ae8f24bbff65c79029193e2f7e8786f96f740a361a003888a384329045e11ab9

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SketchUp.exe
Size 36.0MB
Sample260905-sl24jsxcph
SHA256 ae8f24bbff65c79029193e2f7e8786f96f740a361a003888a384329045e11ab9
MD5 06e30c5fa513c98bf4d097ac4b3910fd
SHA1 808f1d326c81d7ef8be30d1534edc7e1cf548f1e
SHA512 eb5914f9e4f5c71dd4315901bc404d4717dd77e14f70e368cba6c2c970defa2db9c8d1e1ba90ddff6786dcf875546bc8038b1ec7d4b5b50646c36f5df9271bc5
SSDEEP 196608:X65HtLzdD6v2gw+2YnIJUjionF67A7hulvjPSecNSamdp4rg0rg0rg9FLOyomFH2:+tVpgw+2Ynfion4chuFf5dpUJJKFU
TLSH
T199878D6A36A480E5E077C0398A96C667E3B27C155B2147DB21E17E1F3F3BBD04D3AA11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1976_839153319\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1976_839153319\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1976_1224635809\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1976_693254672\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1976_693254672\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3440	msedge.exe
3784	chrome.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330948938168421"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{FD73C353-8525-4DAB-8FA7-4985D1F344A2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
3976	msedge.exe
3976	msedge.exe
6812	chrome.exe
6812	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1976	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeDebugPrivilege	5580	firefox.exe
Token: SeDebugPrivilege	5580	firefox.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeCreatePagefilePrivilege	1948	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
5580	firefox.exe
5580	firefox.exe
5580	firefox.exe
5580	firefox.exe
5580	firefox.exe
5580	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe
1948	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5580	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1976	2568	msedge.exe	89
PID 1976 wrote to memory of 1088	1976	msedge.exe	90
PID 1976 wrote to memory of 3440	1976	msedge.exe	91
PID 1976 wrote to memory of 3672	1976	msedge.exe	93
PID 1976 wrote to memory of 3672	1976	msedge.exe	93
PID 1976 wrote to memory of 4188	1976	msedge.exe	92
PID 1976 wrote to memory of 4188	1976	msedge.exe	92
PID 1976 wrote to memory of 4188	1976	msedge.exe	92
PID 1976 wrote to memory of 4504	1976	msedge.exe	95
PID 1976 wrote to memory of 3100	1976	msedge.exe	96
PID 1976 wrote to memory of 4504	1976	msedge.exe	95
PID 1976 wrote to memory of 4504	1976	msedge.exe	95
PID 1976 wrote to memory of 3100	1976	msedge.exe	96
PID 1976 wrote to memory of 3100	1976	msedge.exe	96
PID 1976 wrote to memory of 4168	1976	msedge.exe	97
PID 1976 wrote to memory of 4168	1976	msedge.exe	97
PID 1976 wrote to memory of 4168	1976	msedge.exe	97
PID 1976 wrote to memory of 348	1976	msedge.exe	98
PID 1976 wrote to memory of 348	1976	msedge.exe	98
PID 1976 wrote to memory of 348	1976	msedge.exe	98
PID 1976 wrote to memory of 3300	1976	msedge.exe	102
PID 1976 wrote to memory of 3300	1976	msedge.exe	102
PID 1976 wrote to memory of 2564	1976	msedge.exe	103
PID 1976 wrote to memory of 2564	1976	msedge.exe	103
PID 1976 wrote to memory of 4020	1976	msedge.exe	104
PID 1976 wrote to memory of 1064	1976	msedge.exe	105
PID 1976 wrote to memory of 4020	1976	msedge.exe	104
PID 1976 wrote to memory of 1064	1976	msedge.exe	105
PID 1976 wrote to memory of 1292	1976	msedge.exe	106
PID 1976 wrote to memory of 1292	1976	msedge.exe	106
PID 1976 wrote to memory of 3796	1976	msedge.exe	108
PID 1976 wrote to memory of 4736	1976	msedge.exe	109
PID 1976 wrote to memory of 4736	1976	msedge.exe	109
PID 1976 wrote to memory of 4836	1976	msedge.exe	110
PID 1976 wrote to memory of 4836	1976	msedge.exe	110
PID 1976 wrote to memory of 4600	1976	msedge.exe	111
PID 1976 wrote to memory of 5016	1976	msedge.exe	112
PID 1976 wrote to memory of 4600	1976	msedge.exe	111
PID 1976 wrote to memory of 5016	1976	msedge.exe	112
PID 1948 wrote to memory of 560	1948	chrome.exe	114
PID 1948 wrote to memory of 1408	1948	chrome.exe	115
PID 1948 wrote to memory of 1408	1948	chrome.exe	115
PID 1948 wrote to memory of 3784	1948	chrome.exe	116
PID 1948 wrote to memory of 1812	1948	chrome.exe	117
PID 1948 wrote to memory of 1812	1948	chrome.exe	117
PID 1948 wrote to memory of 5132	1948	chrome.exe	119
PID 1948 wrote to memory of 5140	1948	chrome.exe	120
PID 1948 wrote to memory of 5132	1948	chrome.exe	119
PID 1948 wrote to memory of 5140	1948	chrome.exe	120
PID 1948 wrote to memory of 5216	1948	chrome.exe	121
PID 1948 wrote to memory of 5216	1948	chrome.exe	121
PID 1948 wrote to memory of 5324	1948	chrome.exe	122
PID 1948 wrote to memory of 5324	1948	chrome.exe	122
PID 1948 wrote to memory of 5668	1948	chrome.exe	123
PID 5596 wrote to memory of 5580	5596	firefox.exe	127
PID 5596 wrote to memory of 5580	5596	firefox.exe	127
PID 5580 wrote to memory of 1672	5580	firefox.exe	128
PID 5580 wrote to memory of 1672	5580	firefox.exe	128
PID 5580 wrote to memory of 1672	5580	firefox.exe	128
PID 5580 wrote to memory of 6012	5580	firefox.exe	129
PID 5580 wrote to memory of 6012	5580	firefox.exe	129
PID 5580 wrote to memory of 6012	5580	firefox.exe	129
PID 5580 wrote to memory of 6012	5580	firefox.exe	129
PID 5580 wrote to memory of 5436	5580	firefox.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SketchUp.exe
"C:\Users\Admin\AppData\Local\Temp\SketchUp.exe"
1⤵
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2bc,0x7ffe3bf5c188,0x7ffe3bf5c194,0x7ffe3bf5c1a0
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,859976266470350094,9505385343870963955,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,7289272133960133138,12444015209293483196,262144 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,383091344718676978,16990912459918161843,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
    3⤵
    PID:3672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,12159953197647512568,10706970980013486836,2097152 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,7860625897610369384,12445328932405017495,2097152 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,11667288438289108874,874176015273976480,2097152 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,2696525491300706814,9464363025613534543,2097152 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
    3⤵
    PID:348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,15848680345700437982,7524671074709421899,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,12594861892419109378,772808494458222476,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,7760133727005290404,382071087857677710,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
    3⤵
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,9444797489488617859,8703132230560665565,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,7040262411328259164,11595070380981078373,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,13297159253052358765,722966847747831659,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,13297159253052358765,722966847747831659,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,17877828404064756578,11631192924215962795,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,15874171606795791028,10870242520169764677,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,8679506274624832308,15596056253833212275,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,9073903938474521744,13856969857290590350,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,18176887241865622158,15735850844871918845,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=140 /prefetch:8
    3⤵
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,8209180872494985341,9973729426739026067,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
    3⤵
    PID:6448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,8608230238214294088,6798983227729696160,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
    3⤵
    PID:6420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,3200329395736317662,5112579006154160476,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,12452452473265476397,5408811522486771381,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
    3⤵
    PID:6844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,3385757132794896301,6635703998707722992,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
    3⤵
    PID:6812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,17327316463980410450,17819930405448008444,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5752,i,2850408202999382056,5698973253006964900,262144 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,1302079900533605334,7868675770654553378,524288 --field-trial-handle=2356,i,3605365698885384723,6147737203036176732,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
    3⤵
    PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe3870c728,0x7ffe3870c734,0x7ffe3870c740
  2⤵
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,11984197352784043261,5590478968566051630,262144 --field-trial-handle=2012,i,11082230315751140544,11740608075754152320,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,13694200044036916312,17751935304302452939,524288 --field-trial-handle=2012,i,11082230315751140544,11740608075754152320,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1584 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,137723365375057612,9211793814105812857,524288 --field-trial-handle=2012,i,11082230315751140544,11740608075754152320,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2396 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,9141953689602615318,16890533113470899230,2097152 --field-trial-handle=2012,i,11082230315751140544,11740608075754152320,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,14365602030594441069,13091467449807397633,2097152 --field-trial-handle=2012,i,11082230315751140544,11740608075754152320,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,16438612076614930084,7321143691858466376,2097152 --field-trial-handle=2012,i,11082230315751140544,11740608075754152320,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,11433488340409504077,5389162694379010686,2097152 --field-trial-handle=2012,i,11082230315751140544,11740608075754152320,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,8320838340772351753,907925084983113584,524288 --field-trial-handle=2012,i,11082230315751140544,11740608075754152320,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,13220215143311465047,14668817221705076467,524288 --field-trial-handle=2012,i,11082230315751140544,11740608075754152320,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:6492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,6831911706502868588,11260555417479565609,524288 --field-trial-handle=2012,i,11082230315751140544,11740608075754152320,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:6408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,8226782045559262149,4354129486601557307,524288 --field-trial-handle=2012,i,11082230315751140544,11740608075754152320,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:6464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4452,i,16156466236195871654,15464617137139036560,262144 --field-trial-handle=2012,i,11082230315751140544,11740608075754152320,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5896

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2024 -prefsLen 27099 -prefMapHandle 2028 -prefMapSize 270279 -ipcHandle 2116 -initialChannelId {052db7a8-2f96-4a1c-be75-3bbb189e97d1} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {b5021e87-0d63-44b1-b5be-0dfc4a933a8e} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:6012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3748 -prefsLen 27276 -prefMapHandle 3752 -prefMapSize 270279 -jsInitHandle 3756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3764 -initialChannelId {686e11da-1cbe-4e49-884e-0706fe37f008} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3940 -prefsLen 27276 -prefMapHandle 3944 -prefMapSize 270279 -ipcHandle 3960 -initialChannelId {b9e5bb51-b7aa-4919-91dc-968826875e45} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1252 -prefsLen 34775 -prefMapHandle 4464 -prefMapSize 270279 -jsInitHandle 4468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3604 -initialChannelId {1afd4e21-0c7e-4116-9fa5-3c587a95bc70} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4800 -prefsLen 35012 -prefMapHandle 4596 -prefMapSize 270279 -ipcHandle 3128 -initialChannelId {829ad091-3689-4407-842c-ab3bfc348738} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5048 -prefsLen 32900 -prefMapHandle 5052 -prefMapSize 270279 -jsInitHandle 5056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3128 -initialChannelId {17e3713d-12eb-4163-b5c3-a0c40a546e53} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5072 -prefsLen 32900 -prefMapHandle 5076 -prefMapSize 270279 -jsInitHandle 5080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4800 -initialChannelId {8c55178c-5d83-4b4d-96e2-5cdd53ee6ac0} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4336 -prefsLen 32952 -prefMapHandle 5436 -prefMapSize 270279 -jsInitHandle 5340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4856 -initialChannelId {7efe84dd-9ac9-4267-b0c1-b19094f5223d} -parentPid 5580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1976_1224635809\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1976_693254672\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1976_839153319\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4d5f7d18f433c57fbadb5211b29f14b555bda032e029e0dabe084e143e6e1de0
MD5 1721ef2cfb7d25be446da21a352971da
SHA1 753b7a7e76851e58efb43026e83c2d4e1172ca11
SHA512 879e119821f4b19129e103294fe70bee5526beccbfd485da9a7a77815f9dac6d0896a503704981f845b9f7e81aad5b7b7fcfd5146194f17097dfb1ec9e612890
TLSH
T1BEE02BA9CD21ED2B2CFD871D50500B85DA1013571B60849F3A3C81188FB0667068589C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 18818c2d07ec9a4eaaa43be58bab48428c08586b08b00737eb9d30a4b92a58a9
MD5 4135afc1003434950fc83810a52e3377
SHA1 dbcd86660157e679af050912a52b3cbde62ecdcb
SHA512 cc12708d77d3a9317b07b24905fbae1a05310b6961932e5bfc1b233ba6b1c3b11bae217d8b2ed8a7227b027ae85fdae2231c7e3a7694e81f22d898768f1b2640
TLSH
T16B518DF3D7E49AAD855156F4DB21AE1FCD2E0A18021C3C66C8E4EE5B53E2872D20139F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 43c13065f271b8ed72649d482d58eb689e892af4f21fea7cd63d92ce30dc2f2c
MD5 9a91e24103c1a498eb24b2838b2d597f
SHA1 042642acd5242d67e6626af458bcc9f08816192d
SHA512 c317bade82e679551c685645ad95dc5d3d281b7235a3b7dd7242c1a6e205026d6e6f55c3de0236a3b7ec3c28546ed286e7a0f96cc973cb0c1bd80e6549962487
SSDEEP 192:iRPxokoa358Chwv7ApAPRp2l9qHsb+WNngf0R1xP6kwEVyIsnAUgtaJ:iRpoiskUXmkwM0nxig8
TLSH
T1C842B52EFE54693B9CDAD219FA253B53D7F5103525D42E84EAFC892C28D75CC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 658854a2c70124dfb5e76a19e5ea7d8e84f40e971cfe321dbad428bcd83f60f6
MD5 aa9c6e75fae4d33f4a133e1e303d3d2b
SHA1 0734ee01d07e1cf57f474da1c70ad1a9410323e1
SHA512 6aeab65195a60464c165a26270af2779265c3951de79200ef583ca594eb47c8afb78d883eb9113b1b797fc0eae04724ffcec1242b812467b26df9084eca72899
TLSH
T1E2B0120084816101C08302B01252949871247F20960A274143E0AEA6D8269A1C1140D1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e327.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e327.TMP
Size 96B
SHA256 e8bb8cfa92642e4f6bce7b81a7b6901ed254a2b4b1be7732eedaa8f5d8082afa
MD5 dfae9a4c260d7e0df14115f2ba345b19
SHA1 63d662b77a9c742f827afa908545d9bd3998b0b5
SHA512 14fe1d578303e0e124d02a8025b89222d6c3fcbd2ca3504971cae56c9fb7bf07a19510598011e4135034447f4eb40b435ed226771c86bc285ff4cbf0577897dd
TLSH
T129B00255C203B32EC08313B42595B5D87660EF25DA03522696E51A66DC356724B25160
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 aad65805297b2d625c6257d0b07815d1b2229c281f6673810b2813d8732de238
MD5 d7271ca7cc5640ad7fb1484c52a9daa7
SHA1 0987ba18a31b0881affd9210bb3aa6a1d33a3312
SHA512 d43fe5b8ec515113bb3565f8f04126ceb4adfb892cb5662e09a0cb1937f9bfd0d68a6600eeea08e770f93351d0331e47a7fcfc7f1b4b3ee08e2fed3997c373b9
SSDEEP 6144:TgyHdua++A6CsEoU/+Zn26tbtgm7Rkm1tYpBeh2BAoW:NHllCjWZNT9oBGcAoW
TLSH
T1303423639D549C37A959E3EE344E464E5EF209E3E908E1E0C4D19A04B7FAFCD1409E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8930693eb96040fe4d4fbcd18816be6b98dcf03800210caadcb3b528a1239115
MD5 96c3502481f0db55f31e6e5b242e6040
SHA1 1d0fb30ddef3e93a1d0567873783618248454b40
SHA512 faa2471b16d653edb53023ff276c607e7884bfe56d2253a4ba3bd3715e91c73fc4806f4ac3250f83e8d739223e15bdef96efb1aa11eede5161d6d971169f573c
SSDEEP 3072:AyGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:im7Rkm1tYpBeh2BAog
TLSH
T1DEC3023B5D75EC3B5CB5A74EB08E0F1E2EF249A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 ea738d12704333e8d4eda90688e7161cd4814b2d1746e5eeb4d87ca24d54f282
MD5 acb6c09175122a5f3456db764c1adfde
SHA1 6d49fdb9e93b27e5aaa4c82534672cd4368e8f6f
SHA512 c3cad745f6433f54119a5565a12d54bc6a988568ee4c4769eff82773108cbc6b8d04c4970b965cdd2afa185a40dd7457f4ab41b2d65c92a9e5e459c33f7eae46
SSDEEP 6144:EgyHdua++A6CsEoU/+Zn26tbtgm7Rkm1tYpBeh2BAoW:KHllCjWZNT9oBGcAoW
TLSH
T1763423639D549C37A959E3EE354E464E5EF209E3E908E1E0C4D19A04B7FAFCE1809E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 6bc86559da7b18ad5197dabe6bb76023816a72d006b5747723e3138efd997453
MD5 43d62af1fd62caaa6c0d2ffa61a35bab
SHA1 1da2e2a51f376595d10193fdcbdc24a8ae3f88b9
SHA512 19739defeac0dcda3efa7459da51a39b88ba8a00e203dd0053b8947c16db5de7581a98cabee38638b255956c6ec1d92a2fa75f6b55df2862df3b9d6795e66880
SSDEEP 6144:b3gyHdua++A6CsEoU/+Zn26tbtgm7Rkm1tYpBeh2BAoW:dHllCjWZNT9oBGcAoW
TLSH
T1393423779C645C369DA9A79E344E560E5EF21AE3D908E0E4C8D0A904B7FEFC91C09E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9f369f4119e8e471370e942a621bdf379fe51c44ccdf6e9c953c628344bbc91d
MD5 228b10c7651fb3f311899c63dcf14c67
SHA1 47c92011659511a0cd61f04444ce5a19d95ab09b
SHA512 c01d759be17edb89a33a552d58999c2ca32e74a82771491c76b74f013237dc4247b9d6079396f2591dfebf07f589891326424ab07bbf3e1104ca89e8cc34a47b
TLSH
T1FFE0268915CBCA6FB25465C781B87B0CC3C13B8A9ACC7A0E67018CCD7049270AB82EA4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 67e0d73358ba5995aadec2be532b7bda0e4b2718a33351b84d61bf396cd63e73
MD5 50d79a4d2bdb9cf7337a3ca3271efd94
SHA1 508b4aafe0a4fb455b387995ee2cdd30487f68e0
SHA512 43400726d767d6fde20e33aa03947987ea28fb090c3efce479a055bcdd42a407b94cfb45a76312d8e44a513b9b5ab244bb507ff8fcd5196365377927c91524ec
SSDEEP 96:WXKqEeWXW/B3Wh9a6Zts8Lz3Zuy5talcsWdBfL08:WXHnWkcvAWcsYOdBA8
TLSH
T18FC174B049B16098FBA50170A4D9680429E072E4F86F5FC6518CFDEE2A0FBD2EF59C84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f306.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f306.TMP
Size 3KB
SHA256 b9b44af714f78d3e2c1781fb25ad0484df4f0ec8f0de90d370d7e1162f742519
MD5 365e8678b4cc6d5185bf581c0fd0d1f5
SHA1 0731b406aa12cb28648521fbb303e05792346987
SHA512 2e8a5c7d5613538f7daf0052212cfe0e2fc3b1398275a0b0d5474dc104e9ff833da76454f421e355e7ddab2c79c6b913cf09c3ebc1c4fd4fe489c0f119709e58
TLSH
T1B071A634023500ACE36041B1A4ED65457DF481E8FD375F02A1CC79B76E0EFE4A769C49
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e18827ae03e25888d6b0605c18b7b01e07c7735ed4dfc66248b28f73d3925ee1
MD5 d082a7b2ea489ae6df107c4843ececc2
SHA1 6851505f2f7568fc2501656f5766bbc2af887671
SHA512 55a812219b16bfb2fa06447cba7b52134cb9a140bb678d084d45b3914e965e48a312bab168cf7dc16a2ba6a7f95ec116524bd936f3f1b02330fdd487922b67fe
SSDEEP 48:YALlNziOCD9HCDLCC8JHCD8sgyz/CsaRslfoKsNzBCmBCnOCKC+syCvsvCKs9+gb:D8OgLncySWzBRBGO5Hha+iwBd/HJtqxx
TLSH
T18A91AAF3C7E5866DCA1191F0AA147F1BCE1D0552436C3D4E88E4AF5BA3F2872E151A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 8339483ae9475fb45439c813c5df9d72d3be4c081cdbed8ce95db46aa1fa1ce8
MD5 80c1d55a0c34edb13a233c65034c406d
SHA1 95148e04a6d17c2772412dc02f12355a547e8d24
SHA512 3ac472c94e5c4464d373a74fd48d66b4c181d9d1c49e5044469eb6aa9281e4b361a6af90ab7ebd286eab440e4c65f36d4b1f2c4e910da53f8069794558d016a5
SSDEEP 192:sxZIxRhyM/jK1Ml8Mrd/fFsmGk6Ew46bdNdpmNHW6+WNB3E/YzPptowIg4DVcOB:sxZIxjzd/fFsmGZEQheHbu/GPkCOB
TLSH
T1A872E6426A20C877CCC6D618B9357F52DBF91463DD554E4CAAFCC91C05EAAFD221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 370938b755d9a11bf2da24131637395bec3cf4872479c772ec37909e03ab3570
MD5 f3c703b2cd985aef87c8cd2dc931911c
SHA1 f17347a1b0d6725f2b6ea205313eb54132ed17b8
SHA512 59987f5f4573023cdb232279a07eaf12003e86d1167011275bf668dee021846f0d432aa4a5b7c27cd128daadbce25c73a23e422e745e22b2e6b4ff2cc8d5d0f2
SSDEEP 192:sxZvQUnmRhyM/jK1Ml8UQurd/fFs88k6Ew46bdNdp4NHW6+WNB3E/YzVstowIg5l:sxZDnmjqMd/fFs88ZEQhIHbu/9PVCOB
TLSH
T1CC82F8426A248877CCC7D619B9327F52DBF81463DD944E4CAAFCC91C05EAAFD161382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 760651cc9cad49caf919b1c89a8ffcc58327b24d6b3bd5df9a60cca13080119c
MD5 4b4a9cecc54c93c835e19f3eb38598f2
SHA1 655a092090f83c59e4dbc198b535153327dab2c9
SHA512 5070b16b617962db7481cf47e6209a3a0eec49cdde86963229bcc19c8b7d0df2385f7731f06bd1d477a3d40d53d1baa645d31d023ee3691f436e2890813324b0
SSDEEP 768:p4W7k0l7pLuLz80Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVHFa5LlWYSjGrom:p4W7k0zEz80Wvqidau1jamFa5LA3j9La
TLSH
T1F0F2FB3B780CCB7E4F804E9CEC2A7E9A6DE8018B56D8C95487FA844C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 804c4725f81e63684cf47500b16f976bfa709d318df48d76f7cb0553af9c8fdc
MD5 bad11d47a3a891f44f5f3eda8b4744f7
SHA1 73bcf79ad46acbb8c65604917bd10e9992468df0
SHA512 192eb48225c27323188d593753cf0fcaf8ba530224ec8de0672a703cc0550d92c9bd838bd87998252e10fb9ea09296f5950c28d2cd8bc9970ef655e3110ee500
TLSH
T176213E898E80956FEAE488F11077A1E43370CADC2312A3A3883C72362C263592E0B184
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 3KB
SHA256 bea2e4f7840adb7c71e878db30d7e9d6334b2adf62b39284e7c3c004b7c65682
MD5 77e0358bffc5fd31801696c33bed10da
SHA1 471addaeb79680a2df06c97a4b096cb338200023
SHA512 f660a3e1e815b38a7a9870c4cc3738e5a65b6b94bd418ea406137de4a3011a1e771af820e911c1b02dd06e3c6f3d48bb53333e69d569ea0c6dcf12c22e7445ea
TLSH
T1A651FA4E0D071F6ADDAC537214B50445337425CC13A8291BE6FE8638F8C372CADD9BAA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5878d5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5878d5.TMP
Size 1KB
SHA256 b106b1f5bb8e19642844b1e4835d764785eae7eb48381103e19d48a8f4c16cfc
MD5 27ec702892f922b8302022053cca4948
SHA1 ff227131689bf9724c661ed8511feb24d0d69a48
SHA512 8ea5d776671010cedf9f0826dab8bdf872fe52e9b43e6c108e37eb7186b0c07f7eb6696077dbe177504935ac7c4984e043002b9b1bcf91a3cd7c3876c7917c03
TLSH
T15E2110CE4791590FE8E040B60552A4F83374C9006322B3D3983D633A5D3579D6A4F0C5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 f27da0424e7a6f74a6300dbdda0726b91523413d2e615e27d74ea24e81755f6a
MD5 e4271fc3e4eb3f6d0746f4ecf76863b4
SHA1 be01c2d2ff5e11dec22d57c05c38f9094f50641a
SHA512 26aa388e7c207ee79b6fb3ee16ff17b7496d9ec2c9700b8cb39a265bebab6f4bc7f84dda6043f4849e24815a2331a9cca686b6fc1052545a9fa6e5b6f2bd4150
TLSH
T1CBA0025602C10109C412A2B5A59B12B23312FE6B1746135785A49997DD50599CF6101C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 1e72f0c6585d80cd6f3276b88186e0aa587b4dc13ba1cac01d782d3d605e1b24
MD5 5e496d618d9b2b87ac8a9bb44132c66c
SHA1 14d991d38902362fac562556cd90bfa9ff07f158
SHA512 f3cbb9d257046b17e2ac231a59d99203a4cf312b40e80e7423593307910b78678c5b47eaa5672073c980916cca12f9884af096f9c265e0e794410348efc4bf73
TLSH
T1C5A0021003C0C405D01311F1BE5202423300C9962300570784E901C5CC905404EC204E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2407fea9e90f959ad31a51e41758b971cbd2cc40d450158a81db9e4db4789658
MD5 a480f4f93910baa6b7bff8a7574658a8
SHA1 a6736124da22fa3724f504aa75852762a5c1a4ec
SHA512 624fb1041891ba755732a77ab16db6a9fc99b49b59734e6dea96fffeb3a95fe3b669a0b38f80e54e361862136aec32c77385ddb92c4bc9d559d88a45764b29ca
TLSH
T1AEE0D8BB2DFB1824ACAF97D638B155A0C58539589904EC4E316BA69770F2751240AC21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a398212321eb88f404d272799011975227c50eb702fbf19533571e890b6f5aa9
MD5 cfb73463f4c4c46c11c6ea1efcd34e98
SHA1 46377d017053c937d12cce2806a1e6a362df473d
SHA512 327cdde88f3ce457067729e248846080f77cd60be518a09ae527b947b697a8fd699f3ae9acd13f4ce452ca1b92c60d4025091deb110e357ce07882c676335118
TLSH
T106A0029589548041C00242F9D4E702886222989C4A15336DB0EDDAB8C8512A041E3315
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cbf6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cbf6.TMP
Size 48B
SHA256 bff780aad6d7c998ab08518d560728261dfb6b12044cb7e5beca8f522b2b68f5
MD5 b6cc5fe4bca6a63509ef44e2889460ff
SHA1 96cb2429a4124996a82667d87118024d846eb156
SHA512 c6f32a3a4fa3b6ad978958d9f6cddb44b1bff88170ae23b1a57ce9703074cc38d1b82888d656d0f9c4166e0e4beeaec9da258251c5617bc477d0a1f7eadbfba9
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c282bf8971d0429cd3285b2f38a4e1f8b3273c6beb0d0221b9e35dc3c4ff05ec
MD5 7e5ad9fea4b34d9ae128b5bce6cf232d
SHA1 9c854c4e36282aa83a4d0afaf096829f24f49447
SHA512 78a512a937d4530209c8335ca6301ae17f99ab91757ea563374edca75085c74e258beb5df77b618e2ac8de3e5c4e495412373b19dbca6ed1a44fe449c0e38e1a
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTT4IHKVG8jyJCIfKLagHPI1Kwcl:KIbCKcT4wKVGKaCMKLa4P6Kwcl
TLSH
T12D918C6232374A4138FD684493A98E375F9239533418A4AF7BB955B50E27E212EFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08776faa-fa96-48fd-85fb-c1d2425c3db1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\08776faa-fa96-48fd-85fb-c1d2425c3db1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0faec900eba0caff818d51f56fa754594b16b76ba6c6cf5758539103770a9b88
MD5 a973bbf26b318c0ea77d5401d461a601
SHA1 7b4963b4427067af10f7da18e03bc2394406019b
SHA512 8ccf94337a60e049ad945ae43c069aff9baddabdcf1cceefb4392830438ab9728f2116b7109fde9e3fc1251c0c63bcff26b7e6027ab2ab16548875d4ec5f46c4
SSDEEP 192:MONM64BAQmiUyP1CW5GBPKUq+FdGe5A0aDkxU6:MONM6eAQIWUdVscU6
TLSH
T17102FA396C796C6B9EB2AE45F4873B175FD8113BEA946B44EAE85B0C00D725C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6f61651c4b4e58d266e3f56f14e9a8c67f7de9124d7299a694908e5c895cb8d6
MD5 3d68739c3de6f5093e4d993e7aa2329f
SHA1 ca145f6c44aa8c8880854c8d985fac0b9d1dfeaa
SHA512 fa7e4a18688fa2bd69613ca78ec42e0714a0217363e975fed80a8117e809e12634a7c432b504c565b7e2ec0bddf0632f69c8d37a688b1a88eeb4a94174c7f60d
SSDEEP 384:nLZcIIsNOBSTBYb2PyrdV5+26577O6R2FeoMHo8:TIqY8QVl657TRhb
TLSH
T10F929C725CB85C3759B6E146F4463B039FF88067ABC85F44E9FCAB1D04DAAA81707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c28eafcca1bc91a149982c018324f19ac700d031d187d4875b0e08a0458e80ab
MD5 53feaadc9581daaae0525f51c6ba9f72
SHA1 0eb8c438d3a5bb8676fd13503587737c84ee55c1
SHA512 1c4427b70c57badcb3c8442424d6c7d264227938d03d86e09dda279f6036c94248bde70237c7ddb4b23144f5c992b7145973fa32245bffa692bff8c00fb683c9
SSDEEP 192:hONaw64B9QmiUyICu5GBPKUq+FdGe5AMV+24WwEqP7U6:hONaw6e7EuUdV5+2e57U6
TLSH
T12D122A35AC746C2B5EA1B545F48736035FA4423BEFC86B44FAEC6B1C01EF6AC2706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 4720046caca1757c9f7923d23aa409c34896b5dd9b6eabc99daaa518aa9afabf
MD5 07d8692eb2f90b78576e39a4046b06e5
SHA1 a2c66fc7269cf0e7476f7fe9a269509341d91982
SHA512 3deefb8db7967fcfc0735c2a1808355ecae64c8b942b5608d96eb7ebfecc3c17aa3f8c157e724ab070a204f1521011390dbac316e73ae91df32c9602f4763c94
SSDEEP 384:nYiFeZcIgsNOT8TUNTUlIlSTBYb2PyZDf4ndV5+2t577O6R2FeoMHo8:jFcghwgIY8bnVlt57TRhb
TLSH
T1F3B22972DCA4CA3BADF69785E60636479EF041A38ACC99C4E9DD6E0C00C76ED070BC06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c6cc02f8731ec671fa01de5d32a6a9e26e5d97b8aec79958eddaf5cf336e7d41
MD5 a59ed083dbf960caacbe16dfaeb212d5
SHA1 4cef4a63e1b3c214f983241b3cd614e7e2dfc1b9
SHA512 829ddea30a37a06a4814b1904979811f1d9aa9d2c68dda0e9e00aeb881f0f85bcf2a8a3bf53d07a759f93da7d2c10eb100447b13437e2bb7d0b0c647958bed75
SSDEEP 384:neZcIIsNOBdTBYb2PyrdV5+26577O6R2FeoMHo8:cI3Y8QVl657TRhb
TLSH
T159829C725CB85C3759B6E146F4473B039FF88067ABC86B44E9FCAB1D04DAAA81707C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

c796d25b-a263-461e-9c73-76d86f06008c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c796d25b-a263-461e-9c73-76d86f06008c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 91ff1e7f92ab5eb32547ab7949048e0c23e336adc49cb00fc929367b29c15d52
MD5 5347dc75e06911aacd23329dcad4d9c0
SHA1 535a2d3d3246a80f6bf214fdfdca8e58f1c20597
SHA512 fb4e2484c29f4e161de6a9753bc1c33eac7b5645396082fea14acc6d54bfc35ddbb5ebe53b1939efaac415d6e0979abd2cf55825a9999496d79ed1209b4ee32c
TLSH
T18E410758AAED1118B3B76F5AABF2B86E887F79372E06C45D10010D4F4A62F44C872737
MD5 SHA1 SHA512 TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 649dfb6402006508eb486ba455eac3ef62ea60a667bc365dd45137134c37f693
MD5 349f7a7c01cf9fd7f73d16af4bfbbe54
SHA1 d50e63f992d5290d3e6b091fe89076869c409335
SHA512 561a2f70b55f58e7dae1a3baa15da3a2cd6dcbe9f81e865dd40b5816a5e5bc56d6a5f5a096bf3753008910dbef8713c6e3255c8b3e786e348d81fb69187c2a8d
SSDEEP 384:HkCjiO024YYDL84KKDL849B7SOEAd9KVRaAcP+AWRMAr:EzZYYDL8lKDL8CB7S/AmVAf+hRMK
TLSH
T199728D795F003CBC1597C0E8C5F9929A8D18B7A7CFE6806D21583D0DCA98AA9B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b7a864d-70c0-478c-ae60-a71fb6487a2e.tmp

Path C:\Users\Admin\AppData\Local\Temp\3b7a864d-70c0-478c-ae60-a71fb6487a2e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d9a7d0a5-7a8d-4cef-a761-b84df738fc29.zip

Path C:\Users\Admin\AppData\Local\Temp\d9a7d0a5-7a8d-4cef-a761-b84df738fc29.zip
Size 3.8MB
SHA256 8679245b0915d024751aa2ee17c6eec65c8638e19a0a6aaf9f05c966f27ebcf4
MD5 71c7ea0625b3874497c68363192e97bc
SHA1 e9a73ad7d2bf7796f38aba11140331a392be7515
SHA512 c38db50665e76a04ca74f1ccc052bafd70fa1c044b811498b951908a79a4ce5b7cc8940eb3ff1ffee226843e9a4dd6b984feb855042b23fd8cde013c3360d21d
SSDEEP 49152:YRSEcTjfncOxjAlXUsQAKEvlcl/jAKnuH+b/0wpA89uIORzhuFkRe+VImOTW3UaN:oSE1ljiEclvlgwpAkuIQurXi3UaPcU
TLSH
T1C806F175D65C1F08F9CF83BA8D0C2FC2B84C4FA68354A95B6A6A95717CA31EE1F74840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f90adb35-e151-4143-b441-c8b8bba6c320.tmp

Path C:\Users\Admin\AppData\Local\Temp\f90adb35-e151-4143-b441-c8b8bba6c320.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61da12d2-58aa-4f13-a4a9-44e4768c36ec.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1976_207428173\61da12d2-58aa-4f13-a4a9-44e4768c36ec.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1976_706505154\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 0820fcea16f7c49de4437bfe2f07f24aef7d963b72176937c2ac797e681b36a9
MD5 c5ca4258c0ae6a26e1497f1f254b59e4
SHA1 d6a7343b5e87aefb35945921b83181d9203f98ad
SHA512 bd1ba1d1ea7d2c08edfb2b6ab90d676c9b19dfb57037f6a7707949de617f43104d52a1467e60824f11368c499232f007b535c57bfbc9c30f76a53e6052ba1f6a
SSDEEP 384:XeCiS59T0OVcRGcmhuhH4qBa0KDWat6bjbzD4nd66JozGzgC1jlgboHqmyji:XeI5lFcRGcmhu1dKDWat6bjbX5EcAZ
TLSH
T1B5C2F084FB2A963FD41512BBDCA507001F79B88A58092F573A4D646C6C872DC7E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 09a6a05b6d3ea733636c770070469e3d09da62f043ee4da31dc1d54ad1b9a62d
MD5 c5b94c1af6f855781491abb5658ed595
SHA1 543ab5078e745a1ca43a131906c3cff26aaabc09
SHA512 a7ab204dc146c0c7f2bc8dd4d17232ba8d6c448b777e4fd4e0a95c9b7db5a5c29d59544e500e00493fa813872ff3bfadc976cd21f7a187676b1fd7661ef852ec
SSDEEP 384:Mnd66JozGzgC1jYeCiS59T0OVcRGcmhuhH4qBa0KDWat6bjbzDugboHqmyji:tESeI5lFcRGcmhu1dKDWat6bjbX9AZ
TLSH
T16BC2F084FB2A963FD41512BBDCA507001F79B88A58092F573A4D606C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 62af226e4657c0e1ee813cd50bba17157c41e4bd2d1f01e5e3b9386509266ea2
MD5 7257ad9fecc7c3f21cf4972f6392290a
SHA1 0169b2ef65cab58c43b42aeaf63c279c056dab50
SHA512 f4b3e426ddc27c81c89886b7e50c721a2beaf803934e935c43635dcacbbc603d954a817576424ce90c222bf798b8244b2b8ceaf053358af348f8fc6078a496b0
SSDEEP 384:6gboHqmyjsnd66JozGzgC1jYeCiS59T0OVcRGcmhuhH4qBa0KDWat6bjbzD:xAwESeI5lFcRGcmhu1dKDWat6bjbX
TLSH
T168C2F084FB2A963FD41512BBDCA507001F79B88A58192F573A4D606C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ff9d48613f3399c9f3cdb4aab0100c619b292d18bef98baf027e5e17100259df
MD5 2ffbe49c1c2fee36d954034939c7dba3
SHA1 c39e4411c4d7cbb9707e282fb27cb8f294de6d37
SHA512 d55aeddbdfbf891092d0901ab2204066defccd2f763d024ca3a0f911bfd115fe7c4819145afd7251858b09a2cbffbca7bc7eb1c25c1dd2fc640bc55a4a07ac9c
SSDEEP 192:Mp1d66JozGzgCl6mc0dRPOv5zboLZqmyjFc:Mnd66JozGzgC1jjgboLZqmyj
TLSH
T161E1FDA5EA28863BC408027BCDA61F800F35399AD84E7F25319D741C2C5B2EE368D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d4ccf26052051c1abec86fdc66132ba32460fc11289bd3b9c5e569caa7a6ab99
MD5 9ac969e8023295c41403827d52c5d69d
SHA1 e07aa6101e4c2f7d9485df24843b74358ecf4df8
SHA512 910a58ce08baec0886907c7b7e95149631125d628024f2961743598ada7f1b8f1ebeb3653adc8ae640ead5f52acf9721da0a2abd1be0046326f5415eea9602a2
TLSH
T1CD216A9C39F84D9E5E86E29C7451128E57A08E0708871D475D62EF8CCE82ADE336A43E
MD5 SHA1 SHA512 TLSH

Submit Download

236a5d1d-4f83-4d53-8c2e-3a4b3fbc3976

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\236a5d1d-4f83-4d53-8c2e-3a4b3fbc3976
Size 2KB
SHA256 1ee811b6a902f30733ab523013ea059f2dec44f788a958dbfa5274ab6d9c7ca0
MD5 f95f80cac96d648914144a42986aecbb
SHA1 e74f91aae63bfa8e721cfd67f9fb016c0a9888a5
SHA512 798f5a8a7279575682591458a3a811ff9520db55a105ab25dfec4a277249d95fa1f4873903640de67090842e5cca59177daf136ffd0d194e903ee3fd101b1459
TLSH
T16941119C79785C765CDAE18DD492338E57608E1640C718932E62EE0CCCD67AD336A43A
MD5 SHA1 SHA512 TLSH

Submit Download

415759ff-a080-46b0-b434-acb7864f2bc3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\415759ff-a080-46b0-b434-acb7864f2bc3
Size 235B
SHA256 8510e5e609dfa766a17bcb0df05a51788b117b30d5c8fe20801ac1e62d048299
MD5 de08f4366d3934d2233ac4e538cac6fa
SHA1 2379cc35c3f6f180bfe61fad558cb48c8224bd4b
SHA512 c4d8c47fa8e52102a70603f4b84a14aa4d75a31d990065a50fb13544b666531e756ace13864064dded619f02e35ef22dfd3d7a925adfd56b3543e880fee34f58
TLSH
T1FED097812888332C08100F03F0E26DCA30448C3369A89910CAA14174EAFDDC8811181B
MD5 SHA1 SHA512 TLSH

Submit Download

5b4d1b3f-e541-4c25-b835-2dd4ecfad243

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\5b4d1b3f-e541-4c25-b835-2dd4ecfad243
Size 883B
SHA256 5884faedabac3868dc0ddf13202e7693d2902cbd1cec9a376d6be6a1282cf029
MD5 8804ef2b23401dbd87b6b7ceea3bbdf4
SHA1 4577728bb5831addd94400344a0b2057e82d944c
SHA512 358ef14d3ce8b750b7fcb80e813fb593d1758c62c6bb4051fb475fac8d143736f1631a2f8a953350174f5c61312d88dfb51b4b3e71bb147b34adc64a922828a8
TLSH
T1821123C296347572CC6C9287C69137828FE42523C0CB84103EA56E2C0DBE52E972B707
MD5 SHA1 SHA512 TLSH

Submit Download

85ccc126-e680-4864-a168-e9d229448af5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\85ccc126-e680-4864-a168-e9d229448af5
Size 235B
SHA256 a3f61221c2d21bd2227ddecc40f2390f4d2266fde0e3c361d17ae2cccd8ac971
MD5 b3519f3425d34a772420631f0619c076
SHA1 431d77fe052a32bf439c45de9ab1c3e9426ab458
SHA512 fa1b0e3cae9923f1ca70404ca5964dfcd0ed1967b3cc3b3217fcf7d3ee8b96aaef6ed829883e70dbdd5cdef84722337398a19a4a953ffd384f09fd843fc582a1
TLSH
T105D097862888A77D08140F12B0A0A8CAB0488C3320F4A8A0C5600178C9BEAC4429580A
MD5 SHA1 SHA512 TLSH

Submit Download

8b5046f2-bd2a-448b-81fe-be5ea6987d2f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\8b5046f2-bd2a-448b-81fe-be5ea6987d2f
Size 886B
SHA256 df7681ee08a68d4344c40165e25c1d265e7ee8bf6e3af384493f99d0686c57da
MD5 a44f2b2bda5c41dcd431992587be7d6b
SHA1 d4d4be9cb97da94420a61f8e1339bdc89ba41a7c
SHA512 b041fca6acba7ec7c5f603081db164f3191ac22f25ef37857169188feaefd0b36e099a3f24df2e92b3860176ca54bf2e2f16c490a84e45d817dcf27b4a89fa00
TLSH
T1391123C29A2579728C7CD287D5E0B7834BD4A633C0CB49147E546E2C0DEA53E532B707
MD5 SHA1 SHA512 TLSH

Submit Download

ecdc29dc-a87c-4c1e-9cd6-8c44bf890d62

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\ecdc29dc-a87c-4c1e-9cd6-8c44bf890d62
Size 16KB
SHA256 fa86b5b048749baddabf31a6bc0f9201f0592b7b034aee360b6600c18a132e44
MD5 f7298526ac41d00aa93f91d53d0de413
SHA1 68e2cff32a77998218461c9b9b7d9e3db51c1205
SHA512 0a9b15c0f6a3c0ccb00ff2ce45638a673e99b9ed80474861183ff55f902da583252f1a73f238baf5ac4d3ef742dbb41e1e0a6f351859ca188681326245259f41
SSDEEP 192:vB+1L2Y+0y0DbrHm9yoQzmLBoNPY3Arzgaf9zUSp8BwCuAivDWlUGerWgIJQhSJ2:vQ+0ySrHm9ypBVgerWg6kSHwM/D7i7
TLSH
T18972DA16686045BB8651E36998ECBFC3E2F628CF4C419FCADBE47D081DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\extensions.json
Size 16KB
SHA256 8bac08ade6dbc0a479bb6d80650791e5b42aa0f879ae7b992be1995b2b0666dd
MD5 97c5d1650c64dd3d8d5b15c2cc398ac3
SHA1 7d9b9b81ce51d9c44543529a008d77753ae5bcc9
SHA512 489e99ba4475c5c98a260d389ebed87978e71dd6edfb311035ee61d00f0455080438e118e1433b6302974f3d209466c2a880f40625b30e04ccec55e27f126d16
SSDEEP 384:uskI4vdUmldvt8dhWE94z2p96o3L4HLL4PfL4HXL4HzL4Hdbew4hsJ:ujI4VRfOXN4e60434L474f4T4W
TLSH
T1A772531545049EB8294EA78AAA367E01C37D533B60845C78F4DD8FC842FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 7KB
SHA256 553d7016394670393a315146d602fb142b01b29221a72bbf17bcf76a599de812
MD5 c2f82aa1ddc5405ae9fc4b0351551332
SHA1 262049ce1b5e1148836773e0e768a6b15103e9c9
SHA512 ac74c0d4efc0751e1e91e5a648ac58b646d233878be03be5d177258046ef8c06ca843b58604f31ab34dc5804e1ec1d68cea88bad22fc4681729686c1a19c362f
SSDEEP 96:xHYUTUuqGqdf23JObzSDSSlDdv9j4nERH9O+yCBw88N8L4cnrzBHK:G5Rdf23JZSSP9ACBw884w
TLSH
T1EAF10F7894048F6F64B6767CAC6489716AB2423BBBBF68C710B954C4054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 12KB
SHA256 fafd09d6976c153178e3ad80e392865edbd05b13ee48e650ed5068a8d79b7ff5
MD5 f9898b7fd6a924bab5136b9b9fa7cbd6
SHA1 609c8848d7d06d73ff7e7172a4da55272e4d278f
SHA512 646ad051d524a344ff0e176010fd97144587493531da42f0c3755f501c0b30a4ad65a20b30911fc21d9cacb2099eea1dfdae6c2da43cf1c33ddd11aea1fc250c
SSDEEP 96:xHY1TUuqGqdfA3JObzSDSSlDdv9j4nERpwoDRxsBO+yPYxM7OBw88SQf2EUo32R7:GQRdfA3JZSSPXLRxvA+OBw88ShEUo3nw
TLSH
T19242BE3860408F3F25B7327DBC2549B059614237BABFBCD705F89891454DF2942EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 2f23a4547b7411e731ca8d962e927ba719a201772156a82514fcbd090741fe4d
MD5 a870efd0ddc0223f30fb35e66e2816e1
SHA1 86a1d7394b772f46f0b0f45d84e752ab36db7c9d
SHA512 ddd4e9a5b2009acdc5b5cd850b1a7b476b69aaa1d89508514c86387cd491303aa620326699fd2839574f5af8796dbcb8eb913d86798331fc6155b902e5176885
SSDEEP 96:xHcUTUuqGqdf2oE1zSZUFSSlDdv9j7nERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEgUFSSC9A1Bw88+w
TLSH
T1C4E1307894088B6F74B6766CAC6888716AB2413BB7BF68C750B554C4050CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 10KB
SHA256 63401aaf1ddd0afe08071d042743248f308f881bf551e628c716429d2f1a0129
MD5 807f3deb2afc3a0c6564afcc81d28cef
SHA1 74b8dc58ebe3af86b128a103ba5a872b8fa30ab6
SHA512 d0e2be6fc4c2ab0b71d31cb87876a6f921eb1d9ee66f25bd7f8a70b99c25b3fe6ff0b8a8af12086aba4d839e6a18cc25dcc7e1f64463886f12134b4c6989dd22
SSDEEP 96:xHY1TUuqGqdf23JObzSDSSlDdv9j4nERH9O+yoYxM7OBw88kR163i8L4cnrzBHK:GQRdf23JZSSP9AR+OBw88263Zw
TLSH
T1A022EE3864448F3F65B7327DAC24497069A10337BABF7CDB05B95881054DF2942FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 25005f60f766a682a1f66a0b5366573e9475371d2e2529f633011cef02a2ca4d
MD5 efa688ddc7349fd66d0a32ddf9423bc5
SHA1 30256f88c0fbb9e0ae0bbffd43c6d1a66e4cc0ac
SHA512 663d699f0fbc9910fc50a8612f675b602ba333ca7d0f64b832de2ab813f4f69645fd0cef5aac35d76a6e4fc49ebd1ff1dcb90e5ffd0cb72b143916134c97f201
SSDEEP 96:xHcUTUuqGqdf23J1zSDSSlDdv9j7nERH9O+y1Bw88n8L4cnrzBHK:65Rdf23JSSSC9A1Bw88+w
TLSH
T19AE1307894088F6F74B6766CAC6888716AB2413BBBBF68C750B554C4050CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 a5eeeaeb49a7e41339b07028f3bcfd7049ceb6222b4cc9815af021e990733543
MD5 4135926ba80f20fe9c17cc915b8a23fe
SHA1 2df08a04c22469f5f69aa56d55e5e21ddb3444da
SHA512 0685953d68b198ebfec59476a7bf4ff6d6f15b3fa819955f0a3f8781e4ad3d44649b3339408b0577a0b9842827f57d89b0d6945523fcc5a7217573465f31556c
TLSH
T10021DA88FFAB1CF93B65C10580CD1BD8DB6A7011432868A1DD5EB3026DDCA0E329D256
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 9.0MB
SHA256 3ff93422a79e1009d1a177f4b85d5a0734c0ab708bd85ceb76f401e25c720b8d
MD5 1be87172b6b09a126ad467e707af5574
SHA1 dce55a30dd3972d69d0185b0bed204a7580639ce
SHA512 b6fd7edc47f3a78d7b05fb22bd481e9988a14818a38d26d7d8ce8dcdcd25c8e3bfa443db02a3a7d364d92da0206d6f6de8504da3ccaa746f00ac7441fc28dca4
SSDEEP 49152:xDmgBuOjA5lUT2loNc+8Y+xYcfpunQ2RPFuI:xmYuO856T2Kqp4jL
TLSH
T1A3963B9660D4EA92EB4146B6F30F43DB32BFC18C2095C99416F86EA854136DBFE2F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 9.4MB
SHA256 55a59ea658a7d27c729b7c4a2988ef4c2030ec6f7f0fda26d7817af7f12fa822
MD5 016c3d3b267c7a0de4a5fabec0c8e4e7
SHA1 54bf0ac24b62895949fb89c8b682cb092cb6e7b6
SHA512 47d73316cc290d2b6a691e5e7373c117cabf5eb5f58943fd98fe2ed2ab55460cc19a702164dedf90510747c475d91a03cdecdac5ad7b168be13884fd4638316a
SSDEEP 49152:400v+iZ7Y6FpjRvh8s+zYT1MJHaUCRHFO:n0v+O7jpjRvpMJ6D
TLSH
T131A63B9670D4E682EB0146B6F30F43DB32BFC18C2496C99416F86EA854176DBEE2F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 13.4MB
SHA256 07e94f3c0a6dabcadde15aa957331a3fcae98456e929957d17a6c6ad600e7434
MD5 843588de9bc84f223003f3510012345c
SHA1 1c549937be08ca91944b5953cfb43d66897c75e7
SHA512 a42b918d3f5a314769f870dbfa07b30f93348bef6efaa00ea92173bb21e6e4077bd5bb4f21bbe51846fafb55ce7cfadc596defe1eb720dd64ddadd0cd7a9a45c
SSDEEP 49152:AXzd++h7Y6FhRiEN8g+6YwGbP/yRyFWB1Wnee8DcwqXbg09lcr+jZaSZPUZWW1Ch:gzd+m7jhRiECra/1W
TLSH
T1AEE64B9270E0D692EE0186F2B31F43EB313FC1DC20E689941678B56C596369BEE6F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 13.4MB
SHA256 f19d70e398d0052706009f8ff5cae649892f8573000150b08986f0bc9a690972
MD5 c38b6500bc2a2d255e2fc30d3a333531
SHA1 db012e78155aa548f332fb861211859b8373148c
SHA512 299db70e3a7a95313ebf9f2a84e3359aafa07c9ba213df8efaee5275e0422efc78ce125dcfb5bc76411c3f4ede948f1600332d31b0f94e322302359ccc930852
SSDEEP 49152:p9yWkun/X1Se4y2D3/YahnqrTl1khEDykAtQsRP1VvJTZa6E3z1Ehxs5ISlU+VyF:M1P+c7jhJ2g0FaY1W
TLSH
T135E64B9270E0D692EE0146F2B31F43EB313FC1DC20E689941678B56C596369BEE6F364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download