
MD5 b9ba17136ca35dc19bfa6d0602ce3a20
SHA1 6f5dba0c82b22714d0f0bfd83d98f8bd0c0b385b
SHA512 50e6d6bee6e1c90a75124756466020686dbe48ea57cae6aa02ef877b8958ccb2c623e64b2423cc8afe84f9b3aa1fc5adaaaf7170348962b2280dcf22d77f886f
SSDEEP 3072:uJAprol+oarG330gfCsu5C53iNWBVX7XjeAq2KoL8nAIGffVD:uJAdold30g6lC53iNYXjeNzo6g
TLSH
T1CFD35B8B7261C0ABE452403CE6978F92D7B6F9610E0083CF5294F29E5F273417F6A729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_hashlib.pyd
Size 67KB
SHA256 36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2
MD5 dcf15b3e1858d9324be2c719e4e990c9
SHA1 8311c2fb0bb75342367a83fcca7161a0f7fadafb
SHA512 fa2783d0cbbba477a08bf4f2fa3df21d6d0bf5bd5bc7cef25254a3d29fc7d01229337ad5dd54c2f0e67b956fd43953aa98586240102511ddd48d04c674b7ff93
SSDEEP 1536:KXwAzOYBQca7JKs2+C5oIGDIUy1Ni97BfIkxd8:0J/yJKs2+IoIGDIm6o8
TLSH
T1EF635B8AA6984092DA2382B5C9E34F43F974F252271197DF6678C18E2F233C3573B756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_lzma.pyd
Size 157KB
SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
MD5 cada2b240b280f172aeb32a1666b21e6
SHA1 c15dc39329444433c255309eb89bae188aae1b22
SHA512 8b12298efd28549d46e2c48cff94b07039cf513bbac25063ebad8bae57b96e07eefd7df82229441af142c1b96dc837dec468263c0873d14da280e3ed6e42eb9e
SSDEEP 3072:BJ66g4T5QW7JfyjEqkSkA51b4pznfJ9mNopUpdbQIGI1HFk:BUR4Tp4QPZ8N4RxYOgbPa
TLSH
T110F34C86B794F0E6F7328C38D2624F57E6F578590320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_multiprocessing.pyd
Size 37KB
SHA256 9e87ce081fbcf0b6596fcba98e121379ad72a33d68e6b2af7a8bcc5b900229ba
MD5 f4c0f97d3ed7d0c07f86fb7f30e594aa
SHA1 2f06362552c005d36149d60ceab647754e17b3ef
SHA512 27aaa5979fe8aa3c01bf4838397b02a4a299bc7376e71dc695e80a7314f9f95e54b4eb8c4de511737676f0fe876a53df77e542dfebd86265daad70a4e03dd15c
SSDEEP 768:YFMV/e0XybycUlYIG7t2y1KPuBL2Ip4tTxf1ml9dHc7Lo:Yz0XybycKYIG7t2y1Ni9HfIbHcno
TLSH
T16D038C86A6380043F9678670C5A3EE87F571F7831A26965F3195D2CE1F373C1A36A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\_zstd.pyd
Size 491KB
SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
MD5 035b0a033dd00dbe887556f4d4b852c3
SHA1 e86cf52d825f9b68177354c54edaa57e962012c3
SHA512 0b428aa10a9e977e07023918870368a9c00e0eb4ab4f7cf1e88950d4aebd2ba5774ebea9f3779d05e370bbe315da6634922834106077d511b710c6131d29dc65
SSDEEP 12288:KccWmYLKvveeFSeX0ro+Q2J5BCl9VNqdp:KccWJKvveeFSeX0roMZdp
TLSH
T143B48D43F29943EDE53BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ada92cb5d92a588d1b93__mypyc.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\ada92cb5d92a588d1b93__mypyc.cp314-win_amd64.pyd
Size 218KB
SHA256 3048af5864e17f79410273b3074416d67473eae22b3d7d1b7b58f24a506f82ed
MD5 adeae0ff252151f98991e536fc6a5177
SHA1 dbdc0b3b8f9be29cc01275421b24303f024aad81
SHA512 464ed3b77ff59a9102348456ee4237c947aa9dc114b992a106e1b32a21a20e8334a84ceff100c24136c285f4c3e6ca86454023eccb48ec2da5c3da5765608c23
SSDEEP 6144:F3bJmLg3z8fUJs9ZouzxkP8VXaVlaz8fnt4HtFmiGJZMIo0pn+lw:F3lk9Sztl
TLSH
T1CC24283A61990461ED774174CE27D453EAB2F421833096CF09D0CAB61F2B7E5BE7970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\base_library.zip
Size 1.3MB
SHA256 78a66d84f949417b60092a9a925255c46711416205318b3fd5e8a02faaa3f02b
MD5 7a43050c2711220c39fcbe816d43af32
SHA1 7fb242bce31953e6f5b6c4b92d63b7f3e0085125
SHA512 aecd13878f47419582c572a31db2b167ede69d4500f88412e9b72e539e8fa1dd7dd667f906f8f25f761b7f9ed1b0e261deec72e1ad5b08ad14f892d5090b36dd
SSDEEP 24576:PL3RpKzdxQeOdP2m2dfpQZu64lbLuUFDUYsP:7RCdx/xxuUF4YG
TLSH
T1FC552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\libcrypto-3.dll
Size 6.0MB
SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
MD5 4191d4288230515c5098cc07f699a604
SHA1 bd8b4d48b2f4513dc378bc5a4cf4a3abbc6998d8
SHA512 c110a89ebb5b58126d556ffea1bf01efb4a6dd295f7387665223741a171d9353315de4d361d3d02a186c1c659aee20f46c579efc51b4c41f7282e1b5b4d6d040
SSDEEP 98304:ybM11p6ZVTRwlFh7V6v73WyXTf0W+JJe1CPwDvt3uFA0CaI:ybM1T6ZlalfV6v7GyXbnEJe1CPwDvt3T
TLSH
T1E6566B5EA7A80188E4BAD13CC6534627D2F1F85A5BB097CF05A196790F33BDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\libssl-3.dll
Size 1.3MB
SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
MD5 d99207e7e513f87ad7571c4c2450771b
SHA1 b904eb3989c9a1ad77e3a541e40d84ae890e3df7
SHA512 bccd034e633b96c2c7dff6ca96c2bb8a8c0f90a872f256e8467e470ed57fc4b442c74da488b258b5a255feba26767a5c95293a636c94c754e2644ed91c5be7ac
SSDEEP 24576:gk2RrDo2iVOF8hXN1hyeWsoSvSZlRg5aYsC:gRFDo2uOKJ8sIRg5aYsC
TLSH
T11F556D5AA7B8016DD5B6C17CC6938B23D2B2F41623709BEF06658A790F23BD6273D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\pyexpat.pyd
Size 217KB
SHA256 133942bde91fe43289076a0b50a01b265df4ead078617cca6f6604a4166e1260
MD5 cba7f704fa489655f2e6391c9faf137f
SHA1 730c3bfa120dfe0bdb3f42cc6f82a859b53bafa5
SHA512 5867066057005abe2a8e251e7e745bf82fcc7e41e26513dbbd111df2c9f4d19acbb8e1982fac2f13b0c7ff16400a1587c08b485855f441a6a42d3c03035e7ea1
SSDEEP 3072:fKHcmklCazVuJATShhjXmrZwFKdWTP3AWxk8pg2H6coK6Vqcm2aciTH9FMG1cEOG:fKhklCagYQhWwKdWTP3X/JrcMT1BOL6
TLSH
T190245C9BB261C0ABD843C13CD9978B17DAB2B86503909ACF12C4D77C9F6B751372A319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\python314.dll
Size 6.5MB
SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
MD5 006b0746b5abaf438d1bc753261c6d2c
SHA1 8f34714617f376cfa6e7e2aedc1e2a73de8c8fd8
SHA512 1c156c3f542de0a27e16ca5b7d6bbd34f2059b380ce85dbcfd5ae3a64de473fd160baba45ca30ad85dfe45742fdcb42aa969cbbaab26a569e324d4e65fb6d621
SSDEEP 98304:xVyDBH+ULEfi0VOuZd+FAX/uv3HDMiEEQn0rt:xVyD1+ULW5VrZRxim0rt
TLSH
T136669D26737901A5D9BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\select.pyd
Size 32KB
SHA256 fab1b4cee101359d82d72061b83cff1855337b3677b9fe01cd69f7548f4c496e
MD5 43a869da7432298fce80f8c163ad8e7f
SHA1 65d259ba8350561668706a563ee0800c1748c173
SHA512 26c57d276b82fcb9c4f971a8e74847e14dc1a3b942a62f442740d6244ee8f23ba29c9e56b5001c2734db3fd1ac52a6bda02926f47d12cf727e38703971fa9d55
SSDEEP 768:TB7YLZnCaqF8IGRGCy1KPuBL2Ip4pTxf1ml9dHu7L3:TB7C5CaqF8IGRGCy1Ni9bfIbHun3
TLSH
T17FE28CCAAB345047EA63C671C6A2CE83FA39F7E35611469F31B5918A1E237C1A337354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\sqlite3.dll
Size 1.5MB
SHA256 3557565665e608cd24726730e52690a131efcb0e2d5090337b2e05fb89d49c76
MD5 7b372f0d7947db8b5b10cf0eb3d1f5c2
SHA1 6b6cf3c2d38e17d1b2db506690759d1cd1b24142
SHA512 07c82716ff46c264345853cc5eeb4a335cbb803b605555bf4346f35dd11cd48452a8179d74b4d391937c0c547a3444c36e81a2d44c3e18c5c1bbb89e463eaeee
SSDEEP 24576:cDKX0pwDaOrROsxNkJPcG/ZBZQQSKTWzdPcZb0LJ0ZC5hJ07gf4UBd84ZD1fZX36:o8pOsxNkJPcGxDQuWRP+bZ6Icf4vC1fg
TLSH
T12A759D4BF2B801ADD0A7C17A851B1707EBB1B4051B64A7CF1594CAA92F53FE217BE324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23202\unicodedata.pyd
Size 741KB
SHA256 0d4f124b2d6622d276d777f7106972219f9b310edb5df8149c253da7c013d6d8
MD5 4df357dfce07299b9e6759583f41ca68
SHA1 d5810b7f7d05ac3a37592566ee898f428919cb53
SHA512 f741882d4444a4be4342f89932b2510c57fd943cf782079551c202c419805a90a06203464cdf1a209a8da3e56677426dc9af388b2077a5746b3daf0f2da1f69f
SSDEEP 12288:jIwYBAPtrZmDtBPcH+dEYJ5EYub+z70lDJPT36mwtyqt:jIwYS5ZmDPqO54lDJPTMyqt
TLSH
T11EF4E5F5BB838C16E69B767A48D3210F4E50C2B35F1A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA224.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46762\Crypto\Hash\_SHA224.pyd
Size 21KB
SHA256 773fac9a1a65b31d22f79a5e4f035ddc00301b741873d334ee9902db1d1bebfd
MD5 f18df573602776a7449e4452aec66d99
SHA1 28a957f3b1a738a4d10452faf867f484c2ac743c
SHA512 ad6cd03b1ce8a01fe87ecdb403701e44c118a799e39fd36989be9997b9b29c8a4f52765a67d1cdce3bd9eeb2147020fdd898afde52a6f5855f1037e48cfae9e8
SSDEEP 384:JKXqHGcvYHp5RYcARQOj4MSTjqgPmzIHXqBJ93c3O9zMR7kLMhgZvRv:JP/Ytswv9HXM3c3hkLMKZZv
TLSH
T137A20B19AF3884A4E40E603AB333867B7BF47600D394B7EF8A505B991C263ED563465A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI46762\charset_normalizer\cd.cp314-win_amd64.pyd
Size 10KB
SHA256 032b490f6b42a0928b3cb6e17fd4caf8a6becaaf05739c4fe41267dcf890c278
MD5 e58f635d100bd8d6e27d50253f0ba9d7
SHA1 a7a73a53fafa50b6614fc1956abdc769d7b010d5
SHA512 5aefbee4805f72f88aa41658c160badd748b1d3a7aa9157810d47605eebb11fa0b8b87e48272ab0195863a1ab5caae2ce4f3f03202481ccbcd2f3ec8769538e3
SSDEEP 192:M3xKeIaQYVYZuLnN6KxvecRo930aOc1TbEG9c9HDEuO5:UkYVVLN6Kxxo93EA19cZgl
TLSH
T12422E74CFA558CEAE725023E89A70F1E71A5B6250B5237CF4370D52D1EE37EA62785C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\n_567d47\history.txt
Size 3KB
SHA256 a684473abcc5e7c03c997367d7268cb7b613cdaa687f6e5f700fc5d38fbc96b4
MD5 eacbe66ebb6cd14c31b175982f01664a
SHA1 3496f721f588cdecf731b20141f2fbadd7dbfb40
SHA512 f26501090485bc75eae16805183c1ccb533323b2ae6c87f283bd28d61a42d686ff3cdae6193d7219ce8b273ef642ac8e8574aecb694b2a1e45f9b959db7d37ab
TLSH
T1B271006B960F548E93218B6C5232F7586B1FB41AEC8CEFA9FDC10413194677D82C1A6C
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\n_567d47\screenshot.png
Size 357KB
SHA256 84f749f520108dee15a81e1c44d80ad5a7492df880a4f0b4c07a21b5bd9af041
MD5 547407b2ea962c95970c01877ff44e5d
SHA1 49c2362222a64b4d2c2f64d90655db608fe09f30
SHA512 3b1d8cac35760d8a548f5ba4857276e089f0c14f8881732b1efedea4ede46ff120abb17f4388014949231f54c08b1a1fb955b95045005b3418d0f7bf0a590763
SSDEEP 6144:tFyMQjnDbjRJLKxINvyFRiwQgP27j/bIGulG49sawnkaUmInkzg6HsuI+TjRH0dp:eMQzf2f/Qfjqmz4Og6HsuI+xHGO4Dsjs
TLSH
T1F774238FC7F6D95FFDE02833ED0A4850AFB06527E881109CBA61BA651C5347E6B5406F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t_3c6c.db

Path C:\Users\Admin\AppData\Local\Temp\n_567d47\t_3c6c.db
Size 160KB
SHA256 c90809cfaf3ce045a1a453f87fab3adf150daa6e5a29f4c5bd65e6f1fdce0275
MD5 6050e066b9a3d4c9dd6fa5d0920f6c2b
SHA1 fd29757a3b5999fc2d97ee78289a9b51f119875a
SHA512 338c23b5a2ec824ff547f9b99f879d79b0841e59cac45a93316639a8cea753f9b756f80c1d27f6d56419a276b482ddcc761f78f96a6036f4d1ae06a120fbf321
SSDEEP 768:hCR629r64idkqUWb1k04CbnKEEoV1d4my:hCRrxiHb1k04CbnKEEoV1d4my
TLSH
T103F3D7EFAE157610CAB9E276A4F1E65E487FE07F8B465CD5B8900023CFE256B601C438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t_5967.db

Path C:\Users\Admin\AppData\Local\Temp\n_567d47\t_5967.db
Size 138KB
SHA256 4cad2f0711893d1bc7649af1a85a208ea1066985593643afa379c58c552305c4
MD5 23e6ab9b6d036b3e110a9c5d52732b7a
SHA1 2df4e0c48bfb70b87c55884b76bb0001fb204e85
SHA512 293d9767a8e744ea9102693a3337bbee388f8305811edb68f315a130221b7fd2e9a70619a4ef48382bd13565b392c459cfbc01ad2ef77bd18bd32a69c8c722d9
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP24AVzVumTcZNmkZ:1nbZeMrv/hG5AVINmkZ
TLSH
T147D3884B3A747002DDE5CA721CE055BB5E3CB16D8F1595D438B620688EF2953A23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t_200e.db

Path C:\Users\Admin\AppData\Local\Temp\n_7eeb58\t_200e.db
Size 224KB
SHA256 9aff137487c27564b191cb1bef3f35f31ebe46d73abb720771668d24b1bdefb0
MD5 c97fffc4af7aced71d9988d4f067d801
SHA1 8ec4acf32e8d5c2ff1acd205819d9650f041ffcb
SHA512 bd34ad715ddf1cab4dccc647b0f54e37b4dab279351128c6e93373370be689ce84a94d4b850a7d41d6111a93ec8d874a47fc779cf7dedfcc643d29e0e3f30198
SSDEEP 192:FvoxdnBZyfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:azfyfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1D424530A7B747001EDE7D9725CB080771A3CB16DCF22A6916DB254694DB3853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t_5dac.db

Path C:\Users\Admin\AppData\Local\Temp\n_7eeb58\t_5dac.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t_8d49.db

Path C:\Users\Admin\AppData\Local\Temp\n_7eeb58\t_8d49.db
Size 204KB
SHA256 1ee42951b18320c79f2efe82e3242ba3052dc6c604f8feb7381a8b40f8266d13
MD5 1000b0234db90a834538fba201821057
SHA1 0ed040855d276b0c3e1ea4ad68e9167930fef271
SHA512 ecbb30fd95100996a7a35d3e8362342e9603a3f58d43784c0e3fd0a9a0b8b659e8971d694e7d9d994d04b3e58838a23bbff251dd07cb26bdca6c56b4cf75c63a
SSDEEP 192:P/gvbCh3Ix0+G83uxXBBK31GkSJIv/OK17EJH7DNspUxO:P/aeOa83uFBBQ1GkSev/OK1C7DNspUxO
TLSH
T19714C85F5F353702CA68803664E794A36D6EF07F8B52BAC9B4741460CEE2B52A05C4FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t_dc14.db

Path C:\Users\Admin\AppData\Local\Temp\n_7eeb58\t_dc14.db
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\n_fdc609\history.txt
Size 1KB
SHA256 2e3754edc1ff92560f4ef8d5dd6795abe5dcfbd6618cde8bb39efc8e46288b8f
MD5 0bbec0b1793a20b6cb18b23fcf61644a
SHA1 0b8cb4191d58716b6a7d2899dbe58558a5c2ce83
SHA512 dfd50dfc8755169c73dbea18e8e7b7e1f5f554c25b83834957a3b7b7848c8138c9f39312f2af11dc2742ba1299ec97688189cd274ea916bd3c3a4305d89e2c8f
TLSH
T1C841B056961B008F87114E2D2323B6697B1FB81D6C8CEB68FDD454131C5A77D82C1AFD
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 520727.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 520727.crdownload
Size 43.1MB
SHA256 be7efa348927146eec51e3f8fd8381a92882ff6e4275c7a2fe003624719e6e5e
MD5 b8ebf39f045625d2cab91cd69d203f5c
SHA1 0939fcb50504b16caf1adad22e8bf8bbad642b22
SHA512 5d105cf2b4fb162b2a78ddd876cb73eaca57192a8deaae621ab77a4d1033b7ccff4c114b3043f556f70dac768a982b8e1577f097b6e351fe45849f2b870638e5
SSDEEP 786432:iTm8S1a1aoEZu9i9isYf0n8+kwe+L3r/VVchj8RJgaiq5yH9AjvqWA6xy:Ym51a1aoEQbl0ncwR3r768fgFqc6jvq1
TLSH
T132A7333169598139F5F00037EA19B2746EBCEE152B82846CD2E8FE7D3E789D683B7051
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

craftrise (2).exe

Path C:\Users\Admin\Downloads\craftrise (2).exe
Size 20.5MB
SHA256 4d3483cfab18245549fa5f892a07b0ae1202584ca7aee739e74e13beea16e27b
MD5 cc1002a0a47def79fddb6f46d156f7aa
SHA1 ec60f213d25464818ad95dc62789e90fced3e0b9
SHA512 0006abe5bcec66bfe6687831e5a13f5202b29de5f4b7fab89deef74141a26d6b751e53f1580b9a8c54e29dcfe47aedf38afe2fe65da9fe5858ece78868459304
SSDEEP 393216:YqzlNIZ37UJ32eivEoxy8e6n7PdDiXEAphVtnIUQSg+1/iZldstzEPvF7dLpl4:YqzbS4ce2s7OpiRphDto+RiZjstzEvFO
TLSH
T1A0273394BB8248BFD8E2913C5C799862E37270C60F65D1BF07A05D3A1E3BAD54E38764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

craftrise (2).exe:Zone.Identifier

Path C:\Users\Admin\Downloads\craftrise (2).exe:Zone.Identifier
Size 172B
SHA256 442c744fbe9165cf0beeed063a7852d991d5010e21111d3a36ae5a21eb9bc90a
MD5 97c3f5d2e469ebfb8f757f79b3854f18
SHA1 b1a6695b3d53742b674167100020fc82b2ca255d
SHA512 b5a24590b5efebb8e5d94265399a43499b206c275455674ec03c3adabfe152cfccb12a6a27108a3dddd1c03a8224b8b50b624b16d03d0ff22436991a4d03374a
TLSH
T13DC080D7C550851A018415D83557579EF50B751AB8D5634CE44001D71C4045484D563B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2012-2458-0x0000000140000000-0x000000014148E000-memory.dmp

Download

memory/2012-2369-0x0000000140000000-0x000000014148E000-memory.dmp

Download

memory/2012-2456-0x0000000140000000-0x000000014148E000-memory.dmp

Download

memory/2320-2454-0x0000000140000000-0x000000014148E000-memory.dmp

Download

memory/2320-2424-0x0000000140000000-0x000000014148E000-memory.dmp

Download

memory/2320-2271-0x0000000140000000-0x000000014148E000-memory.dmp

Download

memory/2676-3534-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2676-3462-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2696-3533-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2696-3535-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3432-3423-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3432-3424-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3924-3564-0x000001A0AE8B0000-0x000001A0AE958000-memory.dmp

Download

memory/3924-3566-0x000001A0ACF90000-0x000001A0ACFA4000-memory.dmp

Download

memory/3924-3565-0x000001A0ACFB0000-0x000001A0ACFD2000-memory.dmp

Download

memory/3924-3562-0x000001A0931F0000-0x000001A0931F8000-memory.dmp

Download

memory/3924-3561-0x000001A0931E0000-0x000001A0931EA000-memory.dmp

Download

memory/3924-3560-0x000001A092C90000-0x000001A092CBC000-memory.dmp

Download

memory/4784-2457-0x0000000140000000-0x000000014148E000-memory.dmp

Download

memory/4784-2407-0x0000000140000000-0x000000014148E000-memory.dmp

Download

memory/5024-3419-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5024-3349-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5300-2406-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5300-2409-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5348-2451-0x0000000140000000-0x000000014148E000-memory.dmp

Download

memory/5348-2453-0x0000000140000000-0x000000014148E000-memory.dmp

Download

memory/5348-2308-0x0000000140000000-0x000000014148E000-memory.dmp

Download

memory/5444-2317-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5444-2307-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5564-2833-0x0000000000A40000-0x0000000000B2A000-memory.dmp

Download

memory/5564-2834-0x000000001DCA0000-0x000000001DD30000-memory.dmp

Download

memory/5780-2318-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5780-2220-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5780-2224-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/6068-2408-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/6068-2362-0x0000000140000000-0x0000000140015000-memory.dmp

Download