hxxps://m[.]youtube[.]com/watch?v=1OJ_SUhWs6w&t=105s

Resubmissions

13/06/2024, 04:07

240613-epwt2stekd4

13/06/2024, 04:07

240613-eppezaxdlp1

13/06/2024, 04:05

240613-enpdkstdqa5

13/06/2024, 03:56

240613-ehvy6sxbrr1

Analysis

max time kernel
86s
max time network
89s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
13/06/2024, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://m.youtube.com/watch?v=1OJ_SUhWs6w&t=105s
Sample240613-enpdkstdqa

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SRU\SRU.chk	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRU.log	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.dat	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.jfm	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133627251600969669"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
4832	msedge.exe
4832	msedge.exe
1328	chrome.exe
1328	chrome.exe
3980	msedge.exe
3980	msedge.exe
4436	msedge.exe
4436	msedge.exe
3548	msedge.exe
3548	msedge.exe
5616	msedge.exe
5616	msedge.exe
5756	identity_helper.exe
5756	identity_helper.exe
6292	sdiagnhost.exe
6292	sdiagnhost.exe
6700	svchost.exe
6700	svchost.exe
6700	svchost.exe
6700	svchost.exe
4528	sdiagnhost.exe
4528	sdiagnhost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
3548	msedge.exe
3548	msedge.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
3548	msedge.exe
3548	msedge.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
1328	chrome.exe
1328	chrome.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
1328	chrome.exe
3548	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeDebugPrivilege	6292	sdiagnhost.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	6700	svchost.exe
Token: SeCreatePagefilePrivilege	6700	svchost.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe
Token: SeCreatePagefilePrivilege	1328	chrome.exe
Token: SeShutdownPrivilege	1328	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
1328	chrome.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
1328	chrome.exe
1328	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2160	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4704	4832	msedge.exe	79
PID 4832 wrote to memory of 4704	4832	msedge.exe	79
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 3400	4832	msedge.exe	80
PID 4832 wrote to memory of 820	4832	msedge.exe	81
PID 4832 wrote to memory of 820	4832	msedge.exe	81
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82
PID 4832 wrote to memory of 1440	4832	msedge.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://m.youtube.com/watch?v=1OJ_SUhWs6w&t=105s
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff92c233cb8,0x7ff92c233cc8,0x7ff92c233cd8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,5403297572548306563,6103407453595555881,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,5403297572548306563,6103407453595555881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,5403297572548306563,6103407453595555881,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,5403297572548306563,6103407453595555881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,5403297572548306563,6103407453595555881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,5403297572548306563,6103407453595555881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2004 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,5403297572548306563,6103407453595555881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,5403297572548306563,6103407453595555881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3436

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff92c233cb8,0x7ff92c233cc8,0x7ff92c233cd8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2716 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:7008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:7016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:7160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2584 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:6236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4564
- C:\Windows\system32\msdt.exe
  -modal "524352" -skip TRUE -path "C:\Windows\diagnostics\system\networking" -af "C:\Users\Admin\AppData\Local\Temp\NDF87C9.tmp" -ep "NetworkDiagnosticsWeb"
  2⤵
  PID:6224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9619838991023540907,13540810458146175414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:1
  2⤵
  PID:5960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff92c3cab58,0x7ff92c3cab68,0x7ff92c3cab78
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1476 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:2
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:8
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3140 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4180 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4556 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4760 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4200 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5048 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4884 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3448 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3452 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3440 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:8
  2⤵
  PID:5212
- C:\Windows\system32\msdt.exe
  -modal "131656" -skip TRUE -path "C:\Windows\diagnostics\system\networking" -af "C:\Users\Admin\AppData\Local\Temp\NDFF5D9.tmp" -ep "NetworkDiagnosticsWeb"
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4812 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:6568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3448 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4792 --field-trial-handle=1832,i,2947743208101418433,12347545533632687191,131072 /prefetch:1
  2⤵
  PID:5204

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:656

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6292
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
  2⤵
  PID:6456
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
  2⤵
  PID:6792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
1⤵
PID:6732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost
1⤵
- Modifies data under HKEY_USERS
PID:6864

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4528
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
  2⤵
  PID:6052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NetworkDiagnostics.debugreport.xml

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061304.000\NetworkDiagnostics.debugreport.xml
Size 71KB
SHA256 b266950ee6caf92eebde3d8138e97ec5292fa0b4156c8bb18de175cefcce8da9
MD5 0d2e0a5861d22c95104bba38d5fc9378
SHA1 76b02d4621a07e34c367d28364a0f809c0848cc3
SHA512 4c098ea33cfae3a738465a8e07a42c5575bdd61a5e30553b284520e9fc018084aa01e182bb3f9ab4543407d942b88f8053abf1ed5ab8b9cfbaf64e4a9f016c26
SSDEEP 384:sHK5bp8H54OCiB8q4/RV/RB/RxGOA/zOA/wOA/5OA/H/R+LdA/bLdA/oLdA/xLdT:sO8H118NjPQDPhcq3IsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

results.xsl

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061304.000\results.xsl
Size 47KB
SHA256 06db605b5969c93747313e6409ea84bdd8b7e1731b7e6e3656329d77bcf51093
MD5 90df783c6d95859f3a420cb6af1bafe1
SHA1 3fe1e63ca5efc0822fc3a4ae862557238aa22f78
SHA512 e5dcbb7d8f42eabf42966fccee11c3d3e3f965ecc7a4d9e4ecd0382a31c4e8afea931564b1c6931f6d7e6b3650dc01a4a1971e317dab6c1f03932c6b6b7d399f
SSDEEP 768:hU2TH3b0+tk+Ci10ycNV/OW9a+KDoVorVE+bBH0t9mYNJ7u2+c:hU0H4DY10tNV/OW9abDoVorVE+bBH0td
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 733acac7ab4d721c65efe817469cae4b9f1d58c46da3b63b878e4ab16ae5619b
MD5 0dd24c5d78b2b92d4199bb9ea1043a78
SHA1 a2aae10271ff36ee16350fae87286c9792f22101
SHA512 8145931d006b75b3133fb08f8067f0d0090d76c355d7f65f7da745deb4c831c6ab90faa968be655a8558236baae3f8ee6cdd2eec120c74778a5184f8e11ea755
SSDEEP 192:jnrc2kJ2TpaaJFn8syh+FJye6P5tjEsXtScR:jnrc2TRFJyqYeWtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 0522b12b02ce12461ada940e770dcd6ea22b53f075d85652d3308af95e1d7a36
MD5 b296b860e51cc19214ce6c7b1382cc0b
SHA1 179a243556b7a4203623a73e60232f1f82878e89
SHA512 9106cf8831f1df9abd80c4152f9c350b8cb0b7ade6758bcd44c17f8b912a54fbc6911ed6552b7a3fa3a648ca5f2bd39194c348df0444ae4414c03e169afbc24b
SSDEEP 192:jnrc2kJnTpaaJFn8syh+FJy66P5tjEsXtScR:jnrcnTRFJyqY6WtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 e575d9d77e4209183d8d08be9981fb0a8d8d38e9dfab12f85188a0d089eb2a6d
MD5 b27236f6268d7120eb3f4a272a42e302
SHA1 48e22faded4bd8c1bc041e181f855f37a8be7382
SHA512 3b116f9fad3c119c5bd5cc6f8dfc01352e7c5ef7c610c9977a8c8c928fd1da7afb4af3ddc8f94513432f327ae33329bae213cf090c1260e8d34d2ae6fac994e0
SSDEEP 96:jTzXiWpXmkkdKIkJdfmBU8iZRy7Dx+6MSmueNIO/66CxC2MEVhYtjEsXt0/cgVup:jnXTpaaJFn8syh+FdA6P5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 653ca64d84c4bee278528cd641b3dbea5e4d6e3910b466a0982e584da6c91aef
MD5 aacd1edd49bd68fb72be96c57e4f0c7e
SHA1 6b48b0635e17e05d05077193536f44d2b2cd9f53
SHA512 2a569bee789d4cb54ee9b8935754cabc99fe65f756063ea2368be86c6ee697466ca676c902870fb85cce07b35cc570331fbc9e5da0de8d34c83d4eb20e3413d5
SSDEEP 3072:ykJtel1QotTyzB+lLrOuxfBSw6jKy7JCEmOPXsaUTys7:frI1Qo5yzkpeXjnJFzXsWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 85KB
SHA256 a102dce1141fe7541dc1ebd242990e0b4ea8adbc3098a5884934dbb0518d9b5d
MD5 c022752b8d5f9e90aabdc29540832b43
SHA1 cc205f18f3ad81aec7b49326ab9ea12f98f07c69
SHA512 3de54b7b1e03340fecea5a7cdd3cef3f03213fee4fdd95d948014b3ed67cf64b6fcd3b07568467ab55ae72a424b085e4d481bc88051d313a66abe5e966033c71
SSDEEP 384:zBifxEQ+TfRMMUzhznalRDHs0zIL+8tloCxBdd/mbM7TLccGULiJ4NliboYpgBJD:aiQ+qg+Ck1zJddAzK+pk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe581ce9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe581ce9.TMP
Size 84KB
SHA256 d784046490fab1337f4cd0cdb2123efe1d3d75548b8207977645f91346bd1d3b
MD5 1bc5d4f36bde82fcd687bc2905fe1be6
SHA1 962075d1ca9450350c80e2a6011b09352a1088d4
SHA512 b52c28f08571c8c05d12bbf342a5d5197000c61b3ac15e8d4953ae219cfcf5a86a5ced9b80351748c26c4ec976c8ab2c2758171f890ac0d07611cc6b7b4363fc
SSDEEP 384:0BifxEQ+TfRMMU4znalRDHs0zIL+8tloCxBdd/mbM7TLccfLiJ4NliboYpgBJ/5F:BiQ+qH+Ck1zJddAzK+pY
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3e6c56356d6509a3fd4b2403555be55e251f4a962379b29735c1203e57230947
MD5 390187670cb1e0eb022f4f7735263e82
SHA1 ea1401ccf6bf54e688a0dc9e6946eae7353b26f1
SHA512 602f64d74096d4fb7a23b23374603246d42b17cc854835e3b2f4d464997b73f289a3b40eb690e3ee707829d4ff886865e982f72155d96be6bc00166f44878062
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5682788bb499eb4ebffd57a251109284fa5614eba9da5b36c43aa936c459542b
MD5 78b131d0b39266c39d7da50fa933a64e
SHA1 a2458ee16e3681875150f3ae1ed25036a835a8e0
SHA512 edbdbd9011a19375906bc5fa28d9051954af52cb774b006d7139b8717c57d7dad6fa692791e9d2168b60125986b11c35e2fb4bbccbc54592dc21887efc8ac473
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 92a96c9309023c8b9e1396ff41f7d9d3ff8a3687972e76b9ebd70b04e3bf223a
MD5 8294f1821fd3419c0a42b389d19ecfc6
SHA1 cd4982751377c2904a1d3c58e801fa013ea27533
SHA512 372d369f7ad1b0e07200d3aa6b2cfce5beafa7a97f63932d4c9b3b01a0e8b7eb39881867f87ded55a9973abea973b2d2c9b6fc4892f81cec644702b9edb1566d
MD5 SHA1 SHA512

Submit Download

594d4c04-6b8e-4cbd-9b44-62df82d6d7d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\594d4c04-6b8e-4cbd-9b44-62df82d6d7d2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
Size 44KB
SHA256 8606767b0eb93a35b0b9494f0578e66e4d0bc68993c073ac616783802612cf4e
MD5 cb8c30465a4dc0b60fca127caead19b6
SHA1 6a51756311854bdd8a763238a1463a497381bc3c
SHA512 7a75d12044406348e1e7b3035139774809406417823ab260847b7206d652658b75261ec5295f3ce35944bdba046b3683e2cbd2d8779bc4cc480a5941671e28e8
SSDEEP 3:MsFlYhXllLlX8lM2tvH+clurw/:/Fiz10M2lecU
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Size 264KB
SHA256 4df1cfc6cc9b32bb628758f0d7306f4299f991a08658478a5c40899b06fe31b7
MD5 a408c38e7034f4e10a57c28c08e7a923
SHA1 f5089f99339e59191fe2089f5df6dfb79137ab70
SHA512 f341453ed3e8872008e998508bce1ce275b217b4b4b2fe3e2fd16b9599d0b78abc38d24b31cca0f06ce7c94270bcf957da322c9906bdacf7432420f54762ef7f
SSDEEP 6:/M/PXGuETCNXslG23ViT9xiT9xWMEbGjgDeAPDgLAWiXwMhc:U/PX/s9gx2xWMEiUDekOA/c
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 03c290203cd267c6685b469351527a2c28f971d8df4ff4ab82543923ed1297ad
MD5 ed43c6a207e412e457fa1f3aa3b3b24d
SHA1 d856d725155a397973ed13bb5a3a3cd2db519a8b
SHA512 56a3796bafa3b7d4a7ca479d8d807b2530c4d33425d32edebe4119a80582de8ccce5446e081d676cf570981a4205574db6a912eb7a36461f6ffca597a0487725
MD5 SHA1 SHA512

Submit Download

History Provider Cache

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Size 6B
SHA256 e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191
MD5 a9851aa4c3c8af2d1bd8834201b2ba51
SHA1 fa95986f7ebfac4aab3b261d3ed0a21b142e91fc
SHA512 41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 ed01917f6bc574733d5e54382c230f02c0eae69f68e0514800008fec671b45f3
MD5 cb9e683483cd943eee11589f87c2a543
SHA1 ef895f2f5b2b3ccb9ae9d94fd8c31ea599242c04
SHA512 51711d0754cc7d3074ce89a0357a93d0be17379530efb1e48ce509d775249a0fd43ef167fd3441a1fbf8e3bb802db47be305fd7edfad39f9576297e03f87d453
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 de96e976425bbd8556e06a5528f8dc40075e6c1e37c9e5cb0d7c9f2b60966453
MD5 7ba0376c5ae43d57f1478d1ac01d1f90
SHA1 745d001950c365bb778e0e57568f11d92740f7de
SHA512 09a5227a6aeacb311b442568a4e7689a0feedb80c635776d886ca27b7cc67ba0182710923a9c8524c5f1dd1d0c848a2aa812acf97b174ae957663f49bb34ca28
SSDEEP 96:neKQk3nNOgbkXgwSv0MoiVmdHITJa0WQyV+VuziX3wI3:nOk3Nbkwv0MAI9aLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 499de85c62ed77a5bb0996bae1d39387de8558e9fdb1be9541ef58ff9bad8825
MD5 56ab8f5802d65e89441283550559dd17
SHA1 7e7834f5b86a0bc019e89c5f61993425b25690c0
SHA512 98671602303ef48c7aec17dad7f9d38b13e29ddebbc1754ca00d423186934e8abb19ae8e19877404d916ea804a7ca611abe8ff7372f292d49f77df41d7485dda
SSDEEP 96:neKQk3VOg/KkXgwSv0MoiVmdvyAhPIrJK0WQyV+VpAiX3wI3:nOk3Vykwv0MmyAhIFKLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ea9663942fd4ee3e5f8aba23dec769568c2604d1604e6fde00f91baf5670a829
MD5 5a7bbaf1548482308e3026cc43d3062c
SHA1 a1cf9bb263decf7069caa55c9388987ea62c9630
SHA512 bba69004579f434c004ef4db6d11dcb9a6db5fef51c4386aeef0f33f758f6d06a54698636013810b1ebf4a1c5590eb0831ac3029d3aede3834752d643335e228
SSDEEP 96:neKQk3pOg/KkXgwSv0MoiVmdHITJ50WQyV+VuziX3wI3:nOk3hykwv0MAI95LM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 dd9f2a1d9c4bc0a23d77d2b58caf9107ae8f6a94ff627c709bc4a137712bb85f
MD5 7e34550a2c3964a7d523c503dc11e8db
SHA1 2666ab83fede3e33695633ef0ecc468872be9f09
SHA512 eee3569762805331923f0e7dc74080c3e266d2e4213db45d9ced5533625908c7728028b4d70de82477a6aa71188e83465046c24e376ee9241bf6ed2218e61eca
SSDEEP 96:neKQk3VOgbkXgwSv0MoiVmdHITJa0WQyV+VuAiX3wI3:nOk3Vbkwv0MAI9aLH93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0c89eb5ad47db24eeead84ddca9dd61d9b33cc02e380d9a9bd43ebc20c6ab78a
MD5 16de6c37ba0cc2917ad65254eae54c93
SHA1 2dcc516510f1aab2273101fb77374a86ff02e576
SHA512 94a2ac042cee5a2ef64c2764c59a77526d1ba44ada9b4922645767324ff9896cffcd8fff41f55ce9a20fdfc343fc86dfd9845d46b8393c5c98a2ca41888b4ace
SSDEEP 96:neKQk3VOgbkXgwSv0MoiVmdHIoJj0WQyV+VuAiX3wI3:nOk3Vbkwv0MAIujLH93
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 137B
SHA256 c72428d5b415719c73b6a102e60aaa6ad94bdc9273ca9950e637a91b3106514e
MD5 a62d3a19ae8455b16223d3ead5300936
SHA1 c0c3083c7f5f7a6b41f440244a8226f96b300343
SHA512 f3fc16fc45c8559c34ceba61739edd3facbbf25d114fecc57f61ec31072b233245fabae042cf6276e61c76e938e0826a0a17ae95710cfb21c2da13e18edbf99f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 d73e4dfbf14e14f60ddadd100cedf1673cac88b29bd376bd330654de4d8ecfaf
MD5 786146e4cdf7bc059e85a5c74e4224a3
SHA1 8cc1c018d6562b1b10d858f208012e8b78efe298
SHA512 0ac9c7858c4e857ae9119c7ac860513f8e062cf8dde4b97a4bbab06c605ea1ce26ed18af5b629bb9997cbd09cbb72e4e684baf0cf9aeec1f69f22a369acc2fff
MD5 SHA1 SHA512

Submit Download

Session_13362725140085227

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13362725140085227
Size 1KB
SHA256 757a074a2f659f0ce3ccfed40f71665f4f5c97fe7802265c3fc8846926447da3
MD5 16b92314e333055b73215ca760c9eadb
SHA1 76caf11f732d2778b40ec222db55a6126dfa82db
SHA512 760d876248de9a8b3307aad40d987f8b053e11e3aadcae1068186c6ecb7bd2032401f65a775087a950550209e347703a79a9c1c1e520b14a41e29ab70b22b2d3
MD5 SHA1 SHA512

Submit Download

Tabs_13362725140248227

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13362725140248227
Size 1KB
SHA256 73d0de260594eb681ed73235a2123cc93955e27a9beb5a75f9e4681572a8e34d
MD5 1aa873d3f9957f77e15757c9c763f35b
SHA1 6f4bffb9efd7416b17c39ef9bb2578904c56b675
SHA512 c7bd6097e7578a502590c8267f8cdc330a1a0f990d388a61d7ef465a6326eb18c0822f22738b7272f795a8e458088d7064ad0b9b4c93db9c91643b5e5bcf9650
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 100B
SHA256 bf147f778327cc7a04a7db9b791f8a7ac92c659b48123bd983062ea6ad813e31
MD5 0a4d91faf15799739c03a87c837bd499
SHA1 2ba9bacfc85ef4a900c7ea3e4644eef3c8e96d5f
SHA512 7e2c9a47db43eb3b442f432a38b127c833a8fbbc04edab8bb97750affaf0db1183e992738db9eafa3eb31e89f665556d4ac3fe41286cdc521a72a7b58d1f3bb7
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 f4f19152bb1d5111074fc735c6382daad463020e4e25ab38235775fc318dac84
MD5 b2893b21703d03a8d1096154d4361821
SHA1 0e2d70ddd6a27ce9d3acd41beb90575a2bea862a
SHA512 52f55707b83f69e84b2d1fbfe613f62becc1ee2cbd61b785569f637bf172f5ce49a6c33f741269fbfe7c7c508acf7df214576c1d1bd32d494886f3c243c4441e
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 424557de203223f86552a854263167cea310bc0ba4abe8545a5693115a47e283
MD5 1e66e4b36e2be936b3fdd7929a113cdb
SHA1 3c1635c607788654ba45fc3502cb277a16867ebc
SHA512 f87836bf18805ccb1a9e901b3943b75d6ddcc03cfb31e1e4dd2e93a3929ccaed697ff05fed8fc7c9bd849f97be437fcb96c866f93e7ecd30bc91060a0d923490
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 44KB
SHA256 5691b025a88efd51f5b66df3bc9d2212aeaabb525b6ac731268d9a40c00c9f57
MD5 dfe18c12b0eec6db2eadf69fef5df6b5
SHA1 8e6faa1fa115b058478e9f79c0a8c21dc967786a
SHA512 1ff524152b50006bd125423875bc776eeaa77dc9af0364be53185a7d18c8d5aa032cddd2528995f88ea1740d45974bd2c6fb816498964c42122f295c6ca0da2c
SSDEEP 48:TP6UYVAKAFXX+ycs3phyGG3CJhyUGsoJcEc:ZNsycsbyGG8yUGsbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 3e4dc10f9500e056327bc61e191ef442be3ea4f5187de8c7713b927c0bca827f
MD5 38f8577238972152856c4d19723b37b7
SHA1 e104ced0e547933981e76f8dd17a724b2aae224b
SHA512 910f22fd4dcc63b789f87fc2f4dab18ee881bf2dc0ff4d0e6b05a202b623b0f0e2616e2b05d38ccb5b3cfb8c9db9e64514d2cb2056a036f3c4fa9aa1e33c517c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 e4f6a399c258dbe843276cee1906f95f295526c5c36a051cd390ff1d7302263d
MD5 e25a2f885511448874bac5f77a997cbe
SHA1 104d22a1c6258f28a4f4ca05d4d6b3e5234b12fb
SHA512 a7156b0afb2ac6a8dae54cc9a264a7c34b2825ff4290028f5e173cbde8cf3275e810271da4a141b6deaf0b7745f7a656c9f3f4fc156f920c79e49c31f6e3eb24
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Size 44KB
SHA256 0029569f253cc943c4ef12da9833ff3c2674c39408e81d12b02b23d0d6bb24ca
MD5 0d048d44bef5ac351978a1e100ef4b74
SHA1 e9521838d62d7e9b955c87e0e32f305aab817209
SHA512 a3708bd3b66bc78e367ad0a1222de5f1da1e24ecb035b2419e14816961ecd0db73a76080e9629eb8dd811a803f43a6c6143dc2d24826c65ede7a4a3efe2b37f1
SSDEEP 12:drKHEAqfB+Blqj604/yVcjCdODnh89o//:drKHEvfB6ph/yVPdmhUo//
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Size 264KB
SHA256 c40f26bc17031173ef333407de07ee4b0672742840e068ab5b48d4fb41c21101
MD5 b0a0d3f140be8d97272827d0674b1c04
SHA1 668f67fbaa710e31e5e22cccca571ab7e01ab7bd
SHA512 7a9bf2419fd09f32af7060277364d04cdf4289397fc6d92d489a3667389515f8e59f22e93cffe2a827b561b5f679901a131128e76e215c782ac4df46a8832b84
SSDEEP 96:iOS0DOScTOSXeOSLOS5OSVOSQOSzlOSC:i6DCZe9vD67o
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Size 4.0MB
SHA256 aa76b6e96807324b0ae48ec222c0cf433dc5fac42ed1fe09e69ed3f8ed7f6553
MD5 ccb8b214e7ed09a3c03c2bbd9969737f
SHA1 08c77301498758925512315fd19e568a52f5df63
SHA512 fbac9a80d170cd3ebee9d7cdf69aa45e60145f9db82bd79953f53fbe380fb24e78a8dec896986fedd53c8e1af46878de1c7b0fb23f9a1dd8bb9de7e8d8efe986
SSDEEP 1536:Z88vgusNrZomQrLm8v51zMLmZoZqPtlg7:ZJXmQN5xR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 11B
SHA256 f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4
MD5 b29bcf9cd0e55f93000b4bb265a9810b
SHA1 e662b8c98bd5eced29495dbe2a8f1930e3f714b8
SHA512 e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 857c87fe7342cd3c95c2fb35c56780294931100cfdd79ae3241c2da175a7a912
MD5 ad49e4940f86978247c87ace388c2e36
SHA1 8b436aac03f9dfb94c71207477ceef91b1f9cf4a
SHA512 45cd8e1edbf4994654dc4415186cd6780c2344f3a80e7edf45fe793107bd2d163e770dd307efb03b92bb627f1a80e591df17adf98972385aebcf4379afb524f7
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3oOdIe2RUrtR2JFHRmYZ:M9iIxuERzA83h09RZxA3qySFHQYZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c96fd45f3d80b5e425e65d729ec6a7c7f67fe81771c3e76af87faa8d87ac0083
MD5 80637e514d5cc249ccd2f30a8acdec33
SHA1 c78d48ed263c842451d878c7b38fc4bdd90e74b4
SHA512 d66f0fb4c0b716daf639a9feaff6e72df7889f8b07ad907ee69f63880cdf3a793c1cf4e96311e9cb9cf2025e2bdb714a806fee5490adc3c3b2fdb66b60471264
SSDEEP 192:zoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG4OdIe2RUqtR2tNR1YZ:T9iIxuERzA83h09RZxASG6/+N7YZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 39dededf44def475cd3759b095f75cf3f203c60d1b6644acaca32d648adb17b1
MD5 e0ed57014569399448c10b93d3747b5f
SHA1 8db701df79dfbea72a3735ea871def001d6f2248
SHA512 82e3366523d9c11d8f29992df33c2d800a7c823c9e4152d73f4942aae9466f44eb61709fb885594f73decd35465f7c1be78f3863d6d120acce66bbf313a232ae
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG4Odpe2RUqtR2tpR1YZ:M9iIxuERzA83h09RZxASGJ/+p7YZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bb9319099705fb6283906ef30dc59a4454166d5d80775217fef4c628563094bd
MD5 9202a6f60a12b80f0818fe892461500d
SHA1 d3c375492deeae45fdc63c33cfcc881004fc8e43
SHA512 6a6b14ab002be9bdbdaa2d78306ac5daae23ee264ac670d5d0d911797ac6374a7812b326d896a6a105005d847b3e88c70f13cd3f56a8513d296e4b76ac79e1a9
SSDEEP 192:BoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG4Odpe2RUqtR7wwR1YZ:99iIxuERzA83h09RZxASGJ/Tww7YZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f5f56a476e023b7954df1438f7562cec2a1055b0c7d984dd939a01a4340165c0
MD5 b6ff4dd425357eaa3b331bb96688d3d9
SHA1 cfd741ed7a32163c56195148e08c5b2165be940a
SHA512 40730175933896cc906b3376558001576c52367f57f8fc0512f3fe4dd9c7e80b55e1c219cd383d6d9f760626838d2b62d36ac128a0529e5899e9e2b580e164a5
SSDEEP 192:zoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3oOdIe2RUEdR2JzRmYZ:T9iIxuERzA83h09RZxA3qvCzQYZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_shutdown_ms.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
Size 6B
SHA256 14bc7554cea3c0bdcefaab5e408aacd6ed92166b8fb675049eb46a84042e697e
MD5 b49cbc6a9bc920bd76e9e266d6738857
SHA1 9debd46af16703e1e5dbacadb4719380700637a9
SHA512 7ae52885a6dc2e3e060bf88e617140d9b0d2488730c80ec2bfaee7ab63e18404c6b69fbd88ca6e24900a875b2aff0599b0006381e04cc1363dc39d187f2813ba
MD5 SHA1 SHA512

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 11KB
SHA256 3ce1168408eb889f65cd4d45c12c58842a4291356c835cfb1877d017b6768a9b
MD5 3569ff1aa5310102ef02c312ca4dbe9a
SHA1 4124b1e805d5c487bf86182d19ed22bed6cf44ac
SHA512 c966ebf69abce51aa4fbec1e53f43485786cbeb5fb6cea18eb3407b7d4c7a212a6843b69965de9f577c483c6139840d0f7fe56d69fc8c97e6b0884b75b7aed8d
SSDEEP 192:fJAFJr9oBiV7vi12YJrtkp1NDu6Aksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo1S7puF:fJWJVq12krtuJqpmXmlJVjeQ8RJo89JE
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 11KB
SHA256 70a6cf268c013fb4d907bedc12af3e5f802f179f0cc8353c7b8227dde840d31a
MD5 cd56e155edf53e5728c46b6c9eb9c413
SHA1 14b1b0f090803c9ee39797aed4af13dc7849566d
SHA512 a4ada455d44a89fd2baa505aa9266b70913967b839522ef5da8d7afd31af6662c3ad96ac3e3531d82a72be7d019c9d88f1ce391c5b5fa0e4422a634c51491165
SSDEEP 192:nJAFJr9oBiV7vi12YJrtkp1NDu6Aksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo1g7puF:nJWJVq12krtuJqpmXmlJVjeQ8RJoq9JE
MD5 SHA1 SHA512 SSDEEP

Submit Download

NDFF5D9.tmp

Path C:\Users\Admin\AppData\Local\Temp\NDFF5D9.tmp
Size 3KB
SHA256 904b48d7f7c6f079ddf5453bfe05bd98118a7e69d0bba17a75f2209a7a5389bd
MD5 e310e5578a38aa0803fe501af84e061d
SHA1 ec4e52893b7da842778df8d6658b356de731249b
SHA512 36465ac3ee139947b6623b0efc85cbf66dc8640dbb41abb613057b7d4b48e816bb67cc4893bd994f4f81d2978397f0a8361b2300eb5fb38cb0dcf01a546bceb2
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_tilfyhue.kqq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tilfyhue.kqq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

NetworkDiagnosticsTroubleshoot.ps1

Path C:\Windows\TEMP\SDIAG_484e4bf9-e40d-47c8-8039-5075b7ce62d4\NetworkDiagnosticsTroubleshoot.ps1
Size 25KB
SHA256 e3940266b4368c04333db89804246cb89bf2073626f22b8de72bea27c522282a
MD5 d0cfc204ca3968b891f7ce0dccfb2eda
SHA1 56dad1716554d8dc573d0ea391f808e7857b2206
SHA512 4d2225b599ad8af8ba8516f12cfddca5ec0ce69c5c80b133a6a323e9aaf5e0312efbcfa54d2e4462a5095f9a7c42b9d5b39f3204e0be72c3b1992cf33b22087c
SSDEEP 384:UlSoNnCiXTShob5bbVbgWT6rZTvxlBNexTKmh+xdxBUNQGJ:GSo3h8Jq
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartDPSService.ps1

Path C:\Windows\TEMP\SDIAG_484e4bf9-e40d-47c8-8039-5075b7ce62d4\StartDPSService.ps1
Size 567B
SHA256 d19677234127c38a52aec23686775a8eb3f4e3a406f4a11804d97602d6c31813
MD5 a660422059d953c6d681b53a6977100e
SHA1 0c95dd05514d062354c0eecc9ae8d437123305bb
SHA512 26f8cf9ac95ff649ecc2ed349bc6c7c3a04b188594d5c3289af8f2768ab59672bc95ffefcc83ed3ffa44edd0afeb16a4c2490e633a89fce7965843674d94b523
MD5 SHA1 SHA512

Submit Download

UtilityFunctions.ps1

Path C:\Windows\TEMP\SDIAG_484e4bf9-e40d-47c8-8039-5075b7ce62d4\UtilityFunctions.ps1
Size 53KB
SHA256 3891846307aa9e83bca66b13198455af72af45bf721a2fbd41840d47e2a91201
MD5 c912faa190464ce7dec867464c35a8dc
SHA1 d1c6482dad37720db6bdc594c4757914d1b1dd70
SHA512 5c34352d36459fd8fcda5b459a2e48601a033af31d802a90ed82c443a5a346b9480880d30c64db7ad0e4a8c35b98c98f69eceedad72f2a70d9c6cca74dce826a
SSDEEP 768:AaDgc60FE2UMeV6HQEqEVBWMBaRNdKdNh5BIW6Mk7svkxtFJuAQQW:j0a4bKcW6MkcSuj
MD5 SHA1 SHA512 SSDEEP

Submit Download

UtilitySetConstants.ps1

Path C:\Windows\TEMP\SDIAG_484e4bf9-e40d-47c8-8039-5075b7ce62d4\UtilitySetConstants.ps1
Size 2KB
SHA256 de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f
MD5 0c75ae5e75c3e181d13768909c8240ba
SHA1 288403fc4bedaacebccf4f74d3073f082ef70eb9
SHA512 8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b
MD5 SHA1 SHA512

Submit Download

LocalizationData.psd1

Path C:\Windows\TEMP\SDIAG_484e4bf9-e40d-47c8-8039-5075b7ce62d4\en-US\LocalizationData.psd1
Size 5KB
SHA256 1ccd68e58ead16d22a6385bb6bce0e2377ed573387bdafac3f72b62264d238ff
MD5 91f545459be2ff513b8d98c7831b8e54
SHA1 499e4aa76fc21540796c75ba5a6a47980ff1bc21
SHA512 469571a337120885ee57e0c73a3954d0280fa813e11709ee792285c046f6ddaf9be5583e475e627ea5f34e8e6fb723a4681289312f0e51dc8e9894492407b911
SSDEEP 96:HDmw/9nwbgDwlwn0iYveuQzRkkwj0pD+Eij4FvJG5B9c1rO4L:HDZklGeKxGfw
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagPackage.diagpkg

Path C:\Windows\Temp\SDIAG_44968834-5882-45b3-8488-d7e4f91779ba\DiagPackage.diagpkg
Size 163KB
SHA256 284a7a8525b1777bdbc194fa38d28cd9ee91c2cbc7856f5968e79667c6b62a9d
MD5 0606098a37089bdc9d644dee1cc1cd78
SHA1 cadae9623a27bd22771bab9d26b97226e8f2318b
SHA512 0711e2fef9fde17b87f3f6af1442bd46b4c86bb61c8519548b89c7a61dfcf734196ddf2d90e586d486a3b33f672a99379e8205c240bd4bcb23625ffb22936443
SSDEEP 384:X+BeLgtgFgQg7rgZgp3vFD2smEtttbkcL5Of8hj1fVh1f8hWqEfVhnq2fVhMfxhd:XLgtgFgQg7rgZgplP/s
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagPackage.dll

Path C:\Windows\Temp\SDIAG_484e4bf9-e40d-47c8-8039-5075b7ce62d4\DiagPackage.dll
Size 488KB
SHA256 35fa9f66ed386ee70cb28ec6e03a3b4848e3ae11c8375ba3b17b26d35bd5f694
MD5 ec287e627bf07521b8b443e5d7836c92
SHA1 02595dde2bd98326d8608ee3ddabc481ddc39c3d
SHA512 8465ae3ca6a4355888eecedda59d83806faf2682431f571185c31fb8a745f2ef4b26479f07aaf2693cd83f2d0526a1897a11c90a1f484a72f1e5965b72de9903
SSDEEP 6144:4ZC0lEOC2Us6eEyAc0jbJYOjlCLHUZQsxjuaJ7oSEvcdfSc0jbJYOjlCLHUZQ:4ZFLUe6vJ/wLIvavyfEvJ/wLI
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagPackage.dll.mui

Path C:\Windows\Temp\SDIAG_484e4bf9-e40d-47c8-8039-5075b7ce62d4\en-US\DiagPackage.dll.mui
Size 17KB
SHA256 502abf2efedb7f76147a95dc0755723a070cdc3b2381f1860313fd5f01c4fb4d
MD5 44b3399345bc836153df1024fa0a81e1
SHA1 ce979bfdc914c284a9a15c4d0f9f18db4d984cdd
SHA512 a49ba1a579eedca2356f8a4df94b1c273e483ceace93c617cddee77f66e90682836c77cea58047320b2c2f1d0e23ee7efa3d8af71e8ee864faef7e68f233bec4
SSDEEP 96:PTbJmdYVotzW1xcFjPe/dQTVOd5RLQ9/5HgVqz+4MLRvTLGlyQzwv7KCbVeog3++:Lx1xyexdXeoR4gsgKszWCTWp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/6292-633-0x000001A95C5A0000-0x000001A95C5C2000-memory.dmp

Download

memory/6700-660-0x00000168DD970000-0x00000168DD971000-memory.dmp

Download

memory/6700-656-0x00000168DCFB0000-0x00000168DCFC0000-memory.dmp

Download

memory/6700-652-0x00000168DCF70000-0x00000168DCF80000-memory.dmp

Download