8d9aed2ea77f3bd9912cc598f0d2956e46d6147b8b4f50cf54b021f9f9bc0aaf

Analysis

user interaction
yes
max time kernel
316s
max time network
316s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
r3d.exe
Size 1.1MB
Sample260901-3bb5gsfc53
SHA256 8d9aed2ea77f3bd9912cc598f0d2956e46d6147b8b4f50cf54b021f9f9bc0aaf
MD5 de55b87eaae1f3c67daede9e62913ca9
SHA1 385206887d8a28fb881b5c10e3f20462cf8f2786
SHA512 0a105bba56cff1bab14fe84bc1727e503e8c918adc4a7729efaaf6fa27e721efb38a36e321de27fb7fc1126fb1d538fe4a4be7227f17f50209670e1b743b1b5c
SSDEEP 12288:ebs/m0E54jwaFXGc8lEBBBHGBKq2IZwDnvfqItNqdg:ebOVE5ifGPRZwLvf3fd
TLSH
T1E6357C83E7A385D8C116D9B5534BF137F9627C8E4B153197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4612	msedge.exe
1788	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	r3d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	r3d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134327787181977417"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4328	chrome.exe
4328	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4476	msedge.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeBackupPrivilege	3480	svchost.exe
Token: SeRestorePrivilege	3480	svchost.exe
Token: SeSecurityPrivilege	3480	svchost.exe
Token: SeTakeOwnershipPrivilege	3480	svchost.exe
Token: 35	3480	svchost.exe
Token: SeShutdownPrivilege	4328	chrome.exe
Token: SeCreatePagefilePrivilege	4328	chrome.exe
Token: SeShutdownPrivilege	4328	chrome.exe
Token: SeCreatePagefilePrivilege	4328	chrome.exe
Token: SeShutdownPrivilege	4328	chrome.exe
Token: SeCreatePagefilePrivilege	4328	chrome.exe
Token: SeShutdownPrivilege	4328	chrome.exe
Token: SeCreatePagefilePrivilege	4328	chrome.exe
Token: SeShutdownPrivilege	4328	chrome.exe
Token: SeCreatePagefilePrivilege	4328	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe
4328	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 4476	3448	msedge.exe	109
PID 4476 wrote to memory of 4148	4476	msedge.exe	110
PID 4476 wrote to memory of 4612	4476	msedge.exe	112
PID 4476 wrote to memory of 2664	4476	msedge.exe	113
PID 4476 wrote to memory of 1592	4476	msedge.exe	114
PID 4476 wrote to memory of 2664	4476	msedge.exe	113
PID 4476 wrote to memory of 2664	4476	msedge.exe	113
PID 4476 wrote to memory of 1592	4476	msedge.exe	114
PID 4476 wrote to memory of 1496	4476	msedge.exe	115
PID 4476 wrote to memory of 1496	4476	msedge.exe	115
PID 4476 wrote to memory of 1496	4476	msedge.exe	115
PID 4328 wrote to memory of 3772	4328	chrome.exe	124
PID 4328 wrote to memory of 1788	4328	chrome.exe	125
PID 4328 wrote to memory of 1704	4328	chrome.exe	126
PID 4328 wrote to memory of 1704	4328	chrome.exe	126
PID 4328 wrote to memory of 2404	4328	chrome.exe	127
PID 4328 wrote to memory of 2404	4328	chrome.exe	127
PID 4328 wrote to memory of 3788	4328	chrome.exe	128
PID 4328 wrote to memory of 3788	4328	chrome.exe	128
PID 4328 wrote to memory of 2696	4328	chrome.exe	129
PID 4328 wrote to memory of 2696	4328	chrome.exe	129
PID 4328 wrote to memory of 5012	4328	chrome.exe	131
PID 4328 wrote to memory of 5012	4328	chrome.exe	131
PID 4328 wrote to memory of 1204	4328	chrome.exe	132
PID 4328 wrote to memory of 1204	4328	chrome.exe	132
PID 4328 wrote to memory of 1816	4328	chrome.exe	133

C:\Users\Admin\AppData\Local\Temp\r3d.exe
"C:\Users\Admin\AppData\Local\Temp\r3d.exe"
1⤵
- Checks processor information in registry
PID:4792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault6954adc4hf54ah42a2h844chd87062d53ee8
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault6954adc4hf54ah42a2h844chd87062d53ee8 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffd7137c188,0x7ffd7137c194,0x7ffd7137c1a0
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,9497118692656798273,10053918697221697142,524288 --field-trial-handle=2252,i,15706435862090084749,2678626670823230454,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,9989513455882147101,10893442644577470820,262144 --field-trial-handle=2252,i,15706435862090084749,2678626670823230454,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,9942866226134890017,6315419864469299258,524288 --field-trial-handle=2252,i,15706435862090084749,2678626670823230454,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:8
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3152,i,15171574557994940597,8116701841838024392,2097152 --field-trial-handle=2252,i,15706435862090084749,2678626670823230454,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:2
    3⤵
    PID:1496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd7379c728,0x7ffd7379c734,0x7ffd7379c740
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,11398672872375732163,17786685568554364433,524288 --field-trial-handle=2044,i,17257677310199955155,12921048270601620070,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,12941142051302117710,9002271544277096722,262144 --field-trial-handle=2044,i,17257677310199955155,12921048270601620070,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,7769369715013709150,8965118751823745130,524288 --field-trial-handle=2044,i,17257677310199955155,12921048270601620070,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,8420490142557278584,11455401641358928117,2097152 --field-trial-handle=2044,i,17257677310199955155,12921048270601620070,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,12366242188865196724,15591708160152538734,2097152 --field-trial-handle=2044,i,17257677310199955155,12921048270601620070,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,3075341912234250240,1367416581468292217,2097152 --field-trial-handle=2044,i,17257677310199955155,12921048270601620070,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,161905068790562782,7603436223302534680,2097152 --field-trial-handle=2044,i,17257677310199955155,12921048270601620070,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,561220722067626829,12834832373382554844,524288 --field-trial-handle=2044,i,17257677310199955155,12921048270601620070,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:1816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

12157f21-ebb5-49cf-9b17-3046fcdb1361.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\12157f21-ebb5-49cf-9b17-3046fcdb1361.tmp
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8cd40ca60c5550b5e33a19274b7401ae6c45798b6ed783c2550090634e0aa71f
MD5 71ffdd89e45d93ccb59a4800b6313c81
SHA1 5aed2c045a85650d1958d76810458c12654c06e7
SHA512 c3d2c5c123d33f983386bb6eebbf9705ab8fd3f5e76bae5bcececd8740db216d29aa154706920582a927177bce5090c55d6b05d6a4de0b670fca196e0b318b09
TLSH
T1DAE02BAAC921AD2B09FD071CA4584747E754231B2B41855B3A3CD20D8FB9B37098AC3C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fb5a887ea8c4abd0809852d97f97da8a5fa444428f88454c5c9691fbf7127c6b
MD5 81fcb55d876e9ce68049a574685f0408
SHA1 2ce422b1e9730321dc7b9c15f3f52df78385d34d
SHA512 be7bf76d1aebb3a873dbc7a2f9a80efbc9f4e0b09e95382a37b2c3fd378dba9e9889dc516cd228ce0739aa51fa9d9cb1060517a3f36d89767f75a00b062906cb
TLSH
T1644169B7C3E4897D8A0092E4EB166F1FCE690914131D3C6A88D4AE1B93F2872D20068F
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 b31952f8ef6977e4047d6ac40d745d318cee86b67332da2ce1fc03b3a802c7cc
MD5 23b2003a40ff2316ae5a4e73600a56ca
SHA1 3999afeebb6e751ce13d9dc212b25c457c5a0d65
SHA512 09e527b23085ed3adfc5414b009b6ff475e6eeead96dafadf7abf433ba33873c3e9da4f8bd6c614df99afe286686e1600bf2979347132321ff0d1c136377cae0
TLSH
T10CF059A79AA97027217D45AA2E04F80D6976F8300240ACF4DE5E426DF0814A71F02027
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fd0ee096308930f9edfe44789cab1ad898a0c6fce0b55e3920355ca6132895ca
MD5 bb2080dae65ef5427c4bdf0cda3f0070
SHA1 057bea70be84c8145bfc0bbe8e23b152c7f07062
SHA512 8f10e1799824442b92add34afadcad8ed44f39314ebb27e09e51b9bde198a540c19b8622b3280db9550c4ba06d4908e8fcb14d70ecd0dd2c0f750b21e75f258d
SSDEEP 192:qRkFmIJvWRgSv72ympAPRp2/95Hsb+WNnou0T49eQ2MtalPyIsnAUgtaJ:qRkFmAl+QUXo7wl0i2Cax8
TLSH
T1B442C92EA914697B5CDBC31DFD527753E7F5103625942E84EAFC8A2C05E76CC221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 85129b201f505869a84d857efabb499bcd397cc344dba3c731bd89e7fbcbb3d1
MD5 b1e28b4825040f8432318c6ecabec8ed
SHA1 e5e74a7ad867833ada511c70f4b9a1aacdf81340
SHA512 dbb090d73fb2b7fd4397372fbf29431a10dfc698b5af97f3c43e48902e449d09d44eeeab032d621c5d3c4f2a32ba46d9b3831a5408ae81aa8d3304c5c7a8d5b3
TLSH
T189B0121184815101C41209BC229A148871349F21D509170543F0A932D82A5628018050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cff47.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5cff47.TMP
Size 96B
SHA256 85fbab0e12e15fd9416d76f04f1c721e85af2ae56e43c72a1dab90fc3d4d16fd
MD5 82ce04f805c33d8f8254d6821527ff29
SHA1 91121220b1217492f54009c0e1b8d1145c99dc4d
SHA512 4de84ab0ce32356c759258b760eecf1f5f6a626a9d3d7abf07db6df18a2d055e6d8e70b25c2a746765afdefca3dffc4150ca6bbfd61e6f4c97a1cf5cdc2ccbf7
TLSH
T1A1B022AEC00A3202C00303B82280C8C830E0CF30C2032303C2E00F22CC202300A2C032
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6663dcf13b564347e05df1716f87ac7b448243d17e26ebba324ad21aa9cf14de
MD5 724642394dd17b2a9f5f996c59b5a9c5
SHA1 c2c9f464472efc8e5f7c40b5c79bce4b53c86537
SHA512 c24d29b6893dbeec147772aa5129586834cbd0465a6db47d0c97871bf5b5ea5605ed63fa934180110baaddf29d89fef86d0a937bea02842002ff6a9edc5fbe6e
SSDEEP 1536:TnQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Gqfd7NtZL8cHQRZEQ6Spsk
TLSH
T116C30237DBC21F339D96CB64B9530FD697B644A99034D301AA6D37BF6C83491684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 5f51ddcd7bbfe5fc277d9e4e28d96187e26aed0d74843855d6165f6b0158e65f
MD5 79018381b7485eda326923c192c7b8b0
SHA1 7d2a9c7069fc7eb7ff5dd232c153ad28c2574900
SHA512 1d751fbba3320b1cc92781ca03f7160e8403f7d6fdba77b62eab0de80ce5e295488eeb2eb283515c6ea9a515355e7a7495e66ef1df529d1ff984cea446ad4079
SSDEEP 6144:K7k15cSGSt40AZ65bPUXxA7TqZ/ZLW3Exm:K7ePJt4zZ6KkTqZ/piQm
TLSH
T1673423775F95AF22EEF6C57875125D9F11E848E294B4C7038E98B3FB38D38839841648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

7529dcee-c4e7-4cfa-bbc6-0a36ce949b38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7529dcee-c4e7-4cfa-bbc6-0a36ce949b38.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 b35a05cc3fa3ee07c3bb9c3be02b1742b2799ff5314df05195adac451d5a9aca
MD5 6d0e081e4ce88c387e86ac07a0cd04c8
SHA1 6dd94440940cf979f7e2b83b5a3c8791d9f66895
SHA512 2d88f294b37a46fa691f08962146f068c8eeed23e4a8069c3cebd84fb5c73a35d84579b1d6794c9177a17ec6355f8ee027f5c677e3837a329c4456c29bf32c49
SSDEEP 96:sa2viEDWa9ERhscnb9XBBAedHWU6W6hfuH9EOx+WVoMfm+uecpYQjHU67l2MwUho:sxvuaUhs2BaA5HW6+WNGYI2MxhgF
TLSH
T19CE1D8567E28697B8CCBE11DFA267B53D2F6403165D41948EAFC8A5C049B6CD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 bfdc914709fa0921af71f45326b4025cb2bfa2f307b625e78a426676c617267a
MD5 b596094b1ec7e1996b5b74b322013575
SHA1 f3a7b2ab9d987a80dd81d9d75650b4d9603c15b7
SHA512 a9ed71d382af7c38ee8f19d59fef3f13286bc0497ae5341a0b5d8ddf001a73233189fb03382945477871d7d50b2f1272affda9d2b6ddee28628d10a9cc01304a
SSDEEP 768:FleZu3MWvg0Go8F1+UoAYDCx9Tuqh0VfUC9xbog/OVueLlPZ4V+rozc:FleZu3MWvg0Gou1jajeLZmVVQ
TLSH
T17AC2DA3F744CCA7E4FC00A9DED5A6F973E9802C79A684D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 4edab5ed156f003a13826092adfe8c4fda99c3b2a10f2cb561584030757a6680
MD5 337002f834fb18d56df97dbe5fa0de7e
SHA1 324fae5398765b55be27e1156268fce2acacdc6a
SHA512 5234d6661ff6e8bb852df0a5a109e240b3cefa0a45d70bef231ff9f62c84383009244a2bab66554406da9b35dcd921f753f45f9f59a9ecfe91f7989e7ab53402
SSDEEP 192:vsNoW61tvdWQmiUy12IzX5Obd+jFjzors1yRjAX6klsjQxqDtUO:vsNd67vQDIzX5od+t8s1MAXJUUO
TLSH
T10012E735A46CAC6B9DE2B458F48B32935EE91077DE856F84D6EC1F1C009768C270F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 07bfcdf92e25b0e2e323226a25ffa985ee8b05f246ffb5537bce8e15a1065ead
MD5 950ef569404759d5277ab0ee70ae166a
SHA1 81195679602a796640f3f16426d2f9f6912e846c
SHA512 b659650b557ee4966b28f33865f1687e896386cc50bf677500d29ec505f3662be53cd38be639fab8b3b632c8a705e9b019c9f81a98813fb74fab463d863454a2
SSDEEP 192:yONx61VWQmiUyb2gGX5Obd+jFjzors1yRjL/aE3YtU6:yONx6WTgGX5od+t8s1MuXtU6
TLSH
T15F02C736A9786CBB8EE2BE49B48737135FD5106BEA552F84C6EC0F1C009765C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 88f7478b496d62991f48d327ffef94b741d987c39616270df84b273b873c8c1f
MD5 75442fda13d3d5de6a72dfa8dae1e168
SHA1 c571550ae9f259999e578cd580d96d4eb667f895
SHA512 8c7ea3e4b4e1c40d58c42fdd1f0ae1c1fd64e222279b049c40ab3cf2b1c73691886fd63a7e537cfd11e393710bed3322b0905941210a278ee6ba7dbd9d8bd9e6
SSDEEP 192:vsNoW61tvdWQmiUy02IzX5Obd+jFjzors1yRjAX6klsjQxqDtUO:vsNd67vQOIzX5od+t8s1MAXJUUO
TLSH
T11812E735A46CAC2B9DE2B458F48B33935EE91077DE856F84D6E81B1C009768C270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ef503308fc81ce4ff73349aa1f748f420e32585d359735a9c72374568602bdbb
MD5 622ff4deffa77ed444977f1090061b62
SHA1 e82113170d89b98d5affc0fed7093c6b89bbce53
SHA512 a1c16c7fbe1b61319b2de0581f3fded6a2f5d029e81ae02dfa4c01d1ca5b167811fefd04bde932737c6ff2f6810b236a96c2e960949b7eae97decfeecba680e4
SSDEEP 192:vONo161VWQmiUy52IGX5Obd+jFjzors1yRjAX6klsjJMqDtU6:vONs6qnIGX5od+t8s1MAXknU6
TLSH
T17C12E835A46CAC679DE2B459F48B32935EE52077EE856F80D6E81F1C009768C270FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download