e724422e0edb446a497b3a417831c9ca674db14691e3e17bb1a8670cad86a982

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_ccc485612854a3c9c330bc7ca890795b_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe
Size 620KB
Sample260924-bs8q8sba86
SHA256 e724422e0edb446a497b3a417831c9ca674db14691e3e17bb1a8670cad86a982
MD5 ccc485612854a3c9c330bc7ca890795b
SHA1 81c8b7115083d43c333003d12a68f1c810e33b76
SHA512 30617a556d8540cac2102115c4bc46797de472fee5e280272f267e543bfa89a91671b58db480bf3121bc42afaa2200dd5d53cc9aa5347b3e55177f863b3c82c1
SSDEEP 12288:KorXUfYQsLjo9tyzlqNU6z3W5B4Chq7SKZ7A+s80C/eENQL9:JE5uGnzmwEq57AWxbU
TLSH
T11CD4E0AD71E205F5E266527B80175B16AFE07C024B306EEF22B5C3616F22ACD5C3479B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3264 set thread context of 3412	3264	Explorer.EXE	93
PID 3264 set thread context of 3412	3264	Explorer.EXE	93
PID 3264 set thread context of 1152	3264	Explorer.EXE	92
PID 3264 set thread context of 1152	3264	Explorer.EXE	92

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3412_555435059\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3412_555435059\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3412_849534053\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3412_1607701269\manifest.json	msedge.exe
File opened for modification	C:\Program Files (x86)\Mozilla Firefox\pcaictsoents	Explorer.EXE
File opened for modification	C:\Program Files\HxD\wrimpaattuemp.txt	Explorer.EXE
File opened for modification	C:\Program Files\countrywide\eauwseun.txt	Explorer.EXE
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3412_555435059\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3412_555435059\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3412_849534053\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3412_1607701269\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Program Files\NTCore\sauntseiav.dat	2026-09-23_ccc485612854a3c9c330bc7ca890795b_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Wireshark\euwnuiess.txt	2026-09-23_ccc485612854a3c9c330bc7ca890795b_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5396	chrome.exe
4412	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346867733628392"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{0F8E2A05-5040-452E-BB43-57533F22224B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
1152	chrome.exe
1152	chrome.exe
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3264	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1152	chrome.exe
1152	chrome.exe
3412	msedge.exe
3412	msedge.exe
1152	chrome.exe
1152	chrome.exe
3412	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	3264	Explorer.EXE
Token: SeCreatePagefilePrivilege	3264	Explorer.EXE
Token: SeShutdownPrivilege	3264	Explorer.EXE
Token: SeCreatePagefilePrivilege	3264	Explorer.EXE
Token: SeShutdownPrivilege	3264	Explorer.EXE
Token: SeCreatePagefilePrivilege	3264	Explorer.EXE
Token: SeShutdownPrivilege	3264	Explorer.EXE
Token: SeCreatePagefilePrivilege	3264	Explorer.EXE
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe
Token: SeShutdownPrivilege	1152	chrome.exe
Token: SeCreatePagefilePrivilege	1152	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1180	2026-09-23_ccc485612854a3c9c330bc7ca890795b_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe
3412	msedge.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 3264	1180	2026-09-23_ccc485612854a3c9c330bc7ca890795b_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe	55
PID 1152 wrote to memory of 5548	1152	chrome.exe	94
PID 3412 wrote to memory of 1852	3412	msedge.exe	95
PID 1152 wrote to memory of 6072	1152	chrome.exe	96
PID 1152 wrote to memory of 6072	1152	chrome.exe	96
PID 1152 wrote to memory of 5396	1152	chrome.exe	97
PID 1152 wrote to memory of 1748	1152	chrome.exe	98
PID 1152 wrote to memory of 1748	1152	chrome.exe	98
PID 3412 wrote to memory of 4412	3412	msedge.exe	100
PID 3412 wrote to memory of 4664	3412	msedge.exe	101
PID 3412 wrote to memory of 4664	3412	msedge.exe	101
PID 3412 wrote to memory of 4664	3412	msedge.exe	101
PID 3412 wrote to memory of 4652	3412	msedge.exe	102
PID 3412 wrote to memory of 4652	3412	msedge.exe	102
PID 1152 wrote to memory of 4444	1152	chrome.exe	104
PID 1152 wrote to memory of 4444	1152	chrome.exe	104
PID 1152 wrote to memory of 4696	1152	chrome.exe	105
PID 1152 wrote to memory of 4696	1152	chrome.exe	105
PID 3412 wrote to memory of 3000	3412	msedge.exe	106
PID 3412 wrote to memory of 5252	3412	msedge.exe	107
PID 3412 wrote to memory of 3000	3412	msedge.exe	106
PID 3412 wrote to memory of 3000	3412	msedge.exe	106
PID 3412 wrote to memory of 5252	3412	msedge.exe	107
PID 3412 wrote to memory of 5252	3412	msedge.exe	107
PID 1152 wrote to memory of 2800	1152	chrome.exe	108
PID 1152 wrote to memory of 2800	1152	chrome.exe	108
PID 1152 wrote to memory of 1096	1152	chrome.exe	109
PID 1152 wrote to memory of 1096	1152	chrome.exe	109
PID 1152 wrote to memory of 4516	1152	chrome.exe	115
PID 3412 wrote to memory of 5228	3412	msedge.exe	118
PID 3412 wrote to memory of 1248	3412	msedge.exe	117
PID 3412 wrote to memory of 5228	3412	msedge.exe	118
PID 3412 wrote to memory of 1248	3412	msedge.exe	117
PID 3412 wrote to memory of 2796	3412	msedge.exe	120
PID 3264 wrote to memory of 4736	3264	Explorer.EXE
PID 1152 wrote to memory of 1608	1152	chrome.exe	129
PID 1152 wrote to memory of 5444	1152	chrome.exe	130
PID 1152 wrote to memory of 4016	1152	chrome.exe	131
PID 3412 wrote to memory of 632	3412	msedge.exe	132
PID 3412 wrote to memory of 4376	3412	msedge.exe	133
PID 3412 wrote to memory of 5468	3412	msedge.exe	134
PID 3412 wrote to memory of 1968	3412	msedge.exe	144
PID 3412 wrote to memory of 1968	3412	msedge.exe	144
PID 3412 wrote to memory of 1160	3412	msedge.exe	147
PID 3412 wrote to memory of 1160	3412	msedge.exe	147
PID 3412 wrote to memory of 3440	3412	msedge.exe	148
PID 3412 wrote to memory of 3440	3412	msedge.exe	148
PID 3412 wrote to memory of 4004	3412	msedge.exe	150
PID 3412 wrote to memory of 4004	3412	msedge.exe	150
PID 1152 wrote to memory of 4916	1152	chrome.exe	151
PID 3412 wrote to memory of 4680	3412	msedge.exe	152
PID 3412 wrote to memory of 4632	3412	msedge.exe	153
PID 3412 wrote to memory of 4632	3412	msedge.exe	153

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Users\Admin\AppData\Local\Temp\2026-09-23_ccc485612854a3c9c330bc7ca890795b_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_ccc485612854a3c9c330bc7ca890795b_akira_cobalt-strike_icedid_rusty-stealer_ryuk_satacom.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe55d5c728,0x7ffe55d5c734,0x7ffe55d5c740
    3⤵
    PID:5548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,4769229861459515781,2373338458461169778,262144 --field-trial-handle=2008,i,13431277386316980074,11705207171222404156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2004 /prefetch:2
    3⤵
    PID:6072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1584,i,13363709770657424324,924957629972098936,524288 --field-trial-handle=2008,i,13431277386316980074,11705207171222404156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,5448497056415042628,16886198962625929318,524288 --field-trial-handle=2008,i,13431277386316980074,11705207171222404156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2400 /prefetch:8
    3⤵
    PID:1748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,8032482668020744441,16124121258194273408,2097152 --field-trial-handle=2008,i,13431277386316980074,11705207171222404156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:4444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,14134957290385136626,3422330449635586150,2097152 --field-trial-handle=2008,i,13431277386316980074,11705207171222404156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:4696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4212,i,17273775130523649462,11757533276002017060,2097152 --field-trial-handle=2008,i,13431277386316980074,11705207171222404156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4224 /prefetch:2
    3⤵
    PID:2800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4504,i,6669997566138848340,4088295537398400798,2097152 --field-trial-handle=2008,i,13431277386316980074,11705207171222404156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:1096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,18084301844076424457,15825968253965578174,524288 --field-trial-handle=2008,i,13431277386316980074,11705207171222404156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5472 /prefetch:8
    3⤵
    PID:4516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,5356393718711081215,7099774029593111106,524288 --field-trial-handle=2008,i,13431277386316980074,11705207171222404156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5932 /prefetch:8
    3⤵
    PID:1608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,15455921717397171610,11662081285028802250,524288 --field-trial-handle=2008,i,13431277386316980074,11705207171222404156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5972 /prefetch:8
    3⤵
    PID:5444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,15744144834728879898,533098287972226374,524288 --field-trial-handle=2008,i,13431277386316980074,11705207171222404156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5816 /prefetch:8
    3⤵
    PID:4016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4204,i,18047639544659194069,2649456265454193120,262144 --field-trial-handle=2008,i,13431277386316980074,11705207171222404156,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2e8,0x7ffe55b8c188,0x7ffe55b8c194,0x7ffe55b8c1a0
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,10121751910737848066,15842850911690257454,524288 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,3776334304803149395,10924673075894494149,262144 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:2
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,5077561598833728947,9935837180275304769,524288 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,7371812284720138285,280177301908552175,2097152 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,16617072690833657875,2598014420205877917,2097152 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,17958506775727987974,12924035375960464109,524288 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,1078299269044111662,11464852461878182986,524288 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,10054098744107109021,17319565406455178065,524288 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,10054098744107109021,17319565406455178065,524288 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,11173622650319093676,3969758142260236882,524288 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
    3⤵
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,7166442011100798758,6244774964853420599,524288 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,8530586862375103248,14113462277449973036,524288 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,8157290157494750938,5504287679091156836,524288 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,12787819072794458952,5768041108405351082,524288 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,15193054330428661460,9799019178804730546,524288 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,8265934158094162070,17821612565315422213,524288 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6568,i,18053698502827842462,16180710644916964842,262144 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,13501906396919693439,4857137885048830088,524288 --field-trial-handle=2640,i,6025976400842021010,11915656705618647101,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
    3⤵
    PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3412_1607701269\manifest.json
Size 118B
SHA256 f40a24d5c9f1188be55ed33af602ab23868f69014eaaa8c66dd9e0b7e7eda0ed
MD5 eccfa0022c321905ac4db22a780a86af
SHA1 39e56d8e3211b32dcd5eb4172775653a38a9eba1
SHA512 72942e1f0b5cee1f760e90cafc25b1a7d0a2b2639f121c10674ef354e5835a9cf6fff92aa57720ecf67fba21e00835dd105d45f3387d35e653cb87b790d369a9
TLSH
T1AAB092B00C1AA03B22809760ECA0668283F8021AE8025B1E088036481F8827881362B2
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3412_555435059\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3412_555435059\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3412_849534053\manifest.json
Size 53B
SHA256 7612538ef6ea25a2078adf4ebda2b0565546d80189b6af46bb0e1c9744d720d5
MD5 46b34a0f2dbd5b58337d4cf05bdb4797
SHA1 b190fc81ede34f9fe8f4f5dee1b915331b76cc19
SHA512 49d0691d8eea580f863190f3073552b74bd550ec8b0a1b748fa0c5a18f05a515390735264f62f1aee0590017a1e4e85e470c32bfd49dfd371a47d1493ecab664
TLSH
T1B79002600414921716C10E906571B895A391661955850D1D04551558029586CE150298
MD5 SHA1 SHA512 TLSH

Submit Download

4275ea35-3b19-4994-92da-90157f49fc69.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4275ea35-3b19-4994-92da-90157f49fc69.tmp
Size 263KB
SHA256 670d4a81803e6f2569e00bf7e3a0f2be8eeea91c7b04d7663e952f9bac6ce87d
MD5 2cf53dbdd62cf066ab0baa9a682c53a2
SHA1 a97de1d5de34066a4082d68c268d63eb8b06a911
SHA512 8a455d619326ee8370d1c9a4d22be934256bf4da2c07f5406e15f8cebc165c1f01a113a725a707745b4214c99417237464bc71f79b589032bf2afb5d916af6cd
SSDEEP 6144:8YBAUCOdFKaiz2yd4+hFD+7t56OD9ZfSAppr2:v2UCOdPyFSXD9ZfS4c
TLSH
T1A14423737F55C43BC6BE2680F177A5419FB168FA419D124680821E4FA1DEB1C86A3E37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 acfa1642663e3bf061b1a6df6af60307cce3956b58026435d7298c0a85889dc5
MD5 54009ec90f3783d9b582729be2150429
SHA1 5cbbfb8363cc469931fea3a7578d5b5bf7f74f14
SHA512 b9e141d203cd2116720dec8d56cec6d3753911be3ebdf1f35f0479f72114621c59a46c12b630e969eeb79e1b0be9b8bfc7c95ab7208a505e96c415c57a51066d
TLSH
T15CF02DB5C921FC7719FD1B2D20954B47F755131B3680845F3A3D460D8FB9637469981C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e7ad03e3d8a5539c49d8db461c9c0ce63a831e85f3a46559cf11f9c0c0104053
MD5 2bf2ebc6cb5e3e228c5cdf6ee24f4728
SHA1 d5870dfb41239b3a1bf34e00eecb0ffbb595dccf
SHA512 e13d0f742995698a1d53ea5faf53ac065e3bddfa0b79c39c8d66fe448553a21557fcf93d99de88f423d3bbef28e08b16dcc3f40390082d364c79fe63466fd9e5
TLSH
T1F5516AB7D3D8C67DC81196E49B257E1ACE7D0A18522C3C6688D8AE5F53E2872D24128E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5364da2c4663d60d5490aad7d8769d170e836988550af848b624815aabfd22d4
MD5 df4c4fa0891f6bdc0caaa70fa26b423f
SHA1 a7a4c9a688a4a6272bf8086fc6bd76786b52e643
SHA512 78bfce6399f1646b050e06b4ddcd56ba2c83aab1dfe34aeb052cc46d60b9e5843ac07c8cb236db6e2a92b36d81d7bf6b370b60a9b9405efa1c0f0894370b9b56
SSDEEP 192:wRLiWFuMXEeLWk1fv7GpAPRp2C96Hsb+WNnEK0u4ee2CsVyIsnAUgtaJ:wRLiWFHXvWk13CUXtswp0f2Z8
TLSH
T1B642A42DBE10793B9CD7D329EA657B57D3F6102530942E40EAF88A3C24E76DC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 41d93cfab3c28d0f0bfd997bd74dc4e4e036e0d791fe6d3e186e56c6919cfaeb
MD5 d86b9482115db5a34f14f5dcda8d2717
SHA1 925e164bf4a9cff67d8c5ba89d1c76ce459c0ac9
SHA512 70ad6c5ff2e98264f3bad6c43806bbbd714bc318ca035a719765926c95f85edf466d5360c8ff1cea4c9e0486bd4e1f756672480f3ce9906d590fef4c580f1388
TLSH
T131B0120580C23303C0020BB12190905432609F3ED113238555E02D62C831350901B208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e366.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e366.TMP
Size 96B
SHA256 330f43ea4ec0c159f18fb79adc224f9170caf24469d72222128ff6961e14268f
MD5 8f17a41509534dc310099e731257c0fa
SHA1 fdf474eb834b86edfaaee06ccf369c93560ec940
SHA512 e54956479e387b61ba42d2e38e5670079162b465bd681a8558df8595d39da451f2edd4a06312b9568d297a2e9d8bd0ce4f61621c6e13b006401de2e00b21e111
TLSH
T1B6B002A6C142E212C0421BB03A959AD8B260EF29C6539216A2F51AA6DC25A704625961
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 9b79f5a660d5a5022d2d73260f7df5754059e43403a918553e344a94984dff71
MD5 817cdc44c27b2052d4937e3927892eee
SHA1 db9f346fd7fdcb5241519b51471c6aa0445875d2
SHA512 e7d6e2ab9a727d948ccc0872f13bb75c3fb89feebffbbef00bb65cdef81833a05de313c002aedd443b89ee2aef53ad0e3fa00cae1c629e5b6ce66d46b5069cb7
SSDEEP 6144:8CBAUCOdFKaiz2yd4+hFD+7t56OD9ZfSAppr2:l2UCOdPyFSXD9ZfS4c
TLSH
T1264422727E55C43BCABE2240F167A6019FB179EB819D124A84825E4FA1DDB1CC7A3D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 d96c4e904e1dc2fae7b8d4229fe334ba556da6113973ca13f0a7643365fd45c3
MD5 f8e725e6965a78b6b23b856be97cc9d8
SHA1 24c815a0c3064a901030928328bb5d46983ca82c
SHA512 0a8f0172b6315bf2fe04e2cd9b2fdf799dc6da39ae7e44945a0b9afc3d1872206461a7733efc6dafdb7651cec7a34bc37c5a00432604f1a50d228c6843fefaaa
SSDEEP 3072:UL+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:UL+hFD+7t56OD9ZfSApprB
TLSH
T11DD31232AA91D8BBC9BC2141B157A300DD76ACED45DE3A09444A5F8EE09FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 a9c3a2ae30a85e4066e06de1970a75b55d2f11ea2a15db6bf5bcaa8a4a8824e9
MD5 83db58c21441bdda91e3fe0b54ae9b67
SHA1 dba86cd5161d9e0c62eb2b6aaa47fe45f1ebd2db
SHA512 39dc6130ee7040279146a1129b73f0c82a0359c1875af147189a323c9a065ddf2c924627edfc31a8178f593cec8ed529ea60b97eed108eda39c3e5e663f96afe
SSDEEP 6144:ZYBAUCOdFKaiz2yd4+hFD+7t56OD9ZfSAppr2:e2UCOdPyFSXD9ZfS4c
TLSH
T1CE4423737F55C43BC6BE2680F177A5419FB168FA419D124A80821E4FA1DEB1C86A3E37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 66a0bdbcca35486a158750c8bb155d0e48f5135e56dd86d4f6a593433e71085c
MD5 e03bdbe47e9c3f7511c66688f3a0d16e
SHA1 8644c241ca0a361b2bd5cd1f8949ec73a36bc98e
SHA512 b0fcb57fa8c24f16823a36698a234201a143377697eba7504dc7b6fa6757050ded1512fc5a5a45f83fd4ff0ed881b08fad52fab4352d2d960b5eb9f3d4d7f708
TLSH
T1C6F028B9C921EC3B18FD1B7D20940B46F750232B2B81A84B3B3D810C8FB053B868686C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 d6b5b9e5f2096b9630db0d1759407d097d6cc8da598d110aef93b5088c3fdc51
MD5 a04cbc58a0a80646dee4fee64f81c3ee
SHA1 f66a47220f988a7b458512225c520ca6caab7fc7
SHA512 c4e6f1b55268252fca4f6b95fbd77b935da03699174a65420b36b70ae14ce4ec92970d4b800ca25883bc725498f122116d5c54bcf3fea2dc492b151d4940b134
SSDEEP 96:Y/TZzB/TvI4VtTJj38vUsp6shNqoahLCs8NUT+yTRXfk1q6SuhxJf8Rn:0NVvRTJTvsFudkuR
TLSH
T1EC81B88095D0F05CFB443F71B45F694A24683ABCEF451BEB2D99E96C2C1FAE102786D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5902e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5902e4.TMP
Size 2KB
SHA256 1861beb6ed132e90e560f9d58f7ca1beb426f68bcb7c46f4bfd435f110fca5f2
MD5 4a48a7e1789701ee2682183fa50871ba
SHA1 7af50241e119b208f4f04fc1a28cfc9ffc9ff237
SHA512 4bfde589a2bd26500c6eaa39230b726e35f246bea8c37cb9bbd7a4e410a7390bf575e396595340bd22e47ad6680793de0b48b4928ed18ab884b6510da21f51af
TLSH
T1B3510A8596A1C59DFBA4B3B181CF218B397846BCEF825FF21DA4E8BC5C0EB1442390D4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d253d661b93cc0c7d9c9ebcc7762f279e75957a62eadb38f091eb076c8fab4a1
MD5 dbc36f869ad75c60c1ae09b1125dd2a2
SHA1 6cefd71dce8bb81a14ce83f787fa815ebb87a387
SHA512 cd4f986f0c62f3fab7d8f9ff81e2bc230651375038dcc09f867e9922d38984b93b51d57eccef757b5763a8c9bee0ee48a17c62299ec03ae79fd7754660f02fc1
TLSH
T160819BF7C3E9826DC90196F0AA18AF1BCF2C0555436C3D5A88E4AF5BA3F2471E15178E
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 121394ad3240e68ac1849a01a5533aa20c466087b79650379148f3522b293df6
MD5 7b6efadc976c8fc31392fe63fd9687e0
SHA1 672f056a80fe8ed5cb2f8e7a7e766728ea234b7d
SHA512 6d994627c34b18c8fc5aed73c450fb067f4053ebb09eda249cd8ede6bba7cfab87a630decca8faa2e7b23c297cc1d2428b338dcec070f4a55ad2e6b68d6caa84
SSDEEP 192:sxZbRPE2/fps8YaQZLji81Tbvrodp45HW6+WNByp/Yog2S0hIg5WjtUAJ:sxZbG2/fpsuOP5p0IHbO/HSQctZ
TLSH
T1BD52F8596D24A93F9CC7D629FA157F53E3F85033A4850E48A6FCCA1C24E7ADD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2cfc709d783cb67b81bf80e7c02255c1690d626d1706cbf13182b10fb57c11ec
MD5 b6f209cd17650fbdd5c30780e348eaf2
SHA1 36a7f3d0b489f10fb5f8e0fe496d90f5c177b237
SHA512 773dbdef5a37cbb37b8f3d27efd5e7d4f20452f555bf29b45bdbbed46940ae66ffbc90b1454130d55a07f655ee44a1274581685d43c31fb7abe14ba7a5dff84c
SSDEEP 192:sxZbRPE2/fpsAYaQZLji81Tbvrodp45HW6+WNByp/Yog2S0hIgjtUAJ:sxZbG2/fpsqOP5p0IHbO/HSGjtZ
TLSH
T1D252E8596D24A93F9CC7D619FA157F53E3F85033A4844E48A6FCCA1C24E7ADD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d1279d00e9416d120d8da339583b925e81219be905f33c8854b9521bc30e1a25
MD5 58a9188ac10a57520c085c1196cea9d4
SHA1 3f13f77eb739de3661ee1b570d8a7a832b6abaf9
SHA512 5dc693e59348d01923a5483c2eb2680eb13fa273674d444f08043f9f7c6a42123a3f2b759c57a7e5572328637c5756b5456ea25f0dc4c95ebdb281290f44cffd
SSDEEP 192:sxZbRPE2/fps81QZLji81Tbvrodp45HW6+WNByp/Yo1j2S0hIg5WV4StvJ:sxZbG2/fps+OP5p0IHbO/jaSQOtx
TLSH
T1A052F9596E24993F9CC7D629FB157F53E3F8503394850E48A6FC8A1C24E7ADD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2243896f81933f871b5ecacacb1cc6c0a7b1bcf7909773d4016127935f6bc5ba
MD5 dc45c47eba89d22214652be00f8a7e0d
SHA1 fbab2d2614af3a15e0d61b235f8cfd391832b2af
SHA512 d8f0b7e0e2d297f1b98a28b3d578cb222042aebaff972bdf4b85a3173feb1b97f44bc81882fcea9cf94dc04a3f7c717b345559169ae1bedb9db35977150fdcba
SSDEEP 192:sxZnQUnkP1RPE2/fps81QZLji81Tbvrodp45HW6+WNByp/Yo1j2S0hIg5WV4StvJ:sxZrnSG2/fps+OP5p0IHbO/jaSQOtx
TLSH
T1DF62E8596D24593F9CC7D629FA167F53E3F85033A4850E48E6FC8A1C24EBADD120381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 62166509e0890efddeddd62322d02a9905e0b356891250f35aed2037faf6924d
MD5 cf7e2605f8d10a3eb82e2b79846b8fe1
SHA1 b0f6e97fc0f57d1f55dc83422161736d716b359d
SHA512 851106dc9aeb7773de6e0f1cd994ae02a95d001952309b5c4f0aa6563f19610d9b17cac80bc7a6ebc59517adfe5ac179b1fbb13062c929aeb0390badda8c0d96
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVm1qpLlvVajYrop:Px6r8s2EbG+WviyUKu1jaz1qpLd4jjoA
TLSH
T1E5E2E97B780CCF7E4FC05A9DDD1A7F8A6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\922d0b5e-d7ab-4d0d-a2eb-d8af0afdb18d\index-dir\the-real-index
Size 3KB
SHA256 817dee20a5422787f8e3c9fa110fb0846b4f3e146d6ec0026b4d8b9f9ff2ebb0
MD5 a90bd48a570e69eb893f31191771f73f
SHA1 a76b6d1aaab216afc8b9f049aaacd7e3e71b56c1
SHA512 1bd0aedacbf58f3d347f1c642393aecdc620ca806ac354d50b682da61df5c1b93f94110d354f7e0a817895262d31a17dbdede6254d3b7b2caf1d2d8015773f50
TLSH
T1C351C90F4E425B67DCB4577114B50481337866CC13949A3B50FE9138FDC36552C99729
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ef004916-6437-4317-8c50-8220cff9bb90\index-dir\the-real-index
Size 72B
SHA256 13d221767751f4f6489e5faa9b6b34c7896dcca2a9700c3d6c2fc18f676dae1f
MD5 d53d34f5803e3d3c9c7d5af8f7000f2f
SHA1 69bd34ef8a2a102b44f65acade0cc70e396b742f
SHA512 f7f32fdf10c938b6a588700898e0c4978ae135cab9377bc421e68bf9bb74274f8fd045b084ee3b58e5c9668b9fb05ac9ec712a1b29360b5e92c95df9b236b3f3
TLSH
T1D4A0021E02C96511D1431BB035D641692314FB940A01131761960354DC906675DC700E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e9ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ef004916-6437-4317-8c50-8220cff9bb90\index-dir\the-real-index~RFe58e9ee.TMP
Size 72B
SHA256 fce2f4a2876bd41216beda07c6bb2be4f32feac3056ce35292dc24fbafc83586
MD5 b74801ddfbc7c25a44f5b68dabaeb181
SHA1 b4f9390a88b770cf54000aa764443a4818a3c399
SHA512 fe83038fd040584e372b9cc9bd36b28e21e46e22fd7804ad2a11ff6f341fcadb633d625c604ac11f897c917e15bf04c10005db7a289e9c81ef753d5d8b6180ae
TLSH
T18FA0021403C10009D09311F9366302422300C8146501EF079091D4C4CC528418D5542C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 111404be874a633f4ada772c874f17dde348a10c440cbac1d92132c905584406
MD5 e2f702f262fd5a073d5e9de7c602f5e0
SHA1 b114ee89a802d13f14dd837f3689544803097fd2
SHA512 ba4db14dda4922f6624395dec8be2f97575ef6cc8bc59669b30ab41ed8accf2b7d4b01846b696a57de53e9024829ed09e77d3f2c082056266434b66eeec3576e
TLSH
T140E0D8F72EB21824E87F97D5107254E4010678988D5C9C5F545BA797A0A1345B44AC79
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 9926ed47c4b0c04e62021a5b7b9b0d4f0ea6b71bace24518d57366b315647486
MD5 6f8dbbf932df4823f7d36ee8e166e500
SHA1 b58d89f2ad54663488142b1be67e40d359061c72
SHA512 cd3159b6ccd97e17f937f326fe63dbd0f775d28a892146243acff07c9a6d1c9038e46ea2b95425bdc120dd0b10655af379c7b544e34870eb1e6012b3552983d2
TLSH
T1DCA00290D9AB9141E5408E7028695184B371DD9D0106B21D54DD90DCCC91546F1C6511
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e923.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e923.TMP
Size 48B
SHA256 173fefabc2a5508a358317071fcd27b580ad1022befbb80ee5491d2f1f468f14
MD5 fd0a4e0bb4409be899896b25a44f811e
SHA1 096d71901aa16e1d17c4864b9bd58b2a616c16d0
SHA512 6df6aafd327150401b81c4bd58e5b06db6e600781d3ef0ef7be59eeea58f7d323b28fe4dc48dd87e8c70559a8627e7a6f786016c97b58e4ba389def28c47dea1
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 9eb1638d91e06f6be5729c47e14ccc9fe17f320ff51e7ab5eff00cc091565684
MD5 c1db9377d33727f8863fc78073888419
SHA1 89ff084334b13f78c7d99162f99fef40cabd24dc
SHA512 d29ff6f322c0d3a88e02a40e2f72f4306034c0802e108ff419a44c9d8e5b449e0968049046c6ce1c4569e1924a1eb51fa96652638bebda6b9a75e21c619d11a5
SSDEEP 768:SL29ObJffppdNlrtONqq7+agMIdMZWC2Beot6a5g6hA:SL29ObJffppdNlrtONqq7+agMIdMZWCH
TLSH
T13DC2315571BB421039FE295C82B6972E164231733119EA6B7FBD00B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.25\data.txt
Size 152KB
SHA256 4e932235a6fefae59866c98f69253bf2d3d0e7e2a2a9ae546685bc4646f9a297
MD5 b5394eb229ba53caf4fc321b5087e299
SHA1 b84ae45b51a9d200639a10ea487b1ba9b94ed3eb
SHA512 6e6f890c6fc57d470e2bedaf5b022d13e54762c8d424a4a43493b7eb68f2d22be2a1641f5ffa25a1756fef938841ec50c908e97161da28158a2c7e3b258b39d0
SSDEEP 3072:wPAgDcCHaLHl65aynyosxb3+BLvf55rOiWF4Vkia/UFwK:cX1aI5aZoKzMDXrOiW1igUB
TLSH
T1AAE3F240C9D0AFDDCEA8161C90BE0F1963E1CA8EC13A958ADB23FD4B6FD3A045A175D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 30cb2c337aaaf62abae000529af00254d40a08efc36c93cff6e2d4ac65435ee2
MD5 25a524fb994648b8a27d94ad007f3a22
SHA1 9f105bf66cad49875aceddf126bcb1962c2f7768
SHA512 c7b7f6bbd5fe6d5f4d419b5a74c9ebeb878f368d25caaa101523cbc9ff24a2482ea3060923dcfdc4a8c1068220c111d35862f5daf3bf81372388b00203db09c2
SSDEEP 384:nYiFiZcI63sNf8TUNTUlI4ETWKMUmHmwzfvBCT40HnziiXm0/upa7dLKkdggL/77:jFQ63Wwg8e8hBCb2i20Sa7dLKkoY
TLSH
T1DCC24A76DCA4DEB7ECFA8F85B30A3A03DEE00163949C5AC4D9E94D0D109359D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ee345f7bfa65b87d3d1d76a3c4e0aad8a2f319522349a0fb54a2878faa2593c7
MD5 6554f66a53e5ee03764e8177991c0274
SHA1 16f5047f594b32a7b58a11f9631d74c02c2255ed
SHA512 c438aaae765a5e67c9b8c2b5ebf18528950d6307ab3f09560f131d78ce7a2ca66162f61e21233e404041c466fd3885e8244dd0221edc96247ee188c9616ae614
SSDEEP 384:nziFiZcI63sNf8TUNTUlI4ETWKMUmHmwzfvBCT40HnziiXmngL/7IzUoV:eFQ63Wwg8e8hBCb2i2cu
TLSH
T151C23A36DC94DABBECEA8FC5B70A3A03DEF0016395D89AC4D9E95D1D109359D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f0a7ac7ed335cfc3b4611bd3971bd6637c1a658ebadc2166678e761a8af020d9
MD5 94bfa1957ac1f45a7f2c9a2dd2e222d2
SHA1 6a3f4a778d0dc921b5638927ad87871c3981e880
SHA512 170b219c20c9b6297a05e6f762e2dc162ce68871b8fca40b7b349d79dd7ed515814a093f278ed5a6622325e36f387f4188304709b9b263f25876956fe4128e90
SSDEEP 384:nwiFiZcI63sNg8TUNTUlIm2aKMiG4wzfvBCT40HnuFRsa+VY1wgL/7Izaof:LFQ635wgcVPBCbOFRhguY
TLSH
T192B24A36EC94DABBE8F68FD6A74A7603DEF0026395DC9AC4CAD91D1D108359D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 557f97e84c1dcc853aad85ee0ca3c352c43c6f6c613c2a9cb077329c7e9ddaed
MD5 43c228aa5f88ca5be9944fe29357d5bd
SHA1 e3dc229b0c17eb19a40b3a0eec53be656e15ce86
SHA512 4a8fcd4d214ceb78f4ac6191681042209d682ff7b1698bc925ea447fbc4fe62caf49e936e82ba81014a14af8c0ad6ef2179b27a108a22aa0fd49fea4404ea60e
SSDEEP 384:nwiFiZcIs43sNf8TUNTUlI4ETWKMUmHmwzfvBCT40Hnz8mXm0/upa7dLKkdggL/f:LFQh3Wwg8e8hBCb4m20Sa7dLKkoY
TLSH
T164C24A76DCA4DEB7EDFA8F85B30A3A03DEE40163989C5AC4D9E94D0D109359D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.23.1\typosquatting_list.pb
Size 1.4MB
SHA256 8edde56330fcf8d3292ca20a8020c89e23f8835eb5c088e0f837300f1f81b6f1
MD5 ceea696b4fc3c8532f115da4fafd13c0
SHA1 025f9003c572e2cf3c01b1456c6b13789aebc57a
SHA512 57267a43a339f784bc9250bd8cccaf9af834b0cbb3f16768c8f5c3c9861a34755fab633545e06d0e4f843524b326cc3cc79f581b5c903f7866c9791b910b0388
SSDEEP 12288:sJH1o/AtTKm9uuIE8juZOnUniHSYKoDJcYz:3gKm938j+OnbSe
TLSH
T16265B5B9DFC00184DBB8112D20BE71D8181412A540E9DFEAFE7C859F2BC6AC977E45E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c392b8f5501d340a9eb60a6c79cb3eb3716446dcb9399fc2622a613ecc02e0aa
MD5 edb991d0885cf0222de58ac720b3acf2
SHA1 570b2fb7959c6cfde97f5c682c603572b36a0bb9
SHA512 28137f0800e48c5ea5fc11fe875abb5192acef3364b0bb4499caaf7d885f701d68c4ccdf622d470c85399a87542cac26963409f5f25fb0cec17c34f566d2e0a0
TLSH
T1E94140E05C3C5AD1D0BD0D7EB09B38EC94E89726F8A4347D289CEC988A7A60D704083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b596971031e9dbf42bd7aa0341482a73cab7485077d7c721b9b71fa4ae29f5e6
MD5 662a2fc950b0723d68a6a2cbb864cc93
SHA1 7bc735b7ff97be03421823a7907f306c856af325
SHA512 2721f0d687030ccd355d0cf730f5c67ce3578db491328521f5606c8620c3d8fd17f08a8f906fe98e0fd15c8c1f75e52b26a59d486d712c56d27bac680970faf8
TLSH
T140410FE05C3D5ED1D4BD0E6EB49725EC94EC9725F8A4347D2858E8988A7AA0A2140C3F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7220d3b48e2ffeb7034900d50a7c769f2aa5f90481c84dcb98053dd47b489cb4
MD5 877af39d1d933973af2d7a7925f33f2d
SHA1 c2f2702cbabc5b4af931d78ab4c626bddbfd1585
SHA512 a95c6620968c674ae212b03c96ab35820a65f8766ff907c8e0cf2a45580f09ab6e5e6d33b785e1902f75a01296972ccbab85ecd866eb0bb353d39168e8612a40
TLSH
T15B411FE05C3C5AD1D4BD0E7EB4AB39FC94E89725F8A4347D685CEC98867A61E204083F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b5fca94dd100cf7521975ba513d76bfb107a54f1dcaa5c923d088ce601cab27c
MD5 b0693a98e7205a0f753af3e3214f7791
SHA1 5189e73c699f32f8fde63e3a306b0e3e4c9e53e8
SHA512 6e3bd38b262833d8b2559dfe2e18cd94687e613ce13e1faf29015d7e3c1529b5af43488ed14d30fabd629840776c83a648a0fde13cad4e0c6fe46f6e29392111
TLSH
T11B41E758A6ED1148B3B36F56ABF6A86D487FBC372E56D59E10110D4F0A62F40C872733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2796-657-0x000001E4B25B0000-0x000001E4B35B0000-memory.dmp

Download

memory/3264-21-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-10-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-26-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-13-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-22-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-24-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-2-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-16-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-25-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-20-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-9-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-18-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-8-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-6-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-11-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-12-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-4-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-7-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-0-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-72-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-5-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-1-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-453-0x0000000000C40000-0x0000000000C41000-memory.dmp

Download

memory/3264-316-0x0000000007320000-0x000000000738F000-memory.dmp

Download

memory/3264-3-0x0000000007320000-0x000000000738F000-memory.dmp

Download