hxxps://mega[.]nz/file/YAEGlYDL#S7Y_XVQCfz-TVgjVwp3JQ6e1Kqx3-Apnn-Pkv8b0MNs

Analysis

user interaction
yes
max time kernel
509s
max time network
485s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/YAEGlYDL#S7Y_XVQCfz-TVgjVwp3JQ6e1Kqx3-Apnn-Pkv8b0MNs
Sample260809-fa7hnszhlf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4336	msedge.exe
2688	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307240829443308"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000020268dd3ae3dc01c4ab2b8147e3dc01b063b299b927dd0114000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "4"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
404	chrome.exe
404	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4544	OpenWith.exe
3772	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2900	7zG.exe
Token: 35	2900	7zG.exe
Token: SeSecurityPrivilege	2900	7zG.exe
Token: SeSecurityPrivilege	2900	7zG.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe
Token: SeShutdownPrivilege	4024	chrome.exe
Token: SeCreatePagefilePrivilege	4024	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
2900	7zG.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe
4024	chrome.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
4544	OpenWith.exe
3772	chrome.exe
3772	chrome.exe
3772	chrome.exe
932	chrome.exe
4800	chrome.exe
4800	chrome.exe
4800	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 2176	4396	msedge.exe	85
PID 4396 wrote to memory of 2400	4396	msedge.exe	86
PID 4396 wrote to memory of 2400	4396	msedge.exe	86
PID 4396 wrote to memory of 2400	4396	msedge.exe	86
PID 4396 wrote to memory of 4336	4396	msedge.exe	87
PID 4396 wrote to memory of 1364	4396	msedge.exe	88
PID 4396 wrote to memory of 1364	4396	msedge.exe	88
PID 4396 wrote to memory of 4976	4396	msedge.exe	89
PID 4396 wrote to memory of 4976	4396	msedge.exe	89
PID 4396 wrote to memory of 4372	4396	msedge.exe	90
PID 4396 wrote to memory of 4976	4396	msedge.exe	89
PID 4396 wrote to memory of 4372	4396	msedge.exe	90
PID 4396 wrote to memory of 4372	4396	msedge.exe	90
PID 4396 wrote to memory of 2824	4396	msedge.exe	92
PID 4396 wrote to memory of 2824	4396	msedge.exe	92
PID 4396 wrote to memory of 2824	4396	msedge.exe	92
PID 4396 wrote to memory of 4684	4396	msedge.exe	93
PID 4396 wrote to memory of 4684	4396	msedge.exe	93
PID 4396 wrote to memory of 4684	4396	msedge.exe	93
PID 4396 wrote to memory of 3244	4396	msedge.exe	97
PID 4396 wrote to memory of 3244	4396	msedge.exe	97
PID 4396 wrote to memory of 2076	4396	msedge.exe	98
PID 4396 wrote to memory of 2076	4396	msedge.exe	98
PID 4396 wrote to memory of 4768	4396	msedge.exe	100
PID 4396 wrote to memory of 312	4396	msedge.exe	101
PID 4396 wrote to memory of 312	4396	msedge.exe	101
PID 4396 wrote to memory of 3308	4396	msedge.exe	102
PID 4396 wrote to memory of 3308	4396	msedge.exe	102
PID 4396 wrote to memory of 3952	4396	msedge.exe	104
PID 4396 wrote to memory of 3952	4396	msedge.exe	104
PID 4396 wrote to memory of 2196	4396	msedge.exe	103
PID 4396 wrote to memory of 3952	4396	msedge.exe	104
PID 4396 wrote to memory of 2196	4396	msedge.exe	103
PID 4396 wrote to memory of 3592	4396	msedge.exe	105
PID 4024 wrote to memory of 4788	4024	chrome.exe	119
PID 4024 wrote to memory of 2812	4024	chrome.exe	120
PID 4024 wrote to memory of 2812	4024	chrome.exe	120
PID 4024 wrote to memory of 2688	4024	chrome.exe	121
PID 4024 wrote to memory of 1688	4024	chrome.exe	122
PID 4024 wrote to memory of 1688	4024	chrome.exe	122
PID 4024 wrote to memory of 2824	4024	chrome.exe	124
PID 4024 wrote to memory of 2824	4024	chrome.exe	124
PID 4024 wrote to memory of 3244	4024	chrome.exe	125
PID 4024 wrote to memory of 3244	4024	chrome.exe	125
PID 4024 wrote to memory of 1036	4024	chrome.exe	126
PID 4024 wrote to memory of 1036	4024	chrome.exe	126
PID 4024 wrote to memory of 2320	4024	chrome.exe	127
PID 4024 wrote to memory of 2320	4024	chrome.exe	127
PID 4024 wrote to memory of 1988	4024	chrome.exe	128
PID 4024 wrote to memory of 2292	4024	chrome.exe	130
PID 4024 wrote to memory of 2292	4024	chrome.exe	130
PID 4024 wrote to memory of 3772	4024	chrome.exe	132
PID 4024 wrote to memory of 3972	4024	chrome.exe	133
PID 4024 wrote to memory of 3616	4024	chrome.exe	134
PID 4024 wrote to memory of 4128	4024	chrome.exe	135
PID 4024 wrote to memory of 4128	4024	chrome.exe	135
PID 4024 wrote to memory of 2932	4024	chrome.exe	136
PID 4024 wrote to memory of 2932	4024	chrome.exe	136
PID 4024 wrote to memory of 3216	4024	chrome.exe	137
PID 4024 wrote to memory of 3216	4024	chrome.exe	137
PID 4024 wrote to memory of 3308	4024	chrome.exe	138
PID 4024 wrote to memory of 3308	4024	chrome.exe	138
PID 4024 wrote to memory of 3772	4024	chrome.exe	139
PID 4024 wrote to memory of 932	4024	chrome.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/YAEGlYDL#S7Y_XVQCfz-TVgjVwp3JQ6e1Kqx3-Apnn-Pkv8b0MNs
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb2700c188,0x7ffb2700c194,0x7ffb2700c1a0
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,8091700580526306492,11618649234742745774,262144 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,13197489234950108444,10891368209427809895,524288 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,2099388519707796194,9816173440655296710,524288 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,13914975117072114449,471016950043493702,2097152 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,13703120231225337084,7045590295580297316,2097152 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,16901713134069411565,8315721336798522533,2097152 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,18402746662361431873,16428409160773514240,2097152 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,1507596455599970495,6797204873296107440,524288 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,4881665097232755097,4481682362520637286,524288 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2872289448219683026,12451340998087719482,524288 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2872289448219683026,12451340998087719482,524288 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,10043875848751105357,16339708171168169879,524288 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,8660340657775618622,17300731392979958092,524288 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,10782963092324587186,5614789426524249521,524288 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6380,i,13022001237477196060,2044293369415452700,2097152 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,3020444613688258326,18007608472828466524,524288 --field-trial-handle=2028,i,3332732930389566876,5353035276498428103,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:8
  2⤵
  PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4264

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2312

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\BoostBot (2)\" -ad -an -ai#7zMap22012:86:7zEvent19365
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2900

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb1a3cc728,0x7ffb1a3cc734,0x7ffb1a3cc740
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,2598129766940544834,2218973145447039174,262144 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,8252937491796908537,13541070967312383501,524288 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,1620144644877435023,2794795903712742693,524288 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,392581817909241068,12669459890824505688,2097152 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3456,i,4742232487851842127,6716693834592675354,2097152 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4544,i,10143285344026098534,9166875120115157720,2097152 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4560 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4700,i,7207331448930896611,4996452893195525648,2097152 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,17923582602510944070,11393473951525012030,524288 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5776,i,15681537048030615408,4796416567280920768,2097152 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,103302343690697634,10716511044684985199,524288 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3484,i,7942123965004785874,2956897621734707780,524288 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3472,i,5278188184025519634,12119879872120768020,524288 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5412,i,18144092769067838794,7871647880968167587,2097152 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=868 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3680,i,10082331726067824539,18405367823515718033,2097152 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=868,i,439053088802157345,6075119982837763385,2097152 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,6073715794793835214,8675356071350746055,524288 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3624,i,13754513078535589361,4571521651408501522,524288 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4564,i,12793797006889360142,8530436588787878942,524288 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,14670741784676632652,4029838048942793344,524288 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5948,i,7786665661325793974,18119112290571105668,262144 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3688,i,8476146133522439821,1759108471255850176,524288 --field-trial-handle=1964,i,2729127488034326572,14264652890349456563,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:4656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 72a6b6cb674874e9507ae0a637b48c1e84d97e6031ef5640b57f28bfad60b7fb
MD5 c1547d56d1d6bd4afc4931e995dce4d6
SHA1 15748dd908fb7e1bd9af77b9d5c2b8c4f27972db
SHA512 2cc4690828db780a0c83a4f5c155b8f4f450139309f2d2ad1bbbda04440a85f900dfc7a320eb3c80f9083441fda88d257294cede4999f6f28130f5df495b2870
TLSH
T120E02B9ACC22AC7728FD571850914746EF5513562A91591F3E3CD20C8FB262A4596C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 52KB
SHA256 0c72ee36fc8f17f1973a2d2cef4805a369b78e7f25cd8276543e59ddb1ad0457
MD5 293c8b9dd1ce5b12ae9cdb2730347f0c
SHA1 9bc0055cf4dd0371390739d151ae6ef5f66098ad
SHA512 eec52a1e161389e5336e604b2a97613a50038b11444c948b59052cbdd51fcc3c300aab7c659fafbe9eb7b223045a1cd43811c65b1df334792ef86baf0c421b49
SSDEEP 1536:jmDhqE+FYOqTbzsx7ehMeGAxHL18DnOBcLysp:j6qEiwTfsx7eh3FynhX
TLSH
T11933F1B5674174BA3AA7F87DADE9CB876F3F3D0F569810ADA056893F18C84C27182091
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d
Size 27KB
SHA256 7755b27390678d2d72e4e20722e37d56386d8f01224e625d67bd4404f43600b8
MD5 a6b33ad5aa46835b424b9c9c89eb7287
SHA1 9e0134816dea0fbfa7e17b66b90e1b06f8fafe8a
SHA512 5a93c11dc91f6756a853e2ca1ba79ea99ec45e585187549a6c4d1b74dbfedf04f0e4003e826b6b0488decaf66b1a9b26287f8e544d0afa782b083f6640cbe2aa
SSDEEP 768:KTBE8PQqZELS1R3bRxcKYaePTqI3wnEDmtJiQn:KW0QwLR3bR2KYNmIwpiy
TLSH
T121C2E1765A17DA04AF859557BB47C07133297322160AFE401A08B8BEBFF8709371F65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 aac2bc68a8a23fb0643e10f47efbe9fd04f9df28a2c18c9ff043a93f5ab2d278
MD5 aa593111ee2fd93108941a920f3bcb04
SHA1 b10c983adb5becca3fbcc5df0a8d2ce7e0a206e2
SHA512 4c876e1950a59c54bf98ce259f9f755ec4a71d110881c3edf6399bdd9413f5d86806acc484567784b99c1e74c617614cba64a5c386545e2921ecbe808e8d627a
TLSH
T112C0920861800046CB38A1B126BA454572921E210BB695EA85C329EEC462B648AA2A50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 bb5ad4dbd117d91da72b24b389c7cd7115370199f309ce36ee59b8386a41c157
MD5 9d7d4a8263235241e687ce621a50708c
SHA1 42a753b8e46c6213f55f394d56764ac2880669bf
SHA512 b4753971f8f7df78d8aed15c62ccdc223dbb0981fc6ec790d27e888094121702af881aab2bdcc6838e7048010e4dd552f78342274d18165ee325d7dc1a839c01
TLSH
T11441A584618F48B9CB6028365CCE48327931072377737EFAA3591F30D1DE7A45221BAA
MD5 SHA1 SHA512 TLSH

Submit Download

05344a64-f3d8-4fe3-bf53-6493067a26b4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\05344a64-f3d8-4fe3-bf53-6493067a26b4.tmp
Size 11KB
SHA256 4f3260f0af7a367223620b1bedd8b3da278533d4390bffee0c3b9febf4afd6de
MD5 5127504a150b86fa475c24600c62b8c3
SHA1 418209e6806ac15aee8e57221ecfb49303645873
SHA512 9a63860e9f2bff9a1da37c6fa82f7e56d819d2877a36387693ce77b46cd9e952e34df15bfa4728ec3f50b1d7341f7d4bbc99dd9e886703b77109b0e1bd8a7cb5
SSDEEP 192:DKi2KEFbcypCJRKY8aI7xJg51BcnfhhPE8pXUSNPUeaPpfP56IAKhVoiwfJK9ykl:DKi2KEFbcypCJRKY8aI7xJgPBcnfhhPa
TLSH
T1B632A0B3C3D8C62DC85162F49F297E1BCD290928522C3D67C9D9EE5B93E2472E25024F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 fd8ec4e5651ead4d7490a9d35a9e83173478ccea01de965aecf523dc954ef526
MD5 9d52df26ee28c4008bc45bcba6c6d324
SHA1 3d92df6b71340024a338730830f1d09ce75fe10d
SHA512 ae9dfe231661f9dc3c74d65b180e6faf470d6684d15443f1a8be9344fc7485c8fd77f040c270ec40b701270692ec65497d49eedc561cfe0be58f711345b49429
TLSH
T15771BFF3C7E8C56DC95162F49B256F2FCE290A14431D3C66C8D8AE5B93E2472D20134E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 4d36134fb06263ba5c08bcaca680867246360adb8d19f0271b1843ce28a689a7
MD5 76cfd3e8b4213163ad6c782d6caf0b03
SHA1 9554d88ae5ed909e7c3d5f2e65b81aa99a94f31f
SHA512 5c2b051c79df65a94b2a546b62e624ed1aab747f2d1646344f1217d8bcb5655fc86e8e33124927c3284b6ef66f0ea6c0151e2865e2b8118a9090397a7239c86f
SSDEEP 384:DKi2KEFbcypCJRKYA3SaI7xJgPB2MhPE0XUSNceaxfh6IAKhVoiwfJK9ykLnXzSR:Cc1hDu
TLSH
T1E3429EB3C3D8C62DC85162F49F287E1FCD29092852283D67C9D9EE5B97E2472E25124F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 d318619f1da9003c46520a1f799b8d192a618146586951f9dca3cf60a9f2ecc5
MD5 5464371a0a20f5196a1b7affff0b361d
SHA1 5f996254bfef2034b58b972295464a22a428d420
SHA512 bc695c50c14189e0b91177789c56cc53c26c6df3369a613f5fee30ec0509f013dac6f24822ce6d341d992db88788ef0d9daa0c1ec185f9f89c84b7df9fff8cfb
SSDEEP 192:D0uGlwWtxA/PWxq1D3qtaI7xJEdBtMhkZqXUSNPUeaPpfPiNIAKhVRmwmJx+yG6M:D0uGlwWtxA/PWxq1D3qtaI7xJEdBtMhw
TLSH
T12F2279B783E4C62DC90162F49B29BE1FCE290924532C3D6789D4EE5B93E2472E25174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e96422a6c1abea0d53b4a3813e637c29a2497c7ec99abdeb94cd1a6823682e79
MD5 447e111a2479af7d2c5f95f3fdd7bbeb
SHA1 9a4bd3df935c0493e6d9a544b396353594b847cc
SHA512 bdacbe887039841d84c4a57c74c0be034a9533c6d935f55e67374005254f2b135910363826770e706791bf9340a8b4f278a1ba1c0aba28789ae2d53f43fc8969
SSDEEP 192:dR/E/Lr+LvH1hvv7hpf0PRpyPH7E95Hsb+WNn4M4aBcbOrRBiu1y6VyIsnAUgraJ:dR/GIn9VmXyYrwf7ccRBM6e
TLSH
T18C52D82EB9106D7B5CDAD229FD217B17D7F6103225A42E84EAFC896C15EB9CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 52371d83080ea98820aaf2d172d9ff0487c89f0d7987fcd61c9377c3e7be8cb2
MD5 aca4a5b9fe9d0a5eee32337ccfc2a39d
SHA1 4a133831b1ef9aa0b353c6a01370f758d547bc52
SHA512 e98b0b878aeab7bbd8a54917f6ab7afababdff546610cc5c5d184c237818ec5dc484f9f41ae7e4d7da32359aed9bd178cb87e0801a8f4958439370fb3d7e2deb
SSDEEP 192:dRDcBzE/Lr+LvH1hCv7hpf0PRpyPkx7Un95Hsb+WNcA4M4aBcbOrRBiu1y6VyIsB:dRDmzGIO9VmXyhrwN7ccRBM6e
TLSH
T1CB62C82EB9107D7B9DDAD229FD217B17D7F6102225E42E84EAFC892C15E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 584fc5036c48cb506f115d7b771d7d4e3b51a0cf0d4fa8b9f6dabb67408da2a7
MD5 52c85ef1458d2db10aa9e426a0e10c2d
SHA1 93b3a4c928e1fff6244f08d53e620cc6351f3a5c
SHA512 de7912f105186b14ddba1a1270f1fa2682a163bf173a8db363d5dee729675a7cf5622a245cad352e3f7ab452435a6ae249f06473c5d77d836b21c10f0692bd04
SSDEEP 192:dRDcBzE/Lr+LvH1hAv7hpf0PRpyPkx7Un95Hsb+WNcA4M4aBGBO2qOrRBiu1ydVn:dRDmzGIc9VmXyhrwN7R2FRBMrr
TLSH
T16A62C82EB9107D7B9DDAC229FD61B717D7F6102225E42E84EAFC892C15E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 169KB
SHA256 e8ad0292b78abdc61b3002ccaef6df956ffdb10c64fe4151878bb5f55f76afc1
MD5 6e42671802686dd1a20da88280e1dd35
SHA1 101ecdb431482de66c0492d8d37e91ac81c6cc7c
SHA512 22fd344c7e972160f1ed2cecd991fc372e0aa7fc6e9d9285ee5896d9d5b914397cda6315c721fba19177ea171eb16d092118e26e29acd8417a4d72ad54753571
SSDEEP 3072:DLejzWM9SNxPCD1hFiY5KcukCQG1KUfC1QTq:DkzWUF1KjjOdUq
TLSH
T164044457D1F899636F6B0443E8857E82B32C3147E619DAA1F987BFF0101EA2A70F5835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 33ad5775e54ce00d66798985ffeee99ba7f83f1ca25bc7168eed323ba3a3e6d6
MD5 7e60f572c25e63c80c936d26adeabd79
SHA1 8c9e979baaae3ddc9a5a9b8f9d245c5de6673dba
SHA512 5b94e4599db751d35bf4e1045af09b465314d010c2ad4e41746e363d174a4701c01146d3154c386148f94fbda1d772a7b5a263b99f0ad4de7c82b6651319ebcb
TLSH
T174B01240C0057101C08306B021471488F2145F25960E170143E06972C8253798014060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 45fe8ba89349460fd7d7b64e0bb3e88b3fa504f6eeb0a390ca9fd3ceb17adb07
MD5 37e7e9eec604f2bdff6fa503f762fc0e
SHA1 3b72174e0e4a1aa61c7cf0d0ef0a9c078d6e19da
SHA512 ccb4a8bfa7549dc7a2c0a4ccd30400a0c1dcb1de72cfdb195c36ed601a031b190fad84dd714dc232aa302968b6972eb915aac99dfc4d2362e3edc57c53561459
TLSH
T12BC01201C501A062C40F03B41A539C9DF1189FB8CA0B135893F4E93AE838621D02D161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5950e5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5950e5.TMP
Size 96B
SHA256 09b8edee702cec364ebcf123032ed98e15c636cb3a564665c8901fcafd7e1bac
MD5 0b7ecec0160946f050bfa1d414e15bf7
SHA1 b4c1d9a255dd325b1f4bd6e07edbd18c36e7a103
SHA512 a0cdd3095f28ce33b5e335590096ccb488e4f1bf463ce66cef4b146ed0e8f32f79b7b4a52f56a3a9447ba383bdff1155466857be24c0e138f9c3d086c0f8c4a1
TLSH
T106B00259C1226216C84243B02595E6EC7560DF25C603121293E15BA6DC297734566560
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 f4048355b0e56439fc92c546cb02c523986522831dafad4d486353ed72fbb67b
MD5 26cd7a1ec865895e768340b999ae6bf6
SHA1 049a5131868b88e7d28ae3ff368c1f545fb4b87a
SHA512 000095f4f491eb2328d4124736afc72b3ebe8b48ff4f325368fa9f81fcd61276e832a94a374ed8ab8dac466960246d88d6671be0d32f5600e935e64f6d7314f2
TLSH
T146A00228458D8122C4098378B6C216443225CA9515CB634581E100849C6025181329C4
MD5 SHA1 SHA512 TLSH

Submit Download

d2fefc98-ceb7-4ab1-8e79-bb7c764cd8c7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d2fefc98-ceb7-4ab1-8e79-bb7c764cd8c7.tmp
Size 12KB
SHA256 33ede3e0d39ed7edec4ff9ef881e785e5ffd012802e8ec80d131ac583ff80661
MD5 216651b16df7c8b2361690c4358e9838
SHA1 92fab3b0b16e244dcde50a2ce7322c561e488023
SHA512 dbacb8ac1975545235fcce76d9ebeec748b3402082a550a441a7776bf35f612310db76b25397d15967a3c37e3577323100804e6274fdc5d7f9bd8704b0debf65
SSDEEP 192:dR/E/Lr+LvH1hRBv7hpAPRp2Hv595Hsb+WNn4M4jb2HrRBiu1T6VyIsnAUgtaJ:dR/GIRR9UXYrwfg2LRB968
TLSH
T1A952C72EB9106D7B5CDBC229FD227717D7F7102225A42E84EAFC896C15EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 7f29c8a0435ff6e8293ed47a9f7c887c75fb8e55c54b5cd5959ef12b07aa003e
MD5 3f5110c7f21d5689769cccb3c43f16fe
SHA1 42607d712d638d5f8d9d8bf0e3d6ae1a8a447821
SHA512 6933e45a0c0e3adf2d7985ff8e4ddd7344525450d3fcbfc781a201570a4857ffea98fe20143a21699aa488d61413b7c1d33e14f8cc2d8ce59dea17b958bc2d8a
SSDEEP 3072:E2XQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzInqfd7NtZL8cHQRZEQ6Sps1:ExhxNPRW2PYddqmY7U52F0qZ/ZLW3Ex1
TLSH
T1B3342332BFD22F354C86DE6836432D2E6FF688DD90B4B745E9686F4B2C47810A45389C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 25883dea19d71a3adca7bef7edf8196ea7e60b55089016b3a22a497898b457db
MD5 b05718daefc3a2ad8496acf6402c59bb
SHA1 135049daecf6cafbcfedd90b3e059dbef921b4c9
SHA512 09f21853a876d3beed24f1d4bd6d72a43e09dd99fe3c05a546275d8e6f5730b94eee081dcc7ea5f08eca85c29c7155fac198a884270543c36aa8b9fd97801c4f
SSDEEP 1536:6yyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Fqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1B8C30237EBC25F335D82CB647A534FD697B644A99030D301AABD3BFB6C9345164424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 788b3b85a66d6ba1f1e42486a97b9cdbc530b5e9da4a93517265d05edf6039e9
MD5 50f448ce2c22d67a328f23a387652e72
SHA1 1b6fde2a959a99455a0a7c8e6d4fcb914203c9b6
SHA512 5c0f6595a03c7b787d64f7f133aafd61fbed318d1af46ae5b67cff4226b29e59956247320f23e2bdd4b742ff0110f0334f44e0657b8ba5dcb44f574caf7de988
SSDEEP 3072:epXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzInqfd7NtZL8cHQRZEQ6Sps1:hhxNPRW2PYddqmY7U52F0qZ/ZLW3Ex1
TLSH
T1FD342331BFD22F354C86DE7836431D2EAFF689D860F4A781EA686F4F2847C51645289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 5be9029cad2c985484d1a66f4369fa37bb7251e7aa3fd6f37815fae81f1f916d
MD5 d08c12da705deccfeec1b5f13d17b472
SHA1 e69d00c49a1c4c4fbc83ab70e400eb89f613603d
SHA512 8739f6e853aa91d635c11ddee1d4760cf3bb4a6af9d1576d36a1d9762f4200961809a836dcd22ee9c142eaf4a9d13210cf207460710cf83bb636698da6d085ad
SSDEEP 3072:w2XQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzInqfd7NtZL8cHQRZEQ6Sps1:wxhxNPRW2PYddqmY7U52F0qZ/ZLW3Ex1
TLSH
T1BF342332BFD22F354C86DE6836432D2E6FF689DD90B4B745E9686F4B2C47810A45389C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 2cf8044582b3c565a4ff0ca42f9a1ca88366923dd8d395431ce11ba2d60ae190
MD5 a06241b7f167f703c49976a63fc09766
SHA1 18294c3954388dedc537c344d281f54ac6792cc6
SHA512 d776d8c616cf0029ec69d306c784c7f122dae6865d0142a77e69a963eb1effd948dc9bf941c93cca658d7f8c951fd5a41070229427fcdf2e28b0a2b49017eb66
SSDEEP 3072:hpXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzInqfd7NtZL8cHQRZEQ6Sps1:0hxNPRW2PYddqmY7U52F0qZ/ZLW3Ex1
TLSH
T1A9341331BFD22F354C86DE7836431D2AAFF689D860F4A781EA686F4F2847C51645289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ca4ac85fa9af9d400600502f608a3f8d8bb73aef8a60227135f105dbe1ac2307
MD5 fd67f6c669d512d4f5409397f5166524
SHA1 57fe9fe38f3185ffaf45d9ead615bedb1359e4ef
SHA512 33fb3eb9c722b4610f37fb197d6c1b499a01cc5837317c4a96cf987a38080a355b423a63a7605516c6e162ee005b1a8e5c3175e684731288f3db35ba4da31224
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
TLSH
T124B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f21c2484e331c61ddff52b46cbf8498513b5234757c8746e10ae54e51e27f41
MD5 b0a46b7af0b38c25b50c8b3be8ddaba6
SHA1 116fda3e5dd4e6fbb38a6a806bd87ff4bae65ce9
SHA512 c5e35f661bd702679ca4d61b25d042ff3db55d8ecc7c6e4f7b71e1704afc680d61f84cf54b549c0d5de96ec173c72d7d2d837476990bf80dc57bc33a891f9f21
TLSH
T1EBD023707969F5D0C61C017451105E4037364571319B974BE1965C1D9DF00C0D3EFFD5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bd1e1c9afd91168e0fcf468502996eee7b162929f2bb2862cc0cd99e78061a3a
MD5 fca1efb00ea3072049c1d55f4ee5ab8a
SHA1 fb5cd0c18e89001a6029a3118d405681c47eb6da
SHA512 30e27b396ba4170480cce15460a04139e137baa82eedfabd60a9da7da0e0fd92489ebf8651614940cf8ca5fc69fab667b940d2635cf46c91e5a005f76a1475ea
TLSH
T1B67183193A564B9FE7514E39E4E00237317AC6990E030F6AF2735CFC9396F76A662418
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 18bfab653e544326e7b7f689c7566b005194236b826c394fb2e4e75d4b090213
MD5 d86f75b717207ec1c2fc61434199c75d
SHA1 de6e1a43ad748b031b13b6290d2c356257f35a83
SHA512 3227654dcbc63f39e8b098194c758ffb621692035288d453a44fddb3c2dbce67cc452f026f4635273655527c90c287084c71a97dfbaf3f8786154fd9c5d574ff
TLSH
T1BF7193193A524B9FE7514E39E0E00137717AC6990E030F6AF2B35CFC9396F76A562818
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fea670bd90911db8598a9765bf5a7b1478fb310eac5169f570acbebed50ebb35
MD5 03fdde44a3880119722b38af26ab2de4
SHA1 b4db37ad62a54eae239b6755c6226fa18205804c
SHA512 c327ba050d98d02a0e6416e58b7101ed496407ee02fb75f4f06ce43b3320c1fa17641bbb7523b09f21dfe4ed81a46d5eaaaaff78892c8190546d0cd76a917fa6
TLSH
T1E631ADF783B185AEDE1156F09A04AF2BCE5C0116539C385A8AD4AF5793B3471E101A4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 90222842aee44cc71d019fbb145f328419b6c003a866cfbaad68349ceb87311e
MD5 abf08bee7df4ddb3468ab260e2b3d779
SHA1 d1931fe93e612d45761be2a0ae5d00fc25e8d77f
SHA512 09a0b3e7d2889c23ae48251f96d92c25a3d17d94c6b3e83830ce13d437ce565fd260858e12affc9bf1c3cb03ac6adbc56b9acb1fa68957daec4f1d35aea1a0e5
SSDEEP 192:sxZ2R2yM/jK1Ml8MkM/ffsmhwlIdpLHHW6+WNQMK/YLZkd+bIgrJ:sxZ2oMM/ffsmqWrHbi/Di9
TLSH
T16F52FA126A345977CCDBD209BA15BF53D6F9047392900D589AFCDA1C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4bc14a7e026f9747f0c5cd5fcdb5e86c294b80a54ca986250398bc368ccddaf5
MD5 c3283932165c64db0fbaaf7bbdd88629
SHA1 3f0fadcc4a7bf2074573ce8ceff8ec8c1cedd9fe
SHA512 197747e70889c48fb8ec6b99535476075efc1fa456822a060977a0f01c74e4b9c066ea26ea13f78c68fa64ac68f76dd3a5296a21ccdbd738257e2962d91de19e
SSDEEP 192:sxZ2R2yM/jK1Ml8x9M/ffsWWpVdhwlIdpLHHW6+WNUu/6GXYLzJdp8xIgbVRJ:sxZ2oaM/ffsWWvdqWrHbUqXep65
TLSH
T1C962E912AA34597BCCD7D20DFA55BF53D6F9046392904E589AFC9A1C04E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ed0680906c4bf019a7f103965fb0ea973b884551d819924e7d3f6f1a285965ee
MD5 668c13febb3587b5fd3b00ec16a29a38
SHA1 1be51a9141437901a70870605f570d881c767392
SHA512 17527b31ceba803945238463784fad2487050750c01bc0565ea08f53f8de259264a318d90ece9038c42b66842800fa721bd2d73a1ed4b2f5db7e98eaab5cf22f
SSDEEP 768:0+s6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNvroN0:0+s6pD1WvxzWju1jahILIsN8N0
TLSH
T135D2FA3B680CCB7E4F841E5CAC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0a8719e4a313e62131cd844b25267ced026fb7bb47609dc298b65e813c1438cd
MD5 aaee395f46525d339017bdabeb3738dd
SHA1 39aefc1a607ce63fab629602113ef9b1d70545b4
SHA512 772aa86ee19beccf6c166cc863ac5aebd018e3ca4c3b8eeb6a100f9539240beabeff283812cb8266dafa4cef44062b84b18cb241ecb7a915c43ad343aa9a1d21
TLSH
T1EBA0026559648464C5004570943311981341C8201948725550A501989C95189412242C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589313.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589313.TMP
Size 48B
SHA256 3e3377429f423d4edec5b7a24cab089d96fe4beb49e9628675635df6c4928ca3
MD5 406ca9176b7dda0cd83f995e48e55d41
SHA1 32a947e7ca0f534ea16a18c9b07f8c64f17e01eb
SHA512 d4c582398be5ef29f041b1e46294023fe41e10f94a79c84e88ed19ed81196c740cb277ab99c15cdd9480d26404e1ca7f4dccf0903f762fc2fb71177e64837c66
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8714ea5e5aed6230108be364a18308c67f2e732f26fef6c1cdb877a2af429ebe
MD5 1edf3f06e6ae69e3106d9195701fd552
SHA1 9913fda6d68f4d53b36e9244e28a544e5a1ca0f8
SHA512 b6471bddf5ad557db50e023bd6ed55884c713a71acf7aed70f9c1838f4afb2695218b5730a94fbecfffd76b747e173231a14f2f77665888128e87b3da37a52a2
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFlIFKe4gfytVIZKGE8aW:KUAAKtePulWKe4iuV2KGEVW
TLSH
T16D914B5331BA17022C3E1E0C9354C76A9E4275A3316DA43B3BAC40721EABD214EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6b45421435874a79844c0aa851c01fd055aef34759e76027658c71de91b6dd86
MD5 64f0513d4a5915b5d8a6e234758ce9fd
SHA1 3d40f2f96586914fb4a896bdc2241e9c9ec0e97e
SHA512 9586657f227c4f6bf6e60ee1af1ccc8e18108a66cd7167f9327bee9c1d401b29079a7937f068d0d3ac403ea344434eceaafbfc84c82544e9524b9947e9aecd8d
SSDEEP 384:nZcIhsNfUka54rIua97ORMKoTWnTKwBODNZOCCWB:PhskJOpoTWnewBKZOjWB
TLSH
T152927C71AC3C6CB65DF6B145F94A22178EF88067E5C52B98D5ECAF1C00EB658230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 36f418aaf7f314f5b0529105f4cd7ac100798dc1fea6176db3072b363f0c4707
MD5 87652298773d655430b8a209981397e6
SHA1 098c30b8e67ee606bfdda8083e616f420c232064
SHA512 a462a56dc41494062205526667b848b33b3f3cc0a73921aa93f3d1a1bdb57bcec404139e59ffcd20a675298a3986be437036e6c8abe521b5a92446ad4a8db0cf
SSDEEP 192:qONa6O7+3hQmiUy2qGttb0aO2eh2dqgGlcU6:qONa61UGt97ORMa+U6
TLSH
T141020A356C286CB74EF2AE45FA8737239FA5103BE9952F84D6E81F0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 aea70856c838fb1f433889ab484b873a716940e5b4b9a87d43736a7f5b6c7cb8
MD5 4da88c3b578add298e9f5d2f38ccbbcf
SHA1 350e5dc1ed531b49dc96c814ecf67387a8ea5df6
SHA512 45dd6fd74db73929e0e41136f42d81ca669acccdd12d986c17b78763fa672683335af14e967d1d94a56b5e48a1e1a7d2ec1bd63250152d2f0c170ed261da3e15
SSDEEP 384:XZcInsNfUka5r4Iua97ORMKoTfuvURSBvt/szqKkBwnTKwBODNZOCCWB:fn0kJOpoTY6SozqtwnewBKZOjWB
TLSH
T13DC28DB1E8685CF708A0F4C9A98AE1175DB84137D58D1A5CE2FCBB3C309F9B81356C65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 81457cf93ae5f9a8478ddb3991f9774e214b0be1c1aec26b0864e308202c815a
MD5 7352fc054f54c80b94862678148e1992
SHA1 294c0e20d3217a5f42bf45553ab25612e72986a0
SHA512 c20da5a86f4f6691e4ecc961d0ad3c2f0e75ea5e2e13b5e05c9356886ddeed3ad59267452798493f2a86eb733457ef749742ec6857dbd12a094061654c625e60
SSDEEP 192:AON16O7+3cQmiUyfJqDttb0aO2eh2dsLEMcNbqKeU6:AON16CjDt97ORMKolWU6
TLSH
T1EA121C31686CAC771EF2A545F98737138FA5412BD98A6F84D5DC2E1C01EF66C234B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3f8d1f7353506350d31c3a394a28b0a209e50101f8eaa99bba83044eed91dc1a
MD5 7a2a44982164060fe9fc50f8339cd811
SHA1 419ab127e2c58e64a31db64dbcad79c2a6786aff
SHA512 abaf83269ddd7dba7358ca66f38df16483a605da29c4f2772ce1fd23eb9f0290726e12f76039c69b37c71ecacb04a21e061bf7255ab6c8eb40258601ec3b5ea9
TLSH
T150410748B6FA1148B3776F5A9BF6A86D447BBC772E06D46E10110E4F0676B40C862737
MD5 SHA1 SHA512 TLSH

Submit Download

BoostBot (2).rar

Path C:\Users\Admin\Downloads\BoostBot (2).rar
Size 118KB
SHA256 ebc7cbe8b513cd412e2208b657978833727902827203db3177de9927eb94737f
MD5 7e0956d024752ea2c23222153897529e
SHA1 2bd0219542c8dbc36d4fa3511f7dfa9387bca835
SHA512 82905cc21292abe0f02ea0f805752a6087cf0cfca5832147813be18754bc6a806674661cdf3f4f244d7e9dabb3d23495b1aa93a86c53e9f195d7562f1d5ca3a7
SSDEEP 3072:jfj/Fdaxr1SAKZQyVqD7i49L7gU+s9yH+DsIRLuxAX:P/FAUALyYvrxgIHh
TLSH
T1B2C30261E3B9E6211C1022AE20EDF8A99CDE6BC69FBA87438E3D741405C4F54F31D639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

authsystem.py

Path C:\Users\Admin\Downloads\BoostBot (2)\BoostBot (2)\authsystem.py
Size 2KB
SHA256 201ddfc205cd963a937028a46231f7d89f26ab053503fab200ece8c71327730b
MD5 8836e7ef755742df5b621fbfec77776e
SHA1 68b5b77d517ac870dc31b1cffa5159fa7a4367a3
SHA512 1710c0c139a14a1b62e224a1c0e7a7ae209824e84c168fdb8d73a937e351a74b1cf9b5e70db7db01c555f08b37ef309b5915e9fe73a21a0d80f1e78813d9526a
TLSH
T18351E117BC86581200B6C82FD68AC482D10A57770DF4248375EE6569AF72D2816FAEFC
MD5 SHA1 SHA512 TLSH

Submit Download

logger.py

Path C:\Users\Admin\Downloads\BoostBot (2)\BoostBot (2)\logger.py
Size 2KB
SHA256 d29affb245d148af2609ca77d37a5a218b41a3f9beff3453ffd7862e84002b2f
MD5 d61e1cca39489279b868d4315a6186ff
SHA1 858fce22be1c2d775680384b24127fb302eb46cd
SHA512 f1afd02c8d8d01d01038b4ad89a33c463e778c50c4965fddcaf47f9434e2fa3d17e9f6db5c140e656c9bf440e39a9ef40d167016383a89ffe6ee93322a8c4955
TLSH
T13141CE9D89080F17425BE72D6C69E041B9A87931B639A2F73DBD84193F3C31602AC74D
MD5 SHA1 SHA512 TLSH

Submit Download

main.py

Path C:\Users\Admin\Downloads\BoostBot (2)\BoostBot (2)\main.py
Size 4KB
SHA256 42f6f8ac03a44d41ed39052aeffda0f6f224f4e93c97995e2d89271daa989c92
MD5 4a1963fa0aec1e4463d77e7986e42be3
SHA1 4aa41024af1ff16e2095124f6538e351f61b6c40
SHA512 738b90f2d02c84da225a33c8fabf3e50ba591c854004a1ffe3367410e348048e01a012d84d751e727b7dbef217ef2804b8b7a36cb0cdcbbcd529f238f51e8521
SSDEEP 48:jn5Y2cAA2vNTzWAqkeHqiOvOGfDHZ31X1/11t0mC32D+:jn5Y20dqtpfDHXl/HtF7+
TLSH
T1BC812336951A3362532E8C4410B9EF183B7198C68536E069F6EDB3D02FB9D359CA66C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download