hxxps://tinyurl[.]com/28tbxq5p

Analysis

max time kernel
210s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tinyurl.com/28tbxq5p
Sample240601-phg3esda48

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133617180036427648"	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
2608	msedge.exe
2608	msedge.exe
4432	identity_helper.exe
4432	identity_helper.exe
2600	chrome.exe
2600	chrome.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1216	chrome.exe
1216	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe
Token: SeShutdownPrivilege	2600	chrome.exe
Token: SeCreatePagefilePrivilege	2600	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe
2600	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1388	2608	msedge.exe	83
PID 2608 wrote to memory of 1388	2608	msedge.exe	83
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 4992	2608	msedge.exe	84
PID 2608 wrote to memory of 660	2608	msedge.exe	85
PID 2608 wrote to memory of 660	2608	msedge.exe	85
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86
PID 2608 wrote to memory of 756	2608	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tinyurl.com/28tbxq5p
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bed246f8,0x7ff8bed24708,0x7ff8bed24718
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3836 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,4556717364500551336,6319107738532912047,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4704

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x424 0x4c8
1⤵
PID:4324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ac3eab58,0x7ff8ac3eab68,0x7ff8ac3eab78
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:2
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1944 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2016 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3588 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4260 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4576 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4716 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:8
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4880 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:8
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4856 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:8
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4092 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4748 --field-trial-handle=2008,i,5410211971089450072,16047269194330586465,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 d688acc23df221cd66165379def3549230ea0479361f17d66f4d0d107e25745a
MD5 a49f9d14b6da5bbe85e3f7ecd67fa85a
SHA1 c778b99b9f22cc22bd51594382d3118a18042ff9
SHA512 9e8a22970c4859a7f095b18516fb683d3c090103d8a93f2907251d1ad1a804ecbb0419ee8133600be3cb883a00f1e6a4c6273e14f4cfdfa02d10e988ad04c885
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9e0377ed38ee947a7c0a022042ab0d86de5426505f63aa3a7677bc54aebc76cf
MD5 e779767ff9947c7189b2afcb67d968b6
SHA1 8622a5f7b96c0809618cc6e683766236bad4d297
SHA512 3b4f5006822e15c99add31912e5ddbc4a37f8407dda79f5618cbbbb5a3f9979f7a9ba89aec8f01385ed2aed0e1a5524a4310e5a54008b4a98d551bb85efaf05b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4a5552c387b3195d628c19a9ff80c4d042f89c814e16851858be3405f8f0934f
MD5 5e6435486ad6812cc33f1577ac02de06
SHA1 0f50027764853502e8c0475c53ff8f853d90c794
SHA512 e3922d6b75bff07f1665e7d08130b8f16814b4b4de11c2444512984db3b059796334c36c72e88504b4bf7b35399dc778226831286ca03d206d69d2114b12c49d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 8b3411c7622012dde3730e353935126eb742d7e5b59da1785136ad93b40d880f
MD5 5f11d4c11994b4e87cf010632215578e
SHA1 65471611ee79f05d39d07680348bca8f5d10a339
SHA512 4b389a19a89c660e9d30ce1f81248ddf9f5cb493492b75e77e19241a5adfa495d5291a10ed137acc475600c08cc184ce4da5e5a0d226c76f280daf505ec5a849
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 524B
SHA256 11895d4263482bf02fceeb6bc45935d70b02e89ce1341a99bff99e60775128d2
MD5 2422fd02f5b026165839fe9a24d71241
SHA1 6ce900ffc234e49b74eeb3fbab943c24c5711e04
SHA512 192900f7b59451ba37519cb685a86604b7dbfe65830e1685fee1045c88770842bbadaa5083b99fb57bbd64b3d964332b0e4d4a21cde5633bbbaa437eadadf2e1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 95ac033ad5441dcef93e09608b33711f51ac1116e8c271f7a376fcd68afcbe49
MD5 ed688411f430cb1d4869a4b0498c73a6
SHA1 6dfca89569a1cf25b1eea720ef809d90102db236
SHA512 6ee497ab95bd2548fd4e067de92e2b4d550d33cfa7843382146ea566bd6aa0d6d4058f1e59043af88897f3b4364219d6eb850b1b9e36e0418846f17f30c07c97
SSDEEP 96:boVYkIX8JbrQbwKIkJgEV8iZRy7Dx+6MSmueIIOJZphGx2MEVhYtjEsXt0/cgVup:bg3I6bs0aJV8syh+FYVXSP5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 3487c1764d7112e63724396124a2c7a0769dc5d223541d508ec8b9370d904666
MD5 b03c688df9954f6af4a93956692d4c3a
SHA1 001e4b3e2b084206471a96f059551471707ae50e
SHA512 d7c8b274d38468778f796e17ef9bf4acdf6c482ee0063d147d40ce01ae60c01829e4fc6672c7250e443d4ec8fc3a09e7391814857129e99a2975fb26f01e0199
SSDEEP 96:boVYkIX8JbrQbwKIkJgEV87/HZRy7Dx+6MSmueSO60ZphGx2MEVhYtjEsXt0/cgS:bg3I6bs0aJV87fyh+FRXSP5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 942b53f47bcbb17c0869db7568ffca9cfb723ebbc13296260c91c6bac63e7dc0
MD5 c00bb81fd81534d03e5c25dace1ce19f
SHA1 71451242e6027793ea9dfec7d545a20685394b10
SHA512 259c0c5236ad45fd03ea4ba0b4390fcb80da249093b2fbbb0ebe5d6526f80950e6b064064bfdd96c6b1735f961f0d891b60bf2532b619346ae12a3a6274e2e10
SSDEEP 384:YY2yLPLezJXhL1kXqKf/pUZNCgVLH2Hf9w5rUk6HG+8WdbT3:YnyLPLuNhL1kXqKf/pUZNCgVLH2Hfq5Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 46a5d8dc6fdb776e55f87fc3438dda39d968cbb3164780175ae0c690c8f5535f
MD5 d711203054c2605a5a761fcfdcf86e95
SHA1 08fe439f842a074558d40e04177d9fb8b2324b84
SHA512 b00990d8817896391f05caea5c91fa831620ea4ef234fd35be3d2b0c1bbd735433233b07ed50e5038cb4482c961ed683d95a386d4964741c2ba6da0357945e85
SSDEEP 6144:m+Zo0UgrZJqMU4x5iUt0/7supTxQYRPILxZnhLMJjX0EeGzY2rLs:jcTo5E/7supTxQ5fnReEFsLLs
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f5690c5e02c4ad969e8afb08801dd911d516dcf52a75a35675bdefb4dd9038ff
MD5 76940ba2bbbf537e398ff3bbaf9a361b
SHA1 7cc5b94b77f6e7a0b249a6c6eaac6bd2f94ea94f
SHA512 e0f66a8cb6ca5c42850be1dfed6f00c7150e4fa6f76dbcda2f0fc49b57d1155eadd77e06f6c7d4dc44d273da7f2345c18f6db20226b6f29945de8d7e66002054
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 63468acfe3f5dcfc430e3ecfefc7134bd8bd2e8f207f8f7e732221fdd77fe7b2
MD5 575dc08f5ddd0a70307b794582baf4cb
SHA1 9cd9d7fa3fbdde9f99abd1438bbeaeb9918b48c3
SHA512 580143c07878d79e013b2347afa28bbdbdb94e2f26423f1b217d12dffe7bcfc49d4463109d52df09e7bc1d8eacedbbbedb1df91a193c560ae8af661baaf2c3a5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 eb6dce1e0051ab2cde48885fcf20397378f0cde01e566269d21859cb6b287144
MD5 5153d47777c0920d8745a913c7b6b7c0
SHA1 d31253415c898d0a550f51385b2ab9f31dcc7090
SHA512 d96d1e89351ef162d4e572c37d4a9b128a43e489b81dd91caf650d51df59184ce59cfed25de8f86b3bde2921d8e5cf3cd6fd8803688da33df65b5dd578445ad7
SSDEEP 96:BFNqdmVzb6n+CU6rLxnAIG+ErGpELGYGkGToDGrGdGFcGy7s:BFNqdmVzb6n+CU6rLxnAIKrIELp5rDGP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 750c7fc6ef5a2e7fb5f0d314455324134104db0cabdc0ccf3fa6d5c9f36b2805
MD5 e78af5cda692616d83388da6c271931e
SHA1 136788ccb263692f80b890aac76855c710700b14
SHA512 ee70624cd380b83b04d50d710988b02017212070c5b7891427f54466d69165bc109c92069412d5626e140c804c5740ee4d526dda0568423d62e8106018157d95
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 cb2a6ed036a62f4c89da6abc558758804bc98e21c73eefe94e3e3d766b4a7408
MD5 e8c88128f76977a5ee4c871f259fbad3
SHA1 3f635a5c0f6e569d9419f3511b2c16daaa18d51e
SHA512 26be7080caac3a952d36ce6a8e8b1a2856f75d4226d2bd93bff16c8208999b9168c5a728ff2c6c1f7e8f5d93d30e3748deceea19240d3a6ca97fca5199ea3369
SSDEEP 96:nokvFt1nb0wpvWMoiVmdeH/zATUWQyV+VDCziEwb:nokrdoGWMXGro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 685523587e1ef13e32b065481202251f5712124571daf540625fcbf3f6143ad0
MD5 bce2e310626c70a980e2ee1cdf86be7c
SHA1 3735bac6e3c6f71d526c73a47f54cebd1b39728d
SHA512 4963367286037c1eafdd2bbf03f97745844170182a68f16b555b58dd79b98a1d250b51a63d746d3ae218aeb90aab6fbf6693c3dd16fd40845a7ee074e682777b
SSDEEP 96:nokGFt1nr0wpvWMoiVmde/ud1kEOrErz6rvS0/2/RATUWQyV+VD7AiEwb:nok4dYGWMvudbOrErz6LP/2Qrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 ba939025f1dfeabdd8e681b98ea4a3eb7c30b3e5bd99c5ff09ceb71fd9b9bbc3
MD5 9b979f03895b35e636a25f3a4df74649
SHA1 6a2f67498809e0e2200ff3781ce64db2270ed548
SHA512 f5fa63ee7a83240eddc8e9a17c98c6fb13a57cc9ad13b22914090d1e620a698a6839498429c4367798cb2192d65c1670ee6c6d802460fd1a01dab319950499d5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 c09686ec5640e71490f11fe04f77d9a83014bbd4180a187211b4e01ae18c9106
MD5 236086b3214bfca573a96911599bc3c0
SHA1 0ff3fd219530605298f51515ce720b96a1972993
SHA512 8ffa0a6881031e680786d4e204ec16013694c3407e117f5a656ad4d5527da7207705da340c87b060c83af7b73f5ba0393ce75fdcd27bca0b8f8a50d5a59b3500
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 7438d5871348b77373f27e68304435f531bbdcbddd44da2d265e178bd4b99f50
MD5 dcb21fb84b8520c3a6aa18498a15c73d
SHA1 c177e1ddc2da90dd05d7ffbed65067cd38c233fb
SHA512 d2353cb73bf62c3b20b41d0cbdb48c4e7cf9779af17570ba4af59a551c7a396976922ab7bfee98933c019b27904e9a1cc85221cc4ed27757101ca074eb9834a5
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b594.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b594.TMP
Size 1KB
SHA256 9d9e256b5e969a944cd5bfe5b2922406f85d6e87fe7f049b1e79e855e4cb3cc0
MD5 419b6f06e3559038185f0e7f2ff89fbf
SHA1 69f5cacc9fac03b7130563fcd540ed5b1fd8bb0d
SHA512 c0929ef3bba1c94cb467f4aa60ff4e5bc506c151de30df2f47291c88222ab2adb375c99b12b0c8213c0b19a320872877be139cadf0addd004f39c21744df1348
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 be3a58380a8ee1e4798188d4bd20b0fa41358675c5d3db4c4cb55099a582285a
MD5 f2e361e3c448574018d93959da668e29
SHA1 a1d04cbfb1de99edabcf48e436b0f33d95118203
SHA512 c76d6744318663710c3051516d2685052914fd8d9b85bacbbb6846d4c98d9633b7e7599e269588b97e36a90fb99671ac26fbf5b3847acab0065b688c49e7cd93
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupUvce2RUjmyR33z2OMDCRHz:A9iIxuERzA83h09RZxYqCcR3aOMWRHqc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 86a18f0b512aab62d5ed8c62a6e1edad7cf1b0685de9204c1d2d5fd9e86af877
MD5 78d69470861dcfc54cb56d9c916c6af1
SHA1 b0e9c911175d29270ab65b4b53c2d94bfa585bfa
SHA512 5bcb88fba9a35f30b340f6e4618d881d133fd8348ac28d6fa4622ee9f32aec19b424d64b80f45f904edbb32bd2966a6a26fccd1354435c35e6586ed9b11ca58d
SSDEEP 192:NoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupUvce2RUjmyRc3z2OMDCRHz:B9iIxuERzA83h09RZxYqCcRcaOMWRHqc
MD5 SHA1 SHA512 SSDEEP

Submit Download