hxxp://roblox[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://roblox.com
Sample260930-nvsh9aec84

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2708	chrome.exe
4928	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{16E400F5-A366-45D8-BB35-DE879662A89D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5112	chrome.exe
5112	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe
Token: SeShutdownPrivilege	5756	chrome.exe
Token: SeCreatePagefilePrivilege	5756	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe
5756	chrome.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4216	1540	msedge.exe	85
PID 1540 wrote to memory of 4928	1540	msedge.exe	86
PID 1540 wrote to memory of 3316	1540	msedge.exe	87
PID 1540 wrote to memory of 4484	1540	msedge.exe	88
PID 1540 wrote to memory of 3316	1540	msedge.exe	87
PID 1540 wrote to memory of 3316	1540	msedge.exe	87
PID 1540 wrote to memory of 4484	1540	msedge.exe	88
PID 1540 wrote to memory of 1228	1540	msedge.exe	89
PID 1540 wrote to memory of 1228	1540	msedge.exe	89
PID 1540 wrote to memory of 1228	1540	msedge.exe	89
PID 1540 wrote to memory of 1872	1540	msedge.exe	90
PID 1540 wrote to memory of 1872	1540	msedge.exe	90
PID 1540 wrote to memory of 1872	1540	msedge.exe	90
PID 1540 wrote to memory of 3984	1540	msedge.exe	92
PID 1540 wrote to memory of 3984	1540	msedge.exe	92
PID 1540 wrote to memory of 3984	1540	msedge.exe	92
PID 1540 wrote to memory of 5000	1540	msedge.exe	93
PID 1540 wrote to memory of 5000	1540	msedge.exe	93
PID 1540 wrote to memory of 5000	1540	msedge.exe	93
PID 1540 wrote to memory of 1672	1540	msedge.exe	97
PID 1540 wrote to memory of 1672	1540	msedge.exe	97
PID 1540 wrote to memory of 1672	1540	msedge.exe	97
PID 1540 wrote to memory of 1060	1540	msedge.exe	98
PID 1540 wrote to memory of 1060	1540	msedge.exe	98
PID 1540 wrote to memory of 4832	1540	msedge.exe	99
PID 1540 wrote to memory of 4832	1540	msedge.exe	99
PID 1540 wrote to memory of 3792	1540	msedge.exe	109
PID 1540 wrote to memory of 4876	1540	msedge.exe	110
PID 1540 wrote to memory of 4876	1540	msedge.exe	110
PID 1540 wrote to memory of 4876	1540	msedge.exe	110
PID 1540 wrote to memory of 5188	1540	msedge.exe	112
PID 1540 wrote to memory of 5188	1540	msedge.exe	112
PID 1540 wrote to memory of 5188	1540	msedge.exe	112
PID 5756 wrote to memory of 5872	5756	chrome.exe	122
PID 5756 wrote to memory of 5948	5756	chrome.exe	123
PID 5756 wrote to memory of 5948	5756	chrome.exe	123
PID 5756 wrote to memory of 2708	5756	chrome.exe	124
PID 5756 wrote to memory of 4520	5756	chrome.exe	125
PID 5756 wrote to memory of 4520	5756	chrome.exe	125
PID 5756 wrote to memory of 1504	5756	chrome.exe	127
PID 5756 wrote to memory of 1504	5756	chrome.exe	127
PID 5756 wrote to memory of 3912	5756	chrome.exe	128
PID 5756 wrote to memory of 3912	5756	chrome.exe	128
PID 5756 wrote to memory of 2612	5756	chrome.exe	129
PID 5756 wrote to memory of 2612	5756	chrome.exe	129
PID 5756 wrote to memory of 456	5756	chrome.exe	130
PID 5756 wrote to memory of 2952	5756	chrome.exe	135
PID 5756 wrote to memory of 432	5756	chrome.exe	136
PID 5756 wrote to memory of 3920	5756	chrome.exe	137
PID 5756 wrote to memory of 5516	5756	chrome.exe	138
PID 5756 wrote to memory of 5516	5756	chrome.exe	138
PID 5756 wrote to memory of 828	5756	chrome.exe	139
PID 5756 wrote to memory of 828	5756	chrome.exe	139
PID 5756 wrote to memory of 5352	5756	chrome.exe	140
PID 5756 wrote to memory of 5352	5756	chrome.exe	140
PID 5756 wrote to memory of 5772	5756	chrome.exe	141
PID 5756 wrote to memory of 5772	5756	chrome.exe	141
PID 5756 wrote to memory of 3996	5756	chrome.exe	142
PID 5756 wrote to memory of 3996	5756	chrome.exe	142
PID 5756 wrote to memory of 5112	5756	chrome.exe	144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2dc,0x7ff85864c188,0x7ff85864c194,0x7ff85864c1a0
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,15455654013005536107,6207401109080890884,524288 --field-trial-handle=2336,i,14990731033996917079,8763084066189096390,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,18063273321336922061,7576698179867885360,262144 --field-trial-handle=2336,i,14990731033996917079,8763084066189096390,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,7158343740111794193,3826713933730615166,524288 --field-trial-handle=2336,i,14990731033996917079,8763084066189096390,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,12058236088932520648,1898452687615413056,2097152 --field-trial-handle=2336,i,14990731033996917079,8763084066189096390,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,7307880267965954083,4488690097359062805,2097152 --field-trial-handle=2336,i,14990731033996917079,8763084066189096390,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,14386787046970821218,6258979864117437327,2097152 --field-trial-handle=2336,i,14990731033996917079,8763084066189096390,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,11092373185665642346,18380617430823571180,2097152 --field-trial-handle=2336,i,14990731033996917079,8763084066189096390,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,4178376222360146574,4167990611358581955,2097152 --field-trial-handle=2336,i,14990731033996917079,8763084066189096390,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,1368936764243450435,16456764675476230762,524288 --field-trial-handle=2336,i,14990731033996917079,8763084066189096390,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,7773159682107073565,10717577734918943873,524288 --field-trial-handle=2336,i,14990731033996917079,8763084066189096390,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,3637347654777681250,11659088307184469494,524288 --field-trial-handle=2336,i,14990731033996917079,8763084066189096390,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,3637347654777681250,11659088307184469494,524288 --field-trial-handle=2336,i,14990731033996917079,8763084066189096390,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6216,i,4528893668457437905,5037889580679442451,2097152 --field-trial-handle=2336,i,14990731033996917079,8763084066189096390,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3972,i,6528433939797952800,10918302033734746893,2097152 --field-trial-handle=2336,i,14990731033996917079,8763084066189096390,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8589ec728,0x7ff8589ec734,0x7ff8589ec740
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,5419138038662915269,6849454754030323080,262144 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,13315793684099817157,15448795536189000982,524288 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,3555199722968545659,9991447908672453769,524288 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,15318524171924451904,14813511940923233499,2097152 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3464,i,9752013004788677809,14820896256968233854,2097152 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3860,i,1834078116984997289,16077940480652602642,2097152 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,1984960219619852084,1534652656006401551,524288 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,13248421097250194967,5331407501801602449,524288 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,3323432128898023716,16957529052591488632,524288 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,17833096579412384761,9760877558452789707,524288 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5824,i,5867969733364538131,5344143233913839938,2097152 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5880,i,4368532219130795290,16467998638423280194,2097152 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3584,i,12846934005015696963,1367121461126098552,2097152 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5336,i,16006069355785746859,4388864756772393824,2097152 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3464,i,12248518354430582879,6745878076639948382,524288 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3552,i,7454635970730018986,3668274601327866612,262144 --field-trial-handle=1996,i,12083610368269561498,1929803449764118428,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d51c77c011e37f81281b0ecfb52380a3758dfcfd69f053ba83648ad908a3ec24
MD5 b84f601bc2a483c669dd8e9ced042546
SHA1 152a99cc9ff8ef18f74ff1668bb0a4bb6fdd1b5a
SHA512 b474aaf78cdc94581236df5db01f0189c7bf98d31d2b0826ad7c9e4045e012f2bb91f579ab2a2ea56bb6c4d3544bd0b52e2fbe9f6ad70861ff67b26a6d337b33
TLSH
T113F02DA5C921AC771DFC072D20A50B47F79013672781899F373C950C8FB563F464685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 76KB
SHA256 a90f8df822137109d28ea872467f197a533d97960451e3a2837973e923bd0d47
MD5 09d795ca53909d4125ffc0c50f511e5e
SHA1 518b080b469b8ee4a071b0d40960e9f7bbb2fb9a
SHA512 a9efcb8726c9b5c8a2edd71a3b3b4c7931f4576014ba381150c558b71f5dc6764c53ab6bbdcb0aff4cf169dba6ddd47eccaacfce670ed2af9a8dccae3792a602
SSDEEP 1536:ZQsVzkrTY498gaELEQ5fWToz0f6FWOkIk4QLo8CAsa6kRz:nork498gvLD5i+RPkjoLu
TLSH
T1FB731265EBBD1E60C4BD58C230126C9EB0961D8D5FC1A1B86D8D1FB5B19F77A0F80063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Size 1024KB
SHA256 9299d1b38fa766c9217f7ea78c6be1d012aa988b63f279986ff332f5cb4c4134
MD5 ec90a2996f2afc877d597ef298825e73
SHA1 c7dbc2ac52c82aaf044b03abe5a58cc7664f1a69
SHA512 2b1b990945a71db7c5402e8e21fd83f20f7481161ca79d50fa9c19e4d2b7e9b37b5f1f8f0306929b47e411e5341d1807c2454f5bebce5214deebe4018a40fdce
SSDEEP 24576:Bqop1vI7TU8cP4Yad0OssI16Gz4nv+8h42L7g/zhOKR:B3pxI7TRF0OhI19z4vZh42L8/9O4
TLSH
T13A2523A1BFA6B522F35300F69CA6E71048307A51D8BA99673E5075C70DF9B812F32736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 1024KB
SHA256 a944ea7acc33858de47cac3b921eb60af773fbdce19377e8746d596f1972d1ae
MD5 5cfb924ae1c163259c8074d7b826372a
SHA1 092bb5255b75ef542facf171b440d9382abba0ce
SHA512 e08c85511672e4c4cb35480a8b7cc9b6caad4fbfc1a342f41298637f6b4c1cdbe6c0013a0082174f490f36d2ef1beed23a927268945b39c55cdb37a5b675568e
SSDEEP 24576:6Dygh5shyU5bWDZdukljnHRRgePRzIfwB:6uAsIU5bYXukBRxVB
TLSH
T105253396E36F9C3C8C2B986DC204410F71B03D68668B35133BB5E9FA799F409AC6DD58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e034c341011922238642d8d91bad1ca8b8de4d85c036b23fa1ba73c7f95c63dc
MD5 2766db95ac11aae919e43e668986f07a
SHA1 779c86a9c3fd50da43165fda24e30ccc53cecf20
SHA512 9c57ce4dde0acd246ba1271c392127822a2990371f4fb113cf10836c3952fe7c38513decacf1d8eade25f14f2c91a7fb35c01737c90c16cef81e3426d269531e
TLSH
T152216877C4817E1BCB79A076D8D70894743FE55E46260AC61CDAD0B3BDA376D054210A
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_now.gg_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 a32c0bf62d144d6371680fe1db48c9d769a507643dfc59d1d0168f327c1baf7a
MD5 8b75c8791f194c34f63c322fe21a6725
SHA1 b510b998b6f5005c809140ac4bfc6e5d4cb80acd
SHA512 01b7cab0f9644a23b0accf2a43b0d3cf285b623541162a787e178a35255e789c75b10880f034da6491f9ad2f4ab2b9f335b5ccabdc8a81d8664de7909f4cf18f
SSDEEP 384:DYN8jdCxuHevCXAcBeFykoxV00WAn1fLiAvnFo0znJCp+9XnIiq+nMmnnpG4nPwQ:HD3/R3YUoJFXeP
TLSH
T12B627AF787A5466FDA1191F8EA143F1FCE19061617683E0A85D49F47A3A2E70F2C0B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 de05036280f6d3ff4606e8f6bf724012ea1641f81f5204ff0ebf95f01e735f7b
MD5 4424503940a94189f32320e0c9fd1986
SHA1 8be84107dab1c92d372bfcb64b54180ea1fe0a97
SHA512 80643e8bceed4ec3d4534bd98eae77a9ecd5bf152505eb2e5ed7c4c6c8f5df07571bcdbced3ec8048ca84c8c07f88b13ba7d859bd3243ffc873dfe7ac6b7e440
SSDEEP 192:4Rfsw8zNRv7Up0PRpm8lvWP59/Hsb+WNnJGDh2erY2Laq0kwV8yIsnAUgraJ:4RfsPBAYXlahw0geE2mFCe
TLSH
T17642A429AD54793B5CDBC26AFA127B53E3F5103164912E88E6FC8D3C19E76CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 973437aee87a89f2c874a21886efd0e8a2bddad1814b1bc54cd7de00df7f9e4a
MD5 34b495a4ca6429dd5777c2e43f855290
SHA1 8d590a034c8634d6c26a54a5132c778ff7bf8b75
SHA512 548b71a8754dc8e418f1ee856da337351dcc3916f85646260b5772e15a1d66e006d49885f3d76d10931b717c438062ccfaa974c126a4148aa0833a508ecf3d19
SSDEEP 192:4Rfsw8zqwv7UpAPRp2v9/Hsb+WNnJG0QY2Laq0kwyVyIsnAUgtaJ:4RfsIsAUXchw0052mFS8
TLSH
T1A632942DEE54753B5CDBC22BEA127B53D7F5102120952E84EAF88D7C19D79CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 aa2252188ebb7c8940b1818f660522087491a6ce35a076fab8ab3723e5d1eb4a
MD5 e8648596d2546088f044ac7d6b049781
SHA1 960c053c61ff054dd9b7f46c51d5f3e93fcc2ffb
SHA512 0eb1b28cee87d43abc959d6f55272a813e9074af8ea57589fb83b349f1e550d638e33e9fe4fce5f5bd15b4f24a19999b60b9621657a2ea9f01167d5132129652
SSDEEP 192:4Rfsw8zNUv7UpAPRp2xx9/Hsb+WNnJGDV623Y2Laq0kwpVyIsnAUgraJ:4RfsPQAUXmhw0c2o2mFve
TLSH
T14542932DED54757B5CDBC22BEA127B53E3F5102164852E88EAF88D3C29E79CC221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cd661f5df5a22b1ae1881f49698a11a6552ff6d702618764f09c91d93525c021
MD5 6542404ad08dcbd0bb0031f57c402f7f
SHA1 f6cae0d62a8480fe260ec108a4b96c8f8f759247
SHA512 1c0bcf34628cc436a4866d363128fbe4845e2a98a4b925fd1267d6544188e62708b9102ff055312997f1297ae2b95a69c6e31966225888873d4ad99b15e59d39
SSDEEP 192:4Rfsw8zNyv7Up0PRpmx59/Hsb+WNnJGDh2erY2Laq0kwV8yIsnAUgraJ:4RfsPeAYXOhw0geE2mFCe
TLSH
T17B429329AD54797B5CDBC22AFA127B53E3F5103124952E88E6FC8D3C29E79CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 675ac64b421673f77e3c118f2aeed50e683a963e41714cbd09bb776e8c61f0dd
MD5 100403f4e16003b8898d6bb5494f48a9
SHA1 659cc9a86b579f1f8572592ba9c3434283fe497d
SHA512 5df10787a99897b79ba0c00ba10d21e81b391ef1ad44040cdf872d33bdd7108bbde05097fe105dfe67bba7eb58e7fe68d99c545c1d116c9e83d2ad94b861da00
SSDEEP 192:4Rfsw8zNyv7UpAPRp2v9/Hsb+WNnJG0TY2Laq0kwpVyIsnAUgraJ:4RfsPeAUXchw00s2mFve
TLSH
T1C242942DED54753B5CDBC22BEA127B53D7F5102124952E88EAF88D3C29E79CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 092b72b08160ce80be38371647ae2de6f1a6c59e959f0c2baa4161cd93db4f06
MD5 1ff02b411ca7b776266fbdea61db68fb
SHA1 25ef1c49e1b72dd9675e20aa7a4842fdc694f42b
SHA512 2f57cb5b087ebdea7516bf85c18698a0fa644350348e83706220e4e46bae786e21134795576330c1d8bc15b857b80c9f654f1fad876e2d36d8d89e7fb2d6db48
SSDEEP 192:4Rfsx8zNXv7Up0PRpm8lvWP59/Hsb+WNnJGDMbEiY2Laq0kwV8yIsnAUgraJ:4Rfsu/AYXlahw00ED2mFCe
TLSH
T16B52A329AD54797B5CDBC22BFA127B13D3F5102165912E88E6FC8D3C19E76CC221B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 cbff59adc7b520f0de2985ad921ee12da5b00aa0aaadd64b2862a8b11ece7f19
MD5 8620b09f169758aa6d92f2e7b8a4c29c
SHA1 c265bb3d46a3af238c08a66240583a655be69a0e
SHA512 017bb2738ebc633e2b1824b1fe90215df48c3e3ec2d222610a597c250ca9b406bd8560dd6e15c6ddcea319cc301407ec464c4569fc29dfb4f74923aa99fdceb8
SSDEEP 384:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/XODGN+ErU3pxHG4xHk4V4:s2GN7KxkXqKf/pUZNCgVLH2HfgszvO61
TLSH
T1C4520A27A88C9A3F0FD8C54DD8177F4FADF101566268492452FB9C1903A5BDB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ebd1d48456ac10b76eafa6e03ae8fde5deecd34e\689ad3ae-f5f5-4ffe-9567-f51d14991a6a\index-dir\the-real-index
Size 240B
SHA256 3dda8d2e289617fb9010c1924503993919373d7752c43e7ef438ec8e66f43d5f
MD5 22d964b5fa7fc0f1376d1062e5b65add
SHA1 dfb80bbc143e40c623792056e226193a11fdcdba
SHA512 f6226c9e8120a0c2defef09597be2d30804e6247758dac9629b763ce53fd9287d69781b7943dce180dbd061e23c73d16d934323f4e12e1190a97929e1e258492
TLSH
T118D0800785414501C1D393F1589B508AF7114996F54959539594E0E46D503158E1728D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7040.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ebd1d48456ac10b76eafa6e03ae8fde5deecd34e\689ad3ae-f5f5-4ffe-9567-f51d14991a6a\index-dir\the-real-index~RFe5a7040.TMP
Size 48B
SHA256 d88321e2399c8ce89ccac052583095134256c4cf0fe7e02f59836211b35b6767
MD5 a3e15f7100da2fa9e8c2c850f7157877
SHA1 c935250404ce99a92d64c2318f623679aebf908c
SHA512 00cf3e273b23acdade1a8643437231668f8fb2a5a8860228410ef8f2f50a31cc3272074b2ea20a401f9742bb7a95b5881c42c985ef17f8d8ad1c2504a9517de3
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ebd1d48456ac10b76eafa6e03ae8fde5deecd34e\index.txt
Size 147B
SHA256 5f254e97173e2aeec42a85c5a0abe94f3346fe6d59f482478d6a42d74877dba9
MD5 4a3fb9354e86d31fb98552ecfa47094f
SHA1 8ad59b9d37a4ba0e21852eb025cde5da3ccaa84d
SHA512 dcea38ecff905ef10e1e62d1dd679fb7d680a6b21097e85c6756fbf2af99c34e6663d67f45b5f6ccb030b9308e22e7a7242da05eac3986608d67c41917b481b9
TLSH
T171C08CE68C09A18CF5B38FC25825271048226548CEF4CD0CC840080D2062820E0E8705
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a707e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ebd1d48456ac10b76eafa6e03ae8fde5deecd34e\index.txt~RFe5a707e.TMP
Size 152B
SHA256 d67c227ba2f6fdfe05677501626a36b728b1c23e89edb13d31b074600d6cbb65
MD5 a74a8fa3ad807324c274adc4a8bda770
SHA1 ae04c568cb109339e648c116c3a200f74a63979d
SHA512 098e28152ccef9597bd82f2e2953dc82de60292445fe2f1896a2d7c66ad970839cf9f8fee81b8b3c50f55cd85f436aa602b5fd0b5216ce0d8bff462106d59482
TLSH
T1C9C08CE64C29A18CF6F38AC2982567408822AD08CEA4CC0CC840380D2072C20D4A8701
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6b15976179a88f4d6442e411444854835583af02d7a6a043bb36ea735bb5563f
MD5 1eedaa6037b6766f4cdce5721e75bf6f
SHA1 33f700e33ddcf7666fd0351196272d7d2c658200
SHA512 a23d632d4d124deff2e1969123cd325e02697430b7fe9d5b69143c4843e271fe3abe36ebc9400a96f76af19c5657584bff77bf8cf8b23a99f0dc8ae523279d86
TLSH
T193B01200C0863E12C8048170138860482300DE218101530B82E469EDACB30F18655372
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 801dca74e1359d28a0dad88187abd66e9efc65662d76fb4d2cf36289fdf3e834
MD5 fcf0fc8471add3b60bded99c8393260f
SHA1 d9b453ca1363412c5815fe93959b44dc1c7f3fe3
SHA512 176c394cab70d0c3fc3c685ef964f06e3bf21b4905a6a0b69be14725fd4c8e8e4676408abcf9292c83b224ffe48d0116119d93f03a4479ff397ad4fc19a7b61f
TLSH
T12AA002781B421492D2008FFA10D35760236BC9685205035B4690154CAE953D14F07480
MD5 SHA1 SHA512 TLSH

Submit Download

a7d06828-c743-457f-b8d8-7fd7347e2f9c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a7d06828-c743-457f-b8d8-7fd7347e2f9c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 c384221d198faad4f8f83754e9aa38e108e2345b49abd1f81a16a7fd56e13e50
MD5 ee94e9c05be4be20603112b1149af9e9
SHA1 b3a98f2ed81fa82403e6496ef36e94396538cf70
SHA512 9ac1b94a02cd9b40a210801f8e2c30b545661f78cfc311f794993b943f6d4dab30e0ac4e578b844e9311010f579a55eeaf274e54c0bb6761dc8adb8f015f9a73
SSDEEP 6144:sL+Dvz0p3IGzzZDTn+hFD+7t56OD9ZfSApprn:sL+fM4GRPnyFSXD9ZfS4N
TLSH
T17744122629959C7785BDE050E06FF124DD68C9CF42EE6B0A84466F8AD2AFC4E0357C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 ee8a1713a762a2f89bf52cb8522666d33eaa32d7ca76dbf246a17ba6f0d71ada
MD5 3d4e551155a96ae7a52aad9096782862
SHA1 cda49ce7fd89fe6c04e2bcafb04c3e33bdaf05c9
SHA512 d029b3a71220cb7d4d0078d31c4ec494dff2c66f979fc4d87684493f860c328f07d5dede7554efd655a4a3ed64d9841df8c1cc74f2ac9213b7ca5fc056ac7d32
SSDEEP 6144:sPY+Dvz0p3IGzzZDTn+hFD+7t56OD9ZfSApprn:sQ+fM4GRPnyFSXD9ZfS4N
TLSH
T11244133629959C7785B9E050E06FB0248D78DADF82EEAB0D84066F8AD29FC4D0657C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 397050431e51586c80581c26fda6747b4fe096b4777ae2176374c34f2b26182f
MD5 7d739f23856a8533a526deddd96a7a26
SHA1 31f8a6cea91756a545a2f9d598612610f60ccb13
SHA512 810791686de836a1cd35d4d5e68a55b95d1bb4749acab9e1371cadd422b336a06f111699c848ddafc25a9760e6a2d0886e8b47c556f1e4d41d67060254f13165
SSDEEP 6144:1L+Dvz0p3IGzzZDTn+hFD+7t56OD9ZfSApprn:1L+fM4GRPnyFSXD9ZfS4N
TLSH
T10B44122629959C7785BDE050E06FF124DD68C9CF42EE6B0A84466F8AD2AFC4E0357C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 5897b21be0e5304d4a5c889ef62c6e9143f3bc3d6b50f63b58b8163a29fe9fd4
MD5 0549b34bd01b01c641f7536ba8f49b2e
SHA1 7793ce5103288b2ae1b5857eac415085ef4ebcae
SHA512 fe4d78a53d73780c082cd4b47d11a0eb7b023a2f6186392ca99bf936270a25618dd2ec004d3a29af04362e8e4924fe521100d0a2952035614e1f63392d74961d
SSDEEP 3072:xjT+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:hT+hFD+7t56OD9ZfSApprE
TLSH
T1A2D31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f7e901ff3df2d769334a9a6d3d1825c832dead150655a1e08b1ef005d0292c1c
MD5 54b5c89d12a534155a20824f377fc719
SHA1 633c3f7842f6f8f5fca6889975166d8beceab229
SHA512 232113d19f85e9404efda63cedba3028a48c801cab50f01744982526b2603d87acb2c9b209ffaa2266ed46e4496bd525b77408f425a951d529554a9790832746
TLSH
T118D0C06096B83ED9E131203F03700311348C01D351136100D85000490BE808381C1CE0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 e2925ad6c4a3dd344008d388822970e83d99369c80a85821a0865ac1f8cc75a3
MD5 6a6225c9b86bf61d780fef7b875bf1a4
SHA1 93e6f9918d85e4fbd5f0bc38b817f8557f60c0f1
SHA512 859fa38693924a7a3e9670d19c17ce2a2bcbcaf746dc02584a5c12db79dfbe0ab766799a8d0dd9275c68b0ddf9af481fe8be39b117e159c8847038ad060a331a
SSDEEP 96:t4vLpgUySjax68PEsCW+J3r8jR9/2JYly0f4GtKYSEGNiHh:t4DpbZ2LPEsg3Q++jUoB
TLSH
T10CE1BB409AC5B800FF984A30D5A15EEAA97771441AF75B4B3627C2387C5F7D4E210B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5903de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5903de.TMP
Size 3KB
SHA256 a7912213235721d6086cc832422815dac031c9c63c93a54320e8a402015c659d
MD5 71c8a15809ef7f63d9943a9398eddc37
SHA1 41b30960b4d22a57a76499367cf5d2fe780324d4
SHA512 bc3f365d87a092dd314f97823558cc99252f9897292081fe9414b2d583579429bab34a4341e486919fe95c08e01ef3da95f9de0f47bea18541e75b97cd675cbd
TLSH
T1A061ED806C408E64FF965F78A3F622FF35B5F0815AF3AD9E31B8C4799466759920434C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 930c6aeb5cf8ea4b5e5d2d7398bfe5a729cb8f039f3a20a7f6d661619c151cac
MD5 105a9eebfff3eacdb9db86e69cb02fb1
SHA1 a059f3564c7c933d8a17570756917151bec9ee2e
SHA512 6d2180458d98dbbf7ea96f5780ff727498e92ee00b0d9632ce214d0b7eb334de5d93d702c4ae30aa7434ad949dec11ce734e4fa7ac7a79027a9dfc4aeac2e568
SSDEEP 96:DQOh+BlzBhGMHueGxBq8wB9fXO3UHxGO5eM/Hz7tKQTO:Drh+Bl1hGMHueGnq8k9fXcUHx75eM/TK
TLSH
T135B189F383B5C66D9A1296F0AE09AE1BCF5C0521035C787A85E4BE1793B35A1E101B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b3194507c9fc923aa47b68b0eda368442af5a36c99fb47636109d0991d2771b8
MD5 9eaa64f3c67664c335b3d711f900777d
SHA1 62a460bf2019c5a9ca96b9549f7552c15a7f0fd4
SHA512 a76472b895807099f2e26436255ea01731de08f98e56a43ed62a399ca8671176266a3da1e8ccb4fde85c2cf8114f722fb0b3ffe2a4bda840cdab252116830f9f
SSDEEP 192:sxZjRZMO/e/fbsnDNdpm9HW6+WNysS/Y36434IgrJ:sxZjMOW/fbsnNaHbY/XD9
TLSH
T1AF22A7526E28A97B4CC7D20ABA25FF53D6F9503291D51E48EAFC861C04E66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b116f62bbabc813c4ead616c9e146e890eecaaddff7f199c6dad517d8c30740f
MD5 d6b5ba6183d21e8a08d25fed3abf1210
SHA1 eed8583d99de254a57b94a9b86a1238af4447b69
SHA512 afdfda03c474b7558d10920b2342dde110110a8e8cb93ef3c7263df1a599137b9651d9eae3fca74a8734c8ab44338c9144454be8704dbec7f8f4f31e2d545d92
SSDEEP 192:sxZ/RlW/e/fbstYWpVMSzkxtQ2Vddpmv9HW6+WNNLrutVmFDsS/Y36e0iGIgFJ:sxZ/uW/fbstYWvM3hUHb1Snql/7e8v
TLSH
T15352E9426928697B8CC7D21DFE25FF13E6F9102295D51E5CA6FC8A1C04E67DD2207C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0349ca8fe10345e07eb2d18aa3c81b371339d1d2e40ab77f41634b246141049e
MD5 7278dfb846b39723f0e8c41a0f73ab77
SHA1 df55f1a08dd8855152aa33c64d28cf8ce02e40e8
SHA512 998b03dcd665f4b2738548f154e2fe62134725a8cf02f653f0583ac628cc8398e4ed6eef355192fcd6f0568f241dfa66cfcd5e1a72a3c4f76c5a797acbecea62
SSDEEP 768:kSKlm7QWvUYm08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/HroJL:kSKlm7QWvUYm0u1ja8/L/E/UJL
TLSH
T1BDC2FA3B640CCB7E4FC05A9DDC5A6F976EA802C796588D4047FA984C02C77EE912A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16ab426a-132e-4002-8b2c-015bc0a100d8\index-dir\the-real-index
Size 72B
SHA256 22b220844d99adf5154cc65998b38948527e182a9c679c5560d4686f282deba9
MD5 c32408e1ad279f9e3ae469402eda5d5d
SHA1 277da7274cad713597393a21f78642061102f140
SHA512 a27c9739886295b72e28d84d672073703b2c52528f6256c9f96de28fef37ec345a9300cbd1d640fbe8bde0ee1ab3b6f58359592c881b0acd405767e9fac085dd
TLSH
T121A0021403905506C40229F35B6757436744CD7E1710334B709384A4FC95840996124C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16ab426a-132e-4002-8b2c-015bc0a100d8\index-dir\the-real-index
Size 72B
SHA256 523e17d1c97e2589887bf66898bf90207bbf99358ba052553b661d45ee3b35bf
MD5 cc2556a4d3cf03f76ef779d261d18455
SHA1 198ede3de5416493fbb04c7f783aa7f555cba48d
SHA512 869bc65554b2fcb677a635c2ae41480a8d6ffa9ece1e03df156968cb6a0838455c666f9f32531ce387fc6e1dac4621bc53de33d478d8ae75e6949ac0b9bf50be
TLSH
T13EA0021447C10029D01A21B3156202515320C9101201530B50A98644CC604544D5231E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\94a6bf09-dd0f-4b4f-9049-99c9a70f31ad\index-dir\temp-index
Size 360B
SHA256 691181aee50aeac2b9ef8bf0276b1de8922ede00c8c93c5ab04bfb2a61f73407
MD5 6f9a3e7900607a656ffbaaedfac1aec9
SHA1 692d1670b3410e650e75a6ecf6e3fa4fad4689eb
SHA512 42394bbf2a9cc28742ae98e5f37a50f3d5d1aecfde2e8d194360f4d2d77c31c4884b84107ba92a01af7242f7a8761d299e528feb7c4cde39b2ee734573186ab3
TLSH
T140E0954916138286FC980171347E6031B271381CD720274F71EFC055CC87B489E03F14
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\94a6bf09-dd0f-4b4f-9049-99c9a70f31ad\index-dir\the-real-index
Size 768B
SHA256 f4e1a5e739f78e08e075e0d858054c8920bc7e21411da551858acaef1f921bf7
MD5 9e36d4342e67f63faff37541196d2eca
SHA1 64e27cff13e988b55fa310691b671fa6f2e7cd19
SHA512 8ef83ce230fdafd3b519325e8eb4d22d10ba2370c6ada33914027792f2da35eb9760409e0f61c7c4fdb73084d7e9ab445a90c8c63d560635ab8513167d98ceab
TLSH
T1A101EB120E222527DC89D8B294BC21A5A3302ADCB7602B0B31BDD02A8E473986A81208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\94a6bf09-dd0f-4b4f-9049-99c9a70f31ad\index-dir\the-real-index
Size 360B
SHA256 f3488bad891a957213ed85994c4762b6732ed7ccae39ab1dd1e82a545b2b636f
MD5 3e81e93ade743ade47bbe6968932f6dc
SHA1 3298237009dd16c660a46e2c6c3ecf37737f3caa
SHA512 6b7f5a4deef5d0b154b41a12900bde5b111866aaa8323d774a8bb344d9ecb0da75623f9316ddf84c0a421f16e07d6937fcfed82feb33c380bd9f311cf1d9c00f
TLSH
T1E3E02B1A9D135106FC48553564BE60B6A73128DC9715270F30ED901A8C8A384AE4261C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b1347a1dce8fb41809aa8934e6a7487569a42c8632c7f6567c92910f40622bac
MD5 640bf9aa1946c57347187da4345c1de8
SHA1 1c81b98cf1edca215e0e781ca02b47c1161a980e
SHA512 8f5929420589ed0b91433637a98455fbdcf09f5c3dbc121815f961e3cc69102a0850319322bb41f89aa2c36205b7c4f8620fc501d123835ff48d2f54cfea01a3
TLSH
T1C5E0C0772EB31410ECBFE7D6143158A00000B844D4A8FC4F902E46D72473315B40AC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 00c88c06a6c4326340d3b8e30a87d8063052e538e57bc5a0c60c266ec3187331
MD5 ad2cc422b00766f07c5567bf84459c0f
SHA1 731ddc25dd12a80b2b8c508bf268a47a0df16c5f
SHA512 3cf51dbdd7cdc0c72564f85715cf02feaa1e795552964fa8525cb38407584c5bb1cc7f237afe5922af9dfb48c4f2a307469e0d8419d52cdbede8d62d3b722078
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5903bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5903bf.TMP
Size 72B
SHA256 892b8e742dab481f640803e01001664024a52d3e182cc5c2fba605e14bb2cd48
MD5 891557cd34fe0d8200824c2c7d9aa0b7
SHA1 f31a702b19d4b6c1a0e5608d5334fa069a7d5a6f
SHA512 32938e1965f91d8c9fa5f5a80017495d8cb6a39731e2fcd649423f4fc053bfad2b6fbee0363355e6ef298466239f482391d9868313e8a05f7fcd0d0eb1b4a44e
TLSH
T19AA002908E8FE419DC0005B111692B505340F8EB40103206DADCE0E8CCB10C055C2611
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 904B
SHA256 82032805e48570219b777bdd3e3b8d68b50ba81f7a4c21b8c8e35547ce9c8ab2
MD5 c9f2c6c2def77c3a3e383ea09b9e6866
SHA1 a928e54f8a446efd69bc636f5edd1acaa6fcabd7
SHA512 801321186f2f6b1535f664e2e5b50bd9821355c9a1914609ce37ebb08fa6eceec02f2c56f0eef8a8cfeead666b682156599f0ae63540151bb84268a13a5e863a
TLSH
T119115B0134AE2145687F2ACCB9D8E61EC645359334A7EA3B7EB400790B27E044DBCCE9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 2a9985606326ce4288f8aa08282423807450282e9d5729e32301c93e88861424
MD5 4bf184f2337745b4dfdfd38de2593739
SHA1 5af128ea520cdac91b2fde24ce471cb8b6e0b93c
SHA512 3cd398b16e1e8e67eec91200010488c4771a85b073fd119af7b7a954b13a974951378da78e8463d949a479eb17a1d9be794cbf9ae3e347ea93b97a5da2fe4169
TLSH
T1F1216E1079BE2245687E26CCB9D8D51ECA4535A330A7E93B7E7800790B27E045DBC8D9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8675acbc8ad49a4f75fb52b5fbb9c18f2cd2b2b4aff71b831b2a3f8f1e6f4575
MD5 38df5511ad4ba8aa96cb9ed759603f44
SHA1 9edd0c53037ec6fd33912449de65565a914bf26b
SHA512 2191bdb0c5c19bbf14e38124d1443c3a95e0221cdacf82261875b12f4babaa047d800a0608aae0b98b678c27af40e99fa67fa4571efe62f4b902530dc5a9479d
SSDEEP 96:KqONkPQsjpfbUmjH5ih/cIPURHl8h4otop58aDyBKP4v+Y1xf//ojdexBywvBC6q:BONX6JUm0QmiUydSso//3ywvBCE/VSU6
TLSH
T1A702E938BC687C7B9EF3AE45B4877B235FA4106BA6952F84DAD85E1C01D725C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 b73fc434c8ac81d62fce6b50de97efc88a33db9f66807c1596940595697506c6
MD5 e3a3f9368cd2f9892adfaf15bca2b4b1
SHA1 aab21b615eca549bd50429060dac39dbaddd69a8
SHA512 022f7c4a14ca765c4d0114789e61781140d166e8b79bec5ec678034cc561b5c54804516aeaf0c125ec388bfb17ee29605b12382c8cbcadc0d31ff43d541910a5
SSDEEP 384:3ZcIhsNGqTXF8ba7O2h//Pe9HbAStYKXssXkLTtgOIwZOyhLBoZ:/hiFxOG/YcS7XkLTXsSN6
TLSH
T19DB25BB5D8A86CFB49B6E9C1A546F6032EB40477C2C95E4CD5F8BA39309F4F80326D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4a415694fe1dfb001a3c092dc14954f4bdea47ccc40c8e945cb88c873333bdff
MD5 96b512c2dbfa533892f015f2c30ea75c
SHA1 76f664976ca4ec8f7bcf102055fb59150e39aa6f
SHA512 4a2c5cf3d63ad10507c32aea54a9011ce231337bd55ddff7d8bac2c0ef2cb17b2aa271f5c0fe7d376ac7b7bf64c6bde67558abe1af7cda8a6bfa348ea049e522
SSDEEP 384:1ZcIhsNGqr8bIWO2h//Pe91tgOIwZOyhLBoZ:Nh00OG/Y1XsSN6
TLSH
T18A827C72A8B8AC7B1EF7D541F08777034F748467E7C9AE9495ECAB1D01DA1A8030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 493009acdd83934c68a759346c0bbf1dc8abc4c2d242c08a7fa653455cff8db7
MD5 da7c6b9e2d02019cfa6117a2e2e54160
SHA1 69b0fb6b339f81984829caecba0ca0197bee352d
SHA512 a2c6785b285b6764c249e38424697694604d6db7566860fe8e7c12a512c8befd0611186f9164270a6a82be0a354077bd2da5287e6c697ea4e17b8dfd21936f7c
SSDEEP 192:BONH6JUrQmiUyrSXo//3ywenezDNxCcqiU6:BONH6+dLXo//Pe61U6
TLSH
T1D6120935B8A8BC7B5EE3E991B48736235E644167EBC96F80D6DC6A1C01DB19C530BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2d0028bd99d36e90aab3a1231e43c9971d9b08a638c4e6ecb829d2f610e2b703
MD5 aa6a3e15150dd6492bb4821635e06ef3
SHA1 f414bc1b76e4a171c32f8ebb7bfdbb7742a6d6d9
SHA512 76925908dced7ea00b388f8e3a6205d7136db56dadcacf01f5c1ddc0fb2c3ab171c35e25cba806ab8d93a09e8e79c3dbca59844cc0108897d3520c5060181945
TLSH
T1D0414C58A6F91148B3B37F5A9BF2A86D487AB8732E06C4AD00110E4E0B62B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download