hxxps://cl[.]gy/RvCuW

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2024, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cl.gy/RvCuW
Sample240717-dss2wstdjl

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133656599122744470"	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
3224	msedge.exe
3224	msedge.exe
4604	identity_helper.exe
4604	identity_helper.exe
6108	msedge.exe
6108	msedge.exe
4116	chrome.exe
4116	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 4912	3224	msedge.exe	84
PID 3224 wrote to memory of 4912	3224	msedge.exe	84
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 1564	3224	msedge.exe	85
PID 3224 wrote to memory of 2636	3224	msedge.exe	86
PID 3224 wrote to memory of 2636	3224	msedge.exe	86
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87
PID 3224 wrote to memory of 4288	3224	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cl.gy/RvCuW
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc365846f8,0x7ffc36584708,0x7ffc36584718
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,11506489475172759445,15398461112881610507,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,11506489475172759445,15398461112881610507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,11506489475172759445,15398461112881610507,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11506489475172759445,15398461112881610507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11506489475172759445,15398461112881610507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11506489475172759445,15398461112881610507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11506489475172759445,15398461112881610507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,11506489475172759445,15398461112881610507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,11506489475172759445,15398461112881610507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11506489475172759445,15398461112881610507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11506489475172759445,15398461112881610507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11506489475172759445,15398461112881610507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11506489475172759445,15398461112881610507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault84519ca3hb1e7h42e9h8cd5h78747a16e894
1⤵
PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffc365846f8,0x7ffc36584708,0x7ffc36584718
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,5878427249730354758,17165512502278295716,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,5878427249730354758,17165512502278295716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,5878427249730354758,17165512502278295716,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:6092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:3260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xfc,0x124,0x7ffc2727cc40,0x7ffc2727cc4c,0x7ffc2727cc58
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1960,i,8506120849062866969,5883309844272513327,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:5576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1844,i,8506120849062866969,5883309844272513327,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,8506120849062866969,5883309844272513327,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2384 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,8506120849062866969,5883309844272513327,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3240,i,8506120849062866969,5883309844272513327,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4016,i,8506120849062866969,5883309844272513327,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4460,i,8506120849062866969,5883309844272513327,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4900,i,8506120849062866969,5883309844272513327,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Program Files directory
  PID:5876
- - C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff64d084698,0x7ff64d0846a4,0x7ff64d0846b0
    3⤵
    - Drops file in Program Files directory
    PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4512,i,8506120849062866969,5883309844272513327,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4408

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:5984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9997e351-4991-4848-991e-081dca228878.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9997e351-4991-4848-991e-081dca228878.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 a023e2c0f402e4835ad6e4b772f9937e55d39123eb46be17c65e6818561b6b31
MD5 3a5979136fb275715ee84ace85e12b3e
SHA1 dc3c84f730061d4fe59f7cabe60451533cdf541d
SHA512 29e35f6456dd2a7207a62787c163a7543fddccd8b82e8cf3170751eb83ad838ca07992099358bb05189c3b0636b5475fc6f6840534c382ad1642943c5bdb9698
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 211KB
SHA256 043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
MD5 151fb811968eaf8efb840908b89dc9d4
SHA1 7ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA512 83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
SSDEEP 6144:U1jkj9l1xrxCD7bj/M3QiwUwTLo2xZ/gKep:U1uxxNQ7PMATU8o2xZ/jep
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 f34a435d1a82cb5ab363bec5744d93d66784db0107324849ae5b31fbf5e03a25
MD5 059b94feb3e7c97b23ed4a59d79da433
SHA1 035e532b80d88a94d2d98b3e3391a52ec2e84016
SHA512 3b4945b64961b29955edfb293950ae105219e8dbbe0fddb82c4c5c5b19052c6083eb08f71756f53b19d864bb1ab799e3254c7e080b16658c6406596d7cf0d46d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 0b6aadc825b6f3353199db4da9a014b50efc2faad54dbe4839068726d3e997dc
MD5 f5e46deb97a4081323363af4c13fd2b1
SHA1 edee46d2e241e7c7bbbff638fc5b3b763e6c6eb7
SHA512 b2bb971cdc6827befa4fd93b2f9436c250da421c412691264d740cb7f8ba1ea4c391cba7f3614907949d2546c46d08c55b9f7c0510e1f2ef5f1385195ecc268c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 a32cff1744bbc079e6b52e286ebfecd94df7ff9c3b418b7d0bd38268bec9bea1
MD5 28fcec70d211b011cfab1522f03fdb8c
SHA1 0328863c029d591ad4eb6d727f1afeae03250217
SHA512 c27cc89a2e447fc91f483f208a75aa30fddff49b253057e500a6bbe4c78b439db9e8d28863534ad26322c9231de4480d3933eb908f43244e82025179ef8541d2
SSDEEP 192:nnZ9dvDjE0e17HV+Fibu7MkwlrJLIPo6yIsnVdg4:nnZzbOTG2uInLc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 3977794c3fb96de61fe28f07604115556682d325b305e642df3b291b39c96cfc
MD5 cfe41898c744eaa8d314470d2da1af74
SHA1 84e2dcc51031f9c7c88015c20ed809ca94307090
SHA512 ed19cea2e429913565a31de37440f3c3f1209ecd1d6d6c18ad2e4f1763d189ced40e3dd55b21036a165999336f354e7bc4ef3fa42e3de8cda8f60190c1866cb5
SSDEEP 192:nnZ9dvxE0e17HV+F9wkCMkwlrnLIPo6yIsnVdg4:nnZzUTG6kf5Lc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 80746560d8f96ce44b177920bd5f90dcb23a800fb61ebb2a3317afd06c429573
MD5 dad6ed7ef34f598df1028d15dc9747f8
SHA1 8339106110325fa30fb26dd178bc547294ff4604
SHA512 62645ee3918a32d0fae23cffc3ea7bc56b20d930806f540d2d6bafe389972af48d458bd8e682bce122827f9209be0f8b6c50b2395f328c33c52d65a41562677e
SSDEEP 192:nnZ9dvgE0e17HV+F2mIZsd2MkwlrnLIPo6yIsnVdg4:nnZznTGysV5Lc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 9f696328e867985feb17b4a1e154bef891f4bad0114056d4cf0cf635fa175906
MD5 41bfd521ce8a0576c7410fcf9ee296cb
SHA1 0216684dace8a34b923b725f177030485cbd5771
SHA512 4c4c4816b2feea354add59218ff99b2ea77e940c7444b7715c87c0e68f81d08b24ec5b5f344799e0c4eaee5a5a8e609bc6918a6107cd1499897a98e43d3156f4
SSDEEP 192:nnZ9dvxE0e17HV+FkViJMkwlrJLIPo6yIsnVdg4:nnZz0TG6i+nLc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 54e938680a9ba0b72a8b25c6c0af9901b7e81f718c94cfb4bc6cf970d094e2bf
MD5 d138500cada2ad42df5581d9dec825ee
SHA1 a65206daad6db7e4e0735b603eb94d30609b3282
SHA512 aa763c36e1d55ef297fcc571f37c099144160579d34508372cd62cdca66ca374cacce2606c2cedb06259d70334d44112baef3616748294b45a4df16b381539ac
SSDEEP 384:44vA7pLhLcsBApXWr1kXqKf/pUZNCgVLH2HfPgZrU3kHGVu9E+c78/:4CA7pLhL9qtWr1kXqKf/pUZNCgVLH2He
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 184KB
SHA256 bfff562ea59262db5bc49f7eea5f9b967da727638f7ad120ec77b99240f59bd3
MD5 e0fc4f254975bbaff060b128f4c76f4d
SHA1 0fe09cbb215caa7c8886afbffe63d60a669a19f8
SHA512 7e049af3a4b757161211a8e3d6fe91bbe1c52f47850a0d10849279d21650b16c6797f5d05b68084334811dc364fe60f922b635a24934f9a3a8e8fab368862cb9
SSDEEP 3072:klgbh0CMw+WN60JVEJ13YAEsYEEJ9jaczb6rBRPzkxp9n2G/F19cWtjc8kDi7KMA:lGrw+OyL3Yo1mqBR7+xLtjc3M051
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 184KB
SHA256 4a9c40aac73dd64f6a5e0cc1f8f03ed1bc150a08e81a3a0ec45287663a484a13
MD5 651acde0562292ca9c1ebb2e0cfa60be
SHA1 9098b2808c94397b31ddebd2a7aebb530eaad4a4
SHA512 56cb2913f57ba6840dca0f2700d83620bb4b4f9cc4c16eb46ee078b8886fc1e031090fc00a9f358302cdc8a698a8f234e41af318d6f0c32d4bb7e5c19dedb71a
SSDEEP 3072:Tlgbh0CMw+WN60JVEJ13YAEsYEEJ9jaczb6rBRPzkxp9n2G/F19cWtjc8kDi7KMA:GGrw+OyL3Yo1mqBR7+xLtjc3M051
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
MD5 584971c8ba88c824fd51a05dddb45a98
SHA1 b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA512 5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
MD5 b28ef7d9f6d74f055cc49876767c886c
SHA1 d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA512 491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a36b5b9aadf102c9389416f4c618673b3c92064eab0dade1e79f0829a5868b2
MD5 dc3ce42f5a495b4083ac12e6db4b9c5b
SHA1 b69d25919ada106f8bf3bd4fff492b420794e36a
SHA512 2213be8df9fae82566ac09f3349e2d6d1c6390710ded7c862328e68d88eb4771f409d01e08d7203b88c9546139f2aa975e84fa3c9608b1466b29775c40e269a0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d83509ae8b248257b32368f9bdfa308b77b52fbbaa517f489e469e5f38119aec
MD5 de854f6ed617fb3aeba88bf56f9060e8
SHA1 6d2b948808749899574b528be7f141830300f832
SHA512 0f5fc24f2805be90b34bcb9b1f3380a01a5bd5841da2fd946edf3e4f12c5ea23e67ceef5387b1425ff8db91162f52827ce9bfed6cf750b4341af48d8ee4ad599
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 c5d5be31d7c3398ef541d0e872f9ae77ac6fbacbec5522e78fc907c94c1bf6ec
MD5 6e7639daeaf6f5902667522114569ab1
SHA1 ee13ffadebc959218184f686dc9733ccb2bfd754
SHA512 2e5b40795be7e787238968de9a086e8202e5f3aadc060e620e9c637d51737388dd3c82991112de41958736346994432da2df5f197c9e5bd2bd4dbbd17ffcdf2e
SSDEEP 96:cBCyoQ8SI88R0HOZKBThrXttn1BTxWWqPiT6Oya6:uNojSIX6msVrXlnfx6
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 124KB
SHA256 04c28179ab61e814e377ce577565b98caf91959b6e6df52fddb44dd11f601f51
MD5 1ec1cd6ec792b741e411696b07b89e11
SHA1 6417918cbca7d2e10f9ffecadeb992a0dfb269ea
SHA512 eb5a51105a79c5425e78053a721e314d775957b48c1fcdb6a7cb377c5e6b7799913f2eb0fab30a661ba014d7e6673874f836ee136f2d2312e16bbfc18ae0d291
SSDEEP 96:L8GfN2kVU+bDoYysX0uhnyTpvVjN9DLjGQLBE3uo8q:oGl2kC+bDo3irhnyTpvVj3XBBE3u7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 3473e5296904bc8ab44ef112fbfefc3e622920c177305250fbd3921d8250c97c
MD5 3933f157b8c0c50314741a11306778d1
SHA1 024ba057f4c2d00307653258fbe82df4706de758
SHA512 116ef55ac133db95456d515b49fd8fdcaf90a8a9ed60a73d9eeb47a6124ef17afb373b609371680c3a4228e4abae66110dfbcaf8a7796b2981a3d119b0a5985e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d5acd10542ce6d24ffeddfcb4bfa862fb729c6faa890a5cf364f3012c718d8fa
MD5 5f9dbbea25091d1c68718491a8bb84c5
SHA1 51ddf29d225e3511e304821083d10e768c3b5d42
SHA512 236a1510414d0c16fd45a4d85a2db71ad1b80fab7863057d32dedb284880589aab052cba7c449db8c226b8c0c8bc2d0a7fc09e95dfdb96f51b9dc6bf894cbab2
SSDEEP 96:nGlk3xm/vQYmqWT1rNqwpvWMoiVmdeH1JjfUWQyV+VDCziEwb:nKkckbFNqGWMXPro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 94400157d9a7178849cb36fb79a9d1d14adcb4cec5b02d4f1fef4be41d2fee11
MD5 61383866703abb2fbe9def3f028a9a7b
SHA1 7fc68ee67d7f86a493ff975ec5908401fd6e2a66
SHA512 d7a40255d02ae336f1352b6a2cbbef2f34d0f2ddc723f891dacd83e1eac90eac02d868b6fc747636c430e349eba4e3c11e4b8d88f603c63c6ba93cb496b0c113
SSDEEP 96:nGlk3xm/vDmqWT1rWqwpvWMoiWR5mdeTuz1fbagGeBy21JYfUWQyV+VDCAiEwb:nKkcibFWqGWMWBuzdaIBy2mrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 2fe30cee504bd253e367e5a933f27c02d7901f697c2f6eca901ed7ae55c4129b
MD5 ff6311bd7e40a91e74f9e18c29c0dc1b
SHA1 a92969f43e66d36ba2eaa86b42930be02ef492ef
SHA512 77bdbf6e54281148c03fc5d20a400f9f3a70e6d37c26bf287e1d985635940359a42e917fae8600a8e988dd7ee95269774644a61d1bcdb8718dfe7a0ac467826d
SSDEEP 96:nGlkckOxm/vDmqWT1raqwpvWMoiWRSR5mdeTuz15cYXZbagGeBy21JDayWQyV+VV:nKkckDibFaqGWMWgBuzPcYdaIBy2ilg
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 a1cd5da341da44dd191fcdf469268560c4b4eb404986c40e4f168cf86bda998e
MD5 fe324b9ade5a7e1862c8a2a9b5e0f730
SHA1 99b7c627ead63bd76599a7f2ba8cde90decc2e56
SHA512 f4cfc97b6a5be8fce36ae5c1de511788b19ab1a77fd4c428e822efb35a834a1dd4ab04203baae88221c98871965dd46753cd2f9ab1087f14d6466101391186fb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 fa3a77e2a31b0344699ce61caa04d62b5c9ddd43cff4c2ae1498795c2713ba3a
MD5 4f382f0aaa5a0180322f1f75152144c1
SHA1 155edd53b218f6cdaa2829af34e30f7c3b19ea8a
SHA512 7a78ccfff95d04aa835d365f6ba7a4cd740bef9650bdab9633c233c1208f4eec0a5ebba460f2b8b3d5cd3c46bf5a8ad7cc5d87c5f52dd453957ae827a7e0fa51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 04bf151985e3b8deb0eff98eec2ae3a35962ae41a5d637878976e6ac3e6b78bd
MD5 d4ab415b32ec807afec706bc7ede0831
SHA1 cfb1366ab8b6caed062f32e82327ff8999454c74
SHA512 0de7f26964aa11ac77f65b9ba096d06bcaf9bda8c77454d1c044cce4643e5e995ba1d03cdd803281209c3a390d52d78298ac5098c11ecf245f4bafe74403fec5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 960762403f65d04693850ec7e4cab220b17738d8b4c802f511185014d83ac273
MD5 53712af2d59244900238a3d84d8b39f7
SHA1 667ca35e3dde444d9d8a448e838ad768b4a2c451
SHA512 870f0b8d04282e3f98b9e22c6ad0af4eda9a669c695008358bfae8652992d5e6a90b131e93c4fbc705752831ab439dd25cf2af925dc263cb1c9e389f4cf48526
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 94ece6369a8300cd8a26c3044894c7b8a9998a3a5cf1ae6d0970ff77628cd62e
MD5 aa287bff69263c033ae58658162c0dec
SHA1 0b43c8c7db36048a62622cb79137aafeb0a8dcd2
SHA512 aee4f065033e30304c59ec1b594c0451aae3c8e9325ac0084569529649bca1dee307b6750a343d043a3a9c658963ed2f15adda34b160baeb8041beab40960d04
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57e82d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e82d.TMP
Size 1KB
SHA256 cc7bb8254acaf616431da005cef6f42535c15ef28248344b02a8d95084407b1c
MD5 87ff5d58084ac7b160cb140ee6816d75
SHA1 1c1fabf7510bf277a2856dd5fc6fd31a1e6e7dfa
SHA512 9443b0b47d5e0cd6020ce7041e4883f0907a11803d3e148cf9fa501dd7c7c595b531dec9b0041e4137d38a5796fec9bebf1713854ebeb0a40c8f9e5f90f45502
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Size 128KB
SHA256 7412c7a8fdbee20b0cb65bf86670251cbe0aa5d042a774bdc1aba28b84c56b69
MD5 9ca13a5430949725b4331fd5b15e8a82
SHA1 c35e5d9987b202cc9480ca0f88a06037b9d2f329
SHA512 a70d6b13f7404a6c7bc32ce953fc63997a4db8faff4c5d97e3649b99089895d7e5303dcf4a42912da1a62484e524169af6027378669ddc7c9a06e80a2b87521a
SSDEEP 3:ImtVznSq9R6l/o51Nj0cllll/9oADl/:IiVzSYUw5XeA5/
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 11B
SHA256 ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
MD5 838a7b32aefb618130392bc7d006aa2e
SHA1 5159e0f18c9e68f0e75e2239875aa994847b8290
SHA512 9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 bc97eae719ababc7ebb58846669758d1b264311a497238a5d3591a4912b46c84
MD5 8a032cf586abe0b0807d725198254d8e
SHA1 686943fbe05d557e6c545c0832bedc4502a86249
SHA512 f53fa0bcc5ada40749814aa54c9fed3dd7c572be4de4b5cff1abc6684c4f4de2808ec6d7305bce756e7a0c92ee842f28e4307eae5b0dd08514c44d85ea68bec0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuppQWde2RUZapeN4Rci9gpCM:A9iIxuERzA83h09RZxYBGNCcNpCkA8PZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 18f86b223f8a0043223c146baddd03a318ab076bf15e3f306ee91613bafaa28d
MD5 c4d4fc2a8bac6472d9d9fc18cac26eef
SHA1 e76d2879e0445d1be32920b8c27f420aa8d49a66
SHA512 613d5c3c1831d030664415021079a1ca033af35029e4d501afa0e162c9dd92d84305eadee6de63d933333a3ef715c56d9b7c6077a4598e720c1e2d60695b393f
SSDEEP 384:p9iIxuERzA83h09RZxYCnAN3cNpCkA8PmJO:SIxuERzA83h09RZxzaMNp7A8OJO
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 4cc70474ee28f0cdcaee4a18489c9d909ed8c647cf749c01dcec8b4bb6a55cb6
MD5 0eaf93261e2955826c180b58173a4292
SHA1 fcb3121d0c5d30e169b912e720c2aaf642330d5f
SHA512 a9d36b3a9cf61e5ce3c5d376d9292914831836e5a7e54d134d7ef711dfe68a65cb9787eee917ae0790e2dda94aa00347c2c7b37549fb3e6cce4ce4b66a6ad145
SSDEEP 3:MsEllllkEthXllkl2zE/l0K1:/M/xT02z81
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_shutdown_ms.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
Size 4B
SHA256 041e5704fe90f2f897fdad6c7d46637c360bcda6b259267fbec90b2e170f389d
MD5 d9bd42488097eef3f26c7ae2a4b1ba30
SHA1 a00315884e368332987740b209c7f4934890ef96
SHA512 db403bf1866fd4f264f611f39f175a5fde56f972c156a4d93e982b410a721bf05f10c3f5fa03d56f9bee9412871a24c3f89a5ed4646e7af5dcc81f264a6ec6b8
MD5 SHA1 SHA512

Submit Download