hxxps://bazaar[.]abuse[.]ch/sample/1d54322168b05c28662453aaf2ddac6028364a138a55631f11f8c581eb01dac5/

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bazaar.abuse.ch/sample/1d54322168b05c28662453aaf2ddac6028364a138a55631f11f8c581eb01dac5/
Sample260508-tgxtpsd17m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3888	chrome.exe
2472	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227297495584358"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714754311-527593155-1440850301-1000\{73865D1A-34D7-4FDA-8CD3-2DC6EE232756}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714754311-527593155-1440850301-1000\{E954166F-DAAE-4658-8B71-94CF392C68C1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3404	chrome.exe
3404	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 4512	4620	msedge.exe	84
PID 4620 wrote to memory of 2472	4620	msedge.exe	85
PID 4620 wrote to memory of 3836	4620	msedge.exe	86
PID 4620 wrote to memory of 3836	4620	msedge.exe	86
PID 4620 wrote to memory of 3836	4620	msedge.exe	86
PID 4620 wrote to memory of 4700	4620	msedge.exe	87
PID 4620 wrote to memory of 4700	4620	msedge.exe	87
PID 4620 wrote to memory of 3768	4620	msedge.exe	88
PID 4620 wrote to memory of 2948	4620	msedge.exe	89
PID 4620 wrote to memory of 3768	4620	msedge.exe	88
PID 4620 wrote to memory of 3768	4620	msedge.exe	88
PID 4620 wrote to memory of 2948	4620	msedge.exe	89
PID 4620 wrote to memory of 2948	4620	msedge.exe	89
PID 4620 wrote to memory of 2288	4620	msedge.exe	91
PID 4620 wrote to memory of 2260	4620	msedge.exe	92
PID 4620 wrote to memory of 2288	4620	msedge.exe	91
PID 4620 wrote to memory of 2288	4620	msedge.exe	91
PID 4620 wrote to memory of 2260	4620	msedge.exe	92
PID 4620 wrote to memory of 2260	4620	msedge.exe	92
PID 4620 wrote to memory of 2036	4620	msedge.exe	95
PID 4620 wrote to memory of 2036	4620	msedge.exe	95
PID 4620 wrote to memory of 2036	4620	msedge.exe	95
PID 4620 wrote to memory of 3028	4620	msedge.exe	97
PID 4620 wrote to memory of 3028	4620	msedge.exe	97
PID 4620 wrote to memory of 3028	4620	msedge.exe	97
PID 4620 wrote to memory of 3032	4620	msedge.exe	98
PID 4620 wrote to memory of 3032	4620	msedge.exe	98
PID 4620 wrote to memory of 1744	4620	msedge.exe	99
PID 4620 wrote to memory of 1744	4620	msedge.exe	99
PID 4620 wrote to memory of 764	4620	msedge.exe	100
PID 4620 wrote to memory of 4368	4620	msedge.exe	101
PID 4620 wrote to memory of 4368	4620	msedge.exe	101
PID 4620 wrote to memory of 2480	4620	msedge.exe	103
PID 4620 wrote to memory of 1168	4620	msedge.exe	111
PID 4620 wrote to memory of 1168	4620	msedge.exe	111
PID 4620 wrote to memory of 1896	4620	msedge.exe	112
PID 4620 wrote to memory of 1896	4620	msedge.exe	112
PID 4620 wrote to memory of 4212	4620	msedge.exe	113
PID 4620 wrote to memory of 4212	4620	msedge.exe	113
PID 3404 wrote to memory of 3640	3404	chrome.exe	118
PID 3404 wrote to memory of 3888	3404	chrome.exe	120
PID 3404 wrote to memory of 3444	3404	chrome.exe	121
PID 3404 wrote to memory of 3444	3404	chrome.exe	121
PID 3404 wrote to memory of 1740	3404	chrome.exe	122
PID 3404 wrote to memory of 1740	3404	chrome.exe	122
PID 3404 wrote to memory of 3364	3404	chrome.exe	123
PID 3404 wrote to memory of 1216	3404	chrome.exe	124
PID 3404 wrote to memory of 3364	3404	chrome.exe	123
PID 3404 wrote to memory of 1216	3404	chrome.exe	124
PID 3404 wrote to memory of 3308	3404	chrome.exe	125
PID 3404 wrote to memory of 3308	3404	chrome.exe	125
PID 3404 wrote to memory of 2016	3404	chrome.exe	126
PID 3404 wrote to memory of 2016	3404	chrome.exe	126
PID 3404 wrote to memory of 2380	3404	chrome.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bazaar.abuse.ch/sample/1d54322168b05c28662453aaf2ddac6028364a138a55631f11f8c581eb01dac5/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa4b06c188,0x7ffa4b06c194,0x7ffa4b06c1a0
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,145795499135302396,7921292598256477500,524288 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,9558032683985937636,1676052272164847458,262144 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,17959353858026886205,2779760960784532018,524288 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,4818335365417965390,11007053042090955471,2097152 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,14216938153339506235,18406047645582566239,2097152 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,7373531828292862489,13869880113967472483,2097152 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,10253996254049046460,12260732525874066700,2097152 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5128,i,9858549871717691322,6515830434003817136,2097152 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3504,i,13205908928248784692,14994703084551796682,2097152 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,4849394727873649635,10431935554726168731,524288 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,414414261519580229,3032130368081427958,524288 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,2213667194721532824,9054016937325619757,524288 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Modifies registry class
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,14449640613678384084,8156457170609022379,524288 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,4306330233813803366,15129837253966737412,524288 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,4306330233813803366,15129837253966737412,524288 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,17960982789885833573,17920513128873789581,524288 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,4490761604998465774,4835769790300689373,524288 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,7243223226417114645,11929311519780216952,524288 --field-trial-handle=2348,i,15858803700600274766,10898038494054101185,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa5722c728,0x7ffa5722c734,0x7ffa5722c740
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1984,i,3864788711606432515,10050678299539929538,524288 --field-trial-handle=2040,i,6694818243616131666,16158873364862793161,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,12014376603134141507,3013127041244891559,262144 --field-trial-handle=2040,i,6694818243616131666,16158873364862793161,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1760,i,8060568106197205620,18114116870745127477,524288 --field-trial-handle=2040,i,6694818243616131666,16158873364862793161,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,9991412300388478325,2013820619544467492,2097152 --field-trial-handle=2040,i,6694818243616131666,16158873364862793161,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,15854727509133235159,6468055159966150554,2097152 --field-trial-handle=2040,i,6694818243616131666,16158873364862793161,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,14316158377302949021,694524167535078455,2097152 --field-trial-handle=2040,i,6694818243616131666,16158873364862793161,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,1960515752843490117,14683203592124647617,2097152 --field-trial-handle=2040,i,6694818243616131666,16158873364862793161,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,3662451546432965926,6853004884701560057,524288 --field-trial-handle=2040,i,6694818243616131666,16158873364862793161,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:2380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 383a9eaed0f3247ae567bcddd0f43c58994bb8ceb50dbfa0fdd6ffb2acf4ee87
MD5 18bea8a7de252c9403bf5c60ad5d386f
SHA1 0c7f813bdb1ac774b04ffa90715e26c052554132
SHA512 1ce31652b1dd1929ab6a2b79537694b70c6bb1b7e753b33328a935b069555aad6ff69d0233204f0510ef279e174904726b1b89329c52dec0ad25af8fe461d661
TLSH
T1F6E022AACC26DC771CFD0B6861454B46E76027672791C91F3B3CE20D8FB167A46C286C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a5711e625ee437fcf750253360d237e6a59bd008770f192620abd7621c9a08a9
MD5 6e78a7c5ba492ca2ae10c715661517ba
SHA1 453f55ea4bfeea7aed93e2526e197e75aeb03610
SHA512 b0f52e295e704335c42cb3c35c3f305ebc15c1ca441fb528865a0f0a9eb4fa8d300af3fdf3b679bae180feca9d1474db346a1f4728f3d411b0d8857d437e29f3
TLSH
T187518CF393E8897D851192F4EB21AE2FDD790A14131C3C66C9D4AE0B43F6972D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 8f7ea780f8b82666bd6125a670382026186ff09eb9636fa19bef0915858d75ed
MD5 aa8031249c10833b98dea2aedd5a4c9f
SHA1 0fe74dc56914a8de0b919dba09223ae3d89eb19c
SHA512 60573028790134b5449cff192a60de8a939da44c7a517eb324e76d96e78b4101c7aa7cde6bae85f8c946d3959bf116191dfe176104b57344f48d9444c29a7da3
TLSH
T138F059A7E7FE782790BD88779E04B8056479B871029164F5CFAA41BEA0856E70F02413
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 47a387b68c37a19652734dc619561f8d90b34759f06853a2ef974792fbe388bf
MD5 893e13c34e5d18b770b70f451f2b8ed6
SHA1 3279bb881632302904a818618fef92d0b09ed2da
SHA512 d790581675ffbd5546c029f255df484f2e4412b3ccd389da32615aa77162f2725408790aa72324e784740373982b56b758714053b89e7306c1ba3f6027d7388b
SSDEEP 192:dRssOnv8N5MgeVv7rhAPRp2m98Hsb+WNn7b02kFZQpLtpuTqxtVyIsnAUgtaJ:dRs3EN58lH8XF6wP0/FZQtHuTE78
TLSH
T16342D72EB91479BB5CDBC229FD267757D7F2102120952E84EAFC8A3C15EBACD2217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ee70f129f196f875ace9fc5a4d2321f0ab34ba44ac2f0523a972da7bac600b42
MD5 b385e9e1396cc43f2e5c8c36abd65c66
SHA1 85f998b483b2720a73948e9a3bb471e75af531e8
SHA512 598cb82bcb549fff5fdfae1b2f1499478d2bfd035b613403a3458424f221e9208b103f47c6a5ac6a84906cde8192b5d7a71b311455fdadee66a9c1a444a7baaf
SSDEEP 192:dRssOnv8N5Mge6v7rhAPRp2m98Hsb+WNn7b0HkFZQpLtpuTqxZPyIsnAUgtaJ:dRs3EN58WH8XF6wP0EFZQtHuTEN8
TLSH
T1A142E82EB91479BB5CDBC229FD267757D7F2102120956E84EAFC8A3C15EBACD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 03973a25da0021eab19b8f1369a5523343654f3887234a1e1cc301245a48728d
MD5 e96921d5ae30116aafe48367f7ac6695
SHA1 c6641ccac61c68d82ff32eff425c15feb5074091
SHA512 7547cbfa0fc206b66f70451b792b574afeb0e98365fa6e0b5000e8553976425c99b5d9d4c5ead0b18d87bd8ab8100bb185fc97363145cbc0d2cc4cf9b3e8d865
SSDEEP 384:MajIf7KxkXqKf/pUZNCgVLH2HfgslPa7pLuLcifqrXODID+ErU36SHG6+AwTlTNv:MKIf7KxkXqKf/pUZNCgVLH2Hfgs9a7pb
TLSH
T1A1720B777C4C9E7B0F94C6C8D8167E4FADB6024A65DD886482FB982A03D4BCF114A1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c34d3474f1a0f939f6f48895f03b6ef2ab495c7d0667881a34c93efb3f5674c4
MD5 bed72d363e685bfc5b85dc6025a1ff65
SHA1 b4a2f1dbab709fdd09e0b3d6f3cc31241fa45141
SHA512 fc982a6f4f8aefd5eeb1a6b8d29129003fd45de30f3b7ce739ee1ce40bf4ccc312a0f1ca4f7e852136c564534fb3d272a766a51c10562c54da48ac8bcca0e828
TLSH
T1EAB0121080426942C04303B011A2258835149F168B09230177E07979ED2E2B14114190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a668.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a668.TMP
Size 96B
SHA256 73a772c14f467c44e1732bdf740b2b334a44d79ba69e6d06dbeab1e430863697
MD5 7914c790e91309738dfb511f23d6c96b
SHA1 bb35c4d642ea8d279ce52a78d4273e1f3c436e6f
SHA512 0ab096b3658dea31d2e9112a501aee2389f0b2f3599eea905876dc084dd6fa8da81782a4d236ad9b390e82c98d31f5d66a9e99cf82248a7c0d7ff2c35497b5d7
TLSH
T14BB02200C0023303C00303F020C0A8C8B2B0EF22C223220282F00FB2CC2023000322A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 8ab62272b9dc599de68f1c34f26aa76e6d88372e0325ea969a6ba657e5800245
MD5 f68e988e7c799ce9cf0ce92936efe787
SHA1 8d2a6504f2f0f09a06a3be7a2de4c9fe14ba8966
SHA512 aaed5a1bfda0a57e32bdf071fc0ac54452aa3fe5b61f585fe4e04d4b90bc2d94b8a819081c889c8b0f69a3469f9765f70a65dce72a23be021df3604c7ed95651
SSDEEP 1536:gBcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3b:U3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1249302BA5E2A4AE7957E469176AE7809CE12134D70AFA8CC316C539C21D01C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 3a3f233bda4ef4db97e07323a7e71e4ff0243edb2a4395e4831553d8065fdc67
MD5 7f052ef0f21fa3cd094e458ecd2ec37e
SHA1 a911dfb9e3b092e4ab861bd3dd6c5c134251c116
SHA512 6a6a260d23c23037c3f8f53f51b126ee23bee3544b3433ad77287c880c7ebdf151be94226a5c4f4a16d589dddbd5fc17355d21f6b5fc359db89bc4ad74c32cc9
SSDEEP 6144:QpwTqcG8BYI1OC25ncdWGcr1TfrOk0HOGm/SFyEEQ:Uw2mQC25ncdWNlrOjuGdF2Q
TLSH
T1F814126F6D2E6DE786BD11713519A819C826238C71DEE89C713C138D3EC12826F277A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 76e2cc1afba5efea41fef683d66532046c25a0014cba56f5606a85b9c8f3008d
MD5 2d00e518498e5a543e42b80444c34fbb
SHA1 ace4292881f2ad347cdd048807e75502b19a764e
SHA512 e2efaae3ac5b5975ab00c8a495f61a7904cf7ba09691d4fbf674ec557d52ab04d04c7d0dbb025dd522e568be911e79f48ba0c3e66cbac0e22e8c648045725291
SSDEEP 6144:VpwTqcG8BYI1OC25ncdWGcr1TfrOk0HOGm/SFyEEQ:7w2mQC25ncdWNlrOjuGdF2Q
TLSH
T1E214126F6D2E6DD786BD11313519A819C826228C71DEE89C713C138D3EC12826F277A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40aa7710-3810-4372-aea1-323f7464ed50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\40aa7710-3810-4372-aea1-323f7464ed50.tmp
Size 17KB
SHA256 b1f003a49179414cd25fa7168e63127d6ea913368f51293ecfd210ffd6b4a339
MD5 9b85e8972c60d8bfafb1c939c483fc55
SHA1 78212c34cc5db03f09e10605d64644831447c95c
SHA512 6098b622a5a4974f61efc9fea3f02a04c403fdb70b9e3a857a3039c688d3db63bf4a55ce6982ba2fed49401dffd42cd5349ed0036246812ca70df05accd5ddd5
SSDEEP 384:n0JsNQDxHMCZsqfX+yOlr7kOX3/AStMf/2cNI9FLGU8:0JdxsCJf7OVkOXYShT9ZGU8
TLSH
T12F822BB0E8A84CE744E1D5C4F546F6532EA80137C9895E5CE2F8BA3D319F9FC2716816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 329f09584b2d1b595fd09386d31dbe1eec1906f7d450ee40fb405617035e9b3b
MD5 c89978251aec9d90daf9a199726976fa
SHA1 72d52e478c5ea1ddaee134eed8228a6bfada9c3f
SHA512 898671bc521bd5dc24824557f42f33f18007179c03133a4c176d62af1a4afb01dd96179fb320915cfa4fc4d3e62c77cc770436b76ebeb4b092c4a313f9100f39
TLSH
T140D0228CC300A820C3CC88B220ABAB88282AC820820282082CB2080C2C82282300E082
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 74f249529036c42c9d016245c175b4688339781a29fe75d208cff730a3c5f31e
MD5 f5c4ec409cf0f735baa8b7e0b1e5a567
SHA1 de403fe79aa251110fb5881c4436c539d972ae95
SHA512 1ec3c7d2044d0bcfe0d4078acfa86b0b95e278853347e7dee5a94636f9bdcedf29d6faf280551e59c1489eedcbef9a327077ae45d16315832c1fce3eeb432c67
TLSH
T15CD09265FB49F081C38E45B2E86283812A6A4A5076978609A864890EAC69A91B29D187
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 96d5b3b330c1b2eab97594cfdd9f51e68b08e3d988d94048e19a622613f384f7
MD5 0cb41152cc07888f091651ff679cd365
SHA1 c7fd6e063fa0444c32f188e9bc3a355682e7d619
SHA512 d4df02fbfab5d0fa71ee5aa3cb35c22dc269d2538618ddb332a709da7f9479b66b4e69369ecce1ac644f6a0999725c9219a8ec7e8804385f549558c188563376
TLSH
T19A61F94B8360A4EAD3E401B71EF9697A7E3883D4CA1B2E213EF0617F7805F11D085AC1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e3bae2c-96ec-4c3e-ae5d-81f008c0faa7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1e3bae2c-96ec-4c3e-ae5d-81f008c0faa7.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6a4f11db33355123ecc665daaffa19e5392220dc098bedf11cd5b6a3cd3451fe
MD5 a8e9a055fe48f46339dd77b6e18ada57
SHA1 576280987c8200261792e980834dac7962bbf928
SHA512 23636760f46299b183bc05416e332f94c983c91b7712dc4ff1aa0fdb38b07c7acc4dd2edea74926c7507c15124dcbbba4c84cba174d72f58d0d6178c0133e73f
TLSH
T1AC61B0F3C3E48A6ED92255F4A628BE1FCE5E0906432C3D1A85E49F4BD3E2074E141D4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 27666c71408de0829add71d7f45a3e6967be54442491e2c3787fb7bb855b3e79
MD5 af60796dc870df88599e1374071b1ad1
SHA1 ecb3b81831a044319a129027bf38edaee43e07fd
SHA512 fdf70db6e97f942ca796665f172de7e2aee734c114a25dfd4ebdc03fa32acc48d3840a030e60c7db6b7717f54664ad92a1a963a7b7e99156354d90f2f7146595
SSDEEP 192:sxZzRtyM/jK1Ml8Mko/fis6kAIdpwPHW6+WNIAw/+MpEWbReKZIg4J:sxZz7Mo/fis6kBKHbc/Tc
TLSH
T19652D912AA385AB78CDBD209F545BB53D7F50423A2944E84ADFC8A0C05E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ae28fb3afd1bbd8cb4e6996ea0ad39817ef6847cd0a160d7fed76797597a12e3
MD5 e2c7230f3ef8e848838861b0ba8da2ff
SHA1 de89ac44243c76f198ffd2cd96bfb0548ecb0715
SHA512 bb8294c775a5c649cfea901a7a84c0907618e4d3a55c1c41963e5fd8b991aaf349c7b7179b4e8dc5eb9cbb51b400bb9b6c67c8fb8789e7e273932b66f53c832c
SSDEEP 192:sxZzRtyM/jK1Ml8W9o/fisTWpVCkoBIdpwPHW6+WNcll7nNZ+MpE6ac4MZIgboJ:sxZz7po/fisTWvCk5KHbcb5ZhQ
TLSH
T15C62D912A9385ABB8CDBD21DF645BF53D7F5042292954E94ADFC8A1C01E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 84799d2eb0083cadc05bceaf697b5d376c60cd6035076d8ff8dd4a4ed58978dc
MD5 556c50026c7c3bc4ed1c3873d0a75b4c
SHA1 d44527260753d14732f607c3ff306a49f72841cd
SHA512 66db6f880b74a3fd71531873b4ac427bcff9c44de5462877e38bbdb01b57e1e1f75ef82152c5daa3b5bfe9c6a5fe8ffd50915703304ef04eab8b4591a1ecafc4
SSDEEP 768:+k0G9jJWvFnIP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV48LlSMdFnrozG:+k0G9jJWvFnIPu1ja18LcEF0zG
TLSH
T1D1E2093B280CCB7E4F844E9DEC2A6F966EE801CB96984D4447FA484C03C77EF551A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 34a1c3a0c8393b4819eb5dea0205cb188629ab1901ee5d702dda45bf992e59c4
MD5 bf9905e3309de3aae6f5f0b2fe3f2cb5
SHA1 dd89fd24810f576ec997e86db00c3c9fdffe48a9
SHA512 28509554cd8b1bc9a4ede118fc8cc3cd3cc6466368dd1138557f9797917ec072116124d37d4bafd0f9600bc72194306ad61e495d3489ec01ed2de5b6229e6ed6
SSDEEP 48:KskIfKt2cfydrI9Ko8QAzIRK0IcvytPI1KJ:KskAKt2WWrmKo8HzGK0I++PWKJ
TLSH
T182A11530353706822ABE298D96D5B41B66C230637129A92F7BFD14624E6FE10DCFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c20ff1278566b698c65cbbb5a000a86aba0fcb99b111dc31b44eb46ad2ab58ae
MD5 4cce4abe5acd5e244db24aec357bd316
SHA1 f828f010c0e8aa57f031b31ebe4812b9adb0b068
SHA512 234052c57577fcd1d215d561eafff3a03fd7158de4eb7323462bdc68867a870db6ea55214e00bb2ae2251ae180ac40e133ac5c06caecae68b6582c9d831f492d
SSDEEP 192:uu0HLsNBDxHQEGZ0ZynQmiU1yvQ47b+jeOVTr7HEO8LSqq+pU8:n0rsNBDxHMCZsefX+yOlr7kOXAU8
TLSH
T17532093179785CA79EE2AA45F44B37139FE4106B99C52FD8DADC4F1C00CB79C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fefe3ea9eae9d06133c9b7c995e24a4d22aad1bc1376af1b05e23d29c32fc7af
MD5 858ab7e04c213d43bb198a601d6c0d70
SHA1 42ecaeb26130bfecff0f1d47095b7e6b092a328a
SHA512 f659add669756dfb0265af17a9a77d5c8cc12347c24f36f5dab58fe96d7edb789d3e739c828bda826dee08d02fec3b92228a8de970828abc8bdba6bf6561ed8c
SSDEEP 192:hONs6TZ0JQmiUywE9ab+jeOVTr7HEO0cXqq+pU6:hONs6TCnI9g+yOlr7kOzAU6
TLSH
T112121A3169786CA79EE2AE46F44737139FE4106B99862FD4D9D81F1C00CB79C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a734bb011536d14586c779f29a507b7ece78e8074e219975fb3ffadaef5b2915
MD5 25078942cfa2adf5d7ecb8639d5cae40
SHA1 654ca1b9720bd7106ae3ac36c1443327bad00ab5
SHA512 66d3b6dc9383b92397aba1d106f2d833ea8be18a95df674ef0bfb34139bed91d45cdd17b0942eb9a11ddb3f8f680f5613ddb776ddd4c655dd53e0b394c67975a
SSDEEP 192:YONDR6TZ0qQmiUyIElab+jeOVTrYo85EU6:YONDR6TCmmlg+yOlrYKU6
TLSH
T178020935696C6CAB8EE2AE45F48B37275FE4107BE9D12B88D6D81F1C00D779C2307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

9438bc1e-6273-4f4b-a6a8-c62f5c3b4636.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9438bc1e-6273-4f4b-a6a8-c62f5c3b4636.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bc1ce50230093a6d22ad8ee8c71751a80984f1b07d312eb54d8df69844977802
MD5 4215807faa6f54143e16573d81ef0ea3
SHA1 a32b810cc483cae8bfc39760e480823f06de2c32
SHA512 2ce8f1cc18dcf6560fb3789d147068d19f2001d4066fc0b253f8a937efab32cd03fce8885a0983dcadafefd3af6d542b7d8628f1752d1731794c9f3171882500
TLSH
T17241FA5DABEE1144B3B76E5A9BF7A86D487A79772E06D15E00110E4F0573A00CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2480-212-0x00000201FAC10000-0x00000201FAC40000-memory.dmp

Download