hxxp://vx[.]underground[.]org

Analysis

user interaction
yes
max time kernel
1212s
max time network
1215s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://vx.underground.org
Sample260805-v5bf2ssbre

Score

8^/10

bootkit defense_evasion discovery installer persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
676	5420	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Telegram.exe

Executes dropped EXE 6 IoCs

pid	Process
4156	tsetup-x64.7.0.8.exe
6076	tsetup-x64.7.0.8.tmp
5072	Telegram.exe
5616	Telegram.exe
1740	QXcryptor.exe
6072	Telegram.exe

Loads dropped DLL 5 IoCs

pid	Process
3404	msedge.exe
5072	Telegram.exe
5616	Telegram.exe
6072	Telegram.exe
3404	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
257	raw.githubusercontent.com
477	raw.githubusercontent.com
142	raw.githubusercontent.com
252	raw.githubusercontent.com
254	raw.githubusercontent.com
255	raw.githubusercontent.com
478	raw.githubusercontent.com
143	raw.githubusercontent.com
253	raw.githubusercontent.com
256	raw.githubusercontent.com

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Telegram.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	zalupa.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2772_1215695804\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_836070517\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Sigma\Analytics	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Sigma\Cryptomining	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2772_369925848\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1654392855\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2136460821\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_132979915\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_132979915\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_836070517\arbitration_metadata.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2005960239\v1FieldTypes.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_836650624\safety_tips.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2080305159\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Sigma\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Sigma\Staging	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1651252640\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_49942968\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_500647834\surnames.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_836650624\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_500647834\passwords.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_587861749\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Sigma\Other	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1777547167\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2136460821\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2005960239\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2005960239\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1454867701\domain_actions.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1454867701\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_836650624\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1777547167\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1651252640\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2772_635342444\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_587861749\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_132979915\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2005960239\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Mu\Content	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Mu\Staging	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1651252640\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_49942968\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1654392855\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Mu\Entities	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Mu\Other	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Sigma\Fingerprinting	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_40927652\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_500647834\male_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2772_635342444\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Mu\Cryptomining	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Sigma\Social	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_500647834\test.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_500647834\us_tv_and_film.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2136460821\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_223915160\crl-set	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Mu\Advertising	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Sigma\Content	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_500647834\model.markov	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_587861749\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_836650624\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Mu\Fingerprinting	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Mu\Social	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2772_369925848\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2136460821\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Mu\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Sigma\Entities	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Telegram Desktop\QXcryptor.exe:Zone.Identifier	Telegram.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsetup-x64.7.0.8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsetup-x64.7.0.8.tmp

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5316	chrome.exe
5392	chrome.exe
3516	msedge.exe
5980	msedge.exe
5420	chrome.exe
1620	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4156-4785-0x0000000000600000-0x00000000006D8000-memory.dmp	innosetup
behavioral1/memory/4156-4910-0x0000000000600000-0x00000000006D8000-memory.dmp	innosetup
behavioral1/memory/4156-4945-0x0000000000600000-0x00000000006D8000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 24 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Telegram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\	Telegram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304248491576841"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{071C8A51-B3E1-4680-BF73-A1269249F5B9}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tdesktop.tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tdesktop.tg\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tdesktop.tonsite\shell	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tdesktop.tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tonsite\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tdesktop.tonsite\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	Telegram.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tdesktop.tg\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{FC6B05EE-96C1-486C-873D-B003D338375C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tdesktop.tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tdesktop.tonsite	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tdesktop.tg\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tg\shell\open\command	Telegram.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{B0F8BFB2-7E95-4907-A828-DC1A9C5DBAC2}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tdesktop.tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tdesktop.tonsite\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tdesktop.tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tg\URL Protocol	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tonsite\DefaultIcon	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{69D07A41-15C9-4CCF-85C5-8E5D5F0155FE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Telegram Desktop\QXcryptor.exe:Zone.Identifier	Telegram.exe
File created	C:\Users\Admin\Downloads\Telegram Desktop\zalupa.zip:Zone.Identifier	Telegram.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
5072	Telegram.exe
5616	Telegram.exe
6072	Telegram.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
5760	chrome.exe
5760	chrome.exe
3568	chrome.exe
3568	chrome.exe
3404	msedge.exe
3404	msedge.exe
3484	msedge.exe
3484	msedge.exe
312	chrome.exe
312	chrome.exe
312	chrome.exe
312	chrome.exe
5868	chrome.exe
5868	chrome.exe
6076	tsetup-x64.7.0.8.tmp
6076	tsetup-x64.7.0.8.tmp

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2184	OpenWith.exe
5072	Telegram.exe
4344	zalupa.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
3404	msedge.exe
3404	msedge.exe
312	chrome.exe
312	chrome.exe
312	chrome.exe
312	chrome.exe
312	chrome.exe
312	chrome.exe
312	chrome.exe
312	chrome.exe
312	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeShutdownPrivilege	5760	chrome.exe
Token: SeCreatePagefilePrivilege	5760	chrome.exe
Token: SeRestorePrivilege	4272	7zG.exe
Token: 35	4272	7zG.exe
Token: SeSecurityPrivilege	4272	7zG.exe
Token: SeSecurityPrivilege	4272	7zG.exe
Token: SeRestorePrivilege	1576	7zG.exe
Token: 35	1576	7zG.exe
Token: SeSecurityPrivilege	1576	7zG.exe
Token: SeSecurityPrivilege	1576	7zG.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3192	chrome.exe
2184	OpenWith.exe
4332	OpenWith.exe
4352	OpenWith.exe
5072	Telegram.exe
5072	Telegram.exe
4344	zalupa.exe
4344	zalupa.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 1064	3644	msedge.exe	84
PID 3644 wrote to memory of 1620	3644	msedge.exe	85
PID 3644 wrote to memory of 1580	3644	msedge.exe	86
PID 3644 wrote to memory of 1580	3644	msedge.exe	86
PID 3644 wrote to memory of 1580	3644	msedge.exe	86
PID 3644 wrote to memory of 3468	3644	msedge.exe	87
PID 3644 wrote to memory of 3468	3644	msedge.exe	87
PID 3644 wrote to memory of 2000	3644	msedge.exe	88
PID 3644 wrote to memory of 4320	3644	msedge.exe	89
PID 3644 wrote to memory of 2000	3644	msedge.exe	88
PID 3644 wrote to memory of 2000	3644	msedge.exe	88
PID 3644 wrote to memory of 4320	3644	msedge.exe	89
PID 3644 wrote to memory of 4320	3644	msedge.exe	89
PID 3644 wrote to memory of 3904	3644	msedge.exe	91
PID 3644 wrote to memory of 2880	3644	msedge.exe	92
PID 3644 wrote to memory of 3904	3644	msedge.exe	91
PID 3644 wrote to memory of 3904	3644	msedge.exe	91
PID 3644 wrote to memory of 2880	3644	msedge.exe	92
PID 3644 wrote to memory of 2880	3644	msedge.exe	92
PID 3644 wrote to memory of 4584	3644	msedge.exe	94
PID 3644 wrote to memory of 4584	3644	msedge.exe	94
PID 3644 wrote to memory of 4584	3644	msedge.exe	94
PID 3644 wrote to memory of 4044	3644	msedge.exe	98
PID 3644 wrote to memory of 4044	3644	msedge.exe	98
PID 3644 wrote to memory of 4044	3644	msedge.exe	98
PID 3644 wrote to memory of 544	3644	msedge.exe	99
PID 3644 wrote to memory of 5096	3644	msedge.exe	100
PID 3644 wrote to memory of 544	3644	msedge.exe	99
PID 3644 wrote to memory of 5096	3644	msedge.exe	100
PID 3644 wrote to memory of 1480	3644	msedge.exe	102
PID 3644 wrote to memory of 1048	3644	msedge.exe	105
PID 3644 wrote to memory of 1048	3644	msedge.exe	105
PID 3644 wrote to memory of 1048	3644	msedge.exe	105
PID 3644 wrote to memory of 1772	3644	msedge.exe	106
PID 3644 wrote to memory of 1772	3644	msedge.exe	106
PID 3644 wrote to memory of 1772	3644	msedge.exe	106
PID 3644 wrote to memory of 4980	3644	msedge.exe	107
PID 3644 wrote to memory of 4980	3644	msedge.exe	107
PID 3644 wrote to memory of 4980	3644	msedge.exe	107
PID 3644 wrote to memory of 4984	3644	msedge.exe	108
PID 3644 wrote to memory of 4984	3644	msedge.exe	108
PID 3644 wrote to memory of 4984	3644	msedge.exe	108
PID 3644 wrote to memory of 3984	3644	msedge.exe	119
PID 3644 wrote to memory of 1048	3644	msedge.exe	120
PID 3644 wrote to memory of 1052	3644	msedge.exe	121
PID 3644 wrote to memory of 6084	3644	msedge.exe	131
PID 3644 wrote to memory of 6084	3644	msedge.exe	131
PID 3644 wrote to memory of 1632	3644	msedge.exe	134
PID 3644 wrote to memory of 5836	3644	msedge.exe	135
PID 3644 wrote to memory of 5836	3644	msedge.exe	135
PID 3644 wrote to memory of 4276	3644	msedge.exe	142
PID 3644 wrote to memory of 5544	3644	msedge.exe	141
PID 3644 wrote to memory of 4276	3644	msedge.exe	142
PID 3644 wrote to memory of 5544	3644	msedge.exe	141
PID 3644 wrote to memory of 1728	3644	msedge.exe	143
PID 3644 wrote to memory of 1728	3644	msedge.exe	143
PID 3644 wrote to memory of 6060	3644	msedge.exe	146
PID 3644 wrote to memory of 5876	3644	msedge.exe	147
PID 3644 wrote to memory of 5876	3644	msedge.exe	147
PID 3644 wrote to memory of 5876	3644	msedge.exe	147
PID 3644 wrote to memory of 5284	3644	msedge.exe	148
PID 3644 wrote to memory of 5284	3644	msedge.exe	148
PID 3644 wrote to memory of 6124	3644	msedge.exe	149
PID 3644 wrote to memory of 6124	3644	msedge.exe	149

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://vx.underground.org
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffe0041c188,0x7ffe0041c194,0x7ffe0041c1a0
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,817891690434755992,8540152873037978417,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,2922541065571628756,18129086762032475998,262144 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,17437501032569783770,15960086076402496418,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,14686929295901323354,5811768998695184065,2097152 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,5725401033864503037,2523987935538660279,2097152 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,16147073381024038797,15238243703093091470,2097152 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,17890831925536805402,11108148584052100129,2097152 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5036,i,1874385983778881892,902988022562011182,2097152 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5252,i,3393498571137515417,12003247867162408927,2097152 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,15016227099730021937,4543127559217533479,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,11171196456317077824,2115993747652859021,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,13414581464888026074,1763964708414159332,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,13414581464888026074,1763964708414159332,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6196,i,6377487024597131550,6520860190078080404,2097152 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6248,i,8521249368678108385,2945665187139365992,2097152 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6316,i,12630605122696484534,16216192551131108054,2097152 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5064,i,13247542322931004941,17315662045661754137,2097152 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,12624911708028681819,11900955590910002129,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,1531915085200173837,10512810582760101867,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,2429568634814375488,2040414549505577739,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,219324767239459940,8105463835353229860,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5044,i,15193363350059399934,1020633118876705780,262144 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,4464340634564044918,5832297477586789329,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,6650607069787995765,4440931194938323100,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,1213600726452579988,15785464832038283387,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=1312 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,9602608891523455169,16505870922883232008,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,6266659113771711965,9521289037723223105,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,6266659113771711965,9521289037723223105,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7072,i,13111025966011187218,7175250300883783290,2097152 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,9520020888154647175,7241085794767359999,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6284,i,17475270436632291254,3865621386699205542,2097152 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,2400658009214183207,6012534166342342150,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,4173815319613030381,14646075573296788551,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,4173815319613030381,14646075573296788551,524288 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7012,i,8897220492462982317,9180694543729624114,2097152 --field-trial-handle=2260,i,14188877648582972051,6245627922144267165,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1784

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdff93c728,0x7ffdff93c734,0x7ffdff93c740
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1796,i,12944837969282364549,8531412102686854093,262144 --field-trial-handle=2008,i,13479584992552622120,5970117607724555394,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,7541320243493603866,13948371010155011710,524288 --field-trial-handle=2008,i,13479584992552622120,5970117607724555394,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,7729522967672302535,3991429613826999022,524288 --field-trial-handle=2008,i,13479584992552622120,5970117607724555394,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,8748576176222748792,8371710412769921421,2097152 --field-trial-handle=2008,i,13479584992552622120,5970117607724555394,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3476,i,9607885019286899406,14872067525497461875,2097152 --field-trial-handle=2008,i,13479584992552622120,5970117607724555394,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4608,i,11489902702507616115,10208519131759276617,2097152 --field-trial-handle=2008,i,13479584992552622120,5970117607724555394,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4616 /prefetch:2
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4776,i,12251097529665571187,15164450916895287362,2097152 --field-trial-handle=2008,i,13479584992552622120,5970117607724555394,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,184057466881388095,7257906955319741271,524288 --field-trial-handle=2008,i,13479584992552622120,5970117607724555394,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5764,i,9985579243851691819,15907534335107181846,2097152 --field-trial-handle=2008,i,13479584992552622120,5970117607724555394,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3468,i,13124730158235168403,13437931917486195233,2097152 --field-trial-handle=2008,i,13479584992552622120,5970117607724555394,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3500,i,8200553788195523404,5892913084280720905,2097152 --field-trial-handle=2008,i,13479584992552622120,5970117607724555394,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6060,i,1681699356636022557,11773943058315050588,2097152 --field-trial-handle=2008,i,13479584992552622120,5970117607724555394,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4128,i,18246754942656980854,11001033663930556234,524288 --field-trial-handle=2008,i,13479584992552622120,5970117607724555394,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4056 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,4085995067019522032,12992003634853807070,524288 --field-trial-handle=2008,i,13479584992552622120,5970117607724555394,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3808

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ICS.SimaticSmackdown.Go\" -spe -an -ai#7zMap675:106:7zEvent20092
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2184

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4332

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap379:106:7zEvent21075
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdff93c728,0x7ffdff93c734,0x7ffdff93c740
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,6854621316984068033,17341752791239497695,262144 --field-trial-handle=1952,i,6169753813686012158,3349872314812789668,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,151275925345330128,14337236704208312235,524288 --field-trial-handle=1952,i,6169753813686012158,3349872314812789668,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,4761852817657689553,17104578664824656719,524288 --field-trial-handle=1952,i,6169753813686012158,3349872314812789668,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,7079622399736402465,12814727381509445329,2097152 --field-trial-handle=1952,i,6169753813686012158,3349872314812789668,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,12152023879467329282,17551926294011666665,2097152 --field-trial-handle=1952,i,6169753813686012158,3349872314812789668,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4516,i,17774254724373764448,8269329627329061848,2097152 --field-trial-handle=1952,i,6169753813686012158,3349872314812789668,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,692704439136607033,7345326163731699100,524288 --field-trial-handle=1952,i,6169753813686012158,3349872314812789668,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5396,i,6023340767075977801,495199753241464931,2097152 --field-trial-handle=1952,i,6169753813686012158,3349872314812789668,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffe0041c188,0x7ffe0041c194,0x7ffe0041c1a0
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,9914636877383158720,2531869543150315486,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,1560155900201384528,10854706440454432849,262144 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,5218340156731406711,15062389828667333211,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,15560514982832413089,9880773852887186335,2097152 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,16331330352054411534,10509366602362695344,2097152 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,17424496041789158546,8649084901838446146,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,10146699400466301980,4751895106525999241,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,2336327713358859993,7541266045397457397,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,657611439448216105,3721181848411875915,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,13214662487940305460,14876381772950995000,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,13214662487940305460,14876381772950995000,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,10896163201873217006,9559179104918138755,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,15302771426112245845,15126839141401625812,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,2676195271893574185,304737277639114679,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,16678775901800511812,10934274548775268852,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,1641553330470734200,3448704205342819224,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,10750933231083623739,6942557365817406512,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6336,i,10719949692967926374,17910460434381130015,2097152 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4936,i,7626566923920920516,14617956944078356676,2097152 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6548,i,10889725699119649081,4101315398955128248,2097152 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,12055819947066217707,4957802420241013895,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,5046453856289714908,1642860052151807731,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,8939593408920883621,12674331396862255454,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,13283237486896484269,7618459552945100052,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:8
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,10679494151964742564,14197753467594527937,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,3383276962109721068,9336923305008352168,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3048,i,17141440624008435153,16505663746602815837,524288 --field-trial-handle=2296,i,2795962037463838583,8607750175051498189,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe0041c188,0x7ffe0041c194,0x7ffe0041c1a0
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,12128889188477130508,15999432562814417348,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
      4⤵
      System Time Discovery
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,8992285336149206050,14881607659701755586,262144 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:4004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,15410333133814694902,8577320744748852469,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,14394134795205585515,5489550045297245179,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,14394134795205585515,5489550045297245179,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
      4⤵
      PID:652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4808,i,14536531673625146252,17509671665449597661,2097152 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,6238357360999377431,13051694022730909409,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
      4⤵
      PID:412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,8170702729581756547,9573594139212791562,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5576,i,16885278502801115895,1333960967652211081,2097152 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,14245808811512976192,16288870746872098733,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,3000600251943276666,5978777152560093308,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,7569324651042949004,11337503731201284310,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,11981814851121700107,12124613897286505305,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,18063234227525810097,2392291908686527118,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,17349220300227272291,12251906974924300423,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,18093876324018779186,11028145004851359799,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4672,i,1808602653472326678,10036319436914134831,262144 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,8490184144759362088,9190993915818602084,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,14017125078698605256,634669162095950312,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=1052 /prefetch:8
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,17544548196074493422,5008924273217239513,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1056,i,8280285977108985670,12068376719238369951,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,15856490113723649474,12909714896916881403,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3988,i,2955507022115879693,9234689341091033015,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:8
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4088,i,2141988965077966143,10556210129817825536,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
      4⤵
      PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,8248186902644269874,15543539191855708113,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3984,i,3957140464400540034,17289341626460041924,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4068,i,5193716741274876783,241946815022519211,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,13628580953189768796,13667936687359139384,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,3092591751228193419,5128638981558071551,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,11772850879474845032,11004138487876783239,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,10234516198673750153,18148289127778970765,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
      4⤵
      PID:912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,3038971703295982431,16529872796322618805,524288 --field-trial-handle=2320,i,10167138175519054625,1696372118240314485,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
      4⤵
      PID:2236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdff93c728,0x7ffdff93c734,0x7ffdff93c740
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,3822405391374871943,9605599866038487044,262144 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,16263160937190484978,16850404853342072523,524288 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,12211102247756052100,8115630670884389027,524288 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,8954426156037304665,10124604158276293863,2097152 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,10011291737568187617,12229567176906046095,2097152 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,2944574802973835936,15839231881008882706,2097152 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,8944911362120836238,6661163840271961673,524288 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,10474482531307630785,13145198520020137060,524288 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,8500373667495739432,529495844727583076,524288 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,15134051941143538145,5665763369023238649,524288 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5668,i,10799508343253920628,11741395775392772244,2097152 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3364,i,15935407782940944539,14447854653938339861,2097152 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3388,i,3692750624272602468,8203988971234480862,2097152 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3952,i,13608650510283272262,11498171493030716801,262144 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4588,i,16708400773002354327,17745881679319028483,2097152 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3488,i,1252121953920503127,5811682641665445777,2097152 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,3664354524613914316,2890201550202642977,524288 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=4632 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,15986662614962805257,4392907505102617587,524288 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5808,i,12968867293421545527,5792452125109367250,2097152 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,2747490188449006398,14250224227928571291,524288 --field-trial-handle=1988,i,13617446042216326578,800167263402239467,262144 --variations-seed-version=20260805-010032.295000-production --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:1868
- C:\Users\Admin\Downloads\tsetup-x64.7.0.8.exe
  "C:\Users\Admin\Downloads\tsetup-x64.7.0.8.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4156
- - C:\Users\Admin\AppData\Local\Temp\is-JTMVJ.tmp\tsetup-x64.7.0.8.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-JTMVJ.tmp\tsetup-x64.7.0.8.tmp" /SL5="$190182,53262485,826880,C:\Users\Admin\Downloads\tsetup-x64.7.0.8.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:6076
  - - C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
      "C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops desktop.ini file(s)
      Subvert Trust Controls: Mark-of-the-Web Bypass
      Enumerates system info in registry
      Modifies registry class
      NTFS ADS
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:5072
    - - C:\Users\Admin\Downloads\Telegram Desktop\QXcryptor.exe
        
        "C:\Users\Admin\Downloads\Telegram Desktop\QXcryptor.exe"
        5⤵
        Executes dropped EXE
        
        PID:1740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3328

C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
"C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:5616

C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
"C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:6072

C:\Users\Admin\Downloads\Telegram Desktop\zalupa\zalupa.exe
"C:\Users\Admin\Downloads\Telegram Desktop\zalupa\zalupa.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2772_1215695804\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2772_369925848\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2772_635342444\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_132979915\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1454867701\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1651252640\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1654392855\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_1777547167\manifest.json
Size 53B
SHA256 551c5f7ed9a2139eab8089f6fd9724b0b38d226b369209cb2ac295b3884571d3
MD5 1bd4aa2766777b47a4fc061677395793
SHA1 5e88d6015511963e10083771e9747459117b0eba
SHA512 0d7d7b5d8f5ea16308268e5ac5986195d5238bf5f30465fc541c70de8dcf8b3f87bb1e2bc38e837119df1d52a78072088d5c822836d04490027a8e071f52db0a
TLSH
T1519002604424951716C10F5065B0BC819391765995850D1D0545155902A546CE054298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2005960239\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2080305159\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2080305159\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_2136460821\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_223915160\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_40927652\manifest.json
Size 118B
SHA256 a50a524184b2420fa2d050e10c7ecc90ff3ddddbc1d39dd7f6ee65aea7e89904
MD5 0839dbc235945a441183b3b1c54e7cff
SHA1 7d50cc09092601adbdfb99927ad0cea8f9b5be01
SHA512 5ef438077e1f23aa36d9abd6639769eedbdffdda85ee368f386638c288893a1b80c8ecac9eb9659b5559296a189c77fc24a7b716bb7914868e6744a30e7bd50e
TLSH
T1EBB092B00C0AA03B22819B60ECA0668683F81218E8029B1A088036482F8817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_49942968\manifest.json
Size 141B
SHA256 dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d
MD5 811f0436837c701dc1cea3d6292b3922
SHA1 4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87
SHA512 21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35
TLSH
T134C04C5185005D72509D87781D6C97054B12CF4618947509DDC68309EC1DCCB64B234E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_500647834\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_587861749\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_587861749\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_836070517\manifest.json
Size 238B
SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
MD5 15b69964f6f79654cbf54953aad0513f
SHA1 013fb9737790b034195cdeddaa620049484c53a7
SHA512 7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908
TLSH
T178D0A727EC008DB611B207580AF5A742E3B1630F7C012509377308CC0F3D1744081285
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_836650624\manifest.json
Size 72B
SHA256 9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f
MD5 a30b19bb414d78fff00fc7855d6ed5fd
SHA1 2a6408f2829e964c578751bf29ec4f702412c11e
SHA512 66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490
TLSH
T154A02230AC20A03330880B300032838383B02C0A2020FE0A0F0B2080A28823E20B220C
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\Sigma\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3404_846619944\manifest.json
Size 132B
SHA256 68683970ce6d7de9a2043c34129106ae68af21a3b0a3c53cb59695640a7c1cbc
MD5 a4d9ab812da8b2906ff9d46f9ffc07c3
SHA1 48b428dc760bc008058e6df47a9f05f2f86b4abb
SHA512 5a2ba950ed85ee55bc1402d57d09ca8d54c0c2df5b43a402bb8bf3668920a40d584fa18d270376b046e23be00698bd1399ef6a0b695ee6c0b99fb454616b1cb6
TLSH
T1E8C09B115801797654DD77F00D29D7526672CB1D1494250546F5C218EC2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a9bc91a3244e7d72467b656c5486d15c0ed9f92add88f691c3853e2b856cbd81
MD5 b1e1deec2c4182d0013a230b355f4c7d
SHA1 126437183b8f548051a3f561eea1eb0ee68fc9cc
SHA512 e718639402727b342725497f1be1fb31c240520b2883d9791df2e05dd851d0e309e06e9942c2a24d6090668922ba1d9f9a1ebf9b87311e7d55ee2d605549ce06
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 037f1d7af990c243921447bb20b15bdf2cb7fd24c352729cb89ca362728280f9
MD5 e8f3439406eedcb7f0fd84c88350d35d
SHA1 20124b80924fb9342c86e9bedbdec94a05c43d13
SHA512 ca20102dfe6528e72c3546cc1d7707119e7b977587a66355c3ec0b2ecd2c9459743e75780f6444792eda29e4f00051a5234a108c422452dea943c49066d040fa
TLSH
T18CE02BA5CA22AC3718F8275864654705EB41531726809C4F373D400C8FB873A828685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000043

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000043
Size 1024KB
SHA256 392bb8c43da0aa8ed8ef2310b8b18fa1fa9ca8cd1ff7043d0603d8f9412d839d
MD5 d69cd0bc9471a6b2e0b8482100309724
SHA1 e2c7830577c12654f73b78acff5110e1a21954f5
SHA512 bc8f865ed10a699c0b143b2922ef648757ba5fc686c516f4d18dcac3e400afdda465c4a28bc97eebb17cdcc6407f4165fc613e425a0970337a2080e76d865f3c
SSDEEP 24576:6RD42JpyQP6Nc9HG06lQATcIlV8PzuH1XGbvIj:xEpdPZtG0oTcIBXGjIj
TLSH
T1F025337302A0353731A7BB9561C321A3A874C4E9DD5D6BA729099C879CC3FE36B3E911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000051
Size 30KB
SHA256 32339f355b5b9b8693f9f6370dca7b05fe6042e3b2d94546afa05d569dd6b66b
MD5 348c832a4560adebb39e32b91f392e20
SHA1 5f8743e97e3d0c418d90998072416705f17eb720
SHA512 c225d7794c5c01872bb1af8a0c6af443f54e07f40cb8c03ed79c77a092ab35e03cbf29e2672cd070e93c998f54fe7776f4ff4e948dfd67af8d77039af6638cb9
SSDEEP 768:5q2yiiih0/n1a/WAfZXxZbFtjd3iXn24He5UKnCljV4fx:k2yOh0da+qZW24Ha3n4x45
TLSH
T10EE2F12E4C58BDF8AF09B230D8C62E76CAF216D7C6D2EED0543DAAFD2529590D18C5C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000052
Size 151KB
SHA256 a8e7368f03b24867920b42fe31331acf8bde1626336affcee9bd6a9d7daf0692
MD5 c798737fd303ec814cf40d8076bd5d5f
SHA1 0d18fd05f16c17652468175fcc41423a3d99170c
SHA512 31ad0a4e439b706ce0da3a541bad7ed5e5340d086bac526b7872ecfeb722edd9767d99baf72307ae6f79649e3be90542e9034b618dd75db7fc46c19eca72da35
SSDEEP 3072:0EqzX0mMLYGYjNWkUBgpF8djK+nrXXfmlCPaPGOZOaO9TMunLe6EatD:0EoX0mMLYR978dW+njXelCPa3bAYualw
TLSH
T1C8E312AA520A418C573142C80BEF712E499FD0C619DF829B35B4DBFA9974D17270CAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 51c7322625e8d36bbc937a618efd4956035f80cc4af992eb47bbbbc253bcb4f1
MD5 b7c2c9604d704c1518e8786691bce015
SHA1 3eb4b2ff28f4a438a4d73280fe8d3597b0181037
SHA512 1f075172224516fd00bc8a27bbaac613d52b570be8e1b8da56ea19b5730bb85588ae8450dbece05fa93814a705e2b9fca181c190e6228f699b692053637212a0
TLSH
T1E4418412248772D6FFF6083568F648B73C32C26492130EFF6052A9BF186FFAD54580A2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9c648f161455f1ea41845b972822b6b2ddd08e15bb6429bc4b52f07c6fbaebc4
MD5 0c851245a5eb5bbb6647b5ae34360eb7
SHA1 5d38f416a9548784e26a8c6256ae6f4ee7d09368
SHA512 dba90902ae173ddb964aeeb02c5d2da0db3095d22fb83d1c1900be926c57e110b7fa1ae4bf413bfe274e34585c251b0e048e9a95c9c4ebaa774db40613c137f1
TLSH
T18B51DA12608276D2EFF5043568E2087B3E32836892131FFF6051687F682FBBD750405A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 0ea23382f2d749a347e5f05ffccfa930f047d4059097823fd4093ebd1b81e880
MD5 dd1e12ce0121bcb6068d3069812ee9d5
SHA1 fa9ef427c2833580a42f580c226f975adcff5d22
SHA512 d404c197b9a2a5d53d6c02bfb8549c3651036536a16e5e58bd86ebfdd9904a3ac1b21849563cb0a88dae7292f717001c6c106dfd75fd2f869aa67d80ce919b6b
TLSH
T18F413112248277D2FFF6583528F618333C32C6A4E2130EFFA12648BF186EFAC5058496
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1a531326971284a4eabe95d27d6081afe9eaa14efbe44fc95e367517ac0490d8
MD5 ecb01aec0231f686c56c21b42e63cec9
SHA1 28850ed6eeb0b5c948d7faf9a5f1e861ae63b7a3
SHA512 dace4ca2b551b531a8c0ae34e30bba0fd0f3edc31a6a21e62d8be956ff3f571852e9fc668ea365d0ce2b9f3e167c940eb14715c95863d778b0710ad4535565ec
TLSH
T124415112248776D6FFF6483568F608B33C32826492530EFF6052A9BF186EBAC5854492
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 66c0b441cd40d26e216fa4591b5ec510cb513362a17ff95cbe1d5fede2e89aa7
MD5 35a6f675f62e473f6c14bec27a8a0cc8
SHA1 957dd7e7eca4d45fe6064fae888d76db00461321
SHA512 23447abe14cb9a14e8875e1028ff9c8dde59ea527aafce7c60fc4b9fdc7bf6596b71a755bd03d0817ae61ecb1aaa3f7d42c66cb540ed805cb942d880896be8bc
TLSH
T19351C912608276D6FFF5043568F208B73E32836892131FEF6051A97F286FBBD794405A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 337e65e0d04be6ad6d6faed19dd97a968530ecbd90f6ccc3ef332d3e773901cc
MD5 42542479745bafd3c2bb3ebe6d9b1a53
SHA1 4688fddf8ba54e514133985341bbc60e9561d678
SHA512 0793d45fa1aec4797de593697c45bac4b6528a0774a0eaea3ddc8873a864d94fd7cb2f605c0590cc1902a3928548c804547ff7078f4259067a065a6570e11cb1
SSDEEP 384:DA/WPxq1Dlv79ezDC0ttJWERaaFfHUz08hVDGmmHxy+4G6HmwxHFBU8LMEp6wqQk:Z5yZjXl4F
TLSH
T12F52CDF7C3D8C62DC80166F49B257E1FCE290928532C3D66C9D9EE4B93E2472E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 6b3271cd99ce2e467e63a436f7b5d01831db3117dc96295704fefbf946fa6a41
MD5 36c0cebe809c7f7c362dfb6c81f5e81b
SHA1 ec5d8706c2edcd0ee7cb9ca4359fe7f267dbc6b6
SHA512 8b89e69f4417a49d0600497e0cd4c8fa89a49bf1389cfcb0a2d8a9047d269003dc2c72668702ff2ac6bd1adf54778cf477287b36f9d307067f4f00205ee6dd96
SSDEEP 192:DAx7T0ExEd+vcBQaaFsoTxVZkkVqrH0NPi4aPvVfP4vR008hVDG6zHr7g4jPR:DAx7T0ExEd+vcBQaaFsoTxVZkkVqrH0W
TLSH
T1C932B1F7C3D4C62DC94166F89B243E1BCE290928522C3D67C9E9EE4B67E1472E25124F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 67dd6bf7404cba1ff802a71a6400ac021065e7ff14b13b5bdbd9e2470e3c17b1
MD5 72aca772ace4c757e9ed466f95db3aaa
SHA1 1dda682730147c03eae8b5fe74df9c392770a2e7
SHA512 c727d6accebc59f53a322d5a96b20a533005bf26c4db1cde2b3fe388e43ce71794a7decac0a9b020eb4a392b4747a436c44122ea11b0dcdaf335db1b0134ab6d
SSDEEP 192:D6tixA/WPxq1Dlv7FaaF8ZkkZqrH0NPi4aPvVfP4vq08hVDGmmHxy+4G6HInw8Gp:D6tixA/WPxq1Dlv7FaaF8ZkkZqrH0NqD
TLSH
T12C229EB7C3E4C62DC90166F49B257E1FCE290928532C3D66C9D4EE4BA7E2472E25124F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 fd15a83ca42607869877982474f406e473eae5bcd7ab0aedb849a1a05a81da87
MD5 7b442ead1bae1f839ae603984b61f82a
SHA1 8786a51ccdbbc19dd04037912184c5ada39adef4
SHA512 a3c97a63b82fe4248102405caa5119f5dffbb6ebfd99e65e85e19d3fab0130d5105893278c9d99b4d700eea1c5956be101658ceb2871934e318c74d102e70d5b
SSDEEP 384:DA/WPxq1Dlv79ezDC0tWEJORaaFfHUz08hVDGmmHxy+4G6HmwxHFBU8LMEp6wqQW:7EyZjXl45
TLSH
T1E552CEF7C3E4C62DC91166F49B257E1FCE290928532C3C66C9D9EE4B93E2472E25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 55a4a4512e9998aa456e040370b374cf6e4f136bd44bf18769dfaf8ba8db9a7c
MD5 7dca10d958db1f73530d03040cd87b52
SHA1 ee293b8ec042ee9283f541ac7daa29c9644d32eb
SHA512 5598820960dc47251a749a9a07df26e1b6aa23ffa94151d2bda1714d138c9b6a34ac57af498f6a5de6671304ee00ce9d47b363f17957f49bd369ffc0f91fe691
SSDEEP 192:DAx7T0ExEd+vcBQaaF8ZkkVqrH0NPi4aPvVfP4vj08hVDG6zHr7g4jPJZuWInwke:DAx7T0ExEd+vcBQaaF8ZkkVqrH0Nq4aO
TLSH
T1AC32B0B7C3D4C63DC81166F89B253E1BCE290928522C3C67C9D9EE4B67E1472E25124F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 327e7e4ccaa398462c5ac50e3080498eec7f0c79894113365861ecf226dbe833
MD5 0bba9ffee4d5dcf87a832d0bc47621ce
SHA1 0ca7ba6306c8195d676a3eb057d01321155d8834
SHA512 e0a95170945b13f7d7c8993a8e36e5daad6dae5f2a7a3cbf7865c05241d8d1b812987c22cd4df194b68a1acb0ecb75987d91fea99790c08c675ed499a51e6769
TLSH
T1652137A7967EB82721294CBB0D54BC0A1D7AB43581926CF4DB9B40ACB091AF30B17457
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 9768fc4696cbcde1685b8b90b94cb84d29ce29b13c8d43b30ce0d1db34e8ecb1
MD5 d52c88482726b4e0bd347299832b605d
SHA1 3df85196a689e096b7b37693632a80326af74a98
SHA512 811c537bcf18191b6efbaeb1469c0829fdc292de8cbf3ef11fad07d7a2ff15627afac64a9cc69a9ac3c88f8dd233aec6792fe4480f5dbbb0d998d0ff80ba9f72
TLSH
T170517D979A7FBC27213849BB0D44B8452CBEB437419268F9DB67816CB0C55F30B13453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 9e74bdcaf4522ab0f6db3bbafb785a46eb73cb8799889d5716eb7268902237c6
MD5 f62bb3beb7ee0a6a1f37128136b21caf
SHA1 7d67d8a5e0795dad5ad4936ba3c5a3bcd78831da
SHA512 62874a7ff3e8fc63fa730f40a4e63fbfbc145af9dcc278a53ed2d000a1c0e135bdb59a7c16ebf7950cb79ebb3e5da48033a0a47d76e97191eb52745159bf9af5
TLSH
T1D22178A79A7EB827117948FB0D58B8091DBAA4328191A8F4DB9B41ACF0925F30B13457
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7dfca74bc24242af9d4b2afbe6c5acd3c02962ca94fa179aa31905cef4122037
MD5 c807c7116b4fb930754f2d69be1bf9a0
SHA1 702e1b54d08c67f9f318d8e9f57686fd91a768ee
SHA512 1f8dff22d61347f601a95dc924601a581d51fd6768228c1f8b2ec0a0b7322cfd6b5d33a2d659d3257a547d7f1560734305ce463ba17f847eea081fda8860071d
SSDEEP 192:iRtcBzbd2Ncjr31v7MF+pAPRp2zss+r9HHsb+WNJTp24AZ2CA22dkwPak/VyIsnH:iRtmzb9FgoUXH1waV2D2mvaY8
TLSH
T1B152B46AFD10797BACDAC22AF9127B17D7F5102161C42E94EAFC892C15E76CC721701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 2ec1690329ad832d42de3700d6e2bc53fb178bbc993598eefb3ada42c5689215
MD5 1acd253b15f1adb423a3fe515b4831a0
SHA1 b4c14a76cc652ab6293d2372687ab5ef8167cfab
SHA512 fb5abd5d125cabd7de791521ee332eb747bc057804aae97633f552f22c4c08eadbb7e32fd5c60887f166cb552dfd0d74aeee0f0652a552929d102b5b3fb0edaa
SSDEEP 192:6RtcBzbd2NcjrGhJv7MF+pGPRpUYYss+r9HHsb+WNJuayp2AZ2EFe7A22dkwPak8:6RtmzbkhJgo+XL1w0/2EFf2mva6e
TLSH
T14E62C55AF810297BACDAC229F912BB53D3F5202261C41E94AAFC892C15E77CD321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 135ed0db28e9ed120f8b342cf9bdbe49a0c04413cfe9f1fa53fa3a0a8846bf89
MD5 809f0402693470f5f628cfef6340b722
SHA1 495060af9598114454f42d5e9598c17702d84c52
SHA512 9c3298d957b93bc49989384b66931018f6af7e17230784281919763fac8967e894bfb92b82112a6490c1f921aed864bb0dafc154830cdc85c361314225de2835
SSDEEP 192:6RtcBzbd2NcjrGN8v7MF+pGPRpUYYssTJr9HHsb+WNJuaCJ8AZpUDWGFe7A22dkF:6RtmzbkNogo+X21wAp+WGFf2mva6e
TLSH
T15972E65AF910797B6CDAC22AF952BB27D3F5102261C41E94EAFC892C15E77CD321704B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 ecf9f543892a5fa1920f20c6dd88db35fb64ff75a416e8ad84518c53482d39e1
MD5 d177c6f5227e26809e7d41c6f2fa8939
SHA1 15e94a4d7c7b727a48c6e68b2b35387bd6ef71a9
SHA512 5280ea28beace0bdb451f30b84f0def47eba7b565e3a595ab47db8eadc5db282212131eaa658f12d0cbda5858dab60229f16b9d07254a375eb7baa85c2de3c02
SSDEEP 192:uRtcBhbd2NcjrG4sv7MF+TGPRpUYYQ8Jr9HHsb+WNJlVaJdmVNJReEFFe7A22dkF:uRtmhbk44gosXE1w4aKEFFf2mva6e
TLSH
T1D172D65AFC10697B6CDAC22AF952BB57D3F5202261C41E94EAFC892C15E77CD321704B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 d45ade9ab89fcff657a4e27e8a236adc29ed8ee5181df61f4cbc390c0f555225
MD5 100048d9412396159a28fc5d17f48e1e
SHA1 f7ed0fb5358075c312278f940fd1c06bf3c5a714
SHA512 012819d1221d67f3cfb408c9a65847f5a222957cd1c54d81eb1db0cc328ff3ed05946247627dd3e9c00d45d2b68abc3cf1e55bc4379a13a6a62e00a61817d86f
SSDEEP 192:uRtcBhHd2NcjrG4gv73WF+TGPRpUYYQ8kYr9HHsb+WNU7VaJdmXLLReEnFe7A228:uRtmhHk48bWosXq1w9m0EnFf2mva6e
TLSH
T1BF72D65AFC10297B6CDAC22AF952BB67D3F5102261C41E94EAFC892C15E3BCD321744B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 81380579f666bc9dcc4a006cf400110eb3635c1cf5f2f3c5f145d1258712e3f1
MD5 8f6170a3eeffeb9b9082b3c786d9c568
SHA1 ab44bee5cfc41f17f36a1f696139e9efc39fb400
SHA512 65041faf4a54be188c9aa53eb9598f5aaa5eb9ea2d89769e0efbc441e3e0e924a91bfdc9abf6ab71d8811a87c5f442bf8a712b8d09ecd7126278fd0c4abcd9f4
SSDEEP 192:xLRtcBzbd2Ncjrjlv7MF+pAPRp2YYss+r9HHsb+WNJuaMMBAZ2oFNA22dkwPakgh:RRtmzbBVgoUXN1wbe2oFC2mvaI8
TLSH
T12862C55AFD10697B6CDAC22AF912BB17D7F5102261C42E84EAFC892C14E36CD721745B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 efa84718d3dd9ee9f57a970fa99b9e5481a111ae1831a62d857a44c68f741f0c
MD5 1c85060dea543bd0ed8e3de8632320fb
SHA1 aa96994b5ddbba14b87fb0f9ed4d187aad64deed
SHA512 4f9406388b6357e56be736abbefc720ce7a0ccb82fae0d53601857375c6dcda092aca0053f71676ebf8df5c4482f21f91e316f396b3c9959bc498775068b2915
SSDEEP 192:6RtcBzbd2NcjrGt1v7MF+pAPRp2YYss+r9HHsb+WNJuaJO4AZ22FNA22dkwPakgo:6RtmzbktFgoUXN1w4V22FC2mvaV8
TLSH
T11762C55AFD10797B6CDAC22AF912BB57D3F5102261C42E94EAFC892C14E36CD321705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 8e493bdf05507b1fddf33cadaf082edb466f00c32f37ca7c51202046a30da9bc
MD5 d09ca9194816a882adc30a0618262d2c
SHA1 2606c4996a0950bb7aa0550e17dbbfb60b31abad
SHA512 3d9be3967dc4e1366f56ade0d7bc1fed1d93a33d467294d64ed6f332a909a6dde6bea9031b6fe4b4dd4d8944cc96e5348da4cf1e21332624842251662fb4f6b7
SSDEEP 192:uRtcBzbd2NcjrGNRv7MF+TGPRpUYYssTJr9HHsb+WNJuaoPYAZpReESFe7A22dkF:uRtmzbkNBgosX21w01qESFf2mva6e
TLSH
T10E72D55AF810797B6CDAC22AF952BB27D3F5102261C42E94EAFC892C15E77CD321705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 e541b37eb3d3de88101147e4fd31c60c60c14050bcfa672ab4a2ea16248a8705
MD5 7182338de95b65c2a310aef0de6b6420
SHA1 ccd0c02e629bf92786b2b6c726e48833748ec4e2
SHA512 e5bc302df1bdd3baec0c52333710be0d3e8028da5696bbfc388594e1f34d5e27092257116c320ba3e0460549d600022a669f709e4becf986fae1e45fedecad54
SSDEEP 192:uRtcBhbd2NcjrG4/v73WF+TGPRpUYYQ8Jr9HHsb+WNJlVaJdmVNJReEFFe7A22di:uRtmhbk4XbWosXE1w4aKEFFf2mva6e
TLSH
T1FB72C65AFC10697BACDAC229F952BB67D3F5202261C41E94EAFC892C15E77CD321704B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 76d8b5e7f85b49afd0f7a8dfe88909fb15a4dace7495c73714eecb25b9bd45a0
MD5 359c2f5c3c84589da64bc4669ff529e9
SHA1 4b707790273bf0448202f5edbabb8cb42b6dc210
SHA512 6f9fd22d2c792bf5940dadf487171ccb4dfe6bf1bc43aaac7ed7d07bfb5a0314a9ab6a4bfbecf551c05a46131da6b541fc0081b132869f665174aa12e581e79d
SSDEEP 192:6RtcBzbd2NcjrGNJv7MF+pGPRpUYYssTxr9HHsb+WNJuaCJ8AZpnk23Fe7A22dkF:6RtmzbkNJgo+XW1wApe23Ff2mva6e
TLSH
T1C372D55AF810797B6CDAC22AF952BB67D3F5102262C41E94EAFC892C15E37CD321705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 0782b2f9883cf0c6373706b02f9eb885f8a275daebd9fb85ce6f1bb4a875aa0f
MD5 f2bbf33de1057f0c64255e75fd32bb3d
SHA1 ee77fdc37e7ea69d1a39d8fb28d20e52f455856a
SHA512 b49c33aa5f60aec450a928e300cd5dc7c5ee9af8c32665991643032eca53fd111be84619922a5ea4011e6decca87325acd043961879cb1be37f058c691f67863
SSDEEP 192:6RtcBzbd2NcjrGkJv7MF+pAPRp2YYss+r9HHsb+WNJua38xAZ2RFNA22dkwPakZa:6RtmzbkkJgoUXN1wUO2RFC2mvake
TLSH
T19B62C55AF910797BACDAC22AF912BB53D3F5102261C42E54EAFC892C15E77CD721701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 8ca72a277ede8e677b915a773d8a9e7bc809b5a5ea7f974508717fd0e1065c1d
MD5 02e791865794f8d36139bba104eced1d
SHA1 7d9aba14a77c53d501806a5c5041bc27500333b5
SHA512 3f447453fc9b3b394064ea577f1b09f5e6336009825fb935ab39224cf348ed253aee1ecdc1ce4f433244adc31514f9c5e9648829995004367a0392dbcc58bd2e
SSDEEP 192:6RtcBzbd2NcjrGjJv7MF+pGPRpUYYssTxr9HHsb+WNJuaCJ8AZpnk23Fe7A22dkF:6RtmzbkjJgo+XW1wApe23Ff2mva6e
TLSH
T1D772D55AF810797B6CDAC22AF952BB67D3F5102261C41E94EAFC892C15E37CD321705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 34e7509cd68f917c112ed95fa3b5695ffae8c5eb707a11e978417481d2f813ee
MD5 ec9a55ed1a75376327d409cc08591360
SHA1 5f3d213f34d6d3aee93009221aed560bcff58200
SHA512 39630e785ba8455b9cd1b0576b18e862e55d125bd1ab4a6e46b646b0da01536f446db30b518b3579d1fe714bd374e6089a6261f1d75646d614c2942258588ab0
SSDEEP 192:6RtcBzbd2NcjrGtQv7MF+pAPRp2YYss+r9HHsb+WNJuaJO4AZ2fFNA22dkwPakZa:6RtmzbktMgoUXN1w4V2fFC2mvake
TLSH
T1B662C55AF910797B6CDAC22AF912BB53D3F5102261C42E94EAFC892C15E76CD321705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 bfbb017564499eea38d6cc64139778a4c0f313268ff6bd95da798036994bc63f
MD5 3f8d6e53d30df0dfcbf0b248c4246a19
SHA1 9144933da12e1cabcbe9472d5e2848c625a94cd2
SHA512 e7c2a33f8f8600996402513a48a82f0cde7d114ef3d156a056102e3c72e2ddc8904856e5690f1c877abf5da6fcc449c0a526aba46f02a4bae36967ce55722ef6
TLSH
T142C09241C209B068C09742B41912A8ACA204AF788919134842E0692A9838521802D261
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dc631.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5dc631.TMP
Size 96B
SHA256 16b6eb0c2b4c59d7619770a327f0b0f0292cfa231a76d11c4cd3a50fadeeb206
MD5 039ed28acd7e1b3b8cba169a5e55b15c
SHA1 65b75161a1405ec5a5ccd5e1c2a3196734b71d80
SHA512 9b4dfa537b3ce8151df3f9e7d5ccf9f03cf9bb9cc6d3aa8c347d27765429bacab5061ee86a928eb18c0c1e285a0910e9062c2456eb8cb8a33529565efe70fcba
TLSH
T1E1B02200C0023382C08303B0388382E83030CF20C203030282F00E2AEC203300228020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ae10aadcb4b968f94b34ab1792881bbf652ebf120d0591784d217c75ae4af796
MD5 74008b0d97ac58796ed6598031c742fe
SHA1 7842b966082ab4056d729d87eebc40622b12f798
SHA512 f6c47ff2b28cad3ba01292c35937878ea6cef207d70b9e5a2682d54d3bce21a5713873a798f16db0452e11c74eebfd7dbd2f9181bb6b2031e8ca0c7fb6d7a6c9
TLSH
T12FA0025421B06060D10D41B65085455812B19D100EA4020150A0019E885916C8533D16
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 eed88ee28b46b96626efb3c68f1fe614202ad829418e5b42011d632166201507
MD5 e8582d94bdfa968a0d1e23e2a3bbc848
SHA1 c3f58936a8bf80b1b238fa9c42df76a753a3095d
SHA512 dd2cd6d18805bb6f6d96e3ad30dfd7a9c0a69075d687cace0c167084d156de752d2c0189b59e8a78ec475039fe70db10319d880e98f1cced264fe097f04c8d1a
TLSH
T17CB0220820A8B822EB0E83FA00C2FC2832203C300A83C30230B8820C8802380F3E082B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 75d76f878a54209c42256c0d6dc4084bdd53ed0a0f36ef43e286d3130937b888
MD5 f7167b84143075ddd5ce60f5c33e86fe
SHA1 2eaa0ec5ae85a30285936c2cfe76f887453e9392
SHA512 5f3d429ebf6eee16d8fb914b0eb932776fc416ecde7fce807908f827e606d4d7c3378f6dba8b08b86b0bcb74f052f8d2cc548db066874698091b4ce04dc02b87
SSDEEP 6144:pE++cWvs9JEQl/ygum8EnsWZm7Rkm1tYpBeh2BAoP:pE++cWvs9JEK/Emhk9oBGcAoP
TLSH
T1C7341235AD29F9378375DB3E709F5F1F0EF2EE058A21D996D8F0660833DA5CA0A45824
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 244KB
SHA256 11dde455c999084edb1d41af300d83a69cda30eb5602382cb26fbabdbc30ada3
MD5 8bcb8d294ce8bbdf3182d77db91b36af
SHA1 b8ce52f2c40cba9c13902ddbe4b4e63a6986cb0a
SHA512 bd5fbd6ffb5dae09ca47ac534af6e044a154d5e2df5d0beb2512745fab89328c56a23ab0ca2713adc7ef714794e39f71d8ca1081ec66d140ea7995d5096fcdb9
SSDEEP 6144:6d4wv3ju0+gSZcRGatRfZ72SRSj5H2TF++cWvs9JEQl/ygum8EnsWJ:6mwvNSKGatRfdxgHKF++cWvs9JEK/EmP
TLSH
T15D3413347826F6438298CE2C6237FE2F8FE5FE0D5691D4E869D13168235B4D68E91C86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4adccef73d42ea7ec47b16d7f25156d3bddb46a994029256fac71181df3301b4
MD5 6e4959e16ff821bb7c4d47696c8b0977
SHA1 007964eab5c2685bfe47dc655638a3c56a470f47
SHA512 1278dfaa22872d725e1fd04308000c4d902776c3849825dac02f7f470815f831f903291ff6c7a6837da314050da185ead3a7f17cca5b4230ec4d7d561f388762
SSDEEP 3072:/iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Vm7Rkm1tYpBeh2BAoM
TLSH
T198C312275E75E9375878BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 86352d9fbb03d182a1391768ce71f91c5b682b8260cb16c036f3afeb359d65e7
MD5 6afcacb7a40979391f1b79d40886d976
SHA1 686eeeac320a1f152d9032c657e737cd6097181c
SHA512 a598052e1ca52f781112bb5e189aec2b5d0d0fb40400a1ab718e60d45cfabace5b7751a615a16e15d980a2099b699b9fb763d9c98083bb03aed399f020a913e7
SSDEEP 6144:pZ++cWvs9JEQl/ygum8EnsWZm7Rkm1tYpBeh2BAoP:pZ++cWvs9JEK/Emhk9oBGcAoP
TLSH
T1DA341235AD29F9378275DB3E709F5F1F0EF2EE058A21D996D8F0660833DA5CA0A45824
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 ecc10b76a03d7b1e5f4a4a9a1ee48b4f9346b75647a2ca29338605d2eebe2952
MD5 2232275290a06d2939fad934494ad776
SHA1 5cd9d8295bb50caeefc6e9458158ddeb2a8c88e8
SHA512 2e5dc2dc6f4f7029a1f732962d1730be1c881a002b9a7251005d44729ff3aef4b22f7fbd7b5c94a67ec7a74692817e116080a396e76a8ac89d7d5061baf7eb47
SSDEEP 6144:6Vwv3ju0+gSZcRGatRfZ72SRSj5H2TF++cWvs9JEQl/ygum8EnsWJ:6VwvNSKGatRfdxgHKF++cWvs9JEK/EmP
TLSH
T16E3413347826F6438298CE2C623BEE2F8FE9FD0D55D294E459E1317823578D68E91C87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 244KB
SHA256 7f8d1627fabd10ffca58ee5cc518a628c7acb9485a3193adae069487a8f7f0a6
MD5 27b6182d704dc933a28a87ecece43f06
SHA1 d08c4d121a6e31f53483a667165dfd73b7403e54
SHA512 15faec943377666002b4dea80efb854c157c08f94861541a27adf5cf77a465dfc8a49331ca49d1c8f49f296ef744b7119aa58d391d7d4b1a1ae43c0c0e9e7dd0
SSDEEP 6144:6Avwv3ju0+gSZcRGatRfZ72SRSj5H2TF++cWvs9JEQl/ygum8EnsWJ:62wvNSKGatRfdxgHKF++cWvs9JEK/EmP
TLSH
T19C3413347826F6438298CE2C6237FE2F8FE5FE0D56D1D4E869D13168235B4D68E91C86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 244KB
SHA256 d1551738c10209e805ee587da6462c25de7c4029e87d217423e0afb9813cb3b7
MD5 be83d831ba0670280b4b80cf746a1c02
SHA1 ff5ff7bee3fd684f5daa1c833d486a224f4ca0c7
SHA512 a48f704438e8f2ab56ac712e77e66564cd888dfaa89fe06928ce4ec9da5c4bcb2cc94805324500ec6e2ff67d594930d3ed1d530f2c6308f008e13b284adf2cdc
SSDEEP 6144:6g4wv3ju0+gSZcRGatRfZ72SRSj5H2TF++cWvs9JEQl/ygum8EnsWJ:6twvNSKGatRfdxgHKF++cWvs9JEK/EmP
TLSH
T16D3413347826F6438298CE2C6237FE2F8FE5FE0D5691D4E869D13168235B4D68E91C86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 244KB
SHA256 429bd1ab60b73f24f9b6b1d1cca83165adaa4c194b302b838b69756ee3e0f8a3
MD5 16e330d455ec22220c3f683a5fb12be6
SHA1 5d387c1888b20700db099c9b2a91a78eedfec654
SHA512 efeaf839095484848eb77b96081294300eece88a06fb19f0ddf2d3eaad957a147948afb4e0a015bd6befdfbf51828e3c8e817d6ea8d569886e48567a7d88d549
SSDEEP 6144:6ZSwv3ju0+gSZcRGatRfZ72SRSj5H2TF++cWvs9JEQl/ygum8EnsWJ:6AwvNSKGatRfdxgHKF++cWvs9JEK/EmP
TLSH
T1D93413347826F6438298CE2C6237FE2F8FE5FE0D5691D4E869D13168235B4D6CE91C86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 8b81a773562981ffa0cac5d856800ca4b0cea47303a870cdc9b5e862ca234af5
MD5 5bbd72837e51e8ac3a6df5274da16e64
SHA1 b9842a5e24e66693e4745dd4818c43400e27d70a
SHA512 6ae3adff0b4a3311d2d40942c230eba4e9d9940fc00bf68262b397f93a8b54d0251df36c33b3de486598d50fcdb2b47118f6221371612768f9ddeced95a0f9a2
SSDEEP 3072:dGI+/Wc0mg9bvtn69V5F9gJQlBFyguqEc8EnLQWOX:dl++cWvs9JEQl/ygum8EnsWI
TLSH
T198C31270BC2EBE538375CA39706BBA1F8EE5FB094613D999A5B0721D23CA48B4746805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f881497a94c5e9fd3a193112d5ac4eec835d21ecd71f3520112ffc51d32ed3e8
MD5 f3952ac0c0a91e2c8a6adaa292ca1c71
SHA1 6b9318c96187aa3d63b78c632b64c18560fb3b20
SHA512 00dc8fd5f2929939019f4486629a5cf87dccdc24ed9e5541d37511d11c0f5e78c4c0641e95d650a4827c6f78961d993f2856066665220054aa7c4d1cd38d1177
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T11CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5fd0dfd3d3bf3e7005f86201a11a7b14e5b70a804c20d2fab2dc7e18e83479c7
MD5 59dfe5a6038e1ae4c00480b3fa70dfbf
SHA1 d8b171ed62e85a9877f2b32db7bf807cb4576c47
SHA512 0cff21ef0bd37ce3d4f98e7940c908c3201d89cc50406b17dab09361007866bd0951b42f1ffce2eceef6f25882ea83f6afe53c995d82bb88973ce086556c906e
TLSH
T1BBD09730FD10A5A1D22A0071001006001E1404B220A782D1A024181CC9B8040C2EABAA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04fad8f1ea950b22260f49df420dc94d1f096a4b2dcdb30cbafa208171260917
MD5 7c2e87d21a449005a9a7c83403e34858
SHA1 58d9706d090e5072eb7d00b2dfa0b36881e2cd7e
SHA512 bbe43a84ed2462bd0ca9d3fb53399948bfde747f8d698b726c55b9e4357a5f3bedd1bc80d2d28e1ec1900bd1d819925967777ee9bde8a6101c1070c6c56128a7
TLSH
T115D02370FF00D621C51F51315815B7105F61457030EBCAB2D074685CD9EC458D3EF65A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d9dc9a171009cdc0d9909a2e43b4135179005c1dd7cade8932cfab30afaf3b07
MD5 8b7b8e0fdc326b1c3a98e35f779a9bc7
SHA1 0a3cff02f48a6b7192fc752be528524a353dc649
SHA512 de1a7dcb2bd2fb8ccf1ee5531bc5f371fa4bbad0257dd2dd0c0ce01ae2e0544d52d3e665ac7ab1cb07e2214ad000fff5c1a39639006b3a8a3d3048d5cef8cf78
TLSH
T189D02370FF00D621C51F51315C14B7106F6145B430EBCAB2D074685CD9EC458D3EF65A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

34da220d-58c1-4d98-8389-377542ce5aa9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\34da220d-58c1-4d98-8389-377542ce5aa9.tmp
Size 414B
SHA256 3c9c7fbe58913a39a721c0abb8cce738d50f54f1056428d7e61c38c44b8bc20d
MD5 d4729503f654cad72e200bd53e451921
SHA1 0466f49e6f57d234a1a965b5e8f341ef8ec962e3
SHA512 da60af0f431dc7c47f44c77320749d5f63fabd8431bdc11571dea0504811d6c29d9fddb6c37870be9988582c7579528ee596f4172011a5130d7fd9c79a218232
TLSH
T1E2E022BAC820ED2748FE172AA0844786FB44135B2BA0890B3B3ED21C8FF122A018585C
MD5 SHA1 SHA512 TLSH

Submit Download

59b11e2b-e9ec-4290-882a-394ee41c1925.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\59b11e2b-e9ec-4290-882a-394ee41c1925.tmp
Size 17KB
SHA256 e8a28d0474ab1491e98f2138c9ffb7c341d8c18381c12e4ce3c68d9e34fbaa51
MD5 dde815410167146ffe968d027b27979d
SHA1 2f02c8c3690b129867f0748488120b7674bad48b
SHA512 b5c6b4f15d1f4a78e7ec9a006175fe5a361d913d776d8664fa883c222152c04bc516a96f569d0cea66b4706242a0389ddef2ff47765dcce58ec04d16262573a6
SSDEEP 192:sxZ8ZRdyM/jK1Ml8UQ/0cB45/fAXsbPoVPdpvbCHVZHhX6+WNjOWcIdfGlfYv8V9:sxZWjqMm45/fqsbPwUHe4ISfToFCf67O
TLSH
T1FE82F956A62499B7CCCBD619BD71BF53D6F90422D9900E8CAAFCD91C00E76FD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6d79932eb340f0a1226b8e2402572cb9f9f6603020597a570980e5ffcf2f882b
MD5 329a908f07e0295b78f525be6db7efda
SHA1 b6a92c3aecc7c35dea97e183fe4d7d46164c6a46
SHA512 bf37af982307c55a74a375c82d31bfa7fc07b333a85a32eb134ff8ed34243eb2ea5fb4e2fd37b4f105b739346c8696cba6ecc7490b7eb37e3e0ab89c80b47fb4
TLSH
T197E0268807CACE6E9A11B58B51A8AB0C83C0371B9AC9B98B171885983402C40A3CBDB8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 dae339a6150c26d973e5dce05305d50116b458176ef2ae2ef0434fe1a521d662
MD5 eb3ad5e0e6652679cd989b314bb8f0c8
SHA1 d023f39ae9900235adafeb06f98bd169fe338fc3
SHA512 f97f046ac83ae085f9e6b5d3174df5e0b7367c446977a4b1ff54900d42c16c11722e76e9405659cfcf09b7b0af78f5abfb0f551941fcd42c5606279e9f916b47
TLSH
T147E020C525C4CA1FAA0465875278D38C43D0370B97C4B915271C8D4C340204462B7D68
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 eb0159ba2d075b1dd918e06ab433e3ee9b83a2a907d53b9024f98a3534d57cf4
MD5 35d4fb561118359b6286a896d7049a46
SHA1 56e9a7d4a649a6eeba78b60e7b6b13af9b4026fd
SHA512 3d5ef8fe206e3eed975a3a53b9dd506133a30db4bec8b98577c799358373e2736eccb25d4d880ce1e0f271d5bf2de77e6b711cfc8f68a4d0af8faf1630a868c2
TLSH
T180E0268C16C8CABFEA00A88752A8534CC3C0372B9FC8AB0A272C89943401050A286EA8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 30KB
SHA256 340e89f457d96357e5ce95d9f63f4432149ffe51ab7f72c4c671403806f0381c
MD5 421382895ce63b5c9ab695bc6a1b975b
SHA1 83159ce5df6cdf083dc6269a54d0ce10494eb1ac
SHA512 1f6f88fd415e1dbbb451fdb4cb23359fd549d259c9a876b9238d0f38c29440b2f80621f6ec4f014e2410b6c4e50943e524384111a008e6f1e1477c5fef589bc9
SSDEEP 384:myMG9v1lWvb3Z5UHuLwPXkkm+D3RVHPFP+srgpP0GeZzfU9wE8dc7TxxKAzqOePR:myMG9viF+HuL4LRVvdlUiEjhxNkR
TLSH
T1AAE2F13E0F5815148EE9DD4B4B1E6FB6C093179CCBB8A78D83185E21892458DDB3A7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 27KB
SHA256 d4ebb92a8d66731150c514aed8576323ac4b354bcb3bdf84a1584a537b6a84bf
MD5 bcd3d7c3dcc12d2a3b75003c8780893d
SHA1 e41bf331f2e24e19ef020f3024b00b2d903e1d7f
SHA512 7a089bcf0dedc8888ab3bcba878df1dfb1d47699f1a29c9b101818f45481d200c226001c05e532d9aa685c317d653c57b338fb46eca64c971e807a1555df1489
SSDEEP 384:5CbJ0IdzZgkvzjSSo9ywOclheWaieXK/UDp15Ku6MTWakHkKHxhG2pVP2naksn:5EJ0IFDSStzoQVN6MDp15gakHkGSaksn
TLSH
T1AAD2E1BE1838C18CB68B93D50FF5FF8501797C15A3C8952D81ED4732C3B2EA6DAA2494
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab
Size 18KB
SHA256 ad2895e897b6c16771512ffa71833897b7f5f1d877ac4f5c966adf8772b5e0e3
MD5 a866eef7e8dd5754dffb17c0e25aabc0
SHA1 0c23c814887291b5d273070c44018596f5102fc6
SHA512 992c98ead81ff20c891e43d43215e93fb3d2b09761acc13baf999f416821525638b078f6cf4313d460d74ddcb4bb027d0a5ea49a70af8d09a104241887a04bd8
SSDEEP 384:DJbVz/pDYG8Qg7qGPD7unGtNjRM8oLLdG6INvSHN/czQNyf/h1n7loOA1:DJbV7gH7uG3lToLLEHNvSHR8syHTV4
TLSH
T16482E0848A6575417A5DF2CEC3469797E20C53BF2C7B8B65F9B1C00D5920CC842AB79F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd
Size 42KB
SHA256 0d213282d171c3b73987cd5621075d87eeb1c89c5c90d6d814f7f35b6af23c70
MD5 23906688aea4b8d92e1384a493e3ed25
SHA1 6f2ae95d7f5bab4f0ff33fb52aaffbe6e0942b07
SHA512 9e183f39c37332ffa5700dc9cb0d2aac4f3fd7d69d6b5ec6c0cfb0a52a1cad1c5cb5bb4504953ebe3b6208772ce5d04cdaca5c4db68a626126b32cbe628efcdc
SSDEEP 768:qsNklb2PhTpO5fWelEdvcPz1rbviDUfAVadK:qqklKPd45fWeqdvIzVbYU6aA
TLSH
T138130F569DF0E485D44C777A86DD1940AAD70EC38D11640EBFADC9860F425849EEBBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 20KB
SHA256 e01b57abf3b1d0f90030e73d8862553bb47a47809d6b8feef23fe0a2dedcb139
MD5 64b71ad5b2a2230ebee9d7943f04ec5e
SHA1 a6a64a130aead8287c62136a3ef006c4f783461a
SHA512 dbc9d9bf3f146b1586e9468968cbadbb0bb0eb10df73e3999bcf9e07447b061b0d0c3c04b2c9dd36c7347c6d8eab4bf7a291d8e8b52804eabcae0dd062b0757a
SSDEEP 384:HrZ274dbpDaBQFVI0LOr8hGL0fXxQvLZYsYujJCljAvYdRZ7t:LZ28bEBQojCGL0p8NY3ut0SYbZp
TLSH
T119A2E100CE31DA1C17792FF0C8E15508161AB477975B329354B6F09B5BA3ED402AFAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1
Size 40KB
SHA256 db2f2d22e537e3a85c6fbdee326dd81dd98dcbc342b814301214fd6f443e74be
MD5 7db6ad712e0e6eb73bd1f1296640d18f
SHA1 22bba2f854a320cd509061cbcca648e26c004b45
SHA512 1e86237be3a1dd25f71da44eecb923f876dfcaabeac2ca000f6aabfe75b9ce13f5bafb20831fe27c3142e151ccef64ac1cf0448b5b42607617c75412179f5e9f
SSDEEP 768:RIZnUqbAWiWkD/HP9EVm7QDEmywOWzpwD+wWhUc1p/lKdUles4ORtp0FmyvKa:RIZiWiWkD/v9EIRnWzq+zhUIp/QKlesU
TLSH
T19013F24ACFC3796B779A5E141BB16E71C8C744330E6A0C635BD1BE11A390393E258F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 16KB
SHA256 21a3408dc7214f400e2f72ce0c7515f12112df8f36fa8b4591c48d945991aa93
MD5 e64294e570e1559438e9c9aeea761fdc
SHA1 a082d02a2660129bb0812dc3eaa2d87e1dddfa7a
SHA512 c61e7d90f126a7196ce3435a81d4004c0d387dba0bba1f427439297589b2f17117e1caeef6a077a0aa17eca4334b3446c0f907e96871281716d289246e31c42f
SSDEEP 384:qfrf1zlSPwzLcBSqld+z71l4CwANsfPWGMdt4ZM2mk:qL1zlTYBS6Yz71l4Y6fP8jAM/k
TLSH
T14D72D085F93CB6B1F6218ACCBA820A1454DE2E19D89EDB8A609154798BC010F7777B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3
Size 22KB
SHA256 d0cc7f66a701de987ebbca56840886171fc062642d2c9b989169f562f70b80c3
MD5 27002dc7a9be3069eae6a096848a2b4c
SHA1 4751c2f53b62356056ffe9206591639d338be8b8
SHA512 a03dc4a3c1e2bfc8443e9907fc6b4ad4608aa63254f7c00360d28967376d53fc395d652edce8c35fd38bf42b28aa08a2828044f41a3767d87221685b74cc2958
SSDEEP 384:Mw+OcYasrzBQ7r9u8FmNA/yC5shdxsBTyg77KdGkS8JwMqpNbtFKCCC3RV/iJHqB:Mw+OcYzzBaBNFN/yC58dMmwKM8JK1FKk
TLSH
T146A2D01FDF00002DDB5714798E3513A2F707129572A89DE0AB52E4BC9669BDF139013F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c4
Size 55KB
SHA256 f93c9253cd1ce427680ee35f06a0b72e48abe34bb4131b7cc6a9c53da7dbcc40
MD5 0153e0c363db72894421b6514feaae9a
SHA1 358d967bdc175905b0356affcfc315b1e4e54598
SHA512 a4ff6fc6870c61f2b7153585e61149adf040daa864b872ef56101871f53239fb775f2936909f56052cb7ec8ac3bbf23af6be6ebdc22b73e44e2815e94cb93e8e
SSDEEP 1536:/bXD59qyg7l7RcJweKC9jKE3Hl7fGP1g7QJPzQ2:/bznLghdc2el9JHl7MeyPzQ2
TLSH
T1AD43013C3164E6768B158AC8FD8B6C3E1FFC978EF1D09440A4E6146B28411F99A716F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c5
Size 24KB
SHA256 add8e62fcb0d994834a6dfe1d6ede21392365b9da1633648e5e8ec0e565ab06a
MD5 6c91bb09d3d9e35404ef95b0c4f14a3f
SHA1 54b8216d94af9c17a8dc310d8f64c04b2165d4e0
SHA512 c105128f51e12af87b2654d7c0683fb1045be29f4f7c5b6ae22394b1b0e1e1050b4e8c173ab70138f33fe2e0953fa36f4632db814806457228c5e6cfd616b4e0
SSDEEP 768:N8JJcJnZi6iE2CJSRpvELLgfkySZB2bRgBcQZ:ePcHivEvSDYkffdG2QZ
TLSH
T134B2E1AF9DE8BDD0548C8DEB3874EB08EA1768430873642FD6095F70919E5C61146A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6
Size 21KB
SHA256 f054ef0f7fcaaaa587d52e1f3561df53c132be74f11a49b9e4743afa9776451b
MD5 ed47995d1df8032a7c49d02b2fddeabb
SHA1 9d574087d7312e1658b84776a45589f5e1a3cd89
SHA512 6514dd57e84d5f73d98b9035e61b19aa0e295a91300534b33e1a4208e67dad47fbe76560ad5353a2ddbb97bbf3a248d35f85bf380a780ef0a6450579f91e7acf
SSDEEP 384:jJ8TzwOCAwVAE8eavJIJATN8OQYwTnBhpUN9ccHJpiaorfbhr3iepgq:jydqVAGavJmK8OhwDZI6QXi9bnWq
TLSH
T122A2E1BD2CFD13B003CA982C305AD2B1E4A61523E535758D41863DF96E4DD3B9D8E6B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c7
Size 59KB
SHA256 8c68fa6b025372033846aff9aa1e4794bf9d5fd01d4349679f87d007d34454be
MD5 43a13caf42b8bf984d8ebc29b60974a8
SHA1 21493ecf2dc155564c53e3c638f1329180287f53
SHA512 2d3233cc74694a911eb509450dc0a48da962ad513c557fe8a3f5dd12166523d5efc3c136a4f83022de1c6fb9043aef57eb5347e824a1a6a371638e36f33412b5
SSDEEP 1536:1bSLH+RkoAepb5Acu0go6CHTyJtYvr5iewM6m0t5F3:1by4pbGcuvky6rZ4N
TLSH
T1E55302D376C7F9E94D5007A9CB6058F3A8571A932CAC1D528E1A81A4FB88DCF8C1847F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c8
Size 23KB
SHA256 2888891088cc5ff01727bfff15efdb8835be5165a7c34b5501e7ac61c65f2c42
MD5 e64c2c4e804974d649da3efbb155ed61
SHA1 0bf6f748e0f0e5f16c45dc9be4dfda8641a067a5
SHA512 c59286565eb64958d2a0060ae2dd1bb3acd53dd6265c27ef63003d6a8810ba531d1b959d6c49734980a91687a67ea72a4a7216ab34c28316907ea913448b4ea9
SSDEEP 384:+NpwMzwYdbltF9j/nrVVQX4HTQgmEcXp9uGPtvfKhB3JwQJlHeJXwTEl:+3BtvVVlz5mEM9uWtvfyBZwQrH4XwQl
TLSH
T1AFB2D09FDFF629EE39A708AB07C33D3AB3EC4191B90918194D1791F93D218523538B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
Size 35KB
SHA256 5b98f4a624d5dc5ecb667a1555c56be235c44c1184d1076390980ebde11306f0
MD5 f320032fc288270eab9822e2207cf202
SHA1 000247f76061bde5410a152a9768081c347a492b
SHA512 232df35e33a224661cad11fb3c5bb501e05d9019d9f34f72d03891c3742a69a4e0a08e8f3d12c62e52f0f8f2eee066394be4295418fd75f2fdd2b5a19fc4e143
SSDEEP 768:dUjs4FbE4Jc6xFuiGiQd6qgnX6s55FjSWXdtNdxfo8m7e:T4R5S5iPu6LVLVpLe7e
TLSH
T144F2F1CD937C12E60AA9A3C1CC3130B664AD430DD291462BC696B38789847DFD4AF7BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ca

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ca
Size 35KB
SHA256 99e22f12f9324f1da761e073310c69e2d1c219902d370963d0a680e75b1353dd
MD5 d36a24f0e2d0780164df577dc05e8ccd
SHA1 fb1badc6862a6918f29cefac92930ce6c9eb759f
SHA512 532a66997a6ca6ab6062cab85525c4e3118cf18154c7467ec30c4aaeaeeed00f84f6d2a2c12086fb2ed0eb3637f3888eb163a02bd756d7af4d8d7f4c8bdeb434
SSDEEP 768:tEcjinToWlm6VsxkSIUjJIZEy9FSIH5zqO5tF6sNxhrzC:yoWlm6VsCbGGzHtFFDC
TLSH
T1C2F2F1053831B92FCD6CF34B53797B51E627ED76C815D62BA228433EC842EA5C909C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
Size 229KB
SHA256 93a3d10b882ee022593be52acb85381454867f4e868998ea414ce58c1a508dac
MD5 3b78e8d39466ebd4cd26ed9d3917726b
SHA1 fca2bb0eb22843856a09259b0404e2a15811e72f
SHA512 04890ce268f64773e3059fe75eec66272bd4de95eb36991f6d9c383a032e76e89b4450980ac9e85748dcd05391dd0a58c5320de988c621baac9fcbd44109121f
SSDEEP 6144:IQVvPKrSSRDxuaeqpV4+ix/53BCp34MIzFQ+3+:IcvirSSRD+qpSopIM86
TLSH
T13734238D39ACC0637BD387C18A373AC4543DA369F1913DBB191F189E4098DE55A28E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d5
Size 539KB
SHA256 23a7d43a7acae06199e820bc64c100df81e806d2b5985463c1c6b9c1a9e033f9
MD5 fb01f6c00c36e01261e34774a1259840
SHA1 b69c56e0b25c122c6058e0cf31e1a22efa40fe35
SHA512 a4e630bc0a24d117254e07bb32ceb0afc84df74716219708fbc7f9fe4030dd4e13e9431f21f6530b9c546967b1ebaa7a8cf4e0a86116805061224104865107e7
SSDEEP 12288:1x+kzj3hxOrHUGzW2Lb3jui3O5/V0DkzDOB9x5IDd/O6up:H+kzgbi2nuOO5/2Yzax5IZmJ
TLSH
T176C42397619C06F0AA3046E5804EC47CEFDE58882EFF7A5847E328BDFBD3B240659255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000119

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000119
Size 41KB
SHA256 44e8e608dda24bceeba3a6285bbdfb397d9472d035e0c9a6fe8be391dd2a5092
MD5 beebacafc3b60ba8936852666a54c911
SHA1 214191af995d00f72ed7b285205e049b970f0ad4
SHA512 18b51a54f0e6f6b65c64c8ac2e4370a5bfa9c69613765690ffe3b3ca04026b931f0d5aaf47272ee2c1382698d42a74e58e7064069159ab55c57d85f82b275ea7
SSDEEP 768:kt/d3eMYx2Jhh/kdiFn8U/W6+F2r9/IYK1f3W9i5fWlN5/i2KqZGMeH:YVOM1J/aiFn7/OYVINpGQfW4qxO
TLSH
T14D13F1201B2B7C7D0FD0817830B67769C9ECE9922B9FACD141CC86BF7D4A9312551A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 10KB
SHA256 e8247a8d0e8b10c2f03a07b69a8a9cb5c6fef9d74df1aec7d16250f66ffbf92d
MD5 a53682f670eb75e91dbe666fc98372f1
SHA1 bd2c452fb1539096501425c05f7a6881ab27b10a
SHA512 78d48b96c95e1e368f0583746d051c4ea89fe43612cc25989c221090eb7ae540748d6b6c8a3cc221862436a6f92847885da56972b1c8891a569c9e1cff9a88c7
SSDEEP 192:voG21xJ1VetbEIy1cMNpTTkSFwyXUiO+QK:vELwUoP2hO+QK
TLSH
T10C22B57786E9F5F9DBA4047510E98463353A82D8F4679FC3EE85553E1EA633030A027B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 13KB
SHA256 ca92aaff813f95e15766ecb20450e609cd74308a9bb3579f5fd90a3f91790fd7
MD5 c254824362e9b66b1bc66361858a4ad3
SHA1 14fed7c5ffd33eab09a19311266c861c7f62d120
SHA512 f9c68e5129ad8f0531adeec513cc2f0ba1b64886696638ffaab7cae7cf9196d2e161d41280fb0465e065e7fc98f5c0c80f1f6d62cc3c1276102f16edb2f890aa
SSDEEP 192:rfE76qaGYObN7G3FVWr6jtmzntKp0SywYzajgEtz2:g6Op2WKHyw6GZ6
TLSH
T17352F97746E5B5E9CB59043221DA9823393E84D4F52F9FC7EB855C3E1A2A7B120E2073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 13KB
SHA256 8ce9be27fbbca0bc13dea6d566fb728e92a6c298e74554a9ee55632a6b054ba4
MD5 be9a014d4d3e2271afb7ca824a084e75
SHA1 9431ec8e341662b203accd47557c02c8f1de8c82
SHA512 40e686008aaf2b33ee4d475b86e18b3a8cd5c759029a294d91b98009c4f5de92930581fe4f03658522b5b69563da006cb47e865ae76d34d570e295d1b413fd96
SSDEEP 192:XPOkAUHAWwbv7ZLTobWrS7AmztS+pWSyuSUK+P0SEllK:GkwH2bWuLryfjrnQ
TLSH
T10B52517792F5BAE9CB96057224EA6823353A80D4F827AFC3B9C55C3C1D2A77021B1137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 4371f9a68583b5e959562f6efadc7335e5d1d4d41e06744899d1b9016a487f5e
MD5 9097421c34448352e551a036853e285b
SHA1 ec9df41f10d552d6b624609cc0d8764e9b086097
SHA512 cba910ee1e2a35156062ed5064e7af144db03d014418f3e887f7a89e51c589576ec21a7baf6fc0ee4a3ba836cc3db70fd870d77fd113a69026c05fc41343f019
SSDEEP 96:YUr6PKWFypzJpzT6v1aHl1s1VgdFSBiSzBmEhOkZ7Jo9W8eYVQyfw:YOqxUpzTO1VMFSwiBmEhOt9zvw
TLSH
T106028EB746A1F4F8DB98087950EED473743980E4F43B9EC7AE8A643D5F2636001A06B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 6c27089878cc16422e3c718cb71f6ccda97181c4ab686a6cc87caa496387d642
MD5 9b8b0a56ca23494521ae4c7796b488d9
SHA1 6846d381b0fc5ac3b449d1ca31c243385f9b08de
SHA512 d651719f2f708498f8bfef3c2ebc7fa17eb39811722b0529506c6be29255bf0edc768a6da21fae96f6e2b52677c5250e80dc6b8e5d1e6e4e5a4a7f4d048aba40
SSDEEP 192:gNGQ/s1qkqye1rEsmjMHlJ4B+vdFiOaJDxj:gD01xG2+vyvDxj
TLSH
T165321F7747A5BAF5D784847110DAC823353A80D4F4A7AFCBFAE5E0BD1E293A000A1677
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 13KB
SHA256 1cf43006e490ad243785c5578eaa8826fd4c8d4a26da4431626613eb725901d0
MD5 b4217edf7878f59295a9aae7c19b322c
SHA1 d5e9edc8a4c7580f149af9d528b7525fd4e4e454
SHA512 aea57cd6289220caad08c57788b05a82404ebffa6c5ff5b56fb832c5a6e96b42e2e0d94325f2996f270c56703dbd22da4836e3631ec17c99bccd567e62c1e90c
SSDEEP 192:HW4fInESmaFDNC0YxgO80yvfEuWleNZgGX+WUaDBo4jpHZVP57afG8dn:dXCZ5vZbeo5pQ/n
TLSH
T180522A7743A9B5E9DB89053221DA9523393E84D4F62F9FC7EB81583E1E6A37110E2133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5909e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5909e9.TMP
Size 3KB
SHA256 ada98d40e209981f55010ddbb3aff018a3005f59031f8b7bb5c352de7188c586
MD5 87738aa4ca9379c92a0017b4a127ee24
SHA1 17634f9a6d7cd9a939afd68e598633bb8461c4c0
SHA512 3ee904d254c6b3ca484335c76dada09a6252bd8b515d832628dfbc5d302a2be64a4801187a3e81fcdc75b7bd59d9da6de75a649b875b0504ccfa5b0f24a60e58
TLSH
T12C714CBB07F1A8B8E3D04872A4D25555743DC2F9F807EE9AF6D085791E1172582F8174
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 6e6fbaff3978195b4c06a0a1829f9ccb5c8bff5da6967ea775b0ca8c22facddf
MD5 26060e1e276c59584cb12608214cfdaf
SHA1 824a903674eaf3ec429a5f94093c50ea884616fd
SHA512 21a3b82a937d5d0e29fa1b2d31bc52224d4b86f1bb509ebec8ad0a5a03ba7f68b279aa2990b46f91840e025246b3b66b347efbcf2ecce1ceb856aae9aae28c66
SSDEEP 3:MsEllllkEthXllkl2zE1:/M/xT02zw
TLSH
T1A14404047FD01555C51014314011D3D14370F43405355F433C55443FDCC55CC1C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 106KB
SHA256 9d722877d138624b1e368e0e1463f497ad48d36a0191b40839f65e9527bab668
MD5 325648caa3dd59c76c8fc2362fd0aabb
SHA1 df7855e4945046ed75137e598e75137c5ee30a0c
SHA512 9b330430c8b2685731879644ed3393529841a0ad36e082b7a7c3eecb2de289fecccb10a920bd7217e9278332b566994911ec69ee88ce53fb15b47de8f415ced9
SSDEEP 3072:yEA8aEA48EAZEANiEAmEAEaEAAEADSEAv:U
TLSH
T1B0B361FD7AB84C1BEB67832B6CE77E699536F100B980CC9870690D2983F2AC1551E743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6296a1461b5cc6d7e5c65fd58dea97fbef90e80b782be3b914ceb4872455a4ae
MD5 7f62a0a6148f2977cbe6610828e3e259
SHA1 914521820e7a84d4909d7375529ed6af87a3a905
SHA512 10248d2595d355044fb8b4d3625ee6c00357570faf0441d999654b35d26ed063703597873d6db030910e2a181e037dff5c3699dc69f8e6d273fcab3c40654c31
SSDEEP 192:DWGzNZGXMmF1JigvIiRa/a75f4LVuG1tjmzGkmHmDmtmBmgme:DWGzNZGXMmF1JigvIIa/a75f4ZuG1tjC
TLSH
T1A1D1BCF783F5862DDE1195F0AA18AF1FCE2C0551436C386A85E4AE07D3F2871E181B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f5581a49011e3534a128832209f3f1e58a7d72300e18f34c29a4186cf15cc5a1
MD5 af98ccbad26eaf4ec74cac05be04b3b2
SHA1 5615cb6dc00845e87ae6bd37120ec17de2e93c4c
SHA512 bd3b99d3857e79ff41a76bf3e8bd0e00b625739a0b2a49e21bf7df3992fee92a0171376a819dc283d47d54b84fb6cb32e7447d9f4e21b95e2c90598706c4bb2b
TLSH
T18A617AF787E5866DCD1256F0AA18BE1BCE2C0516832C3C2984E4BE17D3F3471E142A9E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0f4f69968d21b7d3595b4a7e4d690188e2d2537a856be55f8d18f62d2fa94fac
MD5 62eddb739391a9afeffff68529e8921e
SHA1 93dfc00df1a2d5b738d392354df963a3c23cb677
SHA512 cb4e778ae138bd670dec3d2c63d5d6f26cdd3588078a8da34e79fe0fa52280ee6337d826389f4af8be90a88777c0790b9f8069f1377b503f58ca6b9a7f66d7f7
TLSH
T17F71AAF787E5866ECA1256F0AA18BE1BCE2C0511832C3C2984E4BE1BD3F3471E141B5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 34cf134a4f3390a694575186785a5e5459f8982b9bd6a2dde88d3db1cabbdb33
MD5 522b1dcf6ce308e54e2a7cfc08a5a0a6
SHA1 a6fb6e4666f83c30bf3a6a57ee9a4866f86fccf2
SHA512 c21aac37bdc229608303ea077a1b49d833dc49b53e2ce2e63dfd07c2fa5e944208d5f672bea8c06cbee0db23b763aec442bbb30fc42fcf58dc4588fb4e5f5c82
SSDEEP 192:DWMGzm9NZGL1JigvIiRa/a75fYKLVuG1tjmDmzkmrmDmBmgmk:DWMGzm9NZGL1JigvIIa/a75fYKZuG1tR
TLSH
T12CD1ABF783F5862DDE1195F0AA18AF1FCE2C0511436C786985E4AE17D3F2871E181B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 251d35bfac2a64befaea0fc46c161beb943a30ad926656efc849ca13bc90f9e1
MD5 c7d68c26a965aab2a2d90f838c4b1e27
SHA1 f3720a49a51d5aac4d1a8f7602011d6664b628eb
SHA512 f0713459d430b65df07c1cc0131af06ba2c24a8de5bbc09a3db073d4c5954cab52d100bf61be24cb7154e270f5b3b1903f1a5e77b14ac471f138e739d0c04cad
SSDEEP 192:DWGzKwlim9I1JigvIiRxajijmDmHmDmtmBmgmzI51jGzWyS/tcT:DWGzKwlim9I1JigvIIxajijmDmHmDmtp
TLSH
T197D1AAF783F5822DDE1195F0AA18AF1FCE2C0551836C786A85E4AE17D3F2871E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 a7f1553adfee8382004531eaeed3d04df0cd4cb1b375cf395fb51958daf9d64c
MD5 7e4f25b2d0d9f68014d2a464157f84df
SHA1 d9b60181dd3572c67965dac1f0db06fda91d373e
SHA512 70c0e266105314d004ac5d188f47b5906272ae8890505228eee58896df9a2ea39d3c729f9dfa54f7a04331916d867f2407e9c0de32e71f5b17d66c3c95e1f4d2
TLSH
T1C0D02263230430BAAAAE3E8970EAAC8FC3264072482AEDD428D4AD9845364AC0717246
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58c2af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58c2af.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 4fad3422d6f486df8f3b60f49f7d9c8f36822d487413bdee229fe5fa8d167086
MD5 b7b98629e977483dc800fbe2fe4a7382
SHA1 e957f8f9781a6bc2786a588988bf9af03dc98a89
SHA512 1d682ae4f3291e6b5f89aea1a05bfd94695a9ebfd2213b3dffba6b68bb452c22b2d31ba35b90a8c1cdfaf8b6b5e77b0e4a897418896b40b07dd5d662670eb814
TLSH
T16141C2A7897F785B216998FF1D987809197CD83780A1A8F0DF9E857CF0959F70B17022
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 2ce79beea83fa53d8b30397532fb02a1666c6d3a0f8c5052c2dc9f8b8c8fe201
MD5 ea1dda8730e1ead09f4dbeafd91bd110
SHA1 96d21ce96b23591f28ef61953afa24e4557bf422
SHA512 4e2d804029c9c4b288308ebc5fbc8e70334a88ae969a152433910fd9c73819a304e6d1aeb47d748f9036a7e2677cb5bba932d089f9d108894d6ddc481d2d7b71
TLSH
T12B41E2A7897F785B206998FF1D987809197CD83740A1A4F0CB9E853CF0969F70B17026
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4f303519200205e094037123894641651e37dbc44dbb09ad681a28d8267e8f87
MD5 e8a665a4496e215345b68a601a60f115
SHA1 1708393f1bb211a71c5c85da21bebf0bbd85f054
SHA512 0cfaf49e19fce5a0fe99371f485b8a3c96ddd8d3af08161dac22ecb558f6d9ffb3b45ebe0cf473490032b9cf1c4bb695a58654fac1952eec3463855ed4ef2e5a
SSDEEP 192:sxZ8KRdyM/jK1Ml8M0cB15/fAXszgLVPdpT4HeHhX6+WNJWcI/Yv3VqlKIgr9CfT:sxZZjsm15/fqszg1zHeNI/HoJCf67O
TLSH
T14F72C6566624D977CCCBD609BD30BF53D6F905629A510E8CAAFCC91C00EB6FD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 00b20d8f17231bea10066fbdfca0bf35b597e6170758cc1ad9564b238592d643
MD5 0b5c377f845392b6b67c4a6173d8fdd5
SHA1 cbaa220336439faa416cfcf617f5fe295ea9b8e5
SHA512 c614d89bc5997f9abdacba71bc69deb5f2d9a27c771bc9fc6515aa20b5fb7b8d91418d33dc3fed6fc5ab9545e8401bf1e23a6777a7d464630753f0768b7f2855
SSDEEP 384:sxZWjqOm45/fqs/WvmPdEHeVIRdZSzCf67O:seeOm45/ftYmPmHeYZ7f67O
TLSH
T11B82E756A6249977CCCBD61DBD317F52D6F90422DA910E88AAFCD91C00EB7FD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d845a02cbab0f2b6dd25081b891f288444ed29f9d37d40e304274c136ff9d744
MD5 2576631a9b9ee33e736366e0dc3d052f
SHA1 694ef2d78b4ecd670011f91105693d325f7b294b
SHA512 54d22898bb15be237c1c1f297011c13cd415792149f588b32454456fd3109483bd7c361c8a75e29ff0eb1ab136401ef03598195987989dec6b49fc292c152c86
SSDEEP 192:sxZ8ZRdyM/jK1Ml8M0cB15/fAXsbgEVPdp9bCHV/HhX6+WNJWcI/Yv3VqlKIg5dU:sxZWjsm15/fqsbg0oHeNI/HoVCf67O
TLSH
T16B72E856A6249977CCCBD609BD30BF53D6F50822DA510E9C6AFCD91C00EB6FD221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ac50c4cf9f661c3b988ca7add373fce91832964619e33b04d86c1eed04a93651
MD5 e27431f64015b792ca08779d11f14c7e
SHA1 29348a7067ba16647f0a8e70e9e0a48fd9e16d48
SHA512 3ce7e29262a344bdc1e576485f10a7c50f9a958b028148d20489e891b8d83b2db8b9756ac5e58b61e546613eccec25419605586012e95829db90936aa75fbc88
SSDEEP 192:sxZ8ZRdyM/jK1Ml8MCcB15/fAXsbP1VPdp9bCHV0HhX6+WNJWcI/YvLDqlKIg5FU:sxZWjam15/fqsbP7HHeNI/PoFCf67O
TLSH
T1AD72F856A6249977CCCBD609BE71BF53D6F90422DA500E8CAAFCD91C00DB6FD221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 a13f77998494ee267d103926a891613549689360caaf8d9d5ec74656ccaf2d59
MD5 0b2dfedca5a52fbc3276aba8987a1a04
SHA1 9e12261d9ed368954d20cb65a0c76fcd633d0e94
SHA512 fb4ed71e77183e9681e59b028bcce43188e65e60678eb36cbca15e3b6cd7e90a7216ba316587822dc4b120fee0209e66478d65764d6107a689b8be90f9db2e69
SSDEEP 384:sxZ/pcqs2m45/fqsaAhWvOPOCaHHeVIR//w/CCf67O:sprPm45/fZhYOPOJHegwVf67O
TLSH
T138A2E746A5248977CDDBD619F9317F63D6F81523D9900E98AAFCD91C00EB6ED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 0ca6e31ef248a07f6c51d8127c776540d67066932ee830f2f0432d8d7ad4d4d8
MD5 d0ed30e0515d085db4a994c929bbdbb4
SHA1 8e46f2023a66171853ffa615204dd3428a442fd4
SHA512 959c67d343c229d13f36958b72aef141509b7c101ced8de0405fd514fcbf8b619ce9ef00089c18380df02bb409b7a4ed6674d887813e94093274a305603b3c5d
SSDEEP 384:sxZ/V8qOmu5/fqsaAhWvaPOEMyHepIR//p/CCf67O:sVLOmu5/fZhYaPOuHe8pVf67O
TLSH
T19BA2F746652099B7CDD7D619FD21BF63D6F81523CA910E98AAFCDD1C00EA7ED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e6dfa241570abe25a3e1e0db80703bbe8cb51aa8ce4ef3c9fbea54b4b72d3766
MD5 8bfa69011faf3993ef438efb19c10c7e
SHA1 99d95e5d2fcae175f3f123c01bd8906c94e275ea
SHA512 e37380679d20d9aadca0d09852ccf6469e38c3e64a8ce7299225d4a4542b4b21ccca777bcdc61365cabb3e59dd38325e92ad661083c47df12c55a55bb9874380
SSDEEP 768:ICseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppHroPm:ICseJ3xWvhfynu1jaVcL88pUe
TLSH
T182D2FB2B280CCB7E4F844E6CEC266F966EE801CB57984D5487FA880C02C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 f2f34d4df54c83246272567ea98bf81d9a9ce26fbbd88e2693075f2e72b419b2
MD5 558ff120518c40c0fe618a6bb026e67c
SHA1 c715013f5638ff316b15b645fa974a03df2e8b3c
SHA512 1eaf64878b35e40fce3fdec31f53656d61e6e72cd520eab65c9a7202ac14ef60fb6ab987757e3a4b8925ca756d62bbf65dae02516a6d20442b60b5f4f2056bc9
TLSH
T100A0022402E55493C40316B436D701B223145D50E201138541D98A49CCE25766A8305C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 316d98531f12656865deb31929c28897d5f402a6268d369ef8fe08156b18726b
MD5 26911c3d05e593d3ef406bce8ff26d4b
SHA1 a9d44ee8a3ec59b10670dbc1241b27e03bc0ccf1
SHA512 ab4780f3ba613c87cb104a717c001f77165c120c2a43c4c6383a2e299592500910ed5faaa68d77d1c56178a554b38d33d0f0d0a2337676be5fdf552aa3f59dbf
TLSH
T1AFA00454DFC00015C01333F1155313511344CFD031101707C0F14044DD50C5F5D4104C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\09f60bc3-5461-401c-a9ae-cb52f8d0e689\index-dir\the-real-index
Size 72B
SHA256 1f1035ff2bb6e3d10a5f928d6c4a293c18c32b6161cdc77058b49f3089a6de3a
MD5 48229dd8150901d35150b796852dcca1
SHA1 f11f47aaefe8bd446d4d6cfe4f25625b55f15914
SHA512 29536431f88e753e2e225a5dbd5a57d2a9ee2326dbcba1b144e6dc252d2fcdae6494150fe1059ec8e42ad244be8b077c401aadd218a00b00109ae065e09c2ff3
TLSH
T127A0021996682B43D80813B422F293872760ACD6AA2603455499914DC864189B51B04C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe6157b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\09f60bc3-5461-401c-a9ae-cb52f8d0e689\index-dir\the-real-index~RFe6157b4.TMP
Size 48B
SHA256 a6374efc73a9cef79761ae12cad93ef2028a06d26fb8078eecf45d28cdab3b2e
MD5 ce400d59e05badea2437de990c05870f
SHA1 bf99da0cea5e6ece60eab6c7cc59a149b95bff74
SHA512 1a39fac2b58163ea15de78de403263ce4029cb3c063e35e10aa9213ff8750a95d3b5f316a0297b62e693b0526c1b35c870c5edbb8ec2475ff93a983a5a1a18d6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\45dcec6f-aa01-4d60-b08c-c87ce78d75a5\index-dir\the-real-index
Size 72B
SHA256 014dc872fff359838ee3885b3dfde28005b8be5b6f9374f92846f1afe032b0ab
MD5 1377d59e7bc6f6539ceda7224e0f6c5e
SHA1 887af2fbdd08610f1ecccf604c076c32215e265e
SHA512 f5a68a99e25c19b879d8d6e226141e7cdab650dfa0cb72f704870158b854fa0a322b42022695fe1003f6fb7c60652625f817e1117ca78a0cd0aef3644f53c79d
TLSH
T11CA0026212E570D5C42117B1EB86155033145C151351830A80F0495D8D5D1DE4521684
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 3KB
SHA256 6cf3a21c85aeedfe04dd278a1a8b9b84b3c124221717f0e58e06e05417df919d
MD5 079831fc38ea0addc1f1cf32b30e58f8
SHA1 40c02882ba7123dae4f4366ea95011546771d77c
SHA512 63d77882a365a72a9560f6d8664266514d4d81f056f9232d63d6f9a4216c53341eba0c5fdf47de20f92202a2fe219d6d0f570194dd2075bae02763da35310f00
TLSH
T19251E70E8C865ADAEDAD11B368FB008437F6A4DD9584DB1B69DCA034BCC327A290B125
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 2KB
SHA256 686afb855b7c2c7f8472cde69e95fbbc661a75d5cd6390fbb03842dae934188f
MD5 c4989715e9ea3dcc40565598c5370e46
SHA1 5dcecef744561b45d05345f686f379b2bd157dbf
SHA512 566727285a7aea31991121e1fbef177adf2738de82ef984a8005941ceaa7d3fc100a303953b36e462674072e4b27b384c1d051fcbc0585413c69cdd3536676dd
TLSH
T12941190E4E50856FD8A884B314B224E837F0D8DC1B51A2274CFC163D7C173AF1C4B2A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f3477.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5f3477.TMP
Size 2KB
SHA256 7f0d268bbb00658f842eca65bab48fe1a00709e92d2d336e99768252271dc147
MD5 7601e8009d806114b6720185132e1584
SHA1 45bddbc5e9dc1e4a425b663ad1d69b701c74c67b
SHA512 03f4f62d2bb90bdbd7effbda7e47b1640654e52f3ffc69e9525ee0c1009ae59427e0312a369d6e27138fa6faa7c4c206a9402ac43def363c738ac4c41021911c
TLSH
T1A641868A4E41461FD8D044730A93B4A83339D94097127B47A4BC563BB8B17BD2D5E1D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 14f5e2c6bba323c25c9a974e4708e7f4d7a27441888e3b1647bc833994efdeb8
MD5 4841fb0d1887c8d72d05b27bb788c256
SHA1 fc77960731c88a74873d5b6a5f454a2c4aedf021
SHA512 7aae81fec2f74bcc848182e71422c4e1d82516abc6b50ed43aef2c82f9ade245d6f1135a2551b686f3375c732f35d9ce55a10acde49a104dc7a3fcd929eab850
TLSH
T165F027762FF72858BFABD3D26030C4900A097C59D842ED0E5816B59750B131534DEC66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 bab7f9ec48add34589585a6c986da393a8fc264fae7fd890149bd0fc863b2a93
MD5 a7ced7eb6b0ede8fd47729f27759f0ec
SHA1 9abc0144300fb32c7ea5609bfeb6bf6b5863567f
SHA512 250e1494cf16cf54cbce182d5c3d27b057e57c5d4fd6034cb38ddfb24bc31e1a93492bb742d6944897d9f3a0f169a09d6a7ac1fd25eff55f7b26f79bb861e90e
TLSH
T1D6F05C762FF72858FFAFD3D22030C4500A097899D551FC0E581AB597107235434DEC36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 68665cf9217f8c198a18665dc081791903c4c8bc98f2b600dbf90f4067050db5
MD5 c720df733c67415e0b1a6ca58f6b8097
SHA1 6e9a68a64930e3b4e620c399026d666113a22ca1
SHA512 64c82258782d3d788a7a7b814424834c97388fe69ecb3855a175fc76c191d511234c60b8c24c7bc5ac227552afc1a0a1f83b85acf2e1df03f0da142b51163b87
TLSH
T19EE0C0B62DD32454BEAFC3D22030C090060A749DE901FC0E541BF6C3107231530DBC35
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0b1ec83c66a6c092aa02399c5aaa76d4627d41ec92184f84d6b157b40c593b10
MD5 b6f6edda5eb7e61fd8121b5923a86265
SHA1 df2aac574084880c783a647ee0d1cd8a453a87bd
SHA512 841c6a6646d93cf279bb4a047f55639079c9ddee0dd3424bf383da992aa8ef061803ea1941002a8f4cf393621ccc71d5b8a357bece168541229fc0843796ff5a
TLSH
T18EA00222CD649182D11606709B6D11946E908CF88B05335243BC48D898A8560EA96105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f890f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f890f.TMP
Size 48B
SHA256 0cc16c389974cc296199152ca92f25db9126d15459bcae1b08ec6a84b171bb82
MD5 03e9ac388246d7d79f8727e8987c2ea8
SHA1 a587aa672f678c3d98262ccaa901f98138280d6b
SHA512 3d38865a15936b32a7e14bff5ff310a6409c083180b9300bd00336a2c4f5d49fbf38cb786093763760035078b6b34ac710c12dd49091309f597e317d7f6e6850
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9e9915350c81d83120379ab167f5dfea4c81357d58217e7db805f609b2554f23
MD5 3f17af7829c30497ea99403813c59da0
SHA1 89a916eb77230b012fa6d062d81831c77c6128e1
SHA512 fd99a85004ce96180548a257447f91e13018ce154d4e6e89b21b43d1901a39fb34119fccb532936dcfb783c6890000fde51f3612f22328ab2e5949ef2aa7313c
SSDEEP 48:KYHIhKggkXyi0InKxmUTyNrIlKkswAd0pt/:KYH+Kggmh0wKxmyurKKksld0pt/
TLSH
T15A919F0A303A0A123CBD3988B69196361F4631AB3528A46F7F7800524D6FD567EFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.19\data.txt
Size 150KB
SHA256 e589f794c343744314bb92dc03cb87b0aabe1a0e4df61bd77327638125d6e1a3
MD5 67a2e4e53750b6b992e203c4e98608bd
SHA1 f84203baa2f63c3dd4e3e6378e9d74faaa27a35b
SHA512 86c77bc809e6e9d80b1e1c16ad97f6a3e9fad6b010f322e0e1146c8cccbb9c0f71146a87e1e6094034c0adb5c2e5f9229a90551bea00b9df975a4a6c05246a6c
SSDEEP 3072:0PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEEn1dm//OKXXJ1RxGfI:YX1aI5aZoKzMJ07NC1d81xGg
TLSH
T11BE3F210CAC41FECDEA4262C60FE0F1D6790C78D883B6A89D7A7FE4A5F9750895274C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594e36.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594e36.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 561acc055becb5203d1fb700d27739381fcf9eccc0a5b613e348d36d944272a4
MD5 c6357bb807395f6162fcafad56391442
SHA1 d92fb684227947f09d813cd85b188d16ab75df5b
SHA512 2077c6c444ac3d3ca51c9d5156f5d319bb47da2f40e2ad975a7e3ae7d349f0ccbadcd2242e9877077b2ebae2651f3b8b3074cce826a2ee2c208da61152c46804
SSDEEP 384:nViFnZcImo3sNx8TUNTUlIRAT9NB7xa7Pm25ffhMdExMdUgDDARFSjf41O90kc90:cFP73UwgELcPmSMLUgoRjO9K9EGW
TLSH
T152F23CF094D29DB6D89D97C7A36DAD0269BCC137B4884498B3F4692DEC8B0BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 961696f3676ab16d7aed559416bfeea80dd8f88a970036b222481aeb74c18c36
MD5 c4b147f8a122c47e8404238aec4428cf
SHA1 8764a85c655259e15cf20de7e575db7039728436
SHA512 4800d666821ca6bf8bf2fb085bfb8c0860d1143d0675fe3a7ca0efacbb1b252e63024d2707ed2d7b2999007adca6ec2264e20b773936b4374b2660c6bfcad777
SSDEEP 384:nqiFnZcImo3sNn8TUNTUlIRAT9NB7xacPm25ffhMdExUCkNL3jw59hMPGxzHx/7F:hFP73ywgELnPmSMcErU5jMPIsW
TLSH
T1CFD270F198D389B7D8AE97C7637D6E0259BCC123B1884598B7E86D1CDC8A4BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 b74b8931e609355b7341348e1052a961d1bcfea6c3afb06d51fe8bd80a386da3
MD5 971b5859e81e738604314c8c33c0310c
SHA1 6cc42bad8af257dace993424c1b62836dd2f5536
SHA512 bc3214f787ea8fb4a44f04a35038a10aef22214509cc1a2eed7aa26641106af63d4e03aebc44ab3048e99ce09f5871a4d3001143c55be12ae56109c3258e3e74
SSDEEP 384:biFPZcIm7sNv8TUNTUlIl8NNB7xnOPm2QdExMdUN0bkU:2FH+iwg4L4PmlLUNakU
TLSH
T19FB207F248E7983AD9AEA747B77D3E024EBCC067B5C45A50B3985A0CCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e0b2402542b2c0087ad9d0318eb71b3f2bf31d94f54d20f8402329473f7e0a86
MD5 2b27e10a2d95789f5f7ce5383cfc55a0
SHA1 eabf4195d6117e6550d28d1eb995b8229dff85e5
SHA512 133b847cfd61fa26433ab1014500a89fc87bbdaf5a8855337508c2f440a3ae4ac038fa9a16d23ade0c383b959c97d6e3d38fa56ec7456301dec6bea8dac46750
SSDEEP 192:lONw6vMtPQmiUyRyThTQv+FdLYx5847A7U/u:lONw6UtRXT3dExBKU/u
TLSH
T1B802F735BC686C7BAAA3AD46F08A37171FF4516FA5D05B54EAE82F1C00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 e2bb8d81c64bac3d899911e6ac1e68543b404c155c5947ebc72dbbc6480e476f
MD5 0a33a5b13a2c1f0b62ffa018e7098ea0
SHA1 cb9f084d96d8b6ebf8dfcd4ca04681c1c6c1e170
SHA512 dfc153590f4781c3c64c1d760fb924d182faee5c71473b10a7f340a5609d167d57fac99c7e3bf6756ec5bb206b12b92d4b95f13ac648cf14a65d32a7c5c3cd09
SSDEEP 192:cONQ6vMKPQmiUyQy3hTQv+FdLYxTkFd3E980I0DqsU/u:cONQ6UKRA33dExMdUC0bU/u
TLSH
T1C4120C35A8746C376E927546F08A36135FF4826BE9C56B90E6ED2F1C01DB65C1306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8c45e8d12598a512e5b1c298bcab21c8c11c47afbd93a31fe30ad7a34a8ef49e
MD5 c882a4162368cba359c2207cbce1e04f
SHA1 38baa2acd8fa071769eadc2582ee5c1fb281a7b6
SHA512 8298c9a25b5547f40f10ce3f92143471de9ec8416131252f22a0a096973d33a299b72a3818a1dea81f2aafac3a435501555f8fe31088300fdd2eb43876fbe75f
SSDEEP 384:naiFPZcImnsN08TUNTUlIRAT9NB7xlMPm2QdExMdUmQwdHx/7IzZW:RFHaRwgELoPmlLUm5GW
TLSH
T181B2F6F158E79876D9AEA307A7BD2E025EFCD067B4805A50B3E85A0DCC821BFD307815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 6b505d55760565339a5ed0f0253f8e7bb68ac28cf86bf58da48b5de0e4a0ede4
MD5 50c8ddfdddf44924e0c487168f6a3e87
SHA1 b2e72c1b39ba7af794d112642c39ab658168ec9d
SHA512 5525b851341d31412004a481b86b3de32836284e6d5326e62a30eff8e6fb4171f2c6c9b17472e29146a6ce2694b12ec80d004b549014f9a9248c0f73e949e755
SSDEEP 192:uom+xasuheOwQxMGsNVwQvkNQM7YYx6miU1vUPy4MTQv+FdLYxTkFd3E38z10Dqq:wZcIhsNVwNNB7xB2P9QdExMdU80bkU
TLSH
T111626D71AC346C37A9E3B146F48636134EF4817BE6C82B90E5FD6F1D01DA6A8131BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b670bf1babb817ca1e5650480bde8a3434472283e1722937a0d1a8f19c686f52
MD5 03cd881e245680bf25556fa242568aab
SHA1 771de68caa500c133227fac722547bca9300027a
SHA512 fadfd8fed6bcfb326cf170aaebcad598ab6c486b45f6aa06595eff7ffaea87afea3d70c7567c99308bc41acebca1aedac97f881e1591c93fa4991cfbf13aa1e5
SSDEEP 384:nViFPZcImo3sN08TUNTUlIRAT9NB7xaOPm25Df4MdExMdUgQwdHx/7IzZW:cFH73RwgEL3PmVMLUg5GW
TLSH
T1ADD291F198D39976E8AE5387A77D2E429EFCD163B4884990B7D85D0CCC821BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 d9c76d249a96a58315fdc21d7554b45d14e6eba5905e66b0e003939c9d8dcad6
MD5 7730096da03f9bf0cc1858b0a643bb0a
SHA1 aef5eb3e86bec5c78dea5ff74f44f2077fef2342
SHA512 8dccc572c4b707913227a79c6512c874a999cd6ac8f1abe5789470ee04294953dc164c2758d8c70003ec03ae4c14ebc176a9013382ec0fbbb2ba9981e5001673
SSDEEP 192:uAm+xasuheOwQxMOsNVY5QvkNQM7YYx6miU1dUPm8BMTQv+FdLYxTkFd3E38z109:UZcItsNV8NNB7xBYPm2QdExMdU80bkU
TLSH
T1C4725C716C746C37A9E7B146F48636138EF4816BA6C82F90A5FD6F1D01DA6A8130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 ca71d6b088ebaf5258440ca6094c339578ab3d831040e83febc77ca20f5f5c53
MD5 05325a966194a0b4f76964bf6916b2c2
SHA1 bf56db465d86fdbd30f53e9a84000ed264cfc5dd
SHA512 05f02ee876303ca31b7818c1ec1fae25e6953e65bd4d85e4f28332d436ac11a59468ac78c0b5b8bf71198ee3b47689d90ef2944c242a3638defa133e76200610
SSDEEP 384:biFzZcIm4sNx8TUNTUlIR8UNB7xx8Pm2QdExMdUX9wvKV4BFihE2rjOK+Y4MkGpx:2FrpowgzLYPmlLUXss48uK+Y4MkckU
TLSH
T1B6E217E184D35CB6D45DA7C7A76DAE1259BCD037B4884508B3E4A62CEC8B5BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 74cdf86d8bda0798066d1433099b9ad2bcda7a13f3e9f99e7f55ccf37c0c69cd
MD5 38f4f65a8ce7be4e49017c23bad4ffe1
SHA1 d6e321f14c05b848ff0d272c658e985f99efe943
SHA512 7b7abd3b98fcdb36a1fb0e67aa409b43c738b53ff62b24574933b7a7fc800b9e8bfd2268ed7cafaf5890d50d3b042238dbf230a9674e25af08ffa86188882204
TLSH
T1DDE00203D30400F7C03C033045C3171437A3C03002E243574D1502743D113001E70D80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9ccf6b44fbda7d9e84de4b81a797479e08b21b64fd64189ffdff9c49b6ff554b
MD5 6fb018eb3eb6c8bc4122bfe45b1272a9
SHA1 42637749f7283d7480e8e1040a3c61c51b394e79
SHA512 ed9a5461df0c9e9b4110e26addce7d2307fa3e3f3bcd67766e037a548a97abac15a79e9f623fc8d6602b94e38414e6883d91654bc5bb75e1252891c6c430f439
TLSH
T17AE00112D30400F7C02C033445C71B143BE3D03002F243579E2502783D233052EB0F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3c624521a9ca80d444a63d23bba5345a5f42a54115af4f789a64b826f40ac7f6
MD5 846201fff4aa73a35b85c5511eb837f4
SHA1 283c36c034fc528e52ecb2fd8e21a9c3202a76c3
SHA512 c94e37b09a1194045d82f90e7c5e8295b797232e65ff3ad55676bbfdffdf8a9d7df402de96559d21dcc53f47b760cac35cedc7b32c94317db8c02772f6902274
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8591f47c22f442afdd6265d235bab74748ad22fdb2738b937da4fb7c0f3739f3
MD5 a94f5ae92525a336c2919a4d530abeb6
SHA1 81288ccd1f69614cd0477d04b82c61351e76dc4d
SHA512 bdff71550de487690a286b00b807a83ea5d03b5c0116d2497d3022be60e0577aa03e02416bd68e9e37bd3132308c1c699db948154bc22587d8b15e3d4981353e
TLSH
T18EE00102D30400F7C02C033445C71B143BA3C03002D243574E2502783D213012E70D80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5a2a499f3c6f3efd31ae65e0c075f1dd96bc0b8ff61f8ecc09cef9d3f740f6b5
MD5 f1558f9e19155c7018e9be06b7f1687c
SHA1 fd0762f01331d77e5fdaf39ac3e8c2420bab689c
SHA512 391da6a5c1230947a4cee7c1424e282dc0771d88c9af65d95f629b99661dbb214e6b1c4242935aeec0b2e212e42997b8fdac2c902ca6e357e84a6023c09dd3bb
TLSH
T160E00807930411F6D07D073545CB1B653BE7D17052E243579E35016C3D633552EB4F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6c592d8baba091e377d4e43b88feec38f7c7eca989067c9aeff750732ff2a608
MD5 4d0abdd1df8f79455762e97c9b8ed37a
SHA1 09442dd7db9f924d655813d5e54a9181c87c7464
SHA512 6c1dab49f54cf65e044baa5d9157929c5b63af300bf4a29685de0a31343d88308a7e5b9e179c0beadaccb8bc282a52402c5d8a0ac360b41280afb0bc2e3db57c
TLSH
T102E00407930412FAD0790B3845CB1B653BE7D13022E283679E2602683D223562EB0E90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6a5b61586b9f780d4322e2d26a4c77c9e6041b8afc74d758d0047cf97f6df778
MD5 5bdfde15a6998794ad6f5548ae2ad6ff
SHA1 b9b90625941092c1dda074c7050fc5d7d10bd080
SHA512 eeb0b5fd3ed0ad79328748eb39ba6c88100524e85eb8c28b226376f12240d91bd0ba22236e4d537553f8e2466745cd8b3b33fae085a44f49d85be4410c57187b
TLSH
T141E00902D30400F7D02C033845C71B153FE3D03002E243579E2502683D233062EB0E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8147e4fb46e2e4a70825da2d15110b7030ca985b062b7f068604317cc6aaf100
MD5 0bd7f1a0e9f4f3d867b46c0faeac3935
SHA1 4af78a846ad4e3e923a9b1a2bf2cc2284b5de8e4
SHA512 23990ebea23849bf54f01a174a215b40bf2ee9fe1c54d68ae04a023d6258679e7ec552cc91aa56c95d30f7c79b8c5b526c2370c93e44cb12ad8e18477ee83cc4
TLSH
T17FE00907D30412FBD06D073845C71B653BE3D03022E283679E3602683D223062EB0E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fa014d2ec5e65266eea75d25088ff63b2ab372bef4b7e3d8281f01a30ecdf41c
MD5 93f52d60e5f1c51b880cbed6a16cfc8d
SHA1 59364a4a1c0db6e310ca3632b851ad38986c948a
SHA512 86608eaf1ad940816d708a2c9bd925f7d4308f3eaf09b6f6d6ef1340e22c80250ca185ce5456a825de0a43d1ea428b4d179ebb802ce12cf2bf0ac7a2a7845027
TLSH
T191E00107970415FAD07D0739458B1B653BE7D17152E282579E35016C3D633562EB4FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58c9f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58c9f2.TMP
Size 392B
SHA256 9a0e93caa95ec7136251a184840f5489be517f183ce77c636f731161c3cb0cfd
MD5 d79ebe4df03d4c9d06ce3f007803a48c
SHA1 821faaf274ef04dda89aa1fab816fed2cbef942c
SHA512 c2db011ef6f8dbca5480fb4ce0cf6680b6b7e1860b8a2b01d3c2bb0eb129423ac6bff91df49697a983f06b115573435989fc5ab0dbf6a861f04e4caa4dd8d087
MD5 SHA1 SHA512

Submit Download

safety_tips.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb
Size 163KB
SHA256 854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666
MD5 bd6846ffa7f4cf897b5323e4a5dcd551
SHA1 a6596cdc8de199492791faa39ce6096cf39295cd
SHA512 aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b
SSDEEP 3072:K1W97njdmeMAYV2ig7ARGHNxmfltItcGJ97WgbT:K1WVZyArBmbI+IfX
TLSH
T1F7F33B49F85703A06F1780C98FAD62972504B2F47395CDDFB3BFB6A5AD40C9B10990BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb
Size 3KB
SHA256 3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e
MD5 17c10dbe88d84b9309e6d151923ce116
SHA1 9ad2553c061ddcc07e6f66ce4f9e30290c056bdf
SHA512 ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c
TLSH
T1895130C109286CC63CD599E71D55BA08B61B0DE846F9C3C2CC7E80894F4548362BADFD
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Advertising
Size 19KB
SHA256 5989ccf9a58e4ffd47c2422bd8dfcb3ea4e1d412fbdec2291385a9955af9eace
MD5 3495430eefd1e96e8bd95b67ccab0f91
SHA1 54129d2d72e062ad36a66922331818e81bd34df3
SHA512 9197537719b70837ce997cd2b168c6bf6fe877811f81459a0c0f1363b7179960594761df147c85034c628b8e9a3463084ac26fb8bcc3fbc765089adfeea56f6b
SSDEEP 384:/jA5024xyUE2oAklQth8rYWepdFhgX/0lRwjTV2qh8NmrbijF4E5C65aNbC:q0WCoAklQcrJepdFeP0lmjTV2qSV9C6P
TLSH
T162925151887035622F2F50CEE0583F8E1199767540AEE6DE9FE48666F28C0F37494EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Analytics
Size 4KB
SHA256 163a5318312b814104d244a4b37b676a02f827068820aa60fc069e6346cb2b75
MD5 db9a3dbc4820c8d84a0a569be1234dc0
SHA1 78fe9b49b800627cd2eb458cbe0251591a2a693a
SHA512 a6735713a801d28e644b31f34335e29d55a46d4b263e923cbec9b57fd18f8b0cecf9b78fab578065207080faa5e81156d04c8fbedb436b718893b6d17123742c
SSDEEP 96:2eHeEcb6eD0Hl1LJEmjwsi4RjBzGPeKkF7y5W4jNU/oyw:2/EcWeQ0d4OZkVkW4jNoo1
TLSH
T105817615A4A024423F2E5668E03C76F911E8253880F6F7D5EFB19975B30C0D778E497E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompatExceptions

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
TLSH
T1E101E6F18EBD58313C74967C876C0E8FB9A5636F2898F2E96502CC87E3C054761A6C78
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Content
Size 4KB
SHA256 7869993fcb93b302598643be96c6ab94c4f3be47c9fc344959773c754291376e
MD5 26c006f350f70dbc8c18098b773c3d4c
SHA1 eb015f7010dd74c874675d0599e634027363b7b4
SHA512 0f56d119a5f89689d0e45a6163133048aa95255447c4156d4fb2565f45c32dbb95adc39666a833d2127ce57f3f4198ce45d2a174955ec088bcdd2f74f59b3f6b
SSDEEP 96:lApOOxO7bthcySBm1yJJzyEsQBCETe+yH:+xqT6mcJJz4QBXTeBH
TLSH
T13F91B8037E4409276E95D005C0ED209E2DB5ABB0C85DDDC99B964B7FBBC8C8BA4961FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Cryptomining
Size 668B
SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
MD5 95aa820d67ec466eb3444a9458eb7e56
SHA1 f93e178ff40310e071e4d596f0aff0514666f787
SHA512 15281c334f013f0200ca2d6faaaec81dc5602058cf3522b805e21ca5f031cb4ca68606d353e6745bfb86f07fdd6ccc892942aee5ad7cf0f9f0798a4d7f497a47
TLSH
T1FE01D3D7D86197676FE25AD1D02E73C9F04456F26050F7C10F55315857A8A432794CE8
MD5 SHA1 SHA512 TLSH

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Entities
Size 68KB
SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
MD5 478a605d5578236f2d1ddc93c2f22456
SHA1 917f05453d497b3e3de684a905e141972c34a267
SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
TLSH
T152630877BC500D3384FB804BB09D2D6C21249FE5D8ABFED89BB1516612839C4B5D86FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Fingerprinting
Size 1KB
SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
MD5 3d90e5235a4bee8f1dccfc2aecf7c585
SHA1 5beb333084b3af33e7fbd8c83326e18650a87f85
SHA512 c81af723cadaa57f638b9dbc60aca5d2600cebb8282d78a7b86edc6b473bd3a1768c8fde1b11d50b6b967b2866495655de09577973778038434bf4b513ba74a7
TLSH
T180214F8685D038316E6E148CD55C3B9C12EA3A7040E6F6DCCEF486A0B50489F7280CA7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\LICENSE
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
TLSH
T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Social
Size 754B
SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
MD5 1d06d58fe9131c14ba5ba5ff740b020f
SHA1 e6ed812e23e201b20170e928686a5d612165df85
SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
TLSH
T14E0126DB1A1450027FAAC495E4458B6948B00630445DFDE582B8D27BA08EC97F39F7B9
MD5 SHA1 SHA512 TLSH

Submit Download

TransparentAdvertisers

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\TransparentAdvertisers
Size 105B
SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
MD5 57d5a3548911886de2f3bd3172e808ed
SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
TLSH
T1FEB00170D480008ADF4062C1D032DD98E08D5377A138C4CAAAF80C66F2433CAD1A38F9
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Advertising
Size 20KB
SHA256 868f3ed3f86f1e82a5041f0a7b382bdd720e411531df2dc680da34eb60580b75
MD5 6959a6835772c67f4e72105e4be259a2
SHA1 72d1fe9070a5c0eed55d989cbd961dbc5442796c
SHA512 98085236a15e810642602e5dd475aa5a9532bb38917aef784e977bb398b3f9e39f7966370d39c1b554cf3e39858713e8b45bc27fbdb8a701b2a903e453a67591
SSDEEP 384:5z8Qpkm9jXUmEtMANAgFYNX8htrCoEeZCNyn9CbRqKi8iyZd0KE:1lb9TU/t9NAgFYNMhte1eZ0yn9is38iT
TLSH
T10292C261986035523EAF019DF1993FCD69A4633080E9FAE9CFA0C636B35D4D335948FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Analytics
Size 3KB
SHA256 33d2b069ea874c12ec96242ca7eb539c1086d38ac6c2e4858c0efcd74fc632e5
MD5 e018dfa2df54c80ffbfd02c6d2ff5430
SHA1 de3f876b05355c6024d76f1bc24a552e532e2a2a
SHA512 b6d7886b4094837b271d1aa1f72b8c521970527552186604bcb83e17f85fa4a22e658628f79eca7d164ace781555abaa07c423a380fe87006aaed77f53e37838
TLSH
T16C61D918252024211F1B526AE55D3E8E69F4233904F8F7E08FF04EB5B10A4E738E5B77
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Content
Size 5KB
SHA256 d99df5936c57a50aebb7f0a3ca65fcc682f523ace93641fbcfb9b09cfb71c739
MD5 dee2a727844dd3cea088941e82722406
SHA1 24ebec9b92eeb6af83841ab02e858f415580f719
SHA512 e48edf5f6dcbbd615f42f1b3181b2998bd700508094466009a6a48193a48c3e30e6c4d71cc43aae81d18a88ad9fd7e28eb50a0a52ca6889a270001fecdb64dfb
SSDEEP 96:PwYuGYJywH2R7pBBYy+wf0yhZ7RBJ1ja8nBwGhQmxpFD1Lcg:Pnf03H2/KwfNL7vNTBR
TLSH
T152B154B2855079922F7D01D2F9D6225088E482715CBEEBC747A1C61CCD1EDE735A835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Entities
Size 106KB
SHA256 0f305323c627cf0c790831c7e0bc38455b7a99983c4ab5bd9d2d9567766c3499
MD5 751e7cc660220e7464935a9b90643274
SHA1 05a725af45c74a9e129839b2fa7acca5d83066d8
SHA512 bc879a9bed224b6abdaed2581f948fcad53361b17dc76d5b5df10607ac893db2f39bc5ce5fbbe86e6392ae66f29fc93ac1079fd2d029b9338697b004325c4b36
SSDEEP 1536:PYNbfqJF3b6wgb6hh2Dgf+x8GC2kMYdSKySPxVMRjAxUR9Wv:Gbi3M6hjf+W2kMk26VMRjaUX4
TLSH
T131B3E73C9F70C4295EE7000B6C28B95846142BD59E87DDC4EEBF7A090272AF536A85F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Fingerprinting
Size 2KB
SHA256 ec0fcbf71d58e707aaf6ba8d3c0719972f26727febe03f8efbf570b9635faddf
MD5 5330ccc991b45c6f2777d23c7d8afe8d
SHA1 d11187c035458fe1201608a91062962903de2e53
SHA512 2db42b7a6b7f2170f6cad2a26a606ff6357cb8c707ba9947baab14dd7f566df04a274e46e36cee72c43ee87ebf4d455b4af3f6da973f29bdbefeb0304f1d6f93
TLSH
T1A3414422581030617E7D49DCF59A3F0D29D9613A84C9F6D6DFE08936722E8E734A4896
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\LICENSE
Size 66B
SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
MD5 5b7baf861a48c045d997992424b5877b
SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
TLSH
T1A8A0025216021A6312E295EA5E589B4FA50A1AD5255C0341164904D898B01D995E87AE
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Other
Size 198B
SHA256 c9ab8dbc87043c71dd649fc06bb006e7f62e81c973c37b125afb88e654e436f8
MD5 7bb2f4076e4f47781b77d811b21ef1ff
SHA1 fc0feddf6f52841bbd780d21b8e0ddff74fd70ac
SHA512 28356614bc38576ecb37218f9f6f631bd9e55573206c3aa854b91956a33fc828c71f42c7dc7dc6aa86540dab8e345b8f88bf9c6eb56e49824f492854c193b27b
TLSH
T1B4D01250151A5B0D6FEA41D1DA8055241DA19DF474CFF8CC5555B032E68895729C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Social
Size 3KB
SHA256 e520603e6fb543cd078b2a7dbd8ccfc175e9aecf71654fc19785927a014d3435
MD5 fbfc314bba2160b09a3376521c762772
SHA1 3566357486c5d466958334e813c90c0a97bfc985
SHA512 e4383491ce5170d0daf4abee61484c62611dfc604549b537d0080f24bfb8cf379ec3efbfb6caf10e7c066ec06457fb077832d5f780d226f0a957f624e0ba9383
TLSH
T17161DD36C590A9932E5D0C41EEC55E700DD8157ECCA6F4D287B082F8F0AD8977D94BAB
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.29.1\typosquatting_list.pb
Size 927KB
SHA256 8da21018e6a6063f029ab8f81ef3de28adbd1740594d43934a231e9bc8458496
MD5 21617bc586960af1751aee4ef90d7b7e
SHA1 8e44d591d02917d5470a382ba5ecb31d03f0cec3
SHA512 75afeab96c768f0647940e940d0e842b2ecd422628a9c0adae06442dc6a27020c85ab03580e6f56382cc2dba3c6cca1f3b8b3e42194f5d27c211075a1faffb27
SSDEEP 12288:a6q8A6KIEJiCG5sskil3XYXHm+nQBfjvG605F0:jGskil3XYXHmyQT
TLSH
T1B215B5B9DFC00194DBB8112D20BE71D8181412A540E9EFEAFE7C855F2BC29C977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 55e365aca725e38415545a99cc8818076700c73007de958203396e83a2f8e045
MD5 b97506f0f9374eaab27b685fc0139c50
SHA1 0a3cdf622604da8117b93b38be0fa9f23db983c0
SHA512 615c7bc6a56a6f327b4a64eacabfaa8891460217e66fd3e4e90da78b04085a34410ebcc4b36d5a3454c74ec53dd7befd4aed666a411e27969051a24e19113ca9
TLSH
T1902111A1183E1AC6C5BD0DEFB0973AFD50D89221F8E834382898ED64963D52D359087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a275aa0cd0cbe72de8098e1889ac38bcb8c4fe8c382e489954e1414dfd0cb282
MD5 54c4d380b27e3ff7412fcc2e6256309b
SHA1 8cf836025065eefc14266e6aefdead08c22241bf
SHA512 7f9382dc14b9b926dad2b08c4d93547880d61de5c7f9f698cf9a8e20b6be6e351b9503064999476b9cb5d6a890ea58b798658ac8591f3057ab5d413ec43cae44
TLSH
T13A3120E11C3D1AC2C8BE0DAFB49739FC94E8D322F9A430382898E954562D51E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 d04725eb3aefa64acc17ff2c46617ee06b0c24b54b59e75f9c3c4943efc97f7c
MD5 d09d013cff390008f01ef5c50c0a28d4
SHA1 4902580f2168d4c45a0e74133e4f54cc651ec905
SHA512 60a73f5750f2964083e1661521e7472fe768311e3f395f83489c05a55d52c429a1fe11633f176fca36af399c73544dfee8a23754183775523e654471e8f12ee8
TLSH
T14CF0D4D14C3F16C7C9AD0E7E64071BFC54D45616B4DC383404CDE5D5907A42F319542E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d852b37597a07a56b80d051ddd197073631d6b0d2568856ea7baa2f19bbdfa12
MD5 218929c0305966ae1fae9814f063b35d
SHA1 89c55b390870ab8ae7529ff930547d301b43ff87
SHA512 5ae1017f9612b55b22932663e95ecba1b550e99956a4f7e97e1216255c6b3d71d972a47a7c79aa65f61fdc4156b9709e5028cf235332b0b4eac867bd72831b5c
TLSH
T1B41112E11C7A1AC7C5BD0EAFA4833AFD50D8A215F4E830341898ED54962D41D255187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1070ca28f48110fa0eee7ef3f8fca97433e9582eb2f928e02038741362610610
MD5 1f391883d912ccc44a9b60c20fd49d5d
SHA1 b151a7d731129bfb1dadc00d20fe50a5a7250e5d
SHA512 d0dd19fe4672eb35c1935cbb19f46c8659f48244ec7383425941dd2e953cece7a0f2b8dc44acefbc5169ea27c93a7e22f1b6722008b8bfc279b81bc23a5b2a6c
TLSH
T15B312FE1083D0AD2C4BE0DEFB49729FC94E8D221F8A834382898E998566D51E355083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1dc0b7d1042df1d94c7dcf560c28dc73604f548fa0353f7e561870ef46448332
MD5 b5e4b21a4589ba9a98769ecf7a53dfa2
SHA1 645e918085f70ad8aa80a0c05ef4870760fd0723
SHA512 e9d4119324d435401f2e362777f9b674ce9ca535ce3e2544754e199f5a2f09716af1c3928efd12650d939d7c964ee6c6b2f373adcf6e292539e48083aae50fd9
TLSH
T1474122E04C3D1AC2C4FD0DAFB49B39FC94D89722F9A4303828A8EA58562D61D358483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 99188f80ba7a5e43755fb9967d4c6bf9e4664108aab74d09b8f00cf053e595ea
MD5 7666f54bb9616378eb7a15f341ceedb9
SHA1 eea704a0bd28d324d91d31d5937fb4fbb3ae460e
SHA512 ec4e51a1197c45c8a6affab375906a0022007e62f22179c7bdaf31d74aab6fdcf383c079d8edc169fa4600759a72b0244e5bbb8831e4eb93a177a4d573929a63
TLSH
T15C4110E04C391AD1C4BD0DAF749739FC84E8D726F9A4303828A8EA58567961D358083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 14676d1e7dbf07d5d6a065b702146a27cf05477e9ada201c6f775bfc6ab1495b
MD5 09299c71d0eb1f6b01067d63e96dfb68
SHA1 5c0fb99870e4e6e87e464e70455cde4787101a3f
SHA512 e83f41866570596224082a94894979b66a3d3f5961bf6bb87272634ca1971974782ea70cb6462cf6f6198a73a558c5aa819717dba559ec4c832e3271c03bbdef
TLSH
T1C93122E04C3D0AD2C4BD0DFFB48B39FC84D89322F9A430382898E958562D61E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 bc6225cf5da2c7c76b20dc9a6ec3743f0222ed6e767b98acb614f4f4142f79e5
MD5 9f317ef1bdd084e75dd21031ae7f974a
SHA1 4be6837e5559358ffc804096d600a6a1e5253406
SHA512 23b9a00f46396a5cedf9f43e8a30e5ad5a4ba50b02beec2d95f6776d8238b79f7cbac9775856f5404fcfc92b8e25322c1ef3f86af490c1b7906b9adc540356d4
TLSH
T1EE3101E04C391AD5C4FD0DBFB48B39FC95D89722F594303828A8E954966D61D354483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 a06aa42731ed666d809f098540e5448cf7e4e235b7f4cee91d5c2b7e6a4ec77b
MD5 2f975a1be4b203ccab9ca50974b9f996
SHA1 dd55029300ea897721935fb19087f4b7a5fe522e
SHA512 bc64a30960310487745ce3b9bd43458d6f423ed82e01f81da5d2299ce975d509dac7766b06d3d81a3542518a8a320998b6456ccb0add68ef0333d550e6f62c31
TLSH
T1ADF0A2D10C3A1B87C96D0EAEA0471BFC54D59516B1D8347418DDE4A5857982E349141E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 966a7ad63e514ae1146010e4c23a80bc2a3c1bcc4334e15457160eeaabfdd977
MD5 0de75cc64337f4fa8057967e0fd42c73
SHA1 5e614eccd8cb40caf18b22683dfefe5511fc96fd
SHA512 c12a52ed55d0601e7f9bce3ef475173c4786712b3a00dec853fc25106d0753123f82363974151af0e2ed463703e088d13729a92fb85d21dadcbe1e6a7dda1531
TLSH
T16C0110E10C7A1AC7CABD0EAEA0832BEC14D46526B5DC347418DCE460817841D349182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 4798637edd24a84c193bde8fb00369f7cfd99df412fceb49a7e54ddcbf6840a7
MD5 45f36c95f67dea416e2d491caa802a08
SHA1 11e2701225193283456b1a8f4773517c31e8e262
SHA512 bc380da8086016c64b5587b211e958bb25906fdddd67d5a9e8f012f09607a80f80ca1dd04d3a0c0592ad6aa3e9f7990eddaca1251d972cd6bba7c3746e5ad12c
TLSH
T1FE0141D10C7F1AC7CABE0EAF60873AFD54D8A626F5AC30381CD8E964817842D345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 2d4949769ea41d19d6eb7af48b5ae31d7b2c23328e589cba4f9d510a658a104d
MD5 e42e4d80710ce4f98d2cb6e9d7a022a6
SHA1 308b6329c4569018ae0a0163e0940a306a4b1e37
SHA512 b0e40e04ea80249a1c3575c74b0006f9de2da1fbe6cc8734d87e76d36514845f499ca550d072a15d3fde27ab936fbeca9dfdba2b123eb6b079450985274c0414
TLSH
T19F1144E10C7E1AC7C9BE0EAFA4833EFD50D8A725F5E8303818D8E954527851E345186F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 14bed630afbe7d672d1262fca749a604c771010667628507d1b746f55e7f63ca
MD5 d91a92e28d5d97d9dc5a68da9d8c9948
SHA1 78ee8c6374aabd2da2e404707b4a49295395d7fb
SHA512 bc1c913edbb136c136116ff284a5c08f5b548cddcd9abd257825c0282b43ee4abc56e6586daff3de24a99864bc1ebe637a98b201f422925620a81bcde5916ea7
TLSH
T14D4142E04C3D1AD1D4BD0EAFB49738FC84E8D726F8A4303828A8EA58467D61D354443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0c2d409ca967bacae4ba5559db9ac50f15ce35f47692d620afd5349f033ca8f6
MD5 6b730b5fc7dc649ffb89db23ed2fcc68
SHA1 38ac2091d064e9e237910b5046108660fa63ee84
SHA512 3ceaa43aa3d85e17d6cccc965cbce6d630a79072b64a6474ea77122507e2494c92a6f99a9d5c250827216cc440f27154b3a849f356108004479e0be98ba20c9f
TLSH
T1D221F3A1183E1AC2C5BD0DEFB49729FC54E89211F49834382898E9A4567D51D359087F
MD5 SHA1 SHA512 TLSH

Submit Download

e77ea3bc-80da-4896-b9b3-5a2f7e6e1431.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e77ea3bc-80da-4896-b9b3-5a2f7e6e1431.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 48deaa7f252c94f804f92faab9ded9efd50f416039c4ab194c71ebc37f6e0bb6
MD5 be060aad3cad6249c74f62836e954330
SHA1 e82f5aba81c2d2265e845f8d0fc16febf0a946e3
SHA512 a61a92845d3829ef2a44acc6a2be33c33c911c76b3567304c9e6395c05e9652af2a6d166430f90b6389c5f2cef010a648a4fcf7205e52beaf23e3dd9753a3ba8
TLSH
T1EB410A5CB6F91158B3776F4A9BF6A86E487FB8772E06D46E10110E4F0A22B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

036d2891-471b-4831-bc07-c8b38bc08ac3.tmp

Path C:\Users\Admin\AppData\Local\Temp\036d2891-471b-4831-bc07-c8b38bc08ac3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6c33f306-dfbf-4d2c-9e09-1af6155ad2f8.tmp

Path C:\Users\Admin\AppData\Local\Temp\6c33f306-dfbf-4d2c-9e09-1af6155ad2f8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2772_1438328549\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc66d643-81af-45a9-b97d-6b57cdff6bd1.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2772_851637224\bc66d643-81af-45a9-b97d-6b57cdff6bd1.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 22B
SHA256 0994bef5e49e421d0af1c4833f5410e131f3f2a49ccc5d217a553f41ca59cb86
MD5 14f705f549f3028d93387168a973b57d
SHA1 904d2cdfa31872976e6144d3049fd93241077cb6
SHA512 2f7dc1827e66c6dbd89c189fa87250971ad033490489f657a6939b5bf30e6e7eadc36deb1d215afb622418b9cea01c7fce321acb2335d3f2b73795d8fccf2052
MD5 SHA1 SHA512

Submit Download

version

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\user_data\cache\version
Size 4B
SHA256 67abdd721024f0ff4e0b3f4c2fc13bc5bad42d0b7851d456d88d203d15aaa450
MD5 4352d88a78aa39750bf70cd6f27bcaa5
SHA1 3c585604e87f855973731fea83e21fab9392d2fc
SHA512 edf92e3d4f80fc47d948ea2f17b9bfc742d34e2e785a7a4927f3e261e8bd9d400b648bff2123b8396d24fb28f5869979e08d58b4b5d156e640344a2c0a54675d
MD5 SHA1 SHA512

Submit Download

unins000.exe

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\unins000.exe
Size 3.3MB
SHA256 0df5e20f00387b3cc99a322b18b1d9f3741f9c79afa81f48f1e9d43ab96a4005
MD5 2a790f8c61ef9ca8300a6d6285b2c658
SHA1 374c5ce70a95099c647d7595429de1d65d35df9a
SHA512 0dd6302aaf5dbdd1248e1e7644df3aa8dde6c35fd3c3cc2bcab6778729e1fd69d3e07a8afde343d2b1a802e27de68a80e2af4823e14abfc693242f6d00c44da4
SSDEEP 49152:2uAKxvISKIJhNRQSJ3MhjxIXhEzAWig8l1sXyKFz0ool5+UKLz333jr:2uAK6XMXhKAWwLsXa23333
TLSH
T1F4F55C23F34D603EF06A1A399D379658583B7A606916CC5797FC3A4C8F361802E3A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupTest.MTS

Path C:\Users\Admin\Desktop\BackupTest.MTS
Size 372KB
SHA256 fff2b9e3e2d78e3f30275aa2e424c9a8f69c25b2de91092d8d05022f29e61ba4
MD5 9829f1ca56deb42ae7545cbe3fd936a6
SHA1 7bcf4c954f09411d6b3f5623781f937027ee95a2
SHA512 5602a683b42d9ab7301ddd667b80133c4f36e4173b56a6a98608586026449b4665e8058760e0cefa52273222cca3bdf2760f046f604cd51ffc6cd2b16b87d923
SSDEEP 6144:o8DhOgOCDqZiyfScY/bS70Mil/LbqfSgKhulR76kFblDf2aQwmFaP6UcWYp7NLve:o+wBBZigSVMipLb5ulRWkFhDeLVFaP60
TLSH
T1AA84236B352669042296F0DB4F7E71428576A57E7486E74073C8BFCCAC5BB03C5B888D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockComplete.contact

Path C:\Users\Admin\Desktop\BlockComplete.contact
Size 293KB
SHA256 ba945d8a28ac8ce4d053da7b0ddac5c535c43f3380bf46f6fec95722b6c6f7c3
MD5 a185d3aff9f98daed168f610318f68e5
SHA1 24bb0da2d8f3bbc726660fbdb6cf15d91859cf85
SHA512 c666509d749e3960d6cc8d2e9fd8c2ae800250503592253e15d0ecf4f5f75711bb527778894ce86f7ef46e85f3b6780237e887e5c0fc9ec4fd36a3bce4f29fc2
SSDEEP 6144:hRQRcguHuR/nY7OEhw5aXNKLIVAeeVJKYR3aYUZUfNRr:hxguHu6Dhw5fIVAeSKYR3vU6fNx
TLSH
T124542377BF24C84249A8C39E6E650E3F6D21B0B21FA21786F0A06951D4D173B85E91FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockUnlock.au3

Path C:\Users\Admin\Desktop\BlockUnlock.au3
Size 705KB
SHA256 4d03f1518c7371720e84ed0ec51418e9b49c22cc26cf488ebeb5899f5fc812e6
MD5 0f647256316459c3e058c0ee34e1ee8f
SHA1 3435f54fcc55d0a4d0c56f058904f3ac86edfbb5
SHA512 45ef39868ecb4fe916b7d349dc60e9d2f290a6cfdac56d30edd29869f9d414a0e86ed16730b5e8f913237ba09b77c33f9bcaffa575d06ef7f7d60de165b4e163
SSDEEP 12288:3apKJTbs9DHm6jD+tE/Z9UeKyx8OOzELinuqCi8FvJf25yyAixodd6XeLq:KpKJTbsBNzZ9tKC5Oz2in6RhO5yvdW
TLSH
T16EE4232CA859CE54FC8308C2B476E1C87D83D2D8807996E5A347A4D5C92BFDC4DCDAB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectComplete.MTS

Path C:\Users\Admin\Desktop\ConnectComplete.MTS
Size 724KB
SHA256 da1c56d77e65ae390342ca923ab55b8d09c53cae02e9ea9ce0f20e7074c7a86b
MD5 1779a085ad3d5aed6a245cebd3d570f5
SHA1 6d7df5ac1621d51443e1ec7f3d32617f5ccc9921
SHA512 047db7a64215ee3954796fcfa28fe61c43d731de7f35a68430356f601c9da0ed09315465ace992db540ba61efe63118ccee95ab290f65b7a905706acf948b5dc
SSDEEP 12288:nU1GLT/OoXvoDiee8H+5rec92mAMLjDt7rDHeUrQf8HyA1B4HIskS1:nUULT/OoXvGieeK+5CcXAMLjDgVf8HJo
TLSH
T177F4234B081579395759FB394BEAF5AA4863A513099E1C44E02BEBC6CE8CA0F0C37F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromReceive.7z

Path C:\Users\Admin\Desktop\ConvertFromReceive.7z
Size 489KB
SHA256 347befce5f58c89f6df7df7f44202b85486ac3bca11bc75f2933bd5e16eda902
MD5 944a4a247c7b85a6e5d7e4dd0c5fc959
SHA1 d16551fe8a70f2efb39d1c026a6bc60bd7243b49
SHA512 8cb3a3af1d46e5af598fb75b4061fe150c11f6507449cbf6ef571b0000301f9b9a50587660595c0febec022f52e9bb23169249da35c545de0d1915117fb5dde5
SSDEEP 12288:pzXQqD5epHdt1dUc5vYtIqz6V+IfvUUj5YbFAE3e6Z6oo:iqE1dxrqKfb3GZNo
TLSH
T112B4232C4DF47794BAF6E2750FD27D83BB28C5539BD8C4086CACB90E74AB34164966A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToOut.docx

Path C:\Users\Admin\Desktop\ConvertToOut.docx
Size 450KB
SHA256 b88f52b635e39bbd9733d9b517daa19772e059b3fb05c0578281d731556061cc
MD5 eb9a03f79a3b3e2c799f730c3d1ec80b
SHA1 f05a4841ba1260bdcc73f7b7ae50fcfc0114b389
SHA512 9e41957c4086eca89fe2078ba83e3e6d7f290895162e8118cf6e0b8297456487e490e133c05379f99f5ad97bb996088a0ed7c5929df31b1289e438fe2701483a
SSDEEP 6144:DUg/rd7iLiKvvpvZuteqs+QDBLTOv9WtYU+Gpr92fouiz5oouZDil9:DUgTd7iL3xQtRsNiVW8GpZ2riz5ooCDW
TLSH
T112A4232A890F33625199E7D6C6A955DB804081361DC2789E6C3A3C7BFFD077F9A0853B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountResume.midi

Path C:\Users\Admin\Desktop\DismountResume.midi
Size 313KB
SHA256 5389f9c67310d3635770b89830205938c1644661594891c4c5ebaa99c78c52a7
MD5 f130d7d2412069c4a37a77f50908ccae
SHA1 69cde4138520ab82669d2afd4b55893ce5ebb134
SHA512 86b3762c25be8c7a9dcda412eb992474348da7b1b181ed517b7ea563b034774181e6a5ef87da18270f7464a946f97644cea067b807516757053a37a6467ad37d
SSDEEP 6144:QRrE1forkjSbP7nCbmZa3/ZEYUIG8IF8XZTr6kP25wKpB:QRrKzcQ2m/ZBtIF8JTr6kwwKpB
TLSH
T16564236266E9B336F893941DA23C1C280E4421940FDEFBC506E353E66759F281FFA65C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitNew.rtf

Path C:\Users\Admin\Desktop\ExitNew.rtf
Size 1.1MB
SHA256 c8ccf3a7ad5895faaa92d0578a57a70e946f704acc9ec8557ef38572925c9143
MD5 74eed7123061e8a3a15d3acb984750d1
SHA1 2629446b6cd8457f266617fb587f5c0eb18389b0
SHA512 8b7f994c6dc480b1cee5fd4af37e8d5c9dfd47e4c63ca2bd465c5c1b913db8450ba39f0212fccb9b83ca0c4d6c0b5262913e6c7a065239e79819afc98d11d2ac
SSDEEP 24576:idhU4QDyCw4RN7XXfAK06T1LFwTGB2d8UXKtiOuTRZX2f:KhU4ahRN7XFJNoKU4ZuTRZmf
TLSH
T190353394F61B6DC046E567C0F811FE047B4EA60B778700883E0EED594BEC966869FF28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetComplete.vssx

Path C:\Users\Admin\Desktop\GetComplete.vssx
Size 587KB
SHA256 541b19407f864a398097b6441a01f895a3c8725ac3e4e90c554434b0ab5bb8ae
MD5 d8bcdb0e6265893181d7ca1fe686dc58
SHA1 ef22ebae6f011f79c258d68b7c3188f009263509
SHA512 f84b2540b284187274d4494643986adcbb1545198d1918e8317f1f3b26b2e9fdb33b8de5a7b9859887ad448d08b3461e98b73a68ccb46c2bc98bbbce69995059
SSDEEP 12288:P2evqHvrkxmoDaG8emmKp5BhasZn8GOYQr8a49AagszYiPw/iTb5jDod:P2KUvYx7OG8e5Kp5BhH8GODK9xgsDWd
TLSH
T138D42326F4C28E7320E3C1597EAA03747AA74DF98F5096491CB4DE097CA3B33BD51662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetFormat.avi

Path C:\Users\Admin\Desktop\GetFormat.avi
Size 470KB
SHA256 ff8af63e28943ac373236cf0f77fd1d0474fa128fb11bf8c3a81ffd591e5cb53
MD5 ca91ce4d8dff1abb00230c54b0d392c5
SHA1 33c22e0eaa4962d15dff5e5fb2a41b8650547c2f
SHA512 ca562dcec328ebf8fa5a165542cfbfabbed242dee824b263dedd3b4652762e4c6b2422a3658ff42b7f1837682fa782fe9a0dc55eec9f1b84fbc6caf06daebce0
SSDEEP 12288:1SiJVpwj7wgOODWLRbC4Xla/PVj8/AtS8h:gi/pwj7wg/iLR9XlaHVKAtFh
TLSH
T1F5A423E8D35688AA1510B320FF97DBB6E5354B0D81D084BABFA44FC5BD40934D35EEA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GroupCompare.xlsx

Path C:\Users\Admin\Desktop\GroupCompare.xlsx
Size 10KB
SHA256 846b559b05812303935fe2051fd87e3b7db331eab07cef35a19f2d766e6b064a
MD5 373295d80a33fabb21636a228b6e14ff
SHA1 737ed9abbb0f69182985ab8810e9ac04ebe86c01
SHA512 d430322f3feefcd7fbb5c9aac6856143e8ac8a7f107bfde7a57afd39338d2fcf197f3c82e181496a3fcec36bf164bc5bd19ffe89c3c9ef85cbb23b20c466cd7e
SSDEEP 192:wc8mVJ/vb3UyDgJyQ10miaFUlbVvevUqzQXpS0TMojnN2NYDsaotz:wc3jj3KoQ10sUlM9z6pIob4ODsaotz
TLSH
T1C6328E0AE1324AB4D3B3C97D84CE01C0B64D20A41B82795A2874F1AFA6453D706EF3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HideClose.jpg

Path C:\Users\Admin\Desktop\HideClose.jpg
Size 626KB
SHA256 1d15471faa057a30ce1c3fd60128c3cf32bad8642c9b258b0c7ff1c23106beff
MD5 b3d6f624348a2593f9959461471a46b8
SHA1 08e61b26b09c36c9bebcd36af25a6e063696a34d
SHA512 06c9e9639df185d4909b22cd05b6b2d28140f9a80a120786dee6a1e716354665e36cd50902346bb5132387d388a3af2c504b11db5829b604317e6ec0094a8d0c
SSDEEP 12288:22DeVGCIkZS2NKoyX1336bCaElOs0YC/Y4WpdIa7VrsDrgGhe7PnzJNchKx5+HR:22DStfsVFH+vE0s0/qb7Vrs/geeznzrk
TLSH
T155D423CEF8339C048428F5687DBE6B26EEC073B1487E0CE95567C8868DD9746DB58E60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HideSet.DVR

Path C:\Users\Admin\Desktop\HideSet.DVR
Size 744KB
SHA256 289547e840f0df8f921cc64066e7f09e9ebbe39305fbfa1c88d5a5554169214b
MD5 f1484591ce76ad82d1ac74c4ea3e8a8f
SHA1 e6f41c77f363b89303e99f8ff719933b8518c668
SHA512 49a63b3d9deaba729ed1e3cc29aaf9eb7f9b83b549d4b26a7dee9dd62fcb0a88471c5eff5fc7237a80630b24eef153dc4c6abec7d33af7fbc48bedff3478fe87
SSDEEP 12288:shaOk4LisxTWJXXtc2BMTppSubJZieFEbE0z9QkjSGu1bvMUmUttAndee7upsvnr:5fqFxTWRJ+vFw9QJt1bv/458s/nr
TLSH
T1A7F433FD377182902BD107EB0695910CD4FAA97B8F2602C79AF07B40A614D0FDE763A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportRead.css

Path C:\Users\Admin\Desktop\ImportRead.css
Size 783KB
SHA256 3530f469a08d2d9e327b146db9d9cb5e5bc6c2d9ba763ececaff5bbf06e08b56
MD5 b5d3d4c8289f0fdb24053f6c4b90be76
SHA1 c9c993d469abb6704a5da37d66e9c5b264a7abd4
SHA512 4dad5737eecf7f5b58784d314e917ad18e68ae456e05e636814f17b49141837ac921336ecbc5525b78c4342a67247d9ac44ed8718ad6abdd0d5a6b0dd5f0a9aa
SSDEEP 12288:KUE1tHP6nkLhORMVDll5AzXJT1lz2jX2CV23Ou32bHM4cYclq1lJsRa5:relP6nkTCzB15GmCV23OQsX8q1laI5
TLSH
T1280523848D632EC09DBB99523825EC726702EF9501CDC927C55BCA83935DB61F582ECF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockAdd.wmv

Path C:\Users\Admin\Desktop\LockAdd.wmv
Size 548KB
SHA256 801bbd2babbb23912c0b2a9dc3d54fa1bd701c10ac2bf97d1dede61e8524e19a
MD5 99f1ad0141dd361cd7a3cd3917987060
SHA1 d03ee64b261a936fd5a86024186e94118a1c244d
SHA512 2cce111387d0d5aff0b474cedf371310aa6ca447dea2a316f0846f9e73d40ce34bffb8d13fcdb82ce69df4c8eba0d05dbf162832b3d4da42a0d3457c850a70e6
SSDEEP 12288:tzTACHJhblo8g2RUPoWmjVzq+MUMslMZYcZxqMxTGJas:tzLlo8g2RXzp7MZYg/mas
TLSH
T157C423945496128BD9AB4E554FC3E802EDDD097AE404ED0FA1C3E4820CAB56376DD8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 d6b728705849691b38e07836344ab659c71af132af9a8f1a01b554a57e1d356c
MD5 a20c10d59b20bd4501665123b4e98aa3
SHA1 8c98a54a96226917e0fadc544b2a5aa548b286dd
SHA512 7c2f592eded9810647169bbcf9cadaa424d22bc43e9250b258e7ae7ca2344c1dd15c422bb52a1ef544c5414fcaab99e9c4d6663e3f1adaf75c305801ed06befb
TLSH
T19241A2246BD50719F3F69E7295737B22AE3BB905F514461F008042481C63A15D57DFB7
MD5 SHA1 SHA512 TLSH

Submit Download

MovePush.i64

Path C:\Users\Admin\Desktop\MovePush.i64
Size 509KB
SHA256 7b8f5a9c62da4d58671dd913e6b1536b723476af1b9e2449dd8861680fcdf047
MD5 0dac2d39d24c474e86385e871572d164
SHA1 aae5ce155c3003316647bb6eab3b6db0ebeefa80
SHA512 30b3caf33ffe1a14e6373df6729fdd42578f639bd32be91ebd33bd1545ed1cfab0fe95fefdc7fae1f7ab4207fca50a4f6a43c3f8eb212d138cb7dfff7dd04703
SSDEEP 12288:TG5SWi/LYFE2pAAV5o7PRB/aMIFSWw40od9/XIv8EZQy2QWxg8j:sSHuE234PL/gSv4Td4hag8j
TLSH
T167B4230A29B7B9D7F8DC2541456824F3E5F7D7A263332B55E13CA83BCA6844D2E021ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenConvertFrom.css

Path C:\Users\Admin\Desktop\OpenConvertFrom.css
Size 666KB
SHA256 585683d99450454fa603b0ed99651d10026c5528909540f79da3fa56bf80fd2d
MD5 179c1c5354b8df03f91e956b741cead5
SHA1 f0087602d0285cedbd873119131fe510d4e25004
SHA512 2193497b9787b1d2fbfe0dce026c87ddfdd767eef38f9678c08a9c59a6da569a651ff6162885bb63e495fb1388751bee7c7bc5213dabbc0a8ab1c020fb6ededd
SSDEEP 12288:fLLnVAMz3dSBOp/YnVThOniWiy5IxUQ9NmwsYb3szqIsAWAfFdiq:TOMjdC8ODNsYTAlf37
TLSH
T1F3E4234E8C12089AB6A45BED147A6033DFD90B666B0CF3EB561BECD8099DD78CDC5C42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PublishAdd.ocx

Path C:\Users\Admin\Desktop\PublishAdd.ocx
Size 431KB
SHA256 0fc0789cbf0ad056378dd7157584869505f32e0333992f9f3cfc758ddc98e74f
MD5 dfccdf4add9e88484b12e161000c4d18
SHA1 7b0c2273e2f3988c366633f911c5430c44ba75a6
SHA512 bb5e5245cce010c8072bae6a69ffa380482339c23c038fb4a09e986e26853d95c83fdd89352d77501a11b054ba8399fdf79114e42b9b245e15862a78178a6b11
SSDEEP 6144:Hqc6Rfjc4V8CwnNtUXA+KNgTnwu1D633+jVDvsxYUQbVzwQLACKrKOrJJr06e6fH:rQEaXAHgTnkQV46TECKrKYJWY
TLSH
T1C99423E7380691E802223C4726C07F5FED36201557FCB966EEC152A145357FAEEB26E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoResume.htm

Path C:\Users\Admin\Desktop\RedoResume.htm
Size 607KB
SHA256 a9ecc054969a2eac04a4a7969e05016014c01d537ec4d5743768927c7fb11a42
MD5 18c5ff4b433eeb199f300e6362e5b73e
SHA1 f8d8e00c38a17f82e3b02d097bd543c4ac7fb97c
SHA512 c858f94bdeb3e5ac8f730a041e9d6f5bd450388804438963c3ac6a8f8e6e3e6093df14f74d8454ca08ce49730120a9d605054d68a762b9ab4cd5f760757b72ef
SSDEEP 12288:2GZO1LYazHGv9iiZKdOU3g6mJ9BwYHinwzZwv1wgD26mtP13YcIM:2GZO1LmViiZmfg9wYCnwzZFge11Rj
TLSH
T13ED42369DA770032D9363FD51E9028B5250B6B2A49FF0F30A9450DF2A2DE6FB15433E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RenameCopy.m4v

Path C:\Users\Admin\Desktop\RenameCopy.m4v
Size 333KB
SHA256 1dafcebdde340867c0edd332f1433e8a4d6a2c61ac4a365dffd2be94c5bfaf12
MD5 11dbf44a0f70f74e7d2976b5de85344d
SHA1 ee755ec06c449a32f1d5a5bccd4cfa7a6f9d9c5f
SHA512 5af8c0abea969b007897482d94818eb3e427d885989b4b6a840cf71d8a2408aaef84558d7cbff53035a4de482891666b25dc2ca3eaf34850985706120535f2a2
SSDEEP 6144:DGZSOferXBbPSYsUSQeeM50pW/j7zZEmRLvC8HyZ1uDy988O04Q9Yhl7sP9pEHz:+SnrRDXsN9SpyDG0a82MWa8O0D9YhZsk
TLSH
T17A7423F710D06BFC56462F5DC49B637E752C87950542A12E2E313BA3EACA34C670A8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResizeReceive.docx

Path C:\Users\Admin\Desktop\ResizeReceive.docx
Size 12KB
SHA256 6fc106bdea7fe1aa384a018a503fb668e55194723884c58917a7473d1ec0c8f6
MD5 5ec4a3ea9e3288b4f50687c442078185
SHA1 c85bf4fccda5131de4efae745136d5812540868d
SHA512 9f577cfcba20e2c8f7fda77e379b241aaaafa4262e53a2c17701d6d61bbffe79ae107ec7c5306d9af0e31b71c4a4b5877b8ea91bc8129dc9f514f5f748144fd8
SSDEEP 192:CtRE3KEU3nrbIHJCCNxtpgoZ22NN2QiyN69eTWNGFHBExUcODcqm:a/BrEpdNxt/ZtNN2VZLIFH6ccqm
TLSH
T1D1429F35EA476D50E72389BCD11832F5E1286592B903C8873166FD8F532AB831767A4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartSearch.ADTS

Path C:\Users\Admin\Desktop\RestartSearch.ADTS
Size 568KB
SHA256 6090d089b6cf4a217612a08a86f5f18480ff82222a51a3a87e1f0a9706b32e3c
MD5 28e2c1a7776b92599645c34b179cafa1
SHA1 f5a97fb185f6f8b055546a2cbe9f2bd43968f24f
SHA512 980a0ec950b38a0a017f089fe6e7fc650a40acb2d4d9cf22fe19410272adbd722ed5621d45f9f958a5e45fecac56783eaf7c912ee84201f842232fb38c6bafd7
SSDEEP 12288:qYKlS7oHQJEH/oCn5PJdm2tFTWCDxk0Z5U953wJ496wPRba:h7oHXFno6TxxP5Urw6s
TLSH
T18CC42340EC905666A5CA022BB70BE82283C4765C3520703FF76665637F4DA3AF7E9E1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevokeInstall.shtml

Path C:\Users\Admin\Desktop\RevokeInstall.shtml
Size 646KB
SHA256 bc07ea16acc2ee095766dff7417009a1c8a86af8aba6a9231b448c37e9f6c589
MD5 327854673c370fc49653dd3895eacbbd
SHA1 0290d10a41f5bcf5b717342827afbf8ceb349cfa
SHA512 25338bd89c2fc6a7c0240ecf6448fc9be6fc8091633fd93a6c48e302ff33f3ca2d2602491c16a0624b7817258ebb196ccc7ebd7830df69db4d072030f3d74d50
SSDEEP 12288:UV7WgW5z78a4K1hAQm/zfzhowhAXBOkq1IJQsMsswsGwsz3LAux9ofhf/:U0gW5fPr1/glaXIkq+pMsswfxREpX
TLSH
T14AE433B86865016271E45E18795D9EDC23D0077EC6B4F28D92E6AE38F4FC3265EE3221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetTrace.WTV

Path C:\Users\Admin\Desktop\SetTrace.WTV
Size 411KB
SHA256 000f2d9802e56318ca8779502ddab98ab1a0ab76514727eeae883b375e2f0216
MD5 29fafcf869ea7519261815ba9578b439
SHA1 04ccfe1c314a93b7a4c392788f82f1c28ed6ff0d
SHA512 6219a102de0b7170ce5a12b3de0d3cba8352b3fc95c9f2a275577659dceba4006b8ea2799fe3e6b09a78fb779b85f9f7b19cfb4aede025ec7fbf7e265052810d
SSDEEP 12288:I61+6kZFGe94xak9zh8HvIDAFNohhO7l1rfki:Iwd84xak9zhC6A7ki
TLSH
T16194234C5938DD68BA810117C6DFDBD3ABC498A4D13176E4AEB58FFFA002C668D0D19B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkipHide.avi

Path C:\Users\Admin\Desktop\SkipHide.avi
Size 274KB
SHA256 39917e1d8dc70a863006fd6a1df0f844792a879a14b8ac778dd84112121b69b8
MD5 bb3fd3b4278e23edfeffb923785b5944
SHA1 8ef376d13a95c39152f52a6955136d9b995a3869
SHA512 3fa09ae56a7d93507f0e6c2b6b7bb6b2281e055be352b14be7087cadb0d35393884bab649ac321b6394c3374dd9877cd58478fad9d9c8f4cd034ecb7cb829c28
SSDEEP 6144:Au98Ijd8364hCjpMo/qBMzPsPouJ98lMl:ReA83SpP/XPsQuJ97
TLSH
T1535423E84BB7A6332B2B6DCA8BDD41CAF6423959115483AD9049C9C4C0CB7DFA5DF530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitClose.mht

Path C:\Users\Admin\Desktop\SubmitClose.mht
Size 391KB
SHA256 8f7a33a60698444b14f017b669fdfbcf6fe8695e4e72a73940c4816e0ef5a8a6
MD5 fd85dd9ff1f1fc4f95e4624097937622
SHA1 7cb9d9d25b5490092c37fca96a500adea3bd909e
SHA512 d82d745ab1e5eea24906e18b6983f38ee153daa591eceaf2671be92171d7bbf50d7a1f50e60b4b35a7726b2263367eee05e83bd91d040e404b50058b4544029e
SSDEEP 6144:1+2v+BVmbGcXFcqTvMgnzaYJLaa/3oscX2jpzbdFVuBr4BattypUKTwum4BX:ceCypvu0Laa/375jpz5FVMrNtQyK
TLSH
T1EA84235472DBE6C36CCB14071EB300070693BE5CCF962B3355C1509B9B9AABBB58A1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuspendCompress.mp2

Path C:\Users\Admin\Desktop\SuspendCompress.mp2
Size 685KB
SHA256 b43fffa235e6b692176bffe724886c13bfa9cc872585294bc09e151c50e9b06c
MD5 097c1c4cef2977a94d8dd54907271894
SHA1 452554ee2a18ddbe903a24e02420d6d8d06cae2d
SHA512 09966fcfde2c3e21b0f667f152a3e446d489a3c1993db6d7dc7cf5b1e747bc1e360859afdfb85c57791e99ef9c4cd42992a87f7cde4192aa3d21d917205b1922
SSDEEP 12288:werBs254TMMINwTFviOwinLsHcEL9RcZonrzl+R+D7awD1gMxOSs5WzwhVl7exsJ:w8BMTMMIYviOxnLsHRL9R4orJ+0aW1gL
TLSH
T173E4234C2AF8F56C0EFF5D09F91C6E4A76602C15A23A53F929B7E568D2C5DC81F38980
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuspendResize.xps

Path C:\Users\Admin\Desktop\SuspendResize.xps
Size 352KB
SHA256 082c6af5e1e44ed2326443d33e10f6208fe34fbb57e451295909098d24685999
MD5 9d781c6d0539574c4e9273b6d2635793
SHA1 e05d7079becf025df675f44acc27ec8c6b7cdd7c
SHA512 feb545a138fab1a29e540e5596762f99091bedf4815921c606202ebc7eb413163a5764b20f454f5921c2d76c652ce69e3b6b7d00f9bfd012ec6624cf886693df
SSDEEP 6144:WXLwybPiFRDbuPSJxrOnDqcEx8IN1RRivgUuj5f+ZeF4Pgi1zPF015Npi8:WXc28puazOux6+NfFFi9F0zNpi8
TLSH
T1177423B4D208FA21F93FABA36925E9C9291E101E739C4E5A1F6C773EC084A4F40D5DD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoStop.7z

Path C:\Users\Admin\Desktop\UndoStop.7z
Size 764KB
SHA256 27eba8cbf5a89e69354a8660a0d34a851d2b715eed4d6ccc7b2f4b9c4b92e42f
MD5 8b986f6f34a1016c30f11f09cd0120e2
SHA1 50bdad0f48a5192c63584df8a262283a83e9ce89
SHA512 6089168047c0d100619d0d021a344e5d3caeaf9ab582408f4ce717682c949ea3349f3737cfaf954b69e16c78a6f8ee09f4ea3d20f5426d11bc5d37a8b83aa340
SSDEEP 12288:8lJZG0QSK5ubFzT/dkmC3MwEs7uGEQcJiSwXWBxKJsFnStqteuO4lHXiHGStiDg:MJ945q//dkmC3MO9hciWrwsJStpuFRyx
TLSH
T185F4230DD890C5A15D745EA8781100CC8795861DBF20E9F251BA8569BE3CFEE3F362EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateCopy.xlsx

Path C:\Users\Admin\Desktop\UpdateCopy.xlsx
Size 528KB
SHA256 53c7bb5f922e51b222f33a02e3dd3e8119b81deb949c3e9cfa53f91ef81a361f
MD5 e32e483008a0bb56c5ca0ea6e1180e01
SHA1 15f3ef625fec92f8f77e0c4eb8867197c72af1a6
SHA512 02ca5147fa5fea6fd0912326f824f3ca75c32e6d3a1494fa9a3d1bbb8d6854bc15758f3f55cd3747476b5e2237777a355ba7c274abda3f1493e9662a736fb466
SSDEEP 12288:hS7Q/IfOIn0at4jDuWf6ER3G0P5P6HAlTCPxr2C6oN/8:hCfP96uWXhP5PuAlTgqa0
TLSH
T197B423502970863D06EC8C5486B97FD0060A1DB7B767BFC2D6A36E640953EBACE4940F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QXcryptor.exe

Path C:\Users\Admin\Downloads\Telegram Desktop\QXcryptor.exe
Size 886KB
SHA256 185adf6d9a2e1098925802a802846c55f9cd8aa0cbc86f62cce6e74085d61579
MD5 39d663860d4185db8952e39b715da7a6
SHA1 cd09dcd65f1f67b2d8db0eaeb2cd991b3c85e115
SHA512 a447bd8da390c03b1f8143adaccc3899ccb1e0b45e1f76af3305708b47eabc8a139327712b534075934bd5d7d75dd77e7df1b7057116328cc3fa815845d59d75
SSDEEP 24576:VgkE/kTkkko2k9kkklkkkkksBkwkk/kkGkkkkk3kkkkkMkkkkkk5k6knkkokkkms:VgkE/kTkkko2k9kkklkkkkksBkwkk/k/
TLSH
T1B715A6C81989157FE11B557917AAE338673A0BD9A70582E37CF05D3B6B63EC53CB2A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zalupa.zip

Path C:\Users\Admin\Downloads\Telegram Desktop\zalupa.zip
Size 91KB
SHA256 574fc4474d2ccebfde1431350e6fd3e3eb6122ea164f3a69bae412211b747d1d
MD5 c3e05d51faf33904b6406d86a72cb4ed
SHA1 58aaa73ae7033aa3204e30083c24ce518a99a12d
SHA512 4277341677e1579275bafa415d9342b9df350f3befcaf528bc2104c0c5bea7b746061505f10a08f2f14a97eaa1b6194c17637a05c2808763ec667308f418e119
SSDEEP 1536:cKY/tq8Kpdv25oVE2MViz/p5/ofWzlbKxHILcYQwgexZTQ5+9ynP/oeY878c5+W:s/tjSvTVaW1ofWzhKyp2Su+9o/oeY87b
TLSH
T15F930218E701186B573D4DEBF7B407B890E607CF1D428BD6F1F5D6AA150A9260CA6CB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zalupa.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Telegram Desktop\zalupa.zip:Zone.Identifier
Size 27B
SHA256 d07777e0dc36ebecce3fa9644f0f44dc4a0b7ede0cbc1f5d33e8d6cb07af5b5c
MD5 c785c55d5fa3443a11b8417209c4b524
SHA1 924de7b5f4fe5c2ce16a8263600dad559a3cfedb
SHA512 cae7738d2bd2b157fb4eaf99954aabcf90008fc0602a1a482de9b0df4c82903991e3a9cd7d85dcd6916307f972965d58192b4557c210ef579fbb23a5860f570c
MD5 SHA1 SHA512

Submit Download

Acrobat Reader DC.lnk

Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Size 2KB
SHA256 74ca38446b367a671247d8799f986cad8ddaf4ecd67f0c164b27237092c17127
MD5 6e0fccc07c7acf7cb601a91cf044ac87
SHA1 756205bb4d4468b6162d822ebacbeb0128d37177
SHA512 5e41ea1e5eab383d30cbd50f01842adda4043da727bf2b8c3a641f009dd05e69d2c00ef5f25f16d3b82f754a8f1f3d775f917457814a969103fc3ead38fd0d0c
TLSH
T17B419E540FE71B17F27689FA9AF11A22EB21BD11F6459E1E1185438B0A62B00D459F2F
MD5 SHA1 SHA512 TLSH

Submit Download

VLC media player.lnk

Path C:\Users\Public\Desktop\VLC media player.lnk
Size 923B
SHA256 ee117818674fbe85be03d5a260b6d6d331e1d9d5f0f192e0d3d6a9529bfd1bf8
MD5 e0ff6971ee3837cc1f7ec4a660d01894
SHA1 c13d0fd8135a3586e4af366040775895b014e96e
SHA512 758b0023ab56753920b20a08dbf061c5810f2dd8f39b749ff33432c8be8e83067cb2058bfd34fadf1ffa13cfab9f9efe1ff198f142d164d446408b67f1351b58
TLSH
T10111D05426E3AB07E3E7C0F016262330AF3AF800AB96AB0E9184114A5D29601F61DB7B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1740-5405-0x00007FF771D70000-0x00007FF771E65000-memory.dmp

Download

memory/4156-4945-0x0000000000600000-0x00000000006D8000-memory.dmp

Download

memory/4156-4785-0x0000000000600000-0x00000000006D8000-memory.dmp

Download

memory/4156-4910-0x0000000000600000-0x00000000006D8000-memory.dmp

Download

memory/6076-4944-0x0000000000AC0000-0x0000000000E1F000-memory.dmp

Download

memory/6076-4911-0x0000000000AC0000-0x0000000000E1F000-memory.dmp

Download