be85f81c938a39d1fa5122d4e68e700be6f8216a34d7cfcedee071e4a587cd4e

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ChatGPT Image 25 maj 2026 13_33_52.png
Size 2.3MB
Sample260930-ndcfpszzcw
SHA256 be85f81c938a39d1fa5122d4e68e700be6f8216a34d7cfcedee071e4a587cd4e
MD5 73476f7c5294bfb05b7ff904f9d23983
SHA1 882abbec2aae3a47de70812c9efac9e56998b49d
SHA512 3efbd24486c682f705a89af766c856a03cbb3a470c6277146b9415fa148893c5ce7d80aaacfa2a0c648318323b981bd948f550b72d94d8f935b405c881e021d7
SSDEEP 24576:RrBZLWv+UqxKluVKloQ7h9gOG9IxITlt/YNKe1Ax94N24xcMuxkElTuIMF8wNMmv:Yv/VR2Q1ITz/qKW2PvxkE8p+zJ91o9B
TLSH
T1ECB533CB3463BB5EEC407CF5A06018A07FAAE74624DE4DB4D5725730788C928D3B5EA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2676	chrome.exe
5808	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1252	mspaint.exe
1252	mspaint.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
4912	chrome.exe
4912	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
5384	msedge.exe
2464	chrome.exe
2464	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1252	mspaint.exe
1252	mspaint.exe
1252	mspaint.exe
1252	mspaint.exe
4964	OpenWith.exe
5248	OpenWith.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 5056	2464	chrome.exe	107
PID 2464 wrote to memory of 2676	2464	chrome.exe	108
PID 2464 wrote to memory of 1592	2464	chrome.exe	109
PID 2464 wrote to memory of 2680	2464	chrome.exe	110
PID 2464 wrote to memory of 1592	2464	chrome.exe	109
PID 2464 wrote to memory of 2680	2464	chrome.exe	110
PID 2464 wrote to memory of 4988	2464	chrome.exe	112
PID 2464 wrote to memory of 4536	2464	chrome.exe	113
PID 2464 wrote to memory of 4988	2464	chrome.exe	112
PID 2464 wrote to memory of 4536	2464	chrome.exe	113
PID 2464 wrote to memory of 3920	2464	chrome.exe	114
PID 2464 wrote to memory of 3920	2464	chrome.exe	114
PID 2464 wrote to memory of 4520	2464	chrome.exe	115
PID 2464 wrote to memory of 4520	2464	chrome.exe	115
PID 5360 wrote to memory of 5384	5360	msedge.exe	123
PID 5384 wrote to memory of 5484	5384	msedge.exe	125
PID 5384 wrote to memory of 5808	5384	msedge.exe	127
PID 5384 wrote to memory of 5816	5384	msedge.exe	128
PID 5384 wrote to memory of 5824	5384	msedge.exe	129
PID 5384 wrote to memory of 5816	5384	msedge.exe	128
PID 5384 wrote to memory of 5824	5384	msedge.exe	129
PID 5384 wrote to memory of 5824	5384	msedge.exe	129
PID 5384 wrote to memory of 5848	5384	msedge.exe	130
PID 5384 wrote to memory of 5848	5384	msedge.exe	130
PID 5384 wrote to memory of 5848	5384	msedge.exe	130
PID 2464 wrote to memory of 5804	2464	chrome.exe	131
PID 2464 wrote to memory of 1708	2464	chrome.exe	133
PID 2464 wrote to memory of 1708	2464	chrome.exe	133
PID 2464 wrote to memory of 5404	2464	chrome.exe	134
PID 2464 wrote to memory of 5404	2464	chrome.exe	134
PID 2464 wrote to memory of 5736	2464	chrome.exe	135
PID 2464 wrote to memory of 5736	2464	chrome.exe	135
PID 2464 wrote to memory of 4316	2464	chrome.exe	139
PID 2464 wrote to memory of 4188	2464	chrome.exe	140
PID 2464 wrote to memory of 4748	2464	chrome.exe	141
PID 2464 wrote to memory of 4912	2464	chrome.exe	146

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\ChatGPT Image 25 maj 2026 13_33_52.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffea164c728,0x7ffea164c734,0x7ffea164c740
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,14929719465352528327,9920238663503887075,524288 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2608 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,6093272777846403568,6622690723725066289,262144 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2472 /prefetch:2
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,14036851462212244988,12378631754649056205,524288 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,460391848539881874,5914593693005895423,2097152 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3484,i,1085680783721951352,10732617916418776571,2097152 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4576,i,16756949465912260516,927534897160272330,2097152 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4592 /prefetch:2
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4808,i,17348316402224264219,3057360496534286746,2097152 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,12255036138521128156,9349424469560809940,524288 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6108,i,15947838610064817973,8321732715054810857,2097152 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4812,i,6753474768475851354,12545791031726491211,2097152 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,7062590438045354391,8618940167396747467,524288 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3532,i,16186564398628685175,4009946527455660775,524288 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3628,i,11882955441845524658,2482390892436186120,524288 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,9399185019235682202,1956425422343538542,524288 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6104,i,6516858766169183008,1386056061859076768,262144 --field-trial-handle=2492,i,14942473828034620391,3343612284562764013,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Modifies registry class
PID:3100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4964

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault592f77afh1083h4cceha8bfh0f712caa8494
1⤵
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault592f77afh1083h4cceha8bfh0f712caa8494 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffe9c03c188,0x7ffe9c03c194,0x7ffe9c03c1a0
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,11577613468938647353,3270141725856842255,524288 --field-trial-handle=2488,i,10965392108915388536,18387636110538891762,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,8539563004885434868,17776705916363442585,524288 --field-trial-handle=2488,i,10965392108915388536,18387636110538891762,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,8044355326961104145,13424347279379302663,262144 --field-trial-handle=2488,i,10965392108915388536,18387636110538891762,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3252,i,10936084574585759199,1173473604708245759,2097152 --field-trial-handle=2488,i,10965392108915388536,18387636110538891762,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:2
    3⤵
    PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

85903e36-ed5b-4a13-b252-525bfbbc4df0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\85903e36-ed5b-4a13-b252-525bfbbc4df0.tmp
Size 17KB
SHA256 d6ef7be1fdf322a98e133d0f16a9689d7b7e779ed80b3b246f7f0abd127671a4
MD5 f47488285ba0b5fb4fc947c0cd4d65d0
SHA1 e2e420ed69ab302b7e65f41cd50c711369a8f339
SHA512 edefbf73c6e7d3b427d1f6fbef00c51ead37774dc83bc59794179b134a29fdd70c2466f4f32c36956cac1428a67c415f0977c6e87ea2e96365244a4ec6f04337
SSDEEP 384:FE3cjxE397KxkXqKf/pUZNCgVLH2HfgslaW7pLuLceSHE31XODxE3d+ErU3jcHGz:FE3wxE397KxkXqKf/pUZNCgVLH2Hfgsn
TLSH
T18A7209677C4C9A3B0F94C9CCDC277A4FEDB9024B65D9886482FA982503D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f6ebde221f670e8fe1e0a09157995734e169028ac841b0bb895344a7ebf4bd04
MD5 3aa78bd7365716a650387896333cb20f
SHA1 1bdd65ca6006a1d111f33de18ecb459db34e1c92
SHA512 b935f6f30fc286624740d0f22a2a55fcf07139d2046581460738a6f26b554c35adb77867730067e21759f9079f55b282ec7d8932f0b6d8cfa35b298847d5253f
TLSH
T1CEF028E5CD20FC3718FD1B6960640B47E750135B2B81895F3A3D921C8FB063B8A96C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0dc4e7cbb4be783541559d936311f20d5c065c0bce4320c3c19628c0e7b41faf
MD5 116fc290b995168c89fe9fb00e78da48
SHA1 efe28aa2877fd76a0dc22ae227eedf9c8c4bf97e
SHA512 78991463e027a9f035bc8f71505b91bc38376da101aa871579e9b8cb041cafc3f0bfdd3e00cc22c23876d8635494982c0160aa99aa5d9d12368a2824f5ee5b1e
TLSH
T1ED418121A45129B4DFA3CAFADDF61D26327129D604131E62DB518135BF3F7E2B0375A0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1b43c489c9493962c52d331e71efc5e885d0200893913cbd57992e95ef13205d
MD5 14346eb0096b52ab7922ae587b72f217
SHA1 958ed4a7a401538976f4e891c3b6238e6872967a
SHA512 8942430d39d362b7e6d147bec5362828ec209b2549cbafb1b0e730e69cd55d2c57a901a2bb1d19f54a698b6f5878d3f7f5b4df22183d3336a3163873968bae47
SSDEEP 48:YALlqfq+qIhSymswJCsRRswfoKsFXLsOgmzs84sXRfs14osT7mYssmVzsnmkJgmy:DexFfm9juDrBDD7mMmkmDmO+m2K
TLSH
T16D918EF7C3E8C66DC91156F4AA24AE2BCE2D0A14531C3C66C8D4AE5B93E2872D24135E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 92104d624ac3f50b7f1036912a460456fe22cdd0f4aa6feeeaecfb94cfac53bd
MD5 929d23a1ffb18c123db690f0b8885eee
SHA1 b134afa3dc38a2527d19c84e72d5a762ceee744f
SHA512 ebca8c788405d3e917989c4d18e6e1f6f8d0f3f99b86920f1ad7947cd45d6789b8a67a2259b37268b243860859162ea301de45d12aa420ade403448d6f2533de
SSDEEP 192:qRroZ6nL9Tvv7D0shAPRp2c8z9+Hsb+WNnyuvC2eWre726fc6VyIsnAUgraJ:qRroZUnvj8XCUwL7et22He
TLSH
T19C52E76DE810757B5CDBD22AFA227B17E3F1102560C02E88EAFC8A7C14E79CC6617817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c4c9498f6f49a527da23b0c36d86d2447320f31c676dbd4999602d1cc3a49864
MD5 fc96c596970896f99dd6e21bf22d5416
SHA1 e22bd3f13ea83c748b8282b1e90c4192e3d9ea80
SHA512 304aadcc58f271628787e23c8a9714d7803c84c3e9848cfb8f207f0493213d701bb561de3fb87a862ca6a697588834a0cd43d53b44097076252338415c8d0d16
SSDEEP 192:qRroZ6nL9Tov7D0shAPRp239+Hsb+WNnyu0Hre726fchVyIsnAUgtaJ:qRroZU0vj8XoUwL0O22W8
TLSH
T1FB42C62DED10757B5CDBC22AFA627B57D7F5102520802E84EAFC897C14E79CC662B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 489ec438252c981c74ca3b730db77b0753c00edf4529194225ef0252cb3be074
MD5 80988fac1b141c30327f2ef75ef74d1a
SHA1 b85feae47446e682198a448489d308264d72a639
SHA512 2ddc67f7a11dab1972a43e9116957f0b2d862f019a9892b92df0c320088ac4d7861112bc2330721b8b98c8546dbf952142d9df5042710efa7c038744fb9a4788
SSDEEP 192:qRroZ6nL9TCv7D0shhPRpBc8z9+Hsb+WNnyuvxZYxre726fceVyIsnAUgraJ:qRroZUOvjnXNUwLnYA22Ne
TLSH
T1DB52E76EE810797B5DDBC22AF9627B57E3F5102520D02E48EAFC8A7C14E75CC261B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b2f2059e423b9bee99df7da9c7b1c918143c1ecc6c7058f5f14d1a410c740c82
MD5 1badb89f08a0a9673b961f570f9181a2
SHA1 92f2dacdc6564c09ae2d01b92836211058647393
SHA512 124052a342f352d296507b558fe13b1cbc8b08051027273a27167c621e97fa69994f9d18f1e372f14c6c4ed6dcad118e095454436a221e0aa7bd6bc329b67413
TLSH
T1DBB0124680422301C00203B011E490783260CF39E61213C551E00E41D8361504017119
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a454.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a454.TMP
Size 96B
SHA256 a20e99a08d61ce51b6ae6f22439b5551671c0004b09b194eadeb1ff816bbbabf
MD5 39fe882cfdf2fce96fdd38d2457c130b
SHA1 6ec93cfa86fcf8defa2970cf03db03b0239e02ff
SHA512 e65ff8cfb69b2e6325925cd035e40a8c6f6cb5aa0e7448e8f1f4d459e05ad286ec5291e86ee849f44c009e1622a282cb9e5ac4999d99fa51bfd317b2adf1a8ca
TLSH
T1C8B01108C202A202C20203F0288288C8B0208F288302022282E30A22A8282220228020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 fd151ab76da9fc7a9a8c9325b6d24a7231f7580b39fd7d67a69efa6964e54266
MD5 f0b3d1cfa4b313625daa12b019b2317b
SHA1 29d37ac239b205d8867b585f1b69e261f2d47059
SHA512 40f6bbe97671a558bc5357f5e2c49b1447337e54f26e3bb55cc0510a41269bdc9a2676c1defd78acc3793ee02527c260ee5d739d047c41ee2bace8f45efbc864
SSDEEP 6144:UTN8F25vAVpl2Pw2DAWnf+hFD+7t56OD9ZfSAppr8RK:UTN8QoVpl2FnfyFSXD9ZfS4+RK
TLSH
T15F442362FE49DE7F4878627470ABE308CEB1259584DE636940D75E8D514FAC81B33E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 4dfc4749d8523ec7ddb8913684f0605def8c7d650b6616fadf05ac1967f87e7d
MD5 50ebacb9f99a9dcb7a4bfb0a528272ee
SHA1 329d2be31f8977a1f65f363ff036746b58eb4257
SHA512 945e01eb99583d1caa8870df7a15e10cd84ccc6509f4837910c36bd0f4cf2d9573826ade0ba1e52bb0b6662bb4498127a9a274148fc34f9ccf570a2cbda96dac
SSDEEP 3072:T+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:T+hFD+7t56OD9ZfSAppry
TLSH
T143D31232AA91D8BBC9BC6541B157A304CE666CED41EE7A09444A5FCEE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 6e8205d691b2d8bdeb91e3cc2165ac4f195199351b6fa90db400223e5f95bfc9
MD5 4643a7422722f1a0536161802843fa7b
SHA1 64bc8700de236d060594db69e899076d1dc81953
SHA512 41cf49920b24553fa63c2cc5fecae865e0b2b06e2b6e4b69dc0eb1aaa5755f59687421ccd840f14370ac24649ce9eb0d5068538aaad35fcf79ea93fcaa4caaae
SSDEEP 6144:HTN8F25vAVpl2Pw2DAWnf+hFD+7t56OD9ZfSAppr8RK:HTN8QoVpl2FnfyFSXD9ZfS4+RK
TLSH
T18C442362FE49DE7F4878627470ABE308CEB1259584DE636540D75E8D514FAC81B33E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 54b28c11cb921adb25cdc5b0166fdc694df6227eb1a243e362680f2cdf04db3c
MD5 d261326ec7450bba087e96c5ab2f574c
SHA1 f2d9411a0759ae44dc91eff47482172a3972d3c4
SHA512 c99aa30e53be7edc77a395de52f0de27028b79e3e58e3406ac042ec4766de4c181b5f61e4be0a79c6430ff0b66beecc35e279bb675b9e5ec06b64d6237046da6
SSDEEP 6144:KUTN8F25vAVpl2Pw2DAWnf+hFD+7t56OD9ZfSAppr8RK:rTN8QoVpl2FnfyFSXD9ZfS4+RK
TLSH
T1DA442372FE49DE7F48B866387067B3088EF16696C4DD626940DB6E8D514FA880E33D31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a1485be6dbc187ef60f02ebb93408e67f78af725726fb053087ad1ccfc30d5c0
MD5 fca914d0bf4577c759a7b5a8ec7f0a1e
SHA1 c842b2c44a133205ab0b863af14791cb7db3787a
SHA512 50f04c1a9bd0b72f75c85b5a663a1da4c761ce4deb4ee0d33a7c238d5a49660af4fcd1d782f734db207ab092f248481da483bc19b94d3ff9c89cd03184509648
SSDEEP 96:sa2YWfiEDW3DU6mUscgUb91XCtdHW+i046W6hfuH9EOx+WVoMfm+uecpYQjaiQ67:sx9fu3DUUsFqy3rpMHW6+WNGYoTxhgOJ
TLSH
T10CF1B792AE24757B4CCBE11DBB657B53E2F6502225C51A48EAFCDA5C049B6CD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 e26b0691cccac3e979a479df515f4924e6f32e59d223f3969292927c093883b6
MD5 a3bccc7848c191a673eaa7945cc57512
SHA1 9f35d8ef8b9d5de8dc19eeb09ada6b24462c4a1d
SHA512 07c1e4312f6ca4ee48c90319b55680810cc56e093dcbff3a6469aa238e0d2d5abcbef9e16f2fd72b8fec182a300499e7f7bb371884ffa6d35aa8b00bbcb26eae
SSDEEP 768:dOyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXarop9aY:dOyYR7jWv3NpBu1ja/CL8OXR7
TLSH
T103C2E92B640DCB7E4FC01A9DDC5A6F9B3E9802C796648D4047FA944C02C77EEA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f2e465108bfef5d08092c1c3b000d220931b2bb445d29767ba3b1b2e2b2c3774
MD5 475d2bbcc0e659581e0c5db69165bfff
SHA1 4d3d9522924454b5fab34d7ce20feddeb5774d42
SHA512 5864d1d8130b4e7e40fb81f6cf9d8ba1579449ec76565ea8db8c986d9ae29bd818fbda0d70a95234e2d80511ed6364f3823807f4a07691030ee0e8a1270dd0f7
SSDEEP 192:EONh6nnHGQmiUy4iQYcX5hQDP1xjzor9RfMcsIwU6:EONh6nCOQNX5+DtN8DshU6
TLSH
T1F702EC35E8A46C7B9BF3AE45B4872313AFE4213BA5956B80DAE81E1C00D765C2306D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 74f6e181a11d10bb876461f6940c632a5d2b4966fda8dc1415d3ace8c3e59066
MD5 10176bd5b234bcace5fc1b8b2731d472
SHA1 63747170afa9288e591a6515ebc546be5711612f
SHA512 d03e963c772c1934ba0a8c1ddebb49b60983bee196735a0751562d0c2142195460bfa1e4d8a672a6a5f019fb8cf3f4fd6e95f0e2ccd5b6abf71f487fa0e961b1
SSDEEP 192:z8sNqVnnHCOQmiUy+RbbcX5hQDP1xjzor9RzX1x+22gyIq5yLUO:z8sNqVniKJbQX5+DtN8zX3+2ITCUO
TLSH
T194121A34E8A8EC674DE7A555B0873253AFE43077A985AF80EAE85F1C00C675C270EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5506a9588a36a6cc352b6439ce5a826eb7455c3589aed47cb3269672bbbb0bdd
MD5 d760953e71584b5f0e5a2344ac554a76
SHA1 a4120fba4cc18caee5023feebe2d6b8903f41f86
SHA512 bdddc020c2f1a84ebce5236e9bb0b5d54e650e4737d0293c4c563c29287ba464e2cc9afe60a6ed9c680001bf83297def415000573db947587a9dd4a462ef2be9
SSDEEP 192:EON56nnHxQmiUymibYcX5hQDP1xjzor9RzX1x+22g3skq5yLU6:EON56nvqbNX5+DtN8zX3+2Rs/CU6
TLSH
T12C120930E4A8EC674EE7A555B0873293AEE43177A985AF80E6E85F1C009675C374EC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 083481d0aee6bb448404d1ccc120376b56b35082e8d98356f9cea2d17b5ce590
MD5 ab8b88b71df56d9d59e6c87ade4a6376
SHA1 29ea17d86f7df3ed81f8b632446552dff76b2020
SHA512 126d486fdab9c2ab241bd9c36745c3429a941b30822e923a7e50af4fe697c588b7b5a79b09ea81350b702e7bdd938a511d598ce0befea42355df45db59aed368
SSDEEP 192:z8sNqVnnHCOQmiUyRRbbcX5hQDP1xjzor9RzX1x+22gyIq5yLUO:z8sNqVniKebQX5+DtN8zX3+2ITCUO
TLSH
T19A120A34E8A8EC674DE7A555B0873253AFE420779985AF80EAE85F1C009679C270EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download