hxxps://rajcogroup[.]com/transbranla/

Analysis

user interaction
yes
max time kernel
118s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rajcogroup.com/transbranla/
Sample260824-pptd2add56

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1976	msedge.exe
4808	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320482518900696"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{26DDF130-3CF9-4261-A2C9-6BF666EB586B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
768	chrome.exe
768	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
4728	msedge.exe
4728	msedge.exe
768	chrome.exe
768	chrome.exe
4728	msedge.exe
4728	msedge.exe
768	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeDebugPrivilege	5760	firefox.exe
Token: SeDebugPrivilege	5760	firefox.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5760	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 5000	4728	msedge.exe	86
PID 4728 wrote to memory of 4192	4728	msedge.exe	88
PID 4728 wrote to memory of 1976	4728	msedge.exe	89
PID 4728 wrote to memory of 4192	4728	msedge.exe	88
PID 4728 wrote to memory of 4192	4728	msedge.exe	88
PID 4728 wrote to memory of 4052	4728	msedge.exe	90
PID 4728 wrote to memory of 4052	4728	msedge.exe	90
PID 4728 wrote to memory of 3796	4728	msedge.exe	92
PID 4728 wrote to memory of 3908	4728	msedge.exe	91
PID 4728 wrote to memory of 3908	4728	msedge.exe	91
PID 4728 wrote to memory of 3908	4728	msedge.exe	91
PID 4728 wrote to memory of 3796	4728	msedge.exe	92
PID 4728 wrote to memory of 3796	4728	msedge.exe	92
PID 4728 wrote to memory of 4048	4728	msedge.exe	93
PID 4728 wrote to memory of 4048	4728	msedge.exe	93
PID 4728 wrote to memory of 4048	4728	msedge.exe	93
PID 4728 wrote to memory of 5072	4728	msedge.exe	94
PID 4728 wrote to memory of 5072	4728	msedge.exe	94
PID 4728 wrote to memory of 5072	4728	msedge.exe	94
PID 4728 wrote to memory of 3312	4728	msedge.exe	98
PID 4728 wrote to memory of 2888	4728	msedge.exe	99
PID 4728 wrote to memory of 3312	4728	msedge.exe	98
PID 4728 wrote to memory of 2888	4728	msedge.exe	99
PID 4728 wrote to memory of 3424	4728	msedge.exe	101
PID 4728 wrote to memory of 2716	4728	msedge.exe	106
PID 4728 wrote to memory of 2716	4728	msedge.exe	106
PID 4728 wrote to memory of 2716	4728	msedge.exe	106
PID 4728 wrote to memory of 1948	4728	msedge.exe	109
PID 4728 wrote to memory of 1948	4728	msedge.exe	109
PID 4728 wrote to memory of 1948	4728	msedge.exe	109
PID 4728 wrote to memory of 1652	4728	msedge.exe	110
PID 4728 wrote to memory of 1652	4728	msedge.exe	110
PID 4728 wrote to memory of 1652	4728	msedge.exe	110
PID 4728 wrote to memory of 4416	4728	msedge.exe	114
PID 4728 wrote to memory of 3572	4728	msedge.exe	115
PID 4728 wrote to memory of 3648	4728	msedge.exe	116
PID 4728 wrote to memory of 4448	4728	msedge.exe	120
PID 4728 wrote to memory of 4448	4728	msedge.exe	120
PID 4728 wrote to memory of 4448	4728	msedge.exe	120
PID 4728 wrote to memory of 824	4728	msedge.exe	121
PID 4728 wrote to memory of 824	4728	msedge.exe	121
PID 4728 wrote to memory of 4236	4728	msedge.exe	123
PID 4728 wrote to memory of 4236	4728	msedge.exe	123
PID 4728 wrote to memory of 4236	4728	msedge.exe	123
PID 4728 wrote to memory of 5084	4728	msedge.exe	124
PID 4728 wrote to memory of 5084	4728	msedge.exe	124
PID 4728 wrote to memory of 5084	4728	msedge.exe	124
PID 4728 wrote to memory of 4932	4728	msedge.exe	125
PID 4728 wrote to memory of 4932	4728	msedge.exe	125
PID 4728 wrote to memory of 812	4728	msedge.exe	126
PID 4728 wrote to memory of 812	4728	msedge.exe	126
PID 4728 wrote to memory of 920	4728	msedge.exe	127
PID 4728 wrote to memory of 920	4728	msedge.exe	127
PID 4728 wrote to memory of 920	4728	msedge.exe	127
PID 768 wrote to memory of 3348	768	chrome.exe	130
PID 768 wrote to memory of 4808	768	chrome.exe	131
PID 768 wrote to memory of 4576	768	chrome.exe	132
PID 768 wrote to memory of 4576	768	chrome.exe	132
PID 768 wrote to memory of 3312	768	chrome.exe	133
PID 768 wrote to memory of 3312	768	chrome.exe	133
PID 768 wrote to memory of 3572	768	chrome.exe	134
PID 768 wrote to memory of 4380	768	chrome.exe	135
PID 768 wrote to memory of 3572	768	chrome.exe	134
PID 768 wrote to memory of 4380	768	chrome.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rajcogroup.com/transbranla/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc1b7ec188,0x7ffc1b7ec194,0x7ffc1b7ec1a0
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,14787804337384459030,9849003015232884516,262144 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,17040370742083902501,14410040248520093671,524288 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,9906111930350472164,6751624726119815517,524288 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,14122727033899949640,13200245074538977959,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,13944144162565624068,16910796536666938952,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,6296640364116962859,9816744711433128556,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,875976441487569065,1151229344039038386,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,9654297708898107311,9062213176162273787,524288 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,8502806780724803001,3524165941136459721,524288 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,18279572451653754860,4939928370630820045,524288 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,18279572451653754860,4939928370630820045,524288 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4440,i,10247389225852055353,11352109933077085588,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3560,i,11172278430013683634,10695007201093433885,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5784,i,7486540392561118878,12742802522784211888,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,5792534084101099508,17312795512575784269,524288 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,16777462634742873939,9827727512390391197,524288 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,6002193683677852219,3129275465443656952,524288 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3376,i,9026407653501570794,194161449367150624,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,9896782507020929481,17809127652176385207,524288 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5236,i,12464394661570466548,17812976122335000517,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5968,i,17762832932824667583,12211938857899024760,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,6451689769905595033,13028403931948115263,524288 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,11932756682522931279,15694526006064715407,524288 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6368,i,6493451416754755275,16047838931929314438,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3632,i,18319422513165975628,10374474746019645071,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6604,i,18267482874755878611,8570229572444954678,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6620,i,17943530584839086082,6555914372304174759,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:6628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3376,i,16416630449177312013,13868766336187898482,2097152 --field-trial-handle=2316,i,14042726952495737991,10917613286662051089,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:6904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc0c96c728,0x7ffc0c96c734,0x7ffc0c96c740
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1924,i,10189141895183826997,2880071251000633700,524288 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,7054934363455316151,17199823715261629871,262144 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,7005020115337987049,10039055584100485258,524288 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2288 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,17885906287089683234,6898577551844000205,2097152 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,13495385419569651783,8583846581499324977,2097152 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4320,i,10936591778812815928,16749543528466679471,2097152 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4696,i,4914750791200117916,15248402168876017774,2097152 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4868,i,15999440216602487749,4150095577067859316,2097152 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6356,i,7847217081869808203,14289609556840547892,524288 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4796,i,12011059152629423756,361514847594099123,2097152 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4472,i,2402464382420441899,18438330017387964009,2097152 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6280,i,6460324994962093306,14313468685819180005,2097152 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:6980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,4811001488709266925,2597914208991119360,524288 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3388,i,8243100355746661055,11101589841234871274,524288 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  PID:536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3220,i,8310721100473121473,15243161504896765284,524288 --field-trial-handle=2228,i,6407053111502036553,14759474538786492015,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  PID:1908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5848

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5816
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {c24286bf-a9c2-4add-a8b8-56d2b391c4d3} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27135 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {c99b7610-27c8-4dec-90d4-8d7715ad3caf} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:6036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 27325 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {b611a4d6-394d-48d8-940b-5b2e3656f4a3} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4028 -prefsLen 27325 -prefMapHandle 4032 -prefMapSize 270279 -ipcHandle 4128 -initialChannelId {7a26f0a1-678c-4f17-83e1-b36f8fbb0869} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2656 -prefsLen 34824 -prefMapHandle 2764 -prefMapSize 270279 -jsInitHandle 3228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2644 -initialChannelId {907a7936-ce58-4650-b29a-8a890351fb1e} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4920 -prefsLen 35012 -prefMapHandle 4928 -prefMapSize 270279 -ipcHandle 4956 -initialChannelId {ed543cd8-b73c-4122-967f-4e835c1b8bb3} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5112 -prefsLen 32952 -prefMapHandle 5116 -prefMapSize 270279 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {c59709e2-7185-474f-86eb-885f9a4f681e} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5116 -prefsLen 32952 -prefMapHandle 5112 -prefMapSize 270279 -jsInitHandle 5176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5264 -initialChannelId {4b08750e-252f-4f8f-bfc2-8cc59de41876} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5536 -prefsLen 32952 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {7e03c35f-5460-45d4-b44f-39d1b1da50ab} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3140 -prefsLen 33031 -prefMapHandle 6164 -prefMapSize 270279 -jsInitHandle 6216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6188 -initialChannelId {c093a6f6-7491-4eca-bcd6-786d6bf69720} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:6676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 611edc9738ce664f28d251dfecf8546ec5e29f0222d84bd2584f588fc29a88d3
MD5 fd47bc5040a4163b729c2695802fc1bf
SHA1 50ce21d3aeebd649a60e39ff3c96bfaa0e510188
SHA512 f6ba5890bd22d663abd4ac2a7203e52618a9757eecfb81c71f8fe984a18dd927c44617637513fea03094a1ed0a076c9d6e01abe29609343805029ddcb94fb125
TLSH
T1A1E02B9ACC22EC274CFD472D94904A47EE10135B1B61995F3B3C81188FB466B4285D5C
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c6b17eeb9e9fec2de308336601583c510fc414a62645de5e2a6565a7f672d482
MD5 25e56a7f69be28a3d9bf511736c64f1c
SHA1 60e37ee5a5a97702b8aa38fa3614d47861815e8c
SHA512 026b2a501ae4523327598cdea4c78fddebc0a10e641b89114e1fec81516ab354c337cbacc955cfd1fc707862134a2d2252c68200f9358e5d37514d257f992f29
SSDEEP 192:9RGpp9dNU8/aJv7ApAPRp2l9qHsb+WNnq40Sdkiz/XHnacvEVyIsnAUgtaJ:9RGpLdCJkUXmkw90SCirHaL8
TLSH
T1CA42D72DF914693B9CDBC229FE663B53DBF5102525942EC8EAFC892C25D35CC121B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 71455f7e81d3f1f662fdd15df51a5075355e9c992417dc12504529b98f227171
MD5 8304a445222f0a8218d4ad918bb357c8
SHA1 979cc8db601725f40e64a1697bb95c0ddc578bd1
SHA512 f0590fe7a81724d4242d8655c73106549817b7c89da1c93b080ab58c8f8f7a0d0b0088175921de59fc33af80b57760b915b55f8ead6caf951211e2bd1c5b443d
TLSH
T1CEB01240C0016101D04606F1214214C876649F189B0E1701C3E87E23D8251E18014071
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b491.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59b491.TMP
Size 96B
SHA256 62f5aeee44d95a6aecafb998164bffaf828f9220a9358a0e2091fb7e56722408
MD5 8782dddd32763e41a609f1505a866a3b
SHA1 a7415dacaa9fc80eba07e28d7c02b3f1e5185f48
SHA512 494bc9d6644711cfd349be25e8b915b926b34149084d4dcae0d78cf37c3afc92896b181edd18c7624e1dad6f88c2b0af14f4f8fd326c0c63378de83d64a4805b
TLSH
T178B02200C302A202C08283F0208280CCB320CF20C3030302CAF28E22EC28B320820020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 ba2b0cbe71fcb06dced91809d8d8a58d566f4cdc421aebbae7b021d95f6285be
MD5 cf5133ba3034184e1c225a9a6e2397bf
SHA1 736a2e08058dcfc1b5ef20e837e1e22968477116
SHA512 cfd447f6b575c3ace041270ba35e0bf123a1ebab96716588caa38d872f82e2338559a1aefd0244122b013664a4724f70508f1514060e9f260b206bca4b2b72d0
SSDEEP 6144:bDbHXQ5Ne3yt6vh8E1XagBGQ9m7Rkm1tYpBeh2BAot:vbA5Ne3ytgBKrb9oBGcAot
TLSH
T1E4342337DE7C9D7B5EB89B0EA18FAC0D19F25A279438D6C209D85B4056FBF810901CB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 641bf401a14c303c26db417e24d13956de026082d651a6a5d68b1b4ee0c50b0e
MD5 7fd31acc030c2b5cf8ac20c00cd19acc
SHA1 f852b595f8ad53e2081c4e5702a63b6229694b4d
SHA512 3f529274d7beb5189a9d2d004dac12758873cf9fcb8fb0f7309b0edf9e132ec568fe0c8e7a131fa68ae8f7c51ab9ad1f39b230104ee2cae97aea7d819d1e1274
SSDEEP 3072:AsGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:cm7Rkm1tYpBeh2BAog
TLSH
T181C3022B5D75E83B9CB5A74EB48E0B1E2EF149A6C930DE9288D85A0437F97CD0A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 c9f084ed86e5b34b9f7a68f6827c72a44a75d3fd6850752c7497a21292c77eb6
MD5 9a8bd1a09bcdb891292ef25bedefb94e
SHA1 e51b79337ed59cc4d600d34dd7625fe5ed813d3d
SHA512 b70039ae3e6d845501a0e9ef676698998d24296db236a0f61cde8579e67d40b91c66493b1fe071915a25c5c5e4a6e72291db5f178b30dd70807bc91da9f5ea8e
SSDEEP 6144:uDbHXQ5Ne3yt6vh8E1XagBGQ9m7Rkm1tYpBeh2BAot:qbA5Ne3ytgBKrb9oBGcAot
TLSH
T160342337DE7C9D7B5EB89B0EA18FAC0D19F25A279438D6C209D85B4056FBF811901CB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 30f1f9043dd60727a0f4856d919527d34c94a64b993529477ee3a26000208a63
MD5 3c7a22f25e0323db57607d07994a3ba5
SHA1 65f58016932b2387f8cca22e2654f3385e8363d9
SHA512 992aeefcd65a506ce10f4d8d7c0ed92ec71153e5546b00c47908d443b52d72cabe0e8630ad38a815bc46c74446882e706d012c9600296a4368e556a04014c19a
TLSH
T1AA6162F8C44207E0EF5270B283DB462F76F182F8F913BE8190E42B796B0676186CB158
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 bb05fe17282236d9fd7eba55054f1203e4f577c868467e3535157293768d22bc
MD5 a9a585c3e894447e29870f28ff7ed64d
SHA1 a536a996c002f07f505bbcfd70e108433bbf9572
SHA512 960221efc66dbb4d482ae30a9b8b11a75c0a575df81684ec646407980f6e0fb1cb344a415331f4139bceb2446b5a2c563848f9dc8400cc34e28209b42f9c0f63
TLSH
T1A5117DF3C3D5966E8E011AF09A24EE2BDE2D0506822C7C1685D4EF2BD3E3479E00259B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9a8a86da116946ac11c93062c200d85f84b0d548c4a8baf5e595eaf5a40002f0
MD5 10fff81a6da49e832d8845bd06b0f9aa
SHA1 5fea0517fdaedaa91fb8bea6bbab957fa6150c72
SHA512 154ebe30fe95b51f67e620010fa2553e79422d01924ce8e249df6f75a34fc13aea87f68275fc045affe5fd591837dfab9eeb8b4ef71ccec636d6fa6977911ef0
SSDEEP 192:sxZfRTyM/jK1Ml8Mki/f3s5Te3IdpJHW6+WNGYzcsSTB9IgrJ:sxZf3Mi/f3s5T9JHbG/h9
TLSH
T14742D7116B38A977CCDBD209FA457F53D6F91472A2940E44A9FCCA1C05E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ba093654152fb51aac9254edfeed87676e7ebdb66082df6cde8c7fdb0fe925e5
MD5 8557d3ad19c1649b5c9cf2853e65100b
SHA1 d04b86750d6add4f2cb22fdc977c8c2e26b068b8
SHA512 49cff904371a110a986464c1b89ad0ae0b4f34e20c00d77231db116abd25292155681c2a25f54a19993e76615684f523c0b3271987cadfef0fe5e1322f7b20ff
SSDEEP 768:iBW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjhroIri1Yh:iBW7kf0Wvqidau1jaa5LA3jaSh
TLSH
T139D20B3B684CCB7E4F840E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 e43518bb75a875f3fff34a12e3411bb63f315ab5e90d62f1b8c939ca49e8a629
MD5 d11511315b1d1fdb3af2f23ff9a0f521
SHA1 28e0060c38ba458826b89f42fc51a64e9cd79a8f
SHA512 8e0135d15212ad9280dae210a39d1415efb8e1bdb0b62a35a8d6cb1d843d9058158c2317405b314f9907eb245f70cc45acad06d88796b2ca6b4a4b1b9cee38fd
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTXjIBKM4MHyhkI7KRS8jydrIxKkIcU5ENpr:KIbCKcXj+KM42CkIKRSCOrWKkIg
TLSH
T12DB1665632370202387E2D6CA65E8A779E4236633458646F7BF801661D27E121FFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8109fb8139b3688cbf13648a7f587b64619b6441db7b40affd2b745746fed461
MD5 8b23ce17217114552ef02ac3c0a4121f
SHA1 0126ae7dea1bf6075b4c8e136a4b71c03cdf4a23
SHA512 cdef5e7166b19ab675f9e7110851c651c543dca4f21ce06d85a6c12ca40074c5cdaad5e6ee6258e96cfb9c69ab3c516b7d6f6cfd61fb883c7898510eda107680
SSDEEP 384:KZcIhsNorVZcb2gX9DdmmaHCEJrOhQivA3ko5:ohlZcHXJIhhOhQiI0S
TLSH
T1FF828E305C749C3B5DA2E145F5863A075FF8803BA7C96F84A5FDEB2D01EA6981306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 33d92989fb2c11ec422296818610d0797d4892eb7f1924c895372c3deabf2f70
MD5 afa46535d4a0302e51cb7d2641674456
SHA1 22e66ffd0c6a4bef09ca8d4295b926483eec5549
SHA512 e6e882bce2ed0705f9608507fee24d7a7a97e79c880103a99ec0ef835f7094faa0a1de3b1c48af3bb1da292e78fb827abbe43e20af34b9ef528a2320ab102401
SSDEEP 384:/ZcI5sNoWVZcb29X9DdmmaHCEJr9hQivA3ko5:X5QZcGXJIhh9hQiI0S
TLSH
T137928E305C749C3B59A2E145FA863A075FF8802B97CD6F80A5FDEB2D01DB6982307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e12ac47d47400ac5fda9d22084fb5696084e68bc39c146575bb6a38bece120ce
MD5 1d01af47e93274ec068b0bce017f907b
SHA1 68916561653f4a3e0de8e5a61cc96d9679b03efc
SHA512 da71455ebac14acc9f2fc2094b2f455e83856d4cce1f1bf084d75f0448446ab305665a7f1cc756a6b50b0c831abd66d8dd37c8f2a5d01ea5f129e5647d601a6e
SSDEEP 384:8ZcIhsNoWVZcb2GX9DdmmaHCEJrOhQivA3ko5:qhQZc9XJIhhOhQiI0S
TLSH
T1AD828E305C749C3B6DA2E185F5863A175FF8803BA7CD6F80A5FDEB2D01EA6981306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 cbf22a71e5dc732e7d41b5d9f95b40dc578d94196bf9d11694f187c1da4c87a7
MD5 424de03634ac7ea83dfc63dbbf79246a
SHA1 da11c3edd0a660f3361bdf73681db9fc06bee4e2
SHA512 0b08eea3b30a40cc6154c9ba33b99bcf173816146a39283274226e394cb2175e08e0509ac65a13bbc3d24a21d55b063af28f9d1cc812b5c0915d1d233cd2c68f
SSDEEP 384:1ZcInsNoCVZcb2SX9DdmmaHCEJrxhQivA3ko5:NnMZcRXJIhhxhQiI0S
TLSH
T1A9927E305C789C3B59A2E145F9863A175FF8802B97C96F80A5FDEB2D02DA6982307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 582955f42e1341332e1173b4b3aabb8425750604933a8a91db55a69ac62ac632
MD5 9415153aabdbf4d11370858262698fb5
SHA1 d83f76fbb777492419f19305b83a27654849e25e
SHA512 253ad981a928ebb3df6968607123194714cfe777357e400870095caaf384b43f13c377d9a8f60c8041239b1d7cbed0d80e4939962439e43fb2e205b1d8a4afe2
SSDEEP 384:UZcI0sNdCVZcbxFX9DdmmaHCEJrrhQivA3ko5:S0ZZcrXJIhhrhQiI0S
TLSH
T1CB927E305C789C3B59A6E145F9863A175FF8802BA7C96FC0A5FDEB1D01DB6982307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6386fe9124b3de19edc7ec5598d2556ff5aa6fca7dc8f1542cbf74f66dd4bff7
MD5 08bbfe97f414d6cb84c8b66bc682a529
SHA1 fc35ea42a7565ad4b48392808e76050c7d51590b
SHA512 9c8f988b01f982e6d9bc2f481e8bf6f2130583028655790eb080c02ed90aface3e03960b173d47b1fdcbd74ce4d8526c8b130f347c711b7c639327185ac9bd09
SSDEEP 192:PONx64BkQmiUybMP5GBPK7H+FdGBma2dEFC1SJrhWwhMqWU6:PONx6e0RPIdmmaHCEJrFhQU6
TLSH
T1D6120B35AC74AC2B9DA2B541F4873A135FE4412BEB897F84E6ED7B1C01EF65C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e82558f6553b8a244d7128da13215c1f0b33c49642254c4ee67f78c14859bae3
MD5 754747e479358ff50d13af8166b73164
SHA1 2992bb9f0143278adeaab3f747978816b6020cd5
SHA512 6f7e32c2b0614481b4bd18c9a30e73389490d41fde94af8684788819f7588df3867e45e1a12f3502ca6439dc39f544bb03adaf5ffa0c7599414274702ae410ef
SSDEEP 192:MONK64BAQmiUyt1MW5GBPK7H+FdGBma2EaDh7+U6:MONK6eAyWWIdmmaOhiU6
TLSH
T10D02FA34AC786C7B9EB3AE45F4863B175FD8112BA6855F44EAE81B0C00D734C234782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d9544ed-0dab-4e20-96e2-a5b7a11039b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9d9544ed-0dab-4e20-96e2-a5b7a11039b2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 32e4374c640d70cf49a8cfe93551d895872d452cb133a186bf0393dc2de3a3f2
MD5 8703b23f5dc9f4a6089efaf1507e3ad5
SHA1 3533b8d8898dfcf9d8cf25660c5ad502c544f216
SHA512 c9c7528d9a0fc914d8c8d048b1efc4a90cd443c28259d5231f83d7b86827efc9f061c8fd8f23bfc34c70a1de62645838204be427b66214adc5489c13ea7a2382
TLSH
T158412758AAEA1148F3B36F5AABF6A86D487FBD372F07D45D00110D8E4632B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 c9ed2705ce39173c3b73ef6990436b4bdc3bce940340e6ac4c2cc8a87aac30a6
MD5 0354e7f060af98399cfbf963a046c299
SHA1 fbe7b711d938a3d2ecb96825f694716459906010
SHA512 9568543d85b82e7f79a29d397240b11d244a2f859438506491168e4b64a6a0747b24109873956a273d232476f8df85e9bdd5449c2a9b041fd75d552b47a807d8
TLSH
T18C61DB58F229463FE445413ACD961B412F30745298AFBF2A359CA14C1E5B2CD7A8D13E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0db22149e77188f6380ac857cae021f70267c141ced7268f2f2b47b3a3208604
MD5 e636f4b6f912984824b8bf2d7f765cbf
SHA1 6a2a8373349489ff1e4dec8ab84fe6c9a322c83f
SHA512 eafdf84b892900d8aa02b51e854c26dca6a137c11c89805dd6302f3552c6f8627a41f85c58574a8b6bc478f7e897044b5675aa345f6552aacf2a5fdd1115c158
SSDEEP 192:zPOv5zbowbqmyjF+eZ1d66JozGzgCl6mc0dz:zgbowbqmyjpXd66JozGzgC1jd
TLSH
T1CDD13FA4EA28463BC409027BCDA61F810F35395BDC4E7F2A319D741C2D5629E7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 82a62070721b95e5f0d6a8ac91a88a2aa4b1875a78ed99d48046b89f57f009b5
MD5 ca0ed6a73ce3509f7d06992f74d570a4
SHA1 7c71bf39b7d357a1610e1f317e7e9bd1134670e3
SHA512 169b99682f4b2aec2a2eca3460256f574165e57fb6895efe298329d758bc1da49ab67f4a98af32bceac3ce8965a8772072ccfb93bf06fe98bba8cd7eaccc07f8
SSDEEP 192:cPOv5zboPzZqmyjF+eZ1d66JozGzgCl6mc0dz:cgbobZqmyjpXd66JozGzgC1jd
TLSH
T180E121A4E628863FC409027BCDA61B810F35399ADC4E7F29359D741C2D562DE3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d695aea2895f3cb7d844ac694b7a0e1f8e6a07a5fbf365126b01668e9478456e
MD5 a67eb1aac0e8c068244f1b36c7bc72df
SHA1 0d66f5403ca3913ecd161e22212f3d1de7806e9b
SHA512 5a689b92699f1da4cce7359d65a3b48776e439334076e1df66ccc1dd79de77f196ea87de83b6ab8a8f0fb2476d29a462e5d6cd806fa7f17cd19a5d6dc068eb9e
TLSH
T10E213A5C39B8CD6A9EC7E2ECB441028E97554A0745872C834D12FFCDCE856D9327A43C
MD5 SHA1 SHA512 TLSH

Submit Download

27f7bad6-e476-4b67-9403-5aae216c6ab4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\27f7bad6-e476-4b67-9403-5aae216c6ab4
Size 16KB
SHA256 5c6776fc44c8b8188287e11c4efdedcb685dc7db828a22f36dc51712f6115efe
MD5 5374b20cb99259388db1909dc92286f4
SHA1 596f7b36245e70018d0a16f2583a2246732fbea2
SHA512 49d1f3b6fb8f6147f3c5cf806c54aa437496519b5026314bfc74eb780b2c11f64c0ca3f6464159241e4c69c5b7017ac104e3b00a2bad917e30282fe35f47c88b
SSDEEP 192:WahDoi6LGEQ9nbAskb30khU4hLllUVbPueaNRbhERedcLFzxxYKLTsp3ZRI1ypck:5m3cuT/E6cLFl+KLT2JRI1ypl5Ylpg
TLSH
T18A72C856682045BA8651E36894FCBFC3E5F638CF4C419FCADBE4BD082DDA06E012794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28b1c67d-1753-42e0-8f9e-34c8895442d0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\28b1c67d-1753-42e0-8f9e-34c8895442d0
Size 235B
SHA256 2e749cc4a6ad2c9ac810a045153b5ae4c4de7cf5befda1709916edc2c55bfa7e
MD5 4037fca51cbe4724081ff90f90efc99b
SHA1 eeff121bb114b7ffa3c75c0a61d8801c0a22277c
SHA512 aff472c753cad2b211268a006d738a198d4bf9fefe59e1394f0bdf5aa0348dac25f97504dce974aa768329d989631256422bd464f4ecee3c582eb16193eb6dbd
TLSH
T19FD097C02CB8671C28110F06F0E07DE234588C3328A0A814CA5085B8AAF8AC59212C0A
MD5 SHA1 SHA512 TLSH

Submit Download

62a58559-7eed-4d60-86c7-54632f7918c3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\62a58559-7eed-4d60-86c7-54632f7918c3
Size 886B
SHA256 b1a757ba2ca317a4f7467728bfcd5c17fcee4e8503dde95438c8324934252016
MD5 c92ea80ec61de84073e7cbe73c2bf548
SHA1 2e6382af892cdba279f897341b00b7ccb9ce2c14
SHA512 a83bbdae7f400d24289e3e925d8016736a28986a6d5d7b33876ba00dc0c6b7cb129b13e0ac8b3de4a7ae1f84464805bae3f77195c9b4db0b9a0714e86bac9f5f
TLSH
T13B1127C19970B972DC6DC287D6D1774397E07133C0C994143E956B280DA651D576F60B
MD5 SHA1 SHA512 TLSH

Submit Download

bb461690-2998-4867-9348-c5d84cd570cc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\bb461690-2998-4867-9348-c5d84cd570cc
Size 235B
SHA256 51538521d6b5c5178452722dc023269ed0a212a71737b3024d0883d41bcace16
MD5 0aa24c33fb7c2c05fdd5e6a4d30ed306
SHA1 0583a0b69d21990391ccd9ae7e6b0f8ebf8c8d94
SHA512 ce3f77a4152c336d7ecb50f76df3d2ccb4b23392d59f5c7b7af741707ff7a628b402d07f6b7cd8567f61b672fd794b63fce33c2aa1c13fbc647d158bd1b65486
TLSH
T109D097841898675E08101F2AF0A0A9CA398A4C332869A820D5614434CAF9EC802A181B
MD5 SHA1 SHA512 TLSH

Submit Download

cc3a4562-896a-4cbb-a223-a0a52407bd9c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\cc3a4562-896a-4cbb-a223-a0a52407bd9c
Size 883B
SHA256 2bf8c27746a690aac1b295b2501e62dedc0290cd61279fc136224d6b56cf7f21
MD5 2e119f427ee382880d3467dc23a5c547
SHA1 322aeba6be3a064fb28b675603ee9cd11b60e80f
SHA512 d2f23a3162426e65b3083f677dfe892a1edfb13075e230a92074f49e26d9363467b31e17d7ae3dabdb5a1bb0ca969f788efa5854017e0627324191f61047ccdc
TLSH
T1F41123D19A30B572CC6DD24BC79537428BE43633C4CA84143EB16E2C0DBA52E576E70B
MD5 SHA1 SHA512 TLSH

Submit Download

cd513f71-2451-48fe-a444-14647d7a29ac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\cd513f71-2451-48fe-a444-14647d7a29ac
Size 2KB
SHA256 a6eb8638779341e6f4513b3419cb125232b452398e266b59959c136db76bb6c9
MD5 9f8a4aa045f90826a927c6d95c428c0d
SHA1 0d2548d732749952de719af0c3a9b85f6804bfc0
SHA512 82720ab70b22f4e96eb0b37247c5a6530ad0abd7c31bae570dcbf894501be93b742acb8fe9d9e3d6e00882704d5574d20f264c3d2e811a2613a3ba88ea037473
TLSH
T17841416839785C778DDAF18DD592238E57648E1740C228832E52EF0C8CDA669236A52F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 6KB
SHA256 0ebe4f11170e01a603904fc130df24d6e12b05b08aa3ad7d00b97351e8ea7200
MD5 946af8fcb89d836947acb2508c162705
SHA1 4ba4f7ed5eeafdf0b1a34c3345fccbf32f65ed78
SHA512 ad0d89ad24a893c604044feca028108ff939279a892a793c6e59d2747b71b4b3c4193e203e1b87c4486d383345edbcf3f137b1fb8e0c323c3c1cf571e0763c90
SSDEEP 96:xHcUTUuqGqdf2WN1zSVSSlDdv9jVnERH9O+y1Bw88n8L4cnrzBHjGS:65Rdf2WNASS49A1Bw88+X
TLSH
T17AE120789408CF6F64B677ACAC6888716AB2417BB7BF68C750B554C5010CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 e9cdc1f36c98f98b1e1bb1d03c584e2307d9f26a3acc49f5338463627f91f6bc
MD5 6faf0bee131fce2c96bb27227d0e74a4
SHA1 e0a943bc3ce83b054dace67fa82268f23aa4cd5c
SHA512 a99f73c84f4e3ffb291b43f6f93c4d2b0c0e4f7f02ffcf71905a1ba2412ca6de714aca576772a45d0a8437dd2ebff42eace20fe36f988e8a183ce07720165e43
SSDEEP 96:xHcUTUuqGqdf2oE1zSVSSlDdv9jpnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEASSo9A1Bw88+w
TLSH
T13FE1307894088B7F74B6776CAC6888716AB2413BB7BF68C750B954C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 b2a56a8d3e5f510513bac15ab1d2e67476e2c06aa5d028b7eaadcb5a70e36f57
MD5 8947c988641c87aa349387223b5d716f
SHA1 c4a078faa3c8cf07f1fa9094d6bb5920915c93fe
SHA512 3adec717ac5a06be17f5d4e9ad84cdb1b3bb277c3e84762615706cb85dc314c22a4a10cc3df5693b1084096ad1e1ae9d6fd347fcc718a11a6f92d88683e02264
SSDEEP 49152:xDmgBugQA5lUT2lAecNxazvgiRBb4xYegN:xmYugF56T2yzxazvgi1N
TLSH
T1641639F820D1A257F3818037668563EB21AFD00C6477DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download