91410536fbaa9a8d9e9e13f3019e70ce93cae0f13ed8ef68f4234fa7a2b09f56

Analysis

max time kernel
39s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91410536fbaa9a8d9e9e13f3019e70ce93cae0f13ed8ef68f4234fa7a2b09f56.exe
Size 610KB
Sample260912-xd2j9ssfjf
SHA256 91410536fbaa9a8d9e9e13f3019e70ce93cae0f13ed8ef68f4234fa7a2b09f56
MD5 58eadcc3e89bed96bdc171d7ce9d36df
SHA1 605b5222a62efa748a131d4e0d852b479ee8d25a
SHA512 85fe85a62edde1655e5dae44381624801487f9b1213dd734d40bcc4b416c88f5ccdf9ee6f0689a48c918d8f598ae01eaa42a0ad2af55b885ee8f723601593f28
SSDEEP 12288:Sc+wN/Bzlk0evlSw+LWzntovQ9G89j+b:x/pC6KntOQ089
TLSH
T152D4D009A295E1EEC03955F6CC1968B277A07C878B445FDF46A03D873EBE5C8297A70C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 18 IoCs

description	pid	Process	procid_target
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1924	3240	Explorer.EXE	84
PID 3240 set thread context of 1924	3240	Explorer.EXE	84
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1216	3240	Explorer.EXE	88
PID 3240 set thread context of 1216	3240	Explorer.EXE	88

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\tenements\aorriaopp.pdf	91410536fbaa9a8d9e9e13f3019e70ce93cae0f13ed8ef68f4234fa7a2b09f56.exe
File opened for modification	C:\Program Files\conic\swurdiapsooght.txt	Explorer.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5016	chrome.exe
1216	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337836749739942"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
1924	chrome.exe
1924	chrome.exe
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3240	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5840	msedge.exe
5840	msedge.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe
Token: SeShutdownPrivilege	1924	chrome.exe
Token: SeCreatePagefilePrivilege	1924	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4752	91410536fbaa9a8d9e9e13f3019e70ce93cae0f13ed8ef68f4234fa7a2b09f56.exe
5840	msedge.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
1924	chrome.exe
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3240	Explorer.EXE
3240	Explorer.EXE
3240	Explorer.EXE

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 3240	4752	91410536fbaa9a8d9e9e13f3019e70ce93cae0f13ed8ef68f4234fa7a2b09f56.exe	55
PID 1924 wrote to memory of 5476	1924	chrome.exe	86
PID 5840 wrote to memory of 5412	5840	msedge.exe	87
PID 5840 wrote to memory of 1216	5840	msedge.exe	88
PID 5840 wrote to memory of 5708	5840	msedge.exe	89
PID 5840 wrote to memory of 5708	5840	msedge.exe	89
PID 5840 wrote to memory of 5708	5840	msedge.exe	89
PID 5840 wrote to memory of 2892	5840	msedge.exe	90
PID 5840 wrote to memory of 2892	5840	msedge.exe	90
PID 1924 wrote to memory of 3472	1924	chrome.exe	91
PID 1924 wrote to memory of 3472	1924	chrome.exe	91
PID 1924 wrote to memory of 5016	1924	chrome.exe	92
PID 1924 wrote to memory of 5076	1924	chrome.exe	93
PID 1924 wrote to memory of 5076	1924	chrome.exe	93
PID 5840 wrote to memory of 2096	5840	msedge.exe	94
PID 5840 wrote to memory of 3332	5840	msedge.exe	95
PID 5840 wrote to memory of 2096	5840	msedge.exe	94
PID 5840 wrote to memory of 2096	5840	msedge.exe	94
PID 5840 wrote to memory of 3332	5840	msedge.exe	95
PID 5840 wrote to memory of 3332	5840	msedge.exe	95
PID 1924 wrote to memory of 3608	1924	chrome.exe	98
PID 1924 wrote to memory of 3508	1924	chrome.exe	99
PID 1924 wrote to memory of 3608	1924	chrome.exe	98
PID 1924 wrote to memory of 3508	1924	chrome.exe	99
PID 1924 wrote to memory of 4336	1924	chrome.exe	100
PID 1924 wrote to memory of 4336	1924	chrome.exe	100
PID 1924 wrote to memory of 2976	1924	chrome.exe	102
PID 1924 wrote to memory of 2976	1924	chrome.exe	102
PID 1924 wrote to memory of 4892	1924	chrome.exe	104
PID 5840 wrote to memory of 3352	5840	msedge.exe	110
PID 5840 wrote to memory of 4900	5840	msedge.exe	111
PID 5840 wrote to memory of 5368	5840	msedge.exe	112
PID 1924 wrote to memory of 4016	1924	chrome.exe	113
PID 1924 wrote to memory of 2884	1924	chrome.exe	114
PID 1924 wrote to memory of 5712	1924	chrome.exe	115

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3240
- C:\Users\Admin\AppData\Local\Temp\91410536fbaa9a8d9e9e13f3019e70ce93cae0f13ed8ef68f4234fa7a2b09f56.exe
  "C:\Users\Admin\AppData\Local\Temp\91410536fbaa9a8d9e9e13f3019e70ce93cae0f13ed8ef68f4234fa7a2b09f56.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f744c728,0x7ff9f744c734,0x7ff9f744c740
    3⤵
    PID:5476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,10074101894604922243,9211628224075837765,262144 --field-trial-handle=2016,i,16656961722530069504,2911413789165868019,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2012 /prefetch:2
    3⤵
    PID:3472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,7700969426957109636,7640732883973140,524288 --field-trial-handle=2016,i,16656961722530069504,2911413789165868019,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2288 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,14025925554491668682,6672025583109389885,524288 --field-trial-handle=2016,i,16656961722530069504,2911413789165868019,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1936 /prefetch:8
    3⤵
    PID:5076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,3598053360119237468,6629621586494730963,2097152 --field-trial-handle=2016,i,16656961722530069504,2911413789165868019,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:3608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,15079557838008965203,735057646943155536,2097152 --field-trial-handle=2016,i,16656961722530069504,2911413789165868019,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:3508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4272,i,12474226755521098790,3940200190612118687,2097152 --field-trial-handle=2016,i,16656961722530069504,2911413789165868019,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3900 /prefetch:2
    3⤵
    PID:4336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4628,i,12632915764855287859,4593807178332102749,2097152 --field-trial-handle=2016,i,16656961722530069504,2911413789165868019,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4652 /prefetch:1
    3⤵
    PID:2976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,9463317526188120503,17070244609241722132,524288 --field-trial-handle=2016,i,16656961722530069504,2911413789165868019,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5400 /prefetch:8
    3⤵
    PID:4892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,18235410073509466724,588439044389404135,524288 --field-trial-handle=2016,i,16656961722530069504,2911413789165868019,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5368 /prefetch:8
    3⤵
    PID:4016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,6481547316697788228,13876997099397613224,524288 --field-trial-handle=2016,i,16656961722530069504,2911413789165868019,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:2884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,8964934342165387916,5613751084410561090,524288 --field-trial-handle=2016,i,16656961722530069504,2911413789165868019,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5664 /prefetch:8
    3⤵
    PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2f0,0x7ff9f727c188,0x7ff9f727c194,0x7ff9f727c1a0
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,16870126252622147802,4196493995628143842,524288 --field-trial-handle=2276,i,460048371038887646,12803688653353748556,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,9870185650256233514,4446881631821799925,262144 --field-trial-handle=2276,i,460048371038887646,12803688653353748556,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,4057718269879682835,11297411287244060680,524288 --field-trial-handle=2276,i,460048371038887646,12803688653353748556,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,10948160528842122261,17052852759308041305,2097152 --field-trial-handle=2276,i,460048371038887646,12803688653353748556,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,4462187447102244576,14812910473151565620,2097152 --field-trial-handle=2276,i,460048371038887646,12803688653353748556,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,11911039700457629613,4008142205339755752,524288 --field-trial-handle=2276,i,460048371038887646,12803688653353748556,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,3699311952761750731,8100981755959743716,524288 --field-trial-handle=2276,i,460048371038887646,12803688653353748556,262144 --variations-seed-version --mojo-platform-channel-handle=700 /prefetch:8
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,18279510893164207238,15838646968092368992,524288 --field-trial-handle=2276,i,460048371038887646,12803688653353748556,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a8b4a2dd309e6f22cacb4523f7af0fb1635392bed62a0d54ebefed1e9c2dbcc5
MD5 85193ffe27e36605dd16472bde162b3c
SHA1 ff9f6a53bf83ee787cbc0218b2fee5908c9265d8
SHA512 173c5dfa8c3ceabb933e8de6e9b052a83dd31529fc00c86589db0638115076c1a8ebbd90ff90a163e9a321e0f215943271e0353cbf5c26f6df6bdfcd2fdc92b8
TLSH
T13EE02BB6C921F83B19FD1B2D50108B87EB4513573681841F3A3D824DCFB8A3646CA81C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e1c3545af82275509471f82fb6ea561e65206d733eb8cece20f91d9e5c847d43
MD5 365943e11947c699c9fafe29a3e03de7
SHA1 b54f6bbb9e42c50cece771794f6762fdf1f982c5
SHA512 c94890b926ba98985807cef0330ae2086751f9c9796e6737fe89e7cab9d27d96c60a65aa27378bc1f4df727bd1c5f142e3533d77be36bb1184c64f67b371f630
TLSH
T16F417AB3C3D89B7DC90166F8AB256F1ACD690A15521C3C16D8E8AE1F53E2CF2D34024E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4611f613017f249f141a610c5627fb31246c39d9ac0397d056bb06c231e86038
MD5 3e36ae593e6dc57709f798f1d7488345
SHA1 34db971f871db612b2657ba9f245da87d19e2bfb
SHA512 816dc8de3ca7a521fa9307e964070b378420403381e3f4f77b0d33b784e928ba4061bae717aecc577b425ccfdc667877664b6c2762964b6cf16f56dd92b9cc30
SSDEEP 192:pRKZEN2sLv7GpAPRp2C96Hsb+WNn9d0LWeSVyIsnAUgtaJ:pRKZE5zCUXtsw30S8
TLSH
T12832712EBE10753B5CDBC32EEA617B53D3F5102624942E84EAF8893C15E76CC221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5c360fb3e9b8c0058566bb3a703b704f6b7d041c23bca725ad002669c2cdcaf5
MD5 f10a1cf7dac9513f64b50ec2e95f0ccc
SHA1 884f496d6fbbab30343c698b6ba83c0b51d4aa60
SHA512 ffe2dc3701196e4e91e6f9846dd9fa6053c492dd70013fc41972accb0d9f0052743aaeff98e2707c285c5e16a29c320605ca608282eac3fac5a394d94d955256
TLSH
T13EB0120690856325C00243701250A09432B08F34D65323C541E00E41CC311614227118
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5920ec.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5920ec.TMP
Size 96B
SHA256 149bec61cbf9314ae4014c462b4af51d809186b5dd8f922cece5a285833d4498
MD5 bcf220101dacd52e90ae6bc9e1440492
SHA1 a6675135916d1b0e984a81cbc3f1952bc883cd10
SHA512 0f6906bdd01d32a368d76befe875785e6ceb271f25b74a0aaaab581a6df226cdbc14a439a9f246a64427fc3d951806d38a48c913d6d1f983d02d0ffe0b56e5e2
TLSH
T188B002AAC2467223C04F53B035A596DC7360DF26CB03225292EC5A66DC296714DA7165
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 259KB
SHA256 5ef730c68c35f772a41c23a119fb02a2231ad71df124db7ab59deb85e58b5b3a
MD5 d1c80916704bbc01b15b0c44beb681d3
SHA1 7f876dbab2d7b843b6f7df9e8f2cdfec6c430bb8
SHA512 34faed4cde262f38f503922d5dab26a50fbc038dcf743b0a4850c59bbaba76a59276c3870bcbf8ddb191855f690641408aef6752eeb3431aebd4ba236411a0a7
SSDEEP 6144:rb2gTyaH+TaYER5E+qXsBDo9FYtumiXT+hFD+7t56OD9ZfSApprU:vPyaH+TjERM8VftcjyFSXD9ZfS46
TLSH
T115441267A569F8BF88BC6252A0A76704CED0ECEC84DD771D45590F8EA0BE50C02E7637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 b30d59c23600c1e1f2f29bc1d0699bd4fc1ec6d0e8ee4eb640e16784fe195fb5
MD5 d3f98bc38bc66fdead91fbca9f0eb69c
SHA1 74335313e15f4735c5bc02673ac8b5c85820195e
SHA512 c9dee1d577673a91fa5a9347ffe851c597f5edc91f924675526789db9d1df9e115a4f474dfd7cf1fc018c49aedbb652e9a0d73745dd1ef0c038b00489df21c5f
SSDEEP 3072:yl+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:yl+hFD+7t56OD9ZfSApprB
TLSH
T144D31232AA91D8BBC9BC6541B157A300CE766CED45DE3A09444A5FCEE09F94C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d8be3ef308f014c123a0fe31ddf45934725b36b7f9914e52c8efcacbcfd9ae5d
MD5 c9f31db15fc59e6f17e3411507caf714
SHA1 6a3a3a35af67c6d8a291811d2f8fb15cfdca788c
SHA512 5410dd7971b4a92d8e75574304f2c94b02b54c1cfda0c37a4a95bb42aa536e2339a061db3f07960c1698d79db38c4b412697db09d38c8c509d99d08f7a265b28
TLSH
T12061B8E381BEBB76EB58D1B091D200C3B577D97E95A36F112390D0B4D7077687A83084
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592745.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592745.TMP
Size 3KB
SHA256 f0ac7aa3e804bcd78b3dd2d2b87c804b6ca8d4f4e341a337e29786ebc8e837db
MD5 75f4043fe6576a9dc82669c2b4723845
SHA1 240a30671f975a2be9aa8c4731e0ed8b249b59ce
SHA512 fcc8c4ef39808e28bb3e7d7c7eded6c1183a1bc546b0ce21688ba7e16fe37ecd3e0445b9e52c1ab4cd7937cde9bd2a2123bfedf6d15edb92d9e430945159c03c
TLSH
T1E96194E145BEBAA6D39851B091E100C7B6B7EDBE85A35F012394D4789707B2CBBC30C4
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3f83976bdcc5e2cfcbfb54896d18ad6ec79544cf0945a224aacc5054aa726d46
MD5 d7c09068d24526e0a497fb18de49c06f
SHA1 29f3c3d958eb1a709abbec572359750f7581eab8
SHA512 6cc4c831770def3dd0e4949d36962fec8268902edc21407c0389f6200c06b913ec113e02ca4b2b0e45bf641021112f0a816658f29f4b4fae0d2d1aea6e9d6762
SSDEEP 192:sxZaReE2/fbscaQZLjF8gmb35odp4HHW6+WNB4o/Yoe2SfNIg5ztSJ:sxZaR2/fbsVOPKn2OHbV/ZSpltu
TLSH
T12E52D609AD28597B9CC7D61DFA167F53E3F9503394D41E88AAFC8A1C14EB6DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e821eb77c678c3354f8905337b904486c58a3aa00541972cf3ba500553ffa483
MD5 2823a9f6fa3d6a7862d765910574ac25
SHA1 8c327762d0b3168d0b8f350141f21d052139c740
SHA512 7fffd0cecf003b911c427cfce51cde96ec0f56fed4160bf6cb3b03b33be6534ac687b591b855e6095274b2d9037d338eef0c888ebbbc39d69b8d36ed6d470122
SSDEEP 192:sxZaReE2/fbs9aQZLjF8gmb35odp4HHW6+WNB4o/Yoe2SfNIgjtSJ:sxZaR2/fbswOPKn2OHbV/ZSpjtu
TLSH
T1F852D705AD28597B9CC7D61DFA167F53E3F9503394D40E88AAFC8A1C14EBADD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 30fb05e64576a520ace05650f8534a2da8fefbe56f94d02e44ff9053f397870f
MD5 a7bc1b978f3cc60d42bded95290b9052
SHA1 4c14c33868ce5c7d67631a9cff3ba5b972d55041
SHA512 ec4483b68f4a4049e5cbb03d7454cc488281ef45f2bc6dbec2a157010bb557c616b309cf9c6cc11c435f9b691e0a86461f7dcd174a546272f3c488ce93395760
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVL1qpLlvVajYros:Px6r8s2EbG+WviyUKu1ja21qpLd4jjo1
TLSH
T1C2E2F97B780CCE7E4FC04A9DDD1A7F8B6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8770e99d-5948-4517-8bb5-da2c1692413a\index-dir\the-real-index
Size 864B
SHA256 8fae342e13fde828fcf97412d1c1184cab471bcf07b5545110a74983709b4f44
MD5 8b204a8733a759c7cd155d64c1ec1e66
SHA1 4d7ac01404b90c5aef839b4267b4545bd9992475
SHA512 06abc8efe71cb7c582da36ff8168b390fe86db62b6c0c631a683c52a76e24db49d605996bea21f7c6d1644b55f6da3cc5e60e6adf3ece928fa68488043566f03
TLSH
T1961162DA0D035B6BEC640374203CFAE6B4B411CC1300671F91BED02A8C87B40BE81AEC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d3c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8770e99d-5948-4517-8bb5-da2c1692413a\index-dir\the-real-index~RFe58d3c6.TMP
Size 864B
SHA256 4e2f5343aec812ad2407d12ea7f4257dabb97530db79ac7f551ee7f0ec2d817b
MD5 5b6afe334a342f785a3ce60c9a931051
SHA1 54ae8292a8fc34be8485c0019a9459bd39ec2fb3
SHA512 cb2e91a93b1fb1c100367b2f3789f3a3014f5b8d2ba050b985eebedcd29ee44525c91ae2420c70088a4bd5e240a6626876d279deae9692408d8b719462ecebdb
TLSH
T1F91147E641538B06EC4403B0996CD956717541445344675F93A7E115CC82B806D83FF0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b25ceea0321f12d80835eaa98dcfbad1f5d9f0205fde08df68465e5533176f72
MD5 a383607d9daaff1cf4b583aed06609bc
SHA1 dc8dd1e6c2a07240ef8f61c54221c193950a0667
SHA512 97d98bc1f1700ed3026d76995814fedecd7b007eec49de9b04e57cfc0c8149391e29b52550436c72ab084a25da5e0f6f29053d6d7f213ed75e29f0cd16b0b758
TLSH
T19BE068B62EB70820AC7BC7E914B054A549017858C90BED9FD62A55CB40B0315244AC21
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c2ccd4036a24521d52fe2defe76f660e48a4d0a28973927ce460f49ab0fd1e6b
MD5 7a7a5bed17c20a9b65866feb76b9abfa
SHA1 e68edc4cf7a5c420e186b9e1162f180b4996f63f
SHA512 001a13024d75604a4b0686f91134ebe2a2ed3384c6c6fb69b966a37534ed5840060101f467de67c4000c063055ecf3cfe1afd3a6889c7b008a81c77f9911aa5a
SSDEEP 384:n1iFiZcI63sNf8TUNTUlImoaKMiE4w2fiBCRP+CYGrFjsa+VYgygL/7Iz0oI:8FQ63KwggrnBCRGKrFjhgnH
TLSH
T13BC24A36EC94DAABECFA4FD6AB4A7603DEF00163919C9AD4DAD85D1D00971DD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7a61875b636b384f98759c1185e1d289240c5ede4a0e5bab209530d6061a9a33
MD5 f3257f0beede6cd180b8363da9aece76
SHA1 bf16920b854cb6c341d3a0ce265f9ae2bd9649d4
SHA512 fbaae25e415c2fd02673005f1a423f5dc9e70be1359c84510164332e99f01dd3a84c692354ef290e950e8dc3a7ff1b0b6284a0509e1b37845fb558145076626a
SSDEEP 384:nviFiZcI63sN88TUNTUlI4NToKMROew2fiBCRP+CYGiuPiHX7WgL/7Izpoa:6FQ63pwgRupBCRGKiKiHXuV
TLSH
T15BB24936EC94DAABFCE64FC9A74A7A03DEE00163849C8AD4DAD85D1D00971DE1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3240-20-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-168-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-25-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-7-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-8-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-6-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-18-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-13-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-72-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-4-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-2-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-11-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-16-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-15-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-5-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-21-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-0-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-23-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-1-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-3-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-24-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-10-0x00000000028D0000-0x0000000002942000-memory.dmp

Download

memory/3240-12-0x00000000028D0000-0x0000000002942000-memory.dmp

Download