hxxps://ghosthub[.]cc/product[.]html?product=Potassium-Executor

Analysis

user interaction
yes
max time kernel
143s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ghosthub.cc/product.html?product=Potassium-Executor
Sample260807-tydgdszcmd

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
6124	AutoIt3.exe
5152	AutoIt3.exe
4376	AutoIt3.exe
4552	AutoIt3.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
61	href.li
240	href.li
59	href.li
60	href.li

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6124 set thread context of 5152	6124	AutoIt3.exe	143
PID 4376 set thread context of 4552	4376	AutoIt3.exe	168

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1908	msedge.exe
5576	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305936673316237"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{C2AA9639-ADBD-4EEC-9E1E-91CF0C358FBE}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{A8E0CD67-2B73-43EF-B03F-69BC2281F580}	AutoIt3.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{2C08351D-76CD-4CD0-8CAE-0C8217223CF1}	AutoIt3.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
6124	AutoIt3.exe
6124	AutoIt3.exe
6124	AutoIt3.exe
6124	AutoIt3.exe
6124	AutoIt3.exe
6124	AutoIt3.exe
6124	AutoIt3.exe
6124	AutoIt3.exe
5152	AutoIt3.exe
5152	AutoIt3.exe
3120	chrome.exe
3120	chrome.exe
4376	AutoIt3.exe
4376	AutoIt3.exe
4376	AutoIt3.exe
4376	AutoIt3.exe
4376	AutoIt3.exe
4376	AutoIt3.exe
4376	AutoIt3.exe
4376	AutoIt3.exe
4552	AutoIt3.exe
4552	AutoIt3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4900	7zG.exe
Token: 35	4900	7zG.exe
Token: SeSecurityPrivilege	4900	7zG.exe
Token: SeSecurityPrivilege	4900	7zG.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe
Token: SeShutdownPrivilege	3120	chrome.exe
Token: SeCreatePagefilePrivilege	3120	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
6124	AutoIt3.exe
6124	AutoIt3.exe
6124	AutoIt3.exe
4900	7zG.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
6124	AutoIt3.exe
6124	AutoIt3.exe
6124	AutoIt3.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe
3120	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 1104	3436	msedge.exe	88
PID 3436 wrote to memory of 1908	3436	msedge.exe	89
PID 3436 wrote to memory of 2180	3436	msedge.exe	90
PID 3436 wrote to memory of 2180	3436	msedge.exe	90
PID 3436 wrote to memory of 2180	3436	msedge.exe	90
PID 3436 wrote to memory of 1436	3436	msedge.exe	91
PID 3436 wrote to memory of 1436	3436	msedge.exe	91
PID 3436 wrote to memory of 2324	3436	msedge.exe	92
PID 3436 wrote to memory of 2324	3436	msedge.exe	92
PID 3436 wrote to memory of 1056	3436	msedge.exe	93
PID 3436 wrote to memory of 2324	3436	msedge.exe	92
PID 3436 wrote to memory of 1056	3436	msedge.exe	93
PID 3436 wrote to memory of 1056	3436	msedge.exe	93
PID 3436 wrote to memory of 4172	3436	msedge.exe	95
PID 3436 wrote to memory of 976	3436	msedge.exe	96
PID 3436 wrote to memory of 4172	3436	msedge.exe	95
PID 3436 wrote to memory of 4172	3436	msedge.exe	95
PID 3436 wrote to memory of 976	3436	msedge.exe	96
PID 3436 wrote to memory of 976	3436	msedge.exe	96
PID 3436 wrote to memory of 4132	3436	msedge.exe	99
PID 3436 wrote to memory of 4132	3436	msedge.exe	99
PID 3436 wrote to memory of 2604	3436	msedge.exe	100
PID 3436 wrote to memory of 2604	3436	msedge.exe	100
PID 3436 wrote to memory of 2864	3436	msedge.exe	102
PID 3436 wrote to memory of 4016	3436	msedge.exe	104
PID 3436 wrote to memory of 4016	3436	msedge.exe	104
PID 3436 wrote to memory of 4016	3436	msedge.exe	104
PID 3436 wrote to memory of 840	3436	msedge.exe	105
PID 3436 wrote to memory of 840	3436	msedge.exe	105
PID 3436 wrote to memory of 840	3436	msedge.exe	105
PID 3436 wrote to memory of 4560	3436	msedge.exe	106
PID 3436 wrote to memory of 4560	3436	msedge.exe	106
PID 3436 wrote to memory of 4560	3436	msedge.exe	106
PID 3436 wrote to memory of 1004	3436	msedge.exe	107
PID 3436 wrote to memory of 1004	3436	msedge.exe	107
PID 3436 wrote to memory of 1004	3436	msedge.exe	107
PID 3436 wrote to memory of 1416	3436	msedge.exe	108
PID 3436 wrote to memory of 1416	3436	msedge.exe	108
PID 3436 wrote to memory of 1416	3436	msedge.exe	108
PID 3436 wrote to memory of 3688	3436	msedge.exe	109
PID 3436 wrote to memory of 3688	3436	msedge.exe	109
PID 3436 wrote to memory of 3688	3436	msedge.exe	109
PID 3436 wrote to memory of 4860	3436	msedge.exe	110
PID 3436 wrote to memory of 4860	3436	msedge.exe	110
PID 3436 wrote to memory of 4860	3436	msedge.exe	110
PID 3436 wrote to memory of 5004	3436	msedge.exe	112
PID 3436 wrote to memory of 5004	3436	msedge.exe	112
PID 3436 wrote to memory of 5004	3436	msedge.exe	112
PID 3436 wrote to memory of 1392	3436	msedge.exe	114
PID 3436 wrote to memory of 4100	3436	msedge.exe	113
PID 3436 wrote to memory of 1392	3436	msedge.exe	114
PID 3436 wrote to memory of 1392	3436	msedge.exe	114
PID 3436 wrote to memory of 4100	3436	msedge.exe	113
PID 3436 wrote to memory of 4812	3436	msedge.exe	117
PID 3436 wrote to memory of 2448	3436	msedge.exe	118
PID 3436 wrote to memory of 4908	3436	msedge.exe	119
PID 3436 wrote to memory of 2756	3436	msedge.exe	124
PID 3436 wrote to memory of 3432	3436	msedge.exe	130
PID 3436 wrote to memory of 3432	3436	msedge.exe	130
PID 3436 wrote to memory of 3432	3436	msedge.exe	130
PID 3436 wrote to memory of 1472	3436	msedge.exe	131
PID 3436 wrote to memory of 1472	3436	msedge.exe	131
PID 3436 wrote to memory of 1472	3436	msedge.exe	131
PID 3436 wrote to memory of 2212	3436	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ghosthub.cc/product.html?product=Potassium-Executor
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f4,0x7ffff83fc188,0x7ffff83fc194,0x7ffff83fc1a0
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,5566072546955649085,7306236888902821617,524288 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,16566143110291574097,15499511752098016128,262144 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,13418514169493386576,15355474720908734629,524288 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,11988298116770099759,11520058202037840325,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,16159851670029024959,6358992646760257536,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,9864144991347226766,11730690570170322426,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,7217724832785248860,716452038215094916,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,9515620590338428907,1589180885177617125,524288 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,15067415403820033923,8126031070354277024,524288 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,16599227428772823413,5975340961606070734,524288 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,16599227428772823413,5975340961606070734,524288 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6232,i,2603108100438970605,10586497892433865769,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6208,i,2612667562142777889,5856065646917269167,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4240,i,8567290629579796136,7675332714296589936,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6664,i,7552794669713409220,9951498422428160165,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6272,i,11593773873026242810,6777198192148673595,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6832,i,6143030673149946009,669239210946646761,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7028,i,16295476283508909398,4705341930913722258,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3664,i,14716344939072239376,16006263004584579630,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,3838274663985607302,5916558777307407061,524288 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6312,i,18258999875250731609,11955222726305795010,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,15757143047461318352,17447474622976227586,524288 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,4417280589572728095,4563786951772244175,524288 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,11700033831489749235,8724456525872597855,524288 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,8998382985589031989,8172062473957056286,524288 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5188,i,3984411290076131876,5747953806511333335,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4492,i,17263846444014573231,18039304185949745229,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6472,i,13571566980853981417,15112725456674854845,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7340,i,3236140125850650936,10316170589790184533,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7136,i,8109231962343149982,6105606727087567526,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6808,i,7320538363408475019,11751442471479658944,2097152 --field-trial-handle=2312,i,11011758588562728594,17335027608122362702,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5696

C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe
"C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe"
1⤵
PID:6036
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Committees.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:6124
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5152

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" t -an -ai#7zMap18369:96:7zEvent21325
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffff79ac728,0x7ffff79ac734,0x7ffff79ac740
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,11349108248578083234,2766575982019150157,524288 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,14706212169949863715,17567955072149559513,262144 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,17063357378874593731,15693693528502444059,524288 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,7779530453404349746,1755933996284733791,2097152 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,2375527968772899001,2490926414911796618,2097152 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4552,i,7358872747714358792,15171393567485996216,2097152 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4460,i,11153467067227588690,15620183172980095476,524288 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,16921771995323892627,15482091295268682433,524288 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,13459042694916556404,1159600859564637469,524288 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,4813725885482915790,17674373172992939245,524288 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,5573546308685613952,8760843069568459637,524288 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5436,i,533522042626008717,1931979119795668936,2097152 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5648,i,1171693269028644463,17052222398417116601,2097152 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4548 /prefetch:2
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4684,i,9465677340148602579,11802882598410488927,2097152 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3348,i,10355220894797681025,9973460452340059600,2097152 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5944,i,16694293049623457113,5648992268641467627,2097152 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3216,i,3697965028337974931,2116767603288708087,2097152 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,9102601911660964415,6735946660353937571,524288 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,4393923695672921458,14190703658255478561,524288 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6284,i,3449181704270107103,13564284341089046308,524288 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,11720779390081952129,3172709719558523782,524288 --field-trial-handle=2068,i,15239564603834364335,4092588037362075059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:3228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1436

C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe
"C:\Users\Admin\Downloads\Ghost\Ghost\Ghost.exe"
1⤵
PID:4056
- C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe Committees.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bff53effcc90f249610601da8c4007e2e58a9df2b427860a0a90f6afb67f0b3a
MD5 14c8adfc3d3f31e2137c1fd39d7b5ecd
SHA1 fa288afc9434727432eed6ad0c6ead6cf56f8d90
SHA512 e60f5cd85620700862642013a5a3fa2ad0d28577b3e82a1fc082fdab59ed60bf6a5827cb17659c4383951a694f0e5dd554ae9295756ca1e23d67fc671ab86681
TLSH
T179E02BB9D861FC6B2DFE276860914745F614135B2E40894B7A3D850C8FF0A3AA685C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0f68c7e49bdec0b744c9103068e95b5533ceb036d53c00eb01aaf28c0d79e80d
MD5 2a0e819e415854b3c6c6043b7b2e9ebf
SHA1 2362dbd41149b773b0ba98f888c3908993c1d2bb
SHA512 25d60d8975e2f7efe43ba609e9777ab22ca0ace571a1105ce62e2d9ddd09aac5b36f7945a7117355e596b69e9b456a2b5c294397f20f873ce1639d62357890b7
SSDEEP 192:8RYGHqdv72vAPRp299THsb+WNn+c0h0Rb4aT//DVyIsnAUge:8RYGKdC6XuFwN0h1able
TLSH
T1EB32B46EA920393B6DDBD229FA667757E7F5103139D42E84EAFC892C14E75CC212700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f0b03a1aaae7dc195f5e0721e38d75c9eb8b0bf5a9c59433225a7b20d27d5a35
MD5 86c29f87697b5e1104186793d4469b3b
SHA1 2eaaca07222321197e4d358aa14a14694d307be9
SHA512 acf579277f39ffc4ce6b5c2ab71eb0d12e712c1206bdbf23cd5a708d7231f7cc71757c1198e0082218dd7f407346b6409b120a48fdaf58b3ddd57187a7d84edc
SSDEEP 192:8RJcBzGHKdv72vAPRp2+Fhq9THsb+WNEt+c4t72o0Rb4aT//DVyIsnAUge:8RJmzGqdC6XiFwW22o1able
TLSH
T18042B5AEA920397B5EDAC229F962775BD7F6113129D42E84E6FC892C14E75CC312700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fe729673d6d310cc3dacae9e24cdf5895de2cb8a57e1e17c4681f2bbe6fe8018
MD5 6d7351e3d43c843e20feb8e91a31fb98
SHA1 d9c767cea9d58f2342cbf1a9090f872e430b1f29
SHA512 fb26586c168f1a7718f963690418cfd82f6a1e524dff6233b39e5f65f8bdc9630e5c9f4bb7a221485a84695d2f0aa96301309660db73c186b551c406d32badef
SSDEEP 192:8RIBccBzGHKdv72vAPRp2/lFhq9THsb+WNEt+c4t72dRb4aT/DDVyIsnAUgE:8RIBcmzGqdC6XNFwW22EaHlE
TLSH
T1B552C7AEA920397B5EDAD329F962771BD7F6103129D42E84E6FC892C11E75CC312700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 f1d5c775bda2c0c18e888a16146f1682463675d8c8faf44f30ee9764d2d806d7
MD5 b8ddb58ebbef8b56e7d78bcc03acb5b4
SHA1 6279a5744a116912dbfe551e1743958910210d7c
SHA512 45de13b7b4be660f60472b2a83af1295ad3df2bcae19757310f5a5030cb179994dc48fa6d042ac92cc24ef2afe833be722d7c3f134319913d2c1f02c21c473fe
SSDEEP 384:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcXODby+ErU3/THGwIB3Whm1KoUs:/lbW7KxkXqKf/pUZNCgVLH2HfgsMOOHk
TLSH
T15452E867688D963F0FD8D68CDC267F4FADB1019666640C2496FA9C0803AA7CF115A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 651a6f23c4685a0fa473b75d1df2d360d5e8407fd1944aa3fd382c19a0b2eda1
MD5 4edd89651fcbfbdbf5147bff7f5e8e4b
SHA1 5ab80b778b95e38bbfcb22f18ab43eb0bd3b65f1
SHA512 6064093c9a833d1e312210d35727fa2ae0a3ebb0af9cd6a8cf8088bc4595e884eb790e2c92af362626b50abb843faece2461d98a2903f5a521ef3895c2a028e7
TLSH
T16BB0240C11D03411CF3003F111C341007013DD50DD57C0033071405744313004371D40
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 7daccdfcd54cff366b3fed8292170a1e0736974ff1d50ca1aacfc29a83e5cfca
MD5 b14ee6d3e0bc8c5a7e43e2c02f1d4fcc
SHA1 7d5b604b848500f5903ab816fd567c0cd6071593
SHA512 c738126a4995e6b96ceca1bb6dc70906527d7be32433b925d9b3b3c19ce86630f2fe7a3f368e63012cdfce6966b525918ee34ca5a7e5488141fff6caa7e81288
TLSH
T1FBB0121264001466C9A48BF550660F5363320C082603130116CD04948A161C45802395
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1619.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a1619.TMP
Size 72B
SHA256 07bb87eb4e401e1d84f242269c8b1e2284b70e7db5aab18f60471a96d3fe9907
MD5 3d5758fe7af3e28417508a1132187107
SHA1 c4d51b5f097adf1431cb7838e06a2c2a23b29830
SHA512 6674bd8a47d80ab967c62f80019e158f1d43023470d602e2f94a481e7bf525c4cdab9e7ac72acdcd9dfec5137a4acd0f450f2121c47fc8425365d692ebd10b03
TLSH
T1DBA0023496402311C64443B860A383423276CD99BF570A1346910C6A9D59A985551520
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 882e80ef0e014e005b050d8a130bbe55579f5521ce1ca3eddaff8816f0d397eb
MD5 2f8ce868808296119da94948051acd6d
SHA1 50fcab18f4bd6b1319e1e077ed010742ff8c86fe
SHA512 3732f9a12e6902e4bf0dc3f23e9db9ac724ac3a4f2cc478cd3b1ddaf463fc882e1910b399d10513f78e25381dbc3aa645c7a37922168cd205ec5781a51045494
SSDEEP 6144:DeuCT8FulmB4XQhsTYCFeSXMm7Rkm1tYpBeh2BAoP:eTb4BTBCwSX/9oBGcAoP
TLSH
T13634223A4FB18A7AA566E31E554E5A1F2FF00952C9B05A62ECC67F003AE2B4C3754D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 0e872016e364ad41622e13e3934e79a7aa108d21e3b3bd23536c8ed0f909e31e
MD5 8ef438cbc12665752b85493388c7be33
SHA1 d89980694a2ceba3c52c7b4146938279d6b9eec1
SHA512 48d7df9e661b524e83445cb3e94b596fa6e2b861df12d2ca81a230f69be2b0206fa97fcc87c928b9131928cbfa8905c5311b366c41d55e551ba0826a50db7aa0
SSDEEP 3072:CGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:1m7Rkm1tYpBeh2BAom
TLSH
T115C3123B5E70E97759B9A74EB08E0B1F1EF14AA2D930DA42C8D85A0437FA7CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 5703b820b209ea2b8ccbeabd371d7c5c7b19bc01c23051096d32b156a8fd5e56
MD5 32c853bd56fb0cf3dde5f8b134d379ba
SHA1 b59125341be88eed7ad82d3f0a169c74c1141a83
SHA512 bce9b61fb818608d545689bf0483fb79ee9230ea2ba670e4c3c2b4a09897928f41530847b583db620cff41973ecaf56ba938b31a88b0158fdcec09b5b5c17cdf
SSDEEP 6144:weuCT8FulmB4XQhsTYCFeSXMm7Rkm1tYpBeh2BAoP:HTb4BTBCwSX/9oBGcAoP
TLSH
T13F34223A4FB18A7AA562E31E554E5A1F3FF00952C9B05A62ECC67F003AE2B4C3704D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cc6205dfc0ad92d30fb9ee805c729d53c836cff0462f2e045a52fbf9353b96ba
MD5 f562913e5926d98801f903f9ab792282
SHA1 8891dadd21fb366e56ca3e18b52a40681e1c6bd5
SHA512 4b1aaca6f81fabe0474d092b453cb6d7540505c123db6a819cbbd5d6f8b61b43326519262ad010d1ef93e3bc712b9067ba041231fbb887f2053b2fb964c01056
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7w:fwUQC5VwBIiElEd2K57P7w
TLSH
T12AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bb198c81963e699455b64b9ce7875c63551bac1db146ac9e8b16246add4890ae
MD5 e5b55006b588cbfd0a0c4801b2c1055a
SHA1 ddde08e8f44660d59ca273351189083ac43d8809
SHA512 453a760669986555d9c71b4c1e974d6f1c226d7ff4ac867acc428d6346dc81990eb139eda65972c93abd04637b774055ff3725b789c9ae8f2d1492ee6187b2dd
TLSH
T1DCD023707D35EBD6D11E10F45420494112374273315757B5B155584EDEB4081F2DFDF6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0c4c0f44b749b57f1cc75a062d1dcbf8b729d9a7cb2f81a104826c7702f77cf1
MD5 e71925642d19230b6061b9e43c9406be
SHA1 a9fa3d635777c10336a8dbfd8772ae5607c92824
SHA512 41a04b473f9991c52f05aba445f61da008374988fe99b6ff641a44e8ea8935fa2a6a7ab9133dae10103bdf513bca2418f7f2232c809d41013fe9dedea0d076b9
TLSH
T1716180773D3505A2E3AF067094F12AD23035F4DBFA4B2E4E1588B9F51524FE0CE5A808
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 614f5b7b6117f4f28b4fb5a144432fd78c45002532d30877ceaa33aced9c782e
MD5 acba602d2a531d04792716225531d5c6
SHA1 979e2bb20ba3862480ad12b38455d58a1ea3d42c
SHA512 3d3e10befff254329ab119f8e159c11f0dc702aaf519c72a82288e6cca5bb42afe860893880ef869ef6839d620464de5c8b1eed961948930384b41a2d8215a61
SSDEEP 48:6UPPXHkiOD/yK12qM41+zVhNuduZ+NtLTfFpy56iMwbQ3qmt6ovLvKH1/JEWKt06:NH9Y/x1Z1+zVhNunzDmA+buq3wLvK6f
TLSH
T104B14B3A3C382112D75F1E3098F119E534B4E0DBF66B5E6EAA44BEB01515FD08D974CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 5c9b22c6b5833acc4365191707390d1b12259f856db4ca40303ad5880e12a641
MD5 34d7268c78f5f4b84c7a96dae33ada88
SHA1 051ee43917cfe5e0bed0111dcd270942d48a3adf
SHA512 93c3f6d7e164baee8fe2925f02f6e8a6c6647b34553488c80d07f088cdfa28b9056a2dce000f4c0ca546e70089f58dcda1b8f0f37b5b0ac56f55b3844225598d
SSDEEP 384:DMqnuvc2c9GgvJB12eJWW1vwGt/QyO4UkY1YQrLTshYvSa4JYomQMV4VR1Vfi7UH:9cekv+x97rkJwRIM
TLSH
T1839289F383E5D52E89015AF89A146E1BCF1D0719432C3C2689D5EE87E3E3472E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e28e178fc8c7372bc04bc99fff8bf487d2729d000d57462db7e2be8cfa070eb3
MD5 eb411b56ab01b31afb4128ef64ae5c00
SHA1 cf582dc41739ad5810735a8f18fdddeda0865180
SHA512 6dc4fd4ee08f364a238be27149589a8933a5a698bd498b16515c5a000982281b53004f546798c6fe8a609d26d93a1841bd4275091811626c8c446863e7a2fb0d
SSDEEP 192:sxZNRzyM/jK1Ml8Mks/fisozPkmIdp9YHW6+WN58T8/Y9IHaoNIgrJ:sxZNRMs/fisozPqGHbL/v9
TLSH
T18842E7126A34A9B7CCDBD209FA55BF53D6F54572A6900E54A9FCDA1C00E7AEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7a2cbec68eef87cb1e8140c3740e5b1884295399b17365d64d818f6206f84e7b
MD5 57cc86d91ac1e9eeec02aceaea623063
SHA1 eff3e5f7a003a51df2d93c8610b83b3abdaa048f
SHA512 97d4c2032ab2c8504a41e16c3320156f480e668c8e10d18a457fea4a85fce09a693532d241096383a4c684b86581d17b47e0d68ef35c52fe6bd15842de575c92
SSDEEP 192:sxZNRzyM/jK1Ml8Tms/fisxWpVCztVmIdpXdKIxHW6+WNtyRHkTtZA85lFh2/Y9C:sxZNRRs/fisxWvCztlnHbtN+/9Hv
TLSH
T1DF62E742A53459BBCDEBD20DF955BF53D2F9556292900E54AAFCDA1C00E6BEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dcf35986be849576bce7e6ff3375c04d4eaec7e29a116977a1a3b0c6047b0b4e
MD5 a7467b1561f55a8df654897bd1971cb3
SHA1 d62565f05e02d3782518f4c516760ee5335a3137
SHA512 0ed24b89464f9d2b80baadd75edf7d26ca468f1787c92e19250d4867a0ff22ede3ba979886dcf48da3f1285b4ef34ee142fc92c22b8e6cb71b7a7d6b63f654d8
SSDEEP 192:sxZNRzyM/jK1Ml8Mms/fisZztPmIdpXdKIxHW6+WNtyRHIM85lXY9IGnoNIg58YJ:sxZNRes/fisZztPnHbt7XP1
TLSH
T1A252E652AA3459B7CCDBD209F945BF53E6F9557292900E54AAFCDA1C00E6BEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3f0e9569a8f9b751293ca344f41311efd439b8d36a7cd2198cace4a653d04cf0
MD5 07b520dd10886577c71a6ba014fe2a8c
SHA1 8559438e647f2ce04722ca0798f9d99ee371d32a
SHA512 d5342be4764935c80f5b15ae2790319a6403b5afc200b4d895bdee17c3ac83a72ac8025d3afef3be08808b57e220f2f334b63bf8f182f4c15b66cfceb8156f9c
SSDEEP 192:sxZNRzyM/jK1Ml8Mcvs/fisZzPPmIdpXdKIxHW6+WNtyRHIM85lXY9I1xoNIg58O:sxZNRkvs/fisZzPPnHbt7XeD
TLSH
T1FC52E742AA3459B7CCDBD209F945BF53D6F9557292900E54AAFCDA1C00E6BEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2b8eb27b8afad64834cedabc56cc31d0eaac6737172e1ac25bff55386df91d43
MD5 af22c2ce06669e585a68f00046e231cd
SHA1 02a888bb16058491ef7da2ea42f1f515b109c0ee
SHA512 3b3f72c7bd6e7e73fe5a5f4e3e026afe34d51b8de5049a26efa3b7f06ee4f18b032a022d663c08e2490a32b5da76f988453e1fac03a8c082bae6d2a6247fcd9c
SSDEEP 768:/Ucv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNCrow1g6G:/Ucv21wWvu+Z+u1jaeFLeRNZw12
TLSH
T10AD20B2B280CCB7E4F841E9CED2A6F8A6DD801CB5B988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 85cedb5d0c6da01b5379b4312785e949dc88aa856ac25ba87d3d408250ecac3d
MD5 3f077d22b5446546d017dd8f02c8837e
SHA1 de00816ad45c9c3e64671e6cd26945b6e48b8bd3
SHA512 7787a51006ccd53b2121fd871c83646ff4b7950e5312807e7cc8ff07962831442af9900dad8b3b819b50cdb964e248c8aaaaec47f61029614c08fefa93c2cb01
TLSH
T111A0022842C435D0D1610DB05E5115D533B09C5582051A5148D14485CCAC542D517254
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ddbf56716209905f06eb15f29692686917e6b3cfb6ca94802af5d1a57ae1c5e3
MD5 d99c18d3ad3a5c1a86b7a2a46811bb71
SHA1 ea31ad92540ea6ccd8656c0cce2e9080e05e5807
SHA512 605d0779acb69e77f327ead3f3dcba5349f6dcf7b262347eba1e423109ed2cfa8d3036769b25a13a5b7312d963b6c08bdd42ecf02bc8ffe6ddebd208e0a01407
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDGPiKwc+iG8KvKauJCKiY2:mT5RXfdr
TLSH
T17CC1DD06307F0342287D695DA6A186378E8172A77858E9BF7B7800A68F67E115CF8CDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 881c66f8d6a152169a9b19d8c7c4e5848355ad732f4fac8f61d495f0afcafd51
MD5 09f0cd947a3190c0d8dcf5793cb96fc8
SHA1 81adeefcfcf18369aeaeba90bf17387d6393fc84
SHA512 a1b2dbba37280a035b27ea6ecee136ac573ca081fe93db549519ba2ba9fd575fc45a4c4124749912505cf3923be9ebdaebcbcb720708b6e47e1f643ed289bff9
SSDEEP 384:6ZcIhsNgkYazidFWe+C/dHeWS+2RWf5Urz/KD0:4hC4hHkJlRWS/z
TLSH
T1C1927D715C385C3A6AE2E945F48735039EF88133D7C63BD4E5EDAF2D01AB5A8230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 eb5a4279c52e02c84aafd768d2f739f5a4a8a5883eb5d7148f390fe1404aae94
MD5 d5724415a80ff63433422d2fde80c9a3
SHA1 6439827bab888d9968b89d465be876c58e9f5414
SHA512 a1bbe7baa1165eab63346d26f267be68fd3577195b22862f88b229baf029be97b1a7bd13e9b883bc11edc7d6584022193853df801d8c8052e9f01af6509a03b3
SSDEEP 384:6ZcIUsNghYazizbOX+e+C/dHeWS+2RWf5Urz/KD0:4UnnX5HkJlRWS/z
TLSH
T16E927D715C386C366AE3E945F48735139EF88123D7C63BD4E5EDAF2D01AB1A8230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ed9b9e798574c5b4f5794c6f13c470970a5f91ca538e444ed47d7bf4eae3317
MD5 07131500ef085f46650a93348094a09e
SHA1 acb943d9f329c25b2ad772cf5e2daed67f2358c6
SHA512 aaef416ecd3d2aba063431e1b86ef77cca38fd59acb89154d6888f00d47fef86b6b0d2421b3f21fdd14de40115c78b96af058c17e34241a05ee4826a85db23d2
SSDEEP 192:JONv6v+YLNQmiUyUZZh+CGx+Fdew9ohXus8fU6:JONv6vz/TZh+C/dHe5GU6
TLSH
T12E020B35AD382CBB9FF2AE05F4873A175FA42177E9922F80D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 328daefbf1ea1de1aba3ba216e2ed40ba0bc7637502693bfd7c83905f4777537
MD5 6af70eef2cf041bd871919c1c115fad2
SHA1 e0046f47b2783f6169857a37deb2d505df850ead
SHA512 db90fd0065370b36fc3c77eb72ed52169740907c75c316a8256230605f0d1221af496900313e3badb8135dc5667a156f85d0ed24aa39ccb5868a2e033d29b60a
SSDEEP 384:UZcIUsNgcYazizbOX+e+C/dHeWS+2RWf5Urz/KD0:SU6nX5HkJlRWS/z
TLSH
T146927D715C386C366AE3E945F48735139EF88123D7C63BD4E5EDAF2D01AB5A8230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d92f619f75d9f2fec882322c9c3685dc14d6abd727d9ba04f4863d0b88e85c5d
MD5 c7d95d0f84e055c84f83e4b1dc18a804
SHA1 6f2ceaf9fee77113524013dbbc374dbf2093293e
SHA512 31fb2d4eb998c29a2a2bd8a7c505857bea252d77be96d932468c276c31d54bf55eb0e697658deea5cba16d8da65d5325a495416628c13c66c233844048ad056e
SSDEEP 384:ZZcIUsNmcYazizbwX+e+C/dHeWS+2RnLvKASBDt/OQJ9lMWyf5Urz/KD0:xUMPX5HkJlRbtSKc9mfS/z
TLSH
T124C27BB0D8641CF755E2EDC5A646F5062EF84237C6C9295CE6F9BA3E315F4F8230281A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6caddf8f4ba7e681f09bc8fd054f3d447268ee865f4ba9ca033a57a46164f9a2
MD5 523a3e850e2efd53edb472bc9612e030
SHA1 5d54246a0e4bbe3aceb983d91afcaa7ddeca4abc
SHA512 781b6810b4e51850d6911a20b2b8910cc19cf5385222f427ec25691a54bfa8b5153fb9aa79574dfec511a7127e3b45bfb60df26a7b3761470e90782a6cd0fd54
SSDEEP 192:aONZ6v+YLTQmiUyVZCh+CGx+Fdew9oh9aFS+2ZBCH4qwU6:aONZ6vzpcCh+C/dHeWS+2gWU6
TLSH
T136122A35AC381C7B5EE2A945F48735139EA85227DECA3F81D5EC2F1C01EF6AC130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e019fa895603da10ca5636c5138f5a631358c3f1f559d6c45dea1d269710e778
MD5 c226ae40376dd3c7e80909c6ede994da
SHA1 b52c959736455f188ec225f7dd17eb9e7b24c025
SHA512 eac6954f77dac8f873db7f10c10ed7befa24dd4e18b066f70af0fbb209372da8fd778896142a179b8acae6c7e3f9ad3f7b9261cacd69c5e601817144d84c1dd4
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58a738.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58a738.TMP
Size 392B
SHA256 18d6bb17150c4f433bddd66abf2605b4a98b0e5eaae1f407054057f08999fa7f
MD5 83afb51577aeeb61612251461e7d6a87
SHA1 3ced93e4e9d5a836cfd13d57c7736eb03a0cd9cb
SHA512 6a957dbed4f9d0632015eaaa83f9cb1e234f74deb9911544c49ea58c9bee56174d12a9f6e4b832ba79fe7f06fafadca4adc9f8a8ed96bffac1ce29ffe1568d4a
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 fec78d3d174cf56caacfda7d232e91b70f25c3fd22b72417593cd808f2c35966
MD5 979a68af8c09bbabdb05aa2d02dcaf27
SHA1 37225b07d6fa7addcb11a0b941bfd10ff26525ad
SHA512 95f3c2c8bc5016e08d43dcbd61f23093d6fbde3df5a04004d7e739063506489987f50f174bec30d1a751498bd90c481fff7deba3d3d922943a106c4e0cbce32a
SSDEEP 3:MsEllllkEthXllkl2zEklk+//:/M/xT02znJ
TLSH
T1B34404047FC35405C51054304031C7710374FCD00D31574335710D135CC55500C01040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 27088e2d617c2f7f289a3ed4a2461eed7735a6d31ae3b04110a1c24e5209e1a0
MD5 6ef577db9536255ae6700cc6dc9cd8d7
SHA1 949182533a7f2833d4f46fa234040d7583989b0e
SHA512 ca02089f5f649fdf86dd3edcfdae363c34aac62b5948f7fdcd664df3dfaf1f0ea46a57f1243b8314c044dba4bb96dc052bd6338cf276b289c7cbccfd25360581
TLSH
T11241386CA6EE1148B3B77E5AABF7A46D547BB9772E0BD45E00010D4F0A62B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Committees.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Committees.a3x
Size 1.1MB
SHA256 6d6980639bb20c551c762bb145d8615dd7aa092f64e9ba56bb464acbc7d28f90
MD5 a94c25fcb7f258495ad9c07800e49322
SHA1 22b3731ea89c018c27a7f9a714a2ea09ba6a9547
SHA512 6fee6b9e48d61b5fc4f392d4badb9a35ac6fb72a8ac6e4418b396b88bc048a298a998fa3c38ede73521114f0b478cca19954f1c379c815ccbe00d0ef45bdadc5
SSDEEP 24576:UR4wdS47w6960Yt39WQzZ8G2DsLne7HBPrpOSqfQJa/bqySW+v:Um6w6I0E9WQlq+0hISGbbqySzv
TLSH
T1403533058BEB11B5EF55BC0BB51757AF1C640A69FC60A09B7E98432CC4EDF8E44B289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ff60487-e678-43e4-804a-49bcfdbc43c3.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3120_2045206042\9ff60487-e678-43e4-804a-49bcfdbc43c3.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3120_2045206042\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4376-906-0x00007FF813F70000-0x00007FF814165000-memory.dmp

Download

memory/4552-1010-0x000001ABBA980000-0x000001ABBA9D2000-memory.dmp

Download

memory/4552-1022-0x000001ABBA980000-0x000001ABBA9D2000-memory.dmp

Download

memory/5152-604-0x000002449A050000-0x000002449A0A2000-memory.dmp

Download

memory/5152-606-0x000002449A050000-0x000002449A0A2000-memory.dmp

Download

memory/5152-602-0x000002449A050000-0x000002449A0A2000-memory.dmp

Download

memory/5152-601-0x000002449A050000-0x000002449A0A2000-memory.dmp

Download

memory/6124-600-0x000002E1FC360000-0x000002E1FC361000-memory.dmp

Download

memory/6124-599-0x00007FF813F70000-0x00007FF814165000-memory.dmp

Download