hxxps://www[.]mediafire[.]com/folder/m1eemggh77q1x/Mod_Pack

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/folder/m1eemggh77q1x/Mod_Pack
Sample260925-tdfe9azfle

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4804	msedge.exe
5248	chrome.exe
5964	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{BD016A34-AF96-4965-B317-ACFE732B6207}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5648	chrome.exe
5648	chrome.exe
4236	chrome.exe
4236	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 41 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe
4236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	5648	chrome.exe
Token: SeCreatePagefilePrivilege	5648	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe
Token: SeShutdownPrivilege	4236	chrome.exe
Token: SeCreatePagefilePrivilege	4236	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe
5648	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
672	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 1044	3400	msedge.exe	87
PID 3400 wrote to memory of 4804	3400	msedge.exe	88
PID 3400 wrote to memory of 4632	3400	msedge.exe	89
PID 3400 wrote to memory of 4632	3400	msedge.exe	89
PID 3400 wrote to memory of 4632	3400	msedge.exe	89
PID 3400 wrote to memory of 4304	3400	msedge.exe	90
PID 3400 wrote to memory of 4304	3400	msedge.exe	90
PID 3400 wrote to memory of 3140	3400	msedge.exe	91
PID 3400 wrote to memory of 1480	3400	msedge.exe	92
PID 3400 wrote to memory of 3140	3400	msedge.exe	91
PID 3400 wrote to memory of 3140	3400	msedge.exe	91
PID 3400 wrote to memory of 1480	3400	msedge.exe	92
PID 3400 wrote to memory of 1480	3400	msedge.exe	92
PID 3400 wrote to memory of 1060	3400	msedge.exe	94
PID 3400 wrote to memory of 3612	3400	msedge.exe	95
PID 3400 wrote to memory of 1060	3400	msedge.exe	94
PID 3400 wrote to memory of 1060	3400	msedge.exe	94
PID 3400 wrote to memory of 3612	3400	msedge.exe	95
PID 3400 wrote to memory of 3612	3400	msedge.exe	95
PID 3400 wrote to memory of 552	3400	msedge.exe	99
PID 3400 wrote to memory of 552	3400	msedge.exe	99
PID 3400 wrote to memory of 4716	3400	msedge.exe	100
PID 3400 wrote to memory of 4716	3400	msedge.exe	100
PID 3400 wrote to memory of 1068	3400	msedge.exe	101
PID 3400 wrote to memory of 1068	3400	msedge.exe	101
PID 3400 wrote to memory of 1068	3400	msedge.exe	101
PID 3400 wrote to memory of 3332	3400	msedge.exe	103
PID 3400 wrote to memory of 992	3400	msedge.exe	111
PID 3400 wrote to memory of 992	3400	msedge.exe	111
PID 3400 wrote to memory of 992	3400	msedge.exe	111
PID 3400 wrote to memory of 1772	3400	msedge.exe	112
PID 3400 wrote to memory of 1772	3400	msedge.exe	112
PID 3400 wrote to memory of 1772	3400	msedge.exe	112
PID 3400 wrote to memory of 2856	3400	msedge.exe	113
PID 3400 wrote to memory of 2856	3400	msedge.exe	113
PID 3400 wrote to memory of 2856	3400	msedge.exe	113
PID 3400 wrote to memory of 5524	3400	msedge.exe	116
PID 3400 wrote to memory of 5524	3400	msedge.exe	116
PID 3400 wrote to memory of 5524	3400	msedge.exe	116
PID 3400 wrote to memory of 5532	3400	msedge.exe	117
PID 3400 wrote to memory of 5532	3400	msedge.exe	117
PID 3400 wrote to memory of 5532	3400	msedge.exe	117
PID 3400 wrote to memory of 5676	3400	msedge.exe	118
PID 3400 wrote to memory of 5676	3400	msedge.exe	118
PID 3400 wrote to memory of 5676	3400	msedge.exe	118
PID 3400 wrote to memory of 5752	3400	msedge.exe	119
PID 3400 wrote to memory of 5752	3400	msedge.exe	119
PID 3400 wrote to memory of 5752	3400	msedge.exe	119
PID 3400 wrote to memory of 5764	3400	msedge.exe	120
PID 3400 wrote to memory of 5764	3400	msedge.exe	120
PID 3400 wrote to memory of 5764	3400	msedge.exe	120
PID 3400 wrote to memory of 5776	3400	msedge.exe	121
PID 3400 wrote to memory of 5776	3400	msedge.exe	121
PID 3400 wrote to memory of 5776	3400	msedge.exe	121
PID 3400 wrote to memory of 5208	3400	msedge.exe	122
PID 3400 wrote to memory of 5208	3400	msedge.exe	122
PID 3400 wrote to memory of 5208	3400	msedge.exe	122
PID 3400 wrote to memory of 5264	3400	msedge.exe	123
PID 3400 wrote to memory of 5272	3400	msedge.exe	124
PID 3400 wrote to memory of 5264	3400	msedge.exe	123
PID 3400 wrote to memory of 5272	3400	msedge.exe	124
PID 3400 wrote to memory of 5272	3400	msedge.exe	124
PID 3400 wrote to memory of 1280	3400	msedge.exe	125
PID 3400 wrote to memory of 3504	3400	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/folder/m1eemggh77q1x/Mod_Pack
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffed3dfc188,0x7ffed3dfc194,0x7ffed3dfc1a0
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,8277060679316990960,828607000679178071,524288 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,8586592250488244320,1942046436785579846,262144 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:2
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,2714225690741928565,15729093532841614490,524288 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,17596105574261995957,7790441851214218204,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,5543094375957787215,15553040926431746036,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,15622380407468109907,1933211019699291730,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,2262559627095692940,4981783611145856166,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,294317980649558910,5633669753450593375,524288 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,16256112779892041527,8378379373758709218,524288 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5948,i,9856282831606400856,4883601180433569882,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,872962876912812590,10596705123466696577,524288 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,872962876912812590,10596705123466696577,524288 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3920,i,5570157241795716642,5009023984634928104,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4140,i,4713194048347104973,6492936409813092339,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6620,i,5941207329646733425,8586160589504777765,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6784,i,16378780884030956949,4650827278929497773,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5628,i,7390539615237881024,9692298038492898632,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4348,i,2892635623465249332,6334260916582804018,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4428,i,1133662658847098185,6937771889014844825,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6848,i,8069437847542667080,16269218657144408476,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7100,i,3921706595340775508,1001641508966639662,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7340,i,17774506845978317120,16863428657651149003,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7612,i,10583905867081840763,4020713296388242561,524288 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:8
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7616,i,4349693167009342014,11761661408093217881,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7516,i,16166046881109346799,1976966985601371123,524288 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8044,i,7440908688446370356,1041047643519118309,2097152 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7664,i,15999683622583482625,10013355500488821359,524288 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,1361989213517800087,2743459248424763769,524288 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7292,i,14548391690086270076,13038654075464109872,524288 --field-trial-handle=2568,i,16882490637843733398,11325942448970529252,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:8
  2⤵
  PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffec6dac728,0x7ffec6dac734,0x7ffec6dac740
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,5064403430015384942,16107278371048754945,262144 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,6625808706416327654,13176262033063235931,524288 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,12203295536485936182,11085026891058687105,524288 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,18053725470556607434,3616455407795106619,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3380,i,2860397170066044973,3844268316060977190,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,3298329205198669859,9361290062581794692,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4780,i,7613409981754550577,8084288954704637740,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,15352963691877660023,1950996476572794638,524288 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5768,i,4178598528120005089,1067642586082209156,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3244,i,12632860468339683145,7248684048446210769,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3224,i,15864244587951225202,16236455835624732351,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4652,i,3770307684050513505,12471372507356235338,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3120,i,12509023955142140427,9924493122906103507,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6072,i,5106883201304601803,7982743446506865103,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6236,i,14002051480459949279,5355090558249873436,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6328,i,5705176651438635673,6534849129804231922,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6312,i,16174550715145650073,3831169324037825069,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6500,i,13673994857654131633,16549166468971828007,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6892,i,9032368885775402118,5871678848313944117,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7008,i,13001115686135763028,5803281953794790088,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7180,i,6683891914277212029,937959960502659837,524288 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7176 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7316,i,15495726106490934223,18071872042218652868,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6776,i,7802873817971928231,10745750163891449506,2097152 --field-trial-handle=1904,i,274998965385883225,14248116423108299625,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:5092

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4976

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2396

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec6dac728,0x7ffec6dac734,0x7ffec6dac740
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,15587402841946584107,16818246529655814831,262144 --field-trial-handle=1992,i,9782207820603732417,12763302765534904464,262144 --variations-seed-version=20260925-010032.572000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2052,i,2474849639514516880,2198738613108488583,524288 --field-trial-handle=1992,i,9782207820603732417,12763302765534904464,262144 --variations-seed-version=20260925-010032.572000-production --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,8828159711483688514,11860941844648164441,524288 --field-trial-handle=1992,i,9782207820603732417,12763302765534904464,262144 --variations-seed-version=20260925-010032.572000-production --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,2323985918670660291,13688246945917028876,2097152 --field-trial-handle=1992,i,9782207820603732417,12763302765534904464,262144 --variations-seed-version=20260925-010032.572000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,1977909182954090207,1392496714931296384,2097152 --field-trial-handle=1992,i,9782207820603732417,12763302765534904464,262144 --variations-seed-version=20260925-010032.572000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4496,i,5972874249766508467,10916636775004666358,2097152 --field-trial-handle=1992,i,9782207820603732417,12763302765534904464,262144 --variations-seed-version=20260925-010032.572000-production --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,597718749851697600,7801233483090832228,2097152 --field-trial-handle=1992,i,9782207820603732417,12763302765534904464,262144 --variations-seed-version=20260925-010032.572000-production --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,7050007518614167502,16259042799025567901,524288 --field-trial-handle=1992,i,9782207820603732417,12763302765534904464,262144 --variations-seed-version=20260925-010032.572000-production --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,14146468266029954187,4077410573784849716,524288 --field-trial-handle=1992,i,9782207820603732417,12763302765534904464,262144 --variations-seed-version=20260925-010032.572000-production --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3468,i,13749040320081191197,13194366526683336689,524288 --field-trial-handle=1992,i,9782207820603732417,12763302765534904464,262144 --variations-seed-version=20260925-010032.572000-production --mojo-platform-channel-handle=3984 /prefetch:8
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,169422217800313366,13878635128030466362,524288 --field-trial-handle=1992,i,9782207820603732417,12763302765534904464,262144 --variations-seed-version=20260925-010032.572000-production --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3372,i,6310557895449404618,16062906038377771336,2097152 --field-trial-handle=1992,i,9782207820603732417,12763302765534904464,262144 --variations-seed-version=20260925-010032.572000-production --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5428,i,18126648809743793097,7627846568086050419,2097152 --field-trial-handle=1992,i,9782207820603732417,12763302765534904464,262144 --variations-seed-version=20260925-010032.572000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:6128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 84e6fd027ea8e630687c4c70bb82f9993501345987298d008342ed16c054e189
MD5 b5895b80e7b4ec0bb8ce6ce0ed94f3dd
SHA1 e30684cd30b0cb2fbadb4f33700176e6fab77891
SHA512 7c99eacfe79e250ff4709334c7bb377f65291285b37c43c38e01f4fc82527726ee313e66efefa9ac1c34bb21eb29386a5d07369c031cad2b1786f544460e257b
MD5 SHA1 SHA512

Submit Download

84f2a2d0-a307-4294-bc5f-4dcd2e5ac280.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\84f2a2d0-a307-4294-bc5f-4dcd2e5ac280.tmp
Size 12KB
SHA256 95bac159eb04eaf19aa43f20b318650748a6d2e87e38174ae8604e9aeb268c23
MD5 11755a5dedd5cca2bf995475f02d8c6c
SHA1 cefc0404b6eba2fc2a38c80d2f74acb8738c86d9
SHA512 1d20824e9ee948d145dbd5f948accebdd245b7af68bd550918dd916b456a5231a4f21bf13bc3c1c4481be284e3e76d333bf1b65bfca94c5a3c82d6a3a0bf5581
SSDEEP 192:qR/AJMQVNLv7D0shAPRp2SW9+Hsb+WNnFCj872hk2FecpR1R+VyIsnAUgtaJ:qR/AJtzvj8XKUwQA2W2dL28
TLSH
T12B42A46DAE24753B4CDBC219F9627B57E3F5102620D12E84EBF98A3C24D79CC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 82fcd115f47fcc02acfb04a78c12780d182368ac643d99053d819eb180561579
MD5 e059ae5ea7d1c9e550af63e5716af711
SHA1 fa04da1a7d75f0cdb637675a3fee9afd23b77997
SHA512 19e1a192424d9a260be2cdd6d228ca6601f3532478236ec844b7cec40f46f2335da5853b14be515b79cd2b11b6c481fc36aea267c33bf5410cc7612d8c153f1a
TLSH
T183F0F4E9CD21FC3B18FD5B2920640B4AE780135B2680895F3A3D911D8FB063B898696C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00003e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003e
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d6338afd39bcd311d79fd4f8fe036bc25548fe757b84ffe75d368a2950926c71
MD5 5e8a5ecced1d6275203b8346d8415621
SHA1 686eb2678ef6011d2cc32f630984fa2e6b2b4909
SHA512 e568adf29c60a3cbee7eb8c5fad2a4d030a455e4882ffec52cd23b7d66b84bcf5b455971129d7737a197fe66a4897e3cfcb540af54ca270d959c7fe58fa2d398
TLSH
T11851551290EC2D16EB15323125C6C8463D34060C6F637F32B8973CF59782BFD65BA954
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3a692b81921a94579cc67ed17e1c96182e6a35c520862a017c6eeac4e0049b72
MD5 9ae331a7cd99f7fe0f08793606804219
SHA1 27f2694e201efa6b643e73a9188c05e05b120ef0
SHA512 9c0f2404ea389cfbd42109851a786e7a50fc06b988e411c4e504db8754983977729c4b59c8cc6acb387ad0f9286694ae5b099f51697fa50391d4145ad270c508
TLSH
T1D0415412A0EC2D16EB15723025CAC8463D34060C6F637F3678973CF19742BFD65BA968
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 29KB
SHA256 c4b3ebb19bf07bbfcde921d004ecce03a3917799f69666ca322bbbcf7f807100
MD5 3667c7b404706c68d2373b6529191192
SHA1 eab16be5bfabb4b25467c4ba16451474b2f41148
SHA512 ec44f44dd9edbee010104d6288e0d1c6096012952a73b42d3391e8354b49048a3ebc704075db722a3838379f07e0d1dc036da49afb523c36866bb5b49e68e76d
SSDEEP 384:D987YExavOGVwaFVeVIEOeFbNevEbW5XTBeS5juWE3Pfxyy4IKYO420JoYKqa9LQ:ZWQRvoyDa5Tubcss/Xchzpb2v
TLSH
T119D279F383E5D52E89115AF897146E1BCF1C0729432C3C2689D5EE4BE3E2472E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 e52bddfcedd99f6aae950bae001be6562bbf85da1622d7f7df89633301f42382
MD5 b4da7f1a4d9778f312a468f46b667da2
SHA1 1b7fb3099ac5645a5f9365faf03a3ae7e8ad378d
SHA512 4a75fd9969e15a33a9ddd493e7aac3a4d6a1ab31304f88a92509f0992d2f71f3fdbd0dfd2812e57ff482ed37b88b3cc1528731384ed22773ec3884c2d9485614
SSDEEP 96:BUsU/AUsUgU4ieUdsUdaeUMbU2NPU6EU35UNUXUGvUgUFUBU7IU3HjU7U1U4uUMQ:BUsU/AUsUgUgUdsUnUgUGUVUJUNUXUGO
TLSH
T171916897877FBC27143D4C6B1E647815ADF9A836025274F8DAA7C27CB088CF32A47426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b7a1f3e3421fc73a6d28d9a2399ba8fa941dde33f7315f0a52b648fb4a24e253
MD5 938b52758b602bd1f23448d027586385
SHA1 e5d6c09ff7fc0252e530f4fd037b738a33a4e144
SHA512 f5d41ec008c4d77b12f77ed84b8e5e22460ef7dd0e656d8e7c5be84f0775460cabba0ee5c20cf71eac7a25456b148344c9606580bf6561f20a89195d931b84aa
SSDEEP 192:lR/wcBzZMQVLcv7D0sVAPRp2HS59PDyC9+Hsb+WNcgpPSYnB6pA08727k2FecpRZ:lR/wmzZrIvjgX9Uw1OAv2o2dDUe
TLSH
T10D62A65EAD24367B5CDBC219F912BB5BE3F5102620D11D84EBF98A3C24D79DC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4ab42a5e8b0d3b7d373a6de0d9a4d5dbccc495fbaa0329b7e7a79011be9da15c
MD5 e4d25cd1f67d1282039bc57d2b579be4
SHA1 685ef9fbfb0ff32fffe507c091794563c8fe798a
SHA512 d06492df805f07931c6259c4bfbdeb3a64cd5989a09f6e39722cc2ae9cb06cdb2cc58886f208520a68f014d0c33d8d91758686beba4f1ed190bc7fbd701a9de0
SSDEEP 192:qR/YZMQVNLv7D0shAPRp2H9CDyC9+Hsb+WNcgpPSFCj8726k2FecpR1RhPyIsnA4:qR/YZtzvj8XPUwRA2X2dL18
TLSH
T1D552A55EAE24797B4CEBC219F9127B5BE3F5102620D12D84EBF98A3C24D7ADC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8479e5df35e0017c60331fe4c7d5dd670906bac61fb4f8c6e2b7aa23b7ce716d
MD5 4a32f5f1a0a70e0ac56fa586b243c930
SHA1 f85140176640d9303b3c40a619922b25a407721f
SHA512 b1521758e4a3fd301b883705d04171c453f77d7db0e659e7f6d0c16aacb9a2103a1ee43cb2ef127d2622ce4b1212b36e9109ed36a8321e566c6194d6a3cfda2b
SSDEEP 192:lR/YZMQVLcv7D0sVAPRp2HSC9DDyC9+Hsb+WNcgpPSYnB4v98721k2FecpR1RQVY:lR/YZrIvjgX8Uw1Gi2q2dLU8
TLSH
T19062945EAD24757B4CEBC219F912BB5BE3F5102620D12D84EBF98A2C24D7ACC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 d6ef7be1fdf322a98e133d0f16a9689d7b7e779ed80b3b246f7f0abd127671a4
MD5 f47488285ba0b5fb4fc947c0cd4d65d0
SHA1 e2e420ed69ab302b7e65f41cd50c711369a8f339
SHA512 edefbf73c6e7d3b427d1f6fbef00c51ead37774dc83bc59794179b134a29fdd70c2466f4f32c36956cac1428a67c415f0977c6e87ea2e96365244a4ec6f04337
SSDEEP 384:FE3cjxE397KxkXqKf/pUZNCgVLH2HfgslaW7pLuLceSHE31XODxE3d+ErU3jcHGz:FE3wxE397KxkXqKf/pUZNCgVLH2Hfgsn
TLSH
T18A7209677C4C9A3B0F94C9CCDC277A4FEDB9024B65D9886482FA982503D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 4e1ca75f7bf7fc872893b334e14fe25d096683707b44b67eca9ffd6289eddf22
MD5 70868b79bdf3fcf64907725e3f593221
SHA1 92592b45267e7beac40745c4ad09239b3f47436f
SHA512 6b566f62fa8e30e3367ea7a9af7adeb06361be6f4bab594439aa9d4954a75f11017fd601cd197b236c2a56d19a9f05c2f502122c04b872fa050bddfcd61b1428
SSDEEP 96:F1mKyAMkRwcnDh1J1bHXg9LXbXFXKXTfFXiXTjv6xhXsX3Sz0XbXNXKXT+uZXBXG:F13q3mDh9D0L1aj9Sjjiz8H3L9ajxxjC
TLSH
T112A1AA6E6909184FE4A9493BCD79571B6FADCB0C27FE3767A8DE8A0405B066701086E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 04126a9a04a20201014625799f64b32b0a224c147a541f40a255dfdaffa51c73
MD5 4d3fb1e7ee5c7d9fdfb10360345bda2b
SHA1 ac67511567cb27ee8cb8265436110574a3320461
SHA512 93002de701df6972aeb8bf58ffb024ee3b32c27cde1125f997f8caa9d870564a780bfeb4debf5d4c470583abe92b27b47c6841d272f3b4951605905135ed8d4e
TLSH
T1BCE07D04A9CAC1BD1256804B0228AF4D97E47605D2CD3F4F2F03E48411C5828FBD2649
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b451a5fff7db32bb6cf132c0a34a9b2c9416e85f3e6bce6397b3d43db91e1ade
MD5 65ca80711632b9d46215b676ca2d61fa
SHA1 7c34c5b02ff012825f9a356d77883829d82c82e2
SHA512 327aedaf148acc2b5316dcf86229a0d31541eb84a07f0e38b1e87695dfa969c55eb74a695a6a79fc6c0ee08cdfae342f90f281e8c4f905b41700277fb7fcbebc
TLSH
T115B02200C002B302C30283B0228882C83223CF2CC303A302C2E00A22CC282B20020030
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7385666296a172afb96968d27a409ce0427d9461844061da0a0cf7f7fdf69d05
MD5 df15d0852aaca23fc577a32b87c26bc9
SHA1 1198a5fdbf54bd318d8b2c287662783b69eaa7ae
SHA512 7091f1cad89b8efd608ab4b4502762585a7116f0de7069fe0bd02f85bdb762ab442b8ffe44dd14426cdbaf727bd488c6ebfa35f398315f1ad1b71afd63a3005b
TLSH
T166B02415C4433710C00503711111D0D43750CF3CF51113CDC5F00D41DC33074401711C
MD5 SHA1 SHA512 TLSH

Submit Download

5d9ae06ab5a1b128_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\5d9ae06ab5a1b128_0
Size 64KB
SHA256 691a9a0481ac061dc68a7e0e0484bfd5ec17bcb8a4c056b14ef067acd270cf6e
MD5 4b95a2ccf3011fd4d98279a6cafc6410
SHA1 2612159ae4ee223d7941559666e30658ce8345bf
SHA512 2bbe4afa10689935edc9a0d35ca820381ea195b56f18df118097f01f8449d15df9cdbc6d0c08c25a4dc9f381c173f3fda25ac904e47b6eb3797c862b2352caaa
SSDEEP 1536:DvS8fe5uWXSUiJCQpygYh9kN2oPipx0TrpmVniUPQ:2uHESppJYHkPi0pzU
TLSH
T124536BD93731B4B383BB61F1506F120B713EE567B404C4A4B198ECE55A54B6602BBFAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 0e98afd1ed72656248beed7cc65a37d1c325e7ac01295f9f880cf3cb74d5df3f
MD5 b18e0876b823e1072eda280b919bd7c4
SHA1 45c33610f440120cad1340193fc0cae5b3178ef5
SHA512 ce54f41838b746826cf430c14f6357437346f53234a8353cfce2e051fa384c2a380b2b102b009ff0507c181e55127de3820ce4e78125e8383aec64c6f6a989f7
TLSH
T199A002262FA20800C14509B4208557841300C8245945832745A4154CDC585DCED45690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 63951f3d0c7aee5e386c31a9c803a5bee75065f250a9281f641c957d8af50726
MD5 bf2c539d4f71b58c586be99b95bab748
SHA1 200307398432ebf451a8703c4f506307d1f95435
SHA512 c579efd107a7dc0c348fbda84703bdb1e8a433a8a0054ad23b8114d99ae3d9195e6fdded59f34d1436513ebadefe5da4e5a09ca06c8df9c2c553fed43bcb9438
TLSH
T1A2E026746ACEC37D0340C0834368BB9E8BF07A0493CE3B8B47056044E180014A1A1A88
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 4196a2cf25b05fefd7321f714ca0f000607c285813415b55e1fb69c2711c94cf
MD5 88f4d4d27f631137e82f70d559ae21b3
SHA1 1b24bd9f3a1e220f108b86c79caaf98a29069381
SHA512 2134243d211c62ed527100281b29e2b3b0558a7edf92022f4fda97051a414fe738f077c109e32742706608353c024ce38d03dbe76f132b244a723475d697d78a
SSDEEP 6144:0tEVjEfT5CCL9A7taB1o3wxluaQpp310nSy+hFD+7t56OD9ZfSAppr8/:vNEVLBARaBWeOh+SyyFSXD9ZfS4+/
TLSH
T1C7442262ED41FCB788BD5440714BAA158EA3E8F841DF714A4452AECBE5BBD850B33837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 9f1fb8ce781e2390d570d2b8841595aa4a926b9eacc92702fec34e9fac0dce68
MD5 902bb60743fed27cac47520e021aed2a
SHA1 0e95ebee2f92198b2d199488f526ba04a343b20f
SHA512 e2db6b3f2a92bdfa155b82aa6c2b668477559e312b208b633fe1142c6a29d9308c4f3349d0889669c7619639ff788b63de4b53676e5754a645ee370a45c2cc7f
SSDEEP 3072:SCEEV5iwT4eAag5CCmJ89A7tNABEco3gNVxlczaQ1RYIzpcYV1NCn8Ze:StEVjEfT5CCL9A7taB1o3wxluaQpp31G
TLSH
T1A1D31392EC45FC6614AE4464390A2C2B4FA7E03484DB60D59AE2AED77EF3ED10F27435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 ef7dfb263d807c78e099c307939cd7e628583d036aaa20e7a4ad458badf32234
MD5 c50058eb49812484500788afcaa00ce6
SHA1 9caca3b358a30205d6ac919e90b3b69b923547ce
SHA512 6d724fd80e3dd27adc9584a9794191af44a8966cde43b4c154200b99ee4a38e3a626bff9139cefb9524641b45f0440476d4e1ff5ad7d50b9cb6788bca0a480af
SSDEEP 3072:zCEEV5iwT4eAag5CCmJ89A7tNABEco3gNVxlczaQ1RYIzpcYV1NCn8Ze:ztEVjEfT5CCL9A7taB1o3wxluaQpp31G
TLSH
T11CD31392EC45FC6614AE4464390A2C2B0FA7E03484CB60D59AE2AED77EF3ED10B27435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 18de238c454e6b67d91e3891cb5b86f03c7c33dfb129a18468acef54aeac6ca7
MD5 56332732ed1041be843026e8d9d522a0
SHA1 5c2bbf1a3659cf53a01a1857f100ef25052e0278
SHA512 31a1fa06a44a0cb50cceb78c4bb8b07667602accfbd583fbf67102b5a4be3f3a91854bc9e79ae554cf9b43f3d40d1aecf0e76c23af6755a8a14865e6db2ad8dc
SSDEEP 3072:k+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:k+hFD+7t56OD9ZfSAppry
TLSH
T114D31232AA51D8BBC9BC6541B157A304DE666CED41EE7A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 6d9fdbc5fd74b37cccf9666270da50a3c00bd2b7d02f7c984bc24a43b008bb35
MD5 0e4716e6e1559e1be123cc872983c8b5
SHA1 da8f9263afdacc31dd67fb82ec8ae81c3ac500a9
SHA512 598815d3840b6ce04fb029bb2cc8bea06a5440e57087e64c9f090013befb5988d189614912abc49e6dd7a16084634668cdffff9581571faff07fa17fbe709868
SSDEEP 6144:NtEVjEfT5CCL9A7taB1o3wxluaQpp310nSy+hFD+7t56OD9ZfSAppr8/:ENEVLBARaBWeOh+SyyFSXD9ZfS4+/
TLSH
T106442262ED41FCBB88BD5440714B6A158EA3E8F841DF314A4452AECBE1BBD850B33837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 eaf77fba1916c53d7bc8d6ff4afd888bce3a692c423c7a52e37bb30a95639de1
MD5 39a9f5810acb4c601a303a0eb20f25a4
SHA1 11651e570cbbcd4a67e04cc22f0c839d60ba63f9
SHA512 88c90a3c65a6e51ed85f05c710a88d348bfeae096c0d08297a503ff0cdd27145befe4e81cdc9ee5bc9cadb89f8b60fd0d92bbd811b6dd2c70bfa33d1f6aef909
SSDEEP 96:QUcfVsslNeqP1Ytpo5zSFfcLSzSFfcP++/4YVwtD8J:QUcdnlNjPmjhawt/NSxQ
TLSH
T12E23D94F2A5452FAC4FA1C3EECC34A607CBD5F44863BAC5201A104B64DD54E962EF8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cb0b2e7b2f05d775343f6d8358811aa49d866a633de80073ad625e169021a10
MD5 f075ad7186a1f6c200abd69ca7856c96
SHA1 9bc250f221c26c725e12199febb7a3a178070ec7
SHA512 52730b59c4a720a9d526482430c0b2af7e12cb71a526f9149bb1b7748ec8134b51426f9b1d414cc62a4ca0c89bb9b0344afb23b1313af6aaf8e1075ff2f08415
TLSH
T1D0D0C001ED689FF4E071183C0239800836CCB1424B023141D0A012578C24242106CCE4
MD5 SHA1 SHA512 TLSH

Submit Download

1aa2e77f-efec-4f72-ae8d-d26167d5af70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1aa2e77f-efec-4f72-ae8d-d26167d5af70.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 d5a2e67ccbe855f7a1897bed9efef2e50b4218799613aea646b74b8c0e9342de
MD5 824426e2ebcd4d14380925147b84b54d
SHA1 5083185e96786029e64956929825638901831e1f
SHA512 8921cf1432aeebf6904d640754acb4d2f7384c3b7132f7ce5ba767f738357d273fe777e87a7bbf9f1942bc3271992e29409268f207086b7e2b3642ca83fbe257
SSDEEP 96:qCmrDIuYtM+z1NoRvW5UKVOzA4Tkel6KlGCVEMjKU7V:0DI4a1y9nA44e0OVEC3V
TLSH
T1C6B1535357EE0A8CFF49B13DE8E0194B3D77809C8BA31F45149AD5FA17327345A88876
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 27KB
SHA256 605fc65b0a7371b01664924a6159f8cb42135cdbae9a5de4f9032d4c8c8f3194
MD5 c734977016994b9beb701227d499bd8d
SHA1 2af5053835400dd13c29a645736151fafdf0f2d6
SHA512 9c5dd88c47c7cce104d7e61f0e88f73cc4a1b19c81081127412bb2f3b682ae7e8ee93d653ead93f57465788dd7bc84925e3dd7fba63c01cf87a0ad74591f916c
SSDEEP 384:D12ThFFOWEqIJpSWSYM0X1SdeTCejurjXJat2FACGLMDe/2JUSXLYLhYNV49n0nL:niXoc9pAtB7zdIJQ1DyQc7F
TLSH
T187C269F783E5D52E89115BF95614AE1BCF1D0729832C3C2588D5EE87E3E2032E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 64b9cda0ae10dea1546e0870a402fd07671adbf2cb56b00edf2273e77b2f76be
MD5 fbabc5908da1369a15f4c566915f9f4d
SHA1 cd85956c31327a6331435847f65b4405289a2570
SHA512 232e784b779624540b9ae480913d41a9257928c1851433608cc2ca42aa8654183d9832cad9ba86269e6671080c7512307f0ca8d4fd1ef75aa12f9b2440918a27
SSDEEP 192:sxZBRtWL/f4snxBIIdp8pHW6+WNmyZ/YYB+eCIgrJ:sxZBSL/f4sf5UHbh/fe9
TLSH
T12A22B7566E38A57B8CCBD21DBB29BF13D6F9503261D51E58AAFC861C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6661ac6a7c621333819985e41c5d167f8540d83fabad16114f5f4212a25ba4f0
MD5 2f4bec9a26d9d8095f945a462faafc96
SHA1 8e77ce72161e8b050c650a0d4df5603bdcccd6fc
SHA512 ddd39e191060329a32ef3f089423a19585123feb85af362b04100f89b5565cdb920c3bdaeba12432d6af4de745297d572166c71b4cc5e5cd2f6311d141d347c5
SSDEEP 192:sxZBRaPL/f4subWpVUBBIdp0pCpuyJHW6+WNg5WtPfkXYwB8m1kIgbBJ:sxZBYL/f4s8WvkqrHbGXjUH
TLSH
T1F042B756AD34697B8CDBD21DFA15BF23E6F9143251D11E94AAFCCA1C04E67DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f911c389d1bff48dabdae952a2561e819e99c18839af071dabdf4a75c5f93220
MD5 c6a9190cfefcfc36a9f393d093a44d74
SHA1 2f94ab0c25159d66edbae600681f9f5ddc2e9dc7
SHA512 e8b97d795d10c017512cbb376bce617171cbc5c3ddb76fe1af3942a893f7a280d3ca6fbcfef89d570aefc2a023407db8c110fd03fff463b54c9f6293530b8ef1
SSDEEP 192:sxZBRtPL/f4su3BrIdp0pCpuyJHW6+WNgCtPfkXYYBieCIg5BJ:sxZBDL/f4sO0rHbeXfa9
TLSH
T12832B756AE38697B8CCBD21DBA15BF13E6F9503251D11E94EAFCCA1C04E67DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 68f50badd768faebc9d4f338ce0d2122eabd54a9cfd36ff6b00b9c154a3e5b00
MD5 4475992180265e85de01ccb072b427b9
SHA1 82a1addbb0606f9cc1d92d927c6175fa58357de8
SHA512 ef1ce81e6965686a7aa48235ead240ff046a597b0aec67661d9f4ea0b3ff24888ba6521ba1cd416d6ad364089af0e95799b9fbb7d63b30104fc8153b16d5d19a
SSDEEP 192:sxZBRtWL/f4suxBGIdp04NHW6+WNmfkXYYBheCIg5zJ:sxZBSL/f4sEnpHbpXfZ7
TLSH
T1D222C6566E38A97B8CCBD21DBA19BF53E5F9103291D41E54AAFC861C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3209adde21ef5cbd72e8da21ff2cae116a0599740666cd5ecb6bb6245cb1f0ce
MD5 b908a0923a1cd1de0ba24139c35b90d2
SHA1 a30a20f0d740c5b0a8b108a64afa7d419a92a02b
SHA512 becf2c7e5137889bce1aedecf26e99de8c50fb8b74e346844c7172c6bdd7d9fd44ef5e7db8f338c98ee90685b9de52bd78241ed7544a6b75e8ba2a9b26cc1851
SSDEEP 768:wRyYR7jWv3NRB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXDropXa7:wRyYR7jWv3NRBu1ja/CL8OXwm
TLSH
T1FEC2EA3B640DCB7E4FC01E9DDC5A6F9B3E9802C796548D4047FA994C02C77EAA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65bd0444254486b3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\65bd0444254486b3_0
Size 64KB
SHA256 63b091ac503687124271692cb7b13f4b6fe5913dce4b638b8c9c1825c182e738
MD5 dec52c5093e0934fb7e9d648281fa8e0
SHA1 52a67b54167931e8b5bcbc1572ee1e73c3419d34
SHA512 509032ec94f2226fd6f7d15b43d2f29d946a6666c41c715e06b27d77e8b30b7b7e4f4272c8bf40d11bf652ca5c855d7b19a65bbb4d828a561355d5c3cb262207
SSDEEP 1536:0vS8fe5uWXSUiJCQpygYh9kN2oPipx0TrpmVniUPQ:fuHESppJYHkPi0pzU
TLSH
T14D536BD93731B4B383BB60F1506F120B713EE567B404C4A4B198ECE15A54B6A02BBFAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 fc60095f8c28412582c233ece81994112ac2dd59a60f7bc2fb00bdb22147e9f6
MD5 2244818a748f2278176dbe6f0d3882e6
SHA1 48c33a7e91866aa9a33a43a622dc535ebeaaa6f0
SHA512 6c2e7d1967bf660583c30e512825b49f8dd9d816a7cc0f53c5b730518f06d0ede16b01ec420739a6a0b6e77c9a372f0d15ba32aafac1b8533421280cda964cb5
TLSH
T19BA002350B714206D1024BB0A2C303412716DD142641970364E185558D545F29D11044
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e24b89622dd57742d595628788822d223577a91a48e88e6f24f7238a29c5baba
MD5 9b6d244139aac117c4a0e238996c1dfa
SHA1 3218c0bab902b85b8dfd9f2db1d88478b4d1d2d3
SHA512 3750bd002f4b2216e8e1121f54ae4a3f7082ac76567149dfc949b11d36bda0a70d19fa1097742f9494ef73f1a5589b2b52be22a7352c8a8a042823b13dcc796c
SSDEEP 48:Kg6lI064I5bkjUISs5K9Q1K5xipYb8IKyLdcRtfLPwbD2jISlwK9l1Hwx1gYmnX6:KsZmKKkaKGkKDSwlmK+cq7
TLSH
T10491471172BB0600397E248892F08B2F12413577355DEB2BBFBC50A1CE6AE195DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 a75987f1ddece2c95863e8772606e8fd83ab130316f0be7e3b26f4cce0086c39
MD5 80f3de8cb8bfdc7c5684e5239abde208
SHA1 637dca3af667165b67d034e075ef753362eb31cd
SHA512 c9f2b9e4afdd212e161e40146e197e4cd09ffa0f83642defed7ef50b15b217fec23900add9ad2468b3677e443055e1ac5e3383933a0a6f49132fa308ad638fba
SSDEEP 384:4ZcIesNI9aeixCuBQX5+DtP8gXB0k1v4AiBpMdscMKwIr+ZtgOIwZOyujoi:GegeTu2kDlB0aPi3BKwIr+ZXsLh
TLSH
T169B23976D8E45CFB18EAE0C46546E213AEB81137D28C5A4C96FCBB3D309F5B81316926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b0caf97135619522948f5f9c58076106d9164a3b605c2590fb41db3d93a292d5
MD5 cbb9281dfa3747ded16895560dd7419e
SHA1 1c5003ee4eb17d00442dc9075783d76b3a5bfc53
SHA512 708464ed9d3bf881f8c6b6e9041b6c01d500016d6e2a0f7b694b0fa6cd9eb0f4cfad1e0df1178136eb173f8bf23788c5ddc8df88877d839dfa61d3e06292d723
SSDEEP 384:AZcIesN+0aeiL3uBQX5+DtP8gXUt6stgOIwZOyujoi:+eLeKu2kDlUt1XsLh
TLSH
T1BE828E369DB85C7B1DFBE148B04B32139FB85067D5C86B80D5EC5F2D01D96A8130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ae85d201c59998e9d8642029497bd0b89c38fcc54b5399d128b09b81efa589fb
MD5 b997f83edbc2b67cf77d2ca10fda42a5
SHA1 ec909b4eefe1a94b2c8841a5f4d8d673cfe0559d
SHA512 3b38437510b0ef1ff0cf418e0684050976c0109d2364a385e7e343f1d4a5222cf3eae0a22786790f730471ced59ee50978d1acf52366edf34c9d32ce9e69349e
SSDEEP 384:AZcIhsN+yaeiedFQX5+DtP8gXUt6stgOIwZOyujoi:+hFejikDlUt1XsLh
TLSH
T175829E369DB45C7B1DFBE148B08B32139FB85067D5C86B80D6EC5F1C01D96A9030AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 78f38b18406e84b68f9d966c2b6224bd29a81b42fcf3523d3b4caaf06a00431b
MD5 d2224318edc9628cde5d5cc6a93bcff3
SHA1 86dc44befb4d3355b095d9832e7ad28132843535
SHA512 3678f7e3e88f9741165a0557a61199f83a836417c26571e9e5e695323471c3cb4431012fd36d4c3a7c06c779a0428da357161afcb2965fa092dd5344e503e06b
SSDEEP 192:EONf6nnHHQmiUytO3YcX5hQDP1njzorBRcX1ewg3fr/56sU6:EONf6nJF3NX5+DtP8gXKt6sU6
TLSH
T181120C36F8B8AC7B5EE3A99570873123AEA51157E6897F80D6EC1F1C01DE65C1309D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 607787590bb18ecac3cfaed5599285cc58e154e0ab868dd103a837f5d0f37fc4
MD5 7bba1608be40c7d4a8b0ca326b57df5c
SHA1 09bd7d347ecc2c6d93cadc81fd139229cd021946
SHA512 b5bb941e8b414c530d915feaa38cdea91aa01cd582b0c9eb8f711ca0c0c6f0742efd1398f9d08c49397355a020aaf384a73396e20871fb7700f4d37109a9c580
SSDEEP 384:bZcIesN+ZaeixLuBQX5+DtP8gXBt6stgOIwZOyujoi:DeCe8u2kDlBt1XsLh
TLSH
T19E828E369DB85C7B5DFBE148B04B32139FB85067D6C86B80D6EC5F1D01DA6A8130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 96bddb3deadf507c07e0a99e8f259dc4fe2bbae90781270c7d42f663313dbcb4
MD5 3ab8044fdad3f98969dc88e83b58f0c4
SHA1 589a2ec44d7ed299e00f049b879b136f1c648f43
SHA512 de4f32c85d09596b1fda3ce5bc5b72f38b6b8c937fa8ddd21f9f85fd5f8ba0e7d65592510d90e0b82d41c8a73756c4b0c0d7fdb2fff78a6024c00a66159c54f6
SSDEEP 192:EONX6nnHGQmiUy0OQYcX5hQDP1njzorBRGMcoUU6:EONX6nC6QNX5+DtP8yVU6
TLSH
T1D602EB35BCA86C7B8AF3AE45B4463613AFA4202BA5956B80DBE81F1D00D765C1306933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1e3b5af28bd04569cb4488b275de8da84c3a2c9d9dc6f8ab37a8e01819a201c6
MD5 98883619c0c64c058a4f9213c9e0eb6c
SHA1 84ce537aab066518a228f5de232b39d12b54c128
SHA512 330b7c76b97bad9cbf7b1fd30479a2464d93823e870f5feb419e7b6d8937e67c2c07543eaeef4fa913df3e20fe368cd9a36573deb32ac2ebeaf0378f11a17a9b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5939a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5939a4.TMP
Size 392B
SHA256 05b67aa91ab2c56b14db1f783be06821e6bb7d05e97070426ab2f72eb68bf2ad
MD5 9009d6ba1f8f37cecdbe1abb63872e19
SHA1 e51cb077a5b00b516b72fc4190db071bcf0b19c6
SHA512 79dc1a01863520166c53fb7422b1a004c417685ed79e221f443cfcd84df85c53d427e00bc9a96dda5b72790383bd065741f7cf27c103dc1706c4e20699aeb1e3
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 3e1329584d127a0e735f0bb0c5ae25f57f7b72799d8c7805ef92362b8798c804
MD5 2ccca44fb9c29fca74bf24c10aaecd0f
SHA1 f1885c2f7f3d0bca28e1244cbb0ec10ecc611afc
SHA512 dd5a7812f28d0ee1f91ac57b824a17c84cdf81e018c252a47688474c9c4d058013829cfb8c6a99e8c56810de48a75bbbcee68f0e63dc7fcba6f0e713542a0bfd
SSDEEP 3:MsEllllkEthXllkl2zEklh2:/M/xT02znh
TLSH
T15444040C7FC4050DCD0070314011C35003F4D41407115753345104535DC5F400C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e98f45f15816ac896f16da25cc94e414e68c900743c7659219fb539d7c242ad3
MD5 4b83785620fab8a5487574eac69a4427
SHA1 d4656993ae7581ba1215ae4d72a8fa1f79a18aa7
SHA512 d7a96846a18753abc008d37bca42f88aac44e80f5bcbc29483e256bf55e184b5e79f41a0a443226673cdd7d61d1dc177904e3cbbfbd3fb770978355cf57aa64b
TLSH
T1C9413858A7E90148B7B36E5AAFF6E86D487FB8772E06D45D10110E4E4672B01DC61733
MD5 SHA1 SHA512 TLSH

Submit Download