hxxp://buzzheavier[.]com/k3bd1xsyjvwu

Resubmissions

25/06/2026, 14:51

260625-r8ar5scz9m3

25/06/2026, 04:25

260625-e16hmahv2j5

Analysis

user interaction
yes
max time kernel
272s
max time network
269s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://buzzheavier.com/k3bd1xsyjvwu
Sample260625-e16hmahv2j

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	30	https://buzzheavier.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a11135e48b497685	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1796	msedge.exe
912	chrome.exe
4220	msedge.exe
1216	msedge.exe
4276	msedge.exe
4040	chrome.exe

Checks SCSI registry key(s) 3 TTPs 16 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 30 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268351508659308"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{DCA5752C-FC33-427C-82A5-ACD3894D4204}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{CD56CFC4-4960-4A1B-B566-0E64AB60E9E8}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{E5F805E4-D54C-4B89-8BE7-CD53B5B71F6D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{CEF2D4C6-8911-49DD-8ACC-E38AF9DB4DCC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
4532	chrome.exe
4532	chrome.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
3720	chrome.exe
3720	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 48 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
3720	chrome.exe
3720	chrome.exe
3720	chrome.exe
3720	chrome.exe
3720	chrome.exe
3720	chrome.exe
3720	chrome.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeCreateGlobalPrivilege	3416	dwm.exe
Token: SeChangeNotifyPrivilege	3416	dwm.exe
Token: 33	3416	dwm.exe
Token: SeIncBasePriorityPrivilege	3416	dwm.exe
Token: SeShutdownPrivilege	3416	dwm.exe
Token: SeCreatePagefilePrivilege	3416	dwm.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3416	dwm.exe
Token: SeCreatePagefilePrivilege	3416	dwm.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeShutdownPrivilege	3720	chrome.exe
Token: SeCreatePagefilePrivilege	3720	chrome.exe
Token: SeCreateGlobalPrivilege	4800	dwm.exe
Token: SeChangeNotifyPrivilege	4800	dwm.exe
Token: 33	4800	dwm.exe
Token: SeIncBasePriorityPrivilege	4800	dwm.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
2460	msedge.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
2460	msedge.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 2460	4448	msedge.exe	86
PID 4448 wrote to memory of 1796	4448	msedge.exe	87
PID 4448 wrote to memory of 2216	4448	msedge.exe	88
PID 4448 wrote to memory of 2216	4448	msedge.exe	88
PID 4448 wrote to memory of 2216	4448	msedge.exe	88
PID 4448 wrote to memory of 2336	4448	msedge.exe	89
PID 4448 wrote to memory of 2336	4448	msedge.exe	89
PID 4448 wrote to memory of 552	4448	msedge.exe	91
PID 4448 wrote to memory of 552	4448	msedge.exe	91
PID 4448 wrote to memory of 552	4448	msedge.exe	91
PID 4448 wrote to memory of 3192	4448	msedge.exe	92
PID 4448 wrote to memory of 3192	4448	msedge.exe	92
PID 4448 wrote to memory of 3192	4448	msedge.exe	92
PID 4448 wrote to memory of 456	4448	msedge.exe	93
PID 4448 wrote to memory of 456	4448	msedge.exe	93
PID 4448 wrote to memory of 456	4448	msedge.exe	93
PID 4448 wrote to memory of 2516	4448	msedge.exe	94
PID 4448 wrote to memory of 2516	4448	msedge.exe	94
PID 4448 wrote to memory of 2516	4448	msedge.exe	94
PID 4448 wrote to memory of 3840	4448	msedge.exe	97
PID 4448 wrote to memory of 3840	4448	msedge.exe	97
PID 4448 wrote to memory of 3840	4448	msedge.exe	97
PID 4448 wrote to memory of 4484	4448	msedge.exe	100
PID 4448 wrote to memory of 4484	4448	msedge.exe	100
PID 4448 wrote to memory of 4484	4448	msedge.exe	100
PID 4448 wrote to memory of 3236	4448	msedge.exe	101
PID 4448 wrote to memory of 3236	4448	msedge.exe	101
PID 4448 wrote to memory of 3236	4448	msedge.exe	101
PID 4448 wrote to memory of 4152	4448	msedge.exe	102
PID 4448 wrote to memory of 532	4448	msedge.exe	103
PID 4448 wrote to memory of 4152	4448	msedge.exe	102
PID 4448 wrote to memory of 532	4448	msedge.exe	103
PID 4448 wrote to memory of 5100	4448	msedge.exe	105
PID 4448 wrote to memory of 1332	4448	msedge.exe	110
PID 4448 wrote to memory of 1332	4448	msedge.exe	110
PID 4448 wrote to memory of 1332	4448	msedge.exe	110
PID 4448 wrote to memory of 3356	4448	msedge.exe	112
PID 4448 wrote to memory of 3356	4448	msedge.exe	112
PID 4448 wrote to memory of 3356	4448	msedge.exe	112
PID 4448 wrote to memory of 3672	4448	msedge.exe	115
PID 4448 wrote to memory of 3672	4448	msedge.exe	115
PID 4448 wrote to memory of 3672	4448	msedge.exe	115
PID 4448 wrote to memory of 5080	4448	msedge.exe	116
PID 4448 wrote to memory of 5080	4448	msedge.exe	116
PID 4448 wrote to memory of 5080	4448	msedge.exe	116
PID 4532 wrote to memory of 4720	4532	chrome.exe	121
PID 4532 wrote to memory of 2480	4532	chrome.exe	122
PID 4532 wrote to memory of 2480	4532	chrome.exe	122
PID 4532 wrote to memory of 912	4532	chrome.exe	123
PID 4532 wrote to memory of 2668	4532	chrome.exe	125
PID 4532 wrote to memory of 2668	4532	chrome.exe	125
PID 4532 wrote to memory of 4040	4532	chrome.exe	126
PID 4532 wrote to memory of 4040	4532	chrome.exe	126
PID 4532 wrote to memory of 688	4532	chrome.exe	127
PID 4532 wrote to memory of 688	4532	chrome.exe	127
PID 4532 wrote to memory of 3688	4532	chrome.exe	128
PID 4532 wrote to memory of 3688	4532	chrome.exe	128
PID 4532 wrote to memory of 2260	4532	chrome.exe	129
PID 4532 wrote to memory of 2260	4532	chrome.exe	129
PID 4532 wrote to memory of 3832	4532	chrome.exe	130
PID 4532 wrote to memory of 3832	4532	chrome.exe	130
PID 4532 wrote to memory of 2716	4532	chrome.exe	131
PID 4532 wrote to memory of 2716	4532	chrome.exe	131
PID 984 wrote to memory of 1628	984	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://buzzheavier.com/k3bd1xsyjvwu
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x23c,0x240,0x238,0x290,0x7ffa306cc188,0x7ffa306cc194,0x7ffa306cc1a0
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,9457475693296774770,14750644625204813911,524288 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,16867693753018238417,10964269210613840460,262144 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,6016207573142132505,8370414747372277771,524288 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,12365721321804803583,9229729918256147619,2097152 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,15706101014027518841,1225623526418401340,2097152 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,9465569790682272852,13873714897709911493,2097152 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,13289769169264904544,16384962218156762662,2097152 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3644,i,17741323504471036166,11932528745174359025,2097152 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5204,i,10962573811805416407,15249934338300192077,2097152 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3660,i,5635104511035928846,17443048057353086770,2097152 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,13422088954557704241,3682588113939017542,524288 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,6863015479170412447,2030759134642949213,524288 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,15990717187232547279,665859316361415748,524288 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,15990717187232547279,665859316361415748,524288 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6816,i,18035845696838057696,11189510923240067738,2097152 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5300,i,6342330494653161329,13667625905767533024,2097152 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5368,i,7660303194378075637,15904935224080292582,2097152 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7124,i,642078032640168978,3364708496125235518,2097152 --field-trial-handle=2160,i,13241112248804253003,10719220198561280894,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa30bbc728,0x7ffa30bbc734,0x7ffa30bbc740
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1924,i,6835074333664575583,7346149020570573371,262144 --field-trial-handle=1980,i,7099428018027147497,6736850797958139368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,14311982905226368744,2097584126182957708,524288 --field-trial-handle=1980,i,7099428018027147497,6736850797958139368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1652 /prefetch:3
  2⤵
  - System Time Discovery
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,10285095827485038167,5644713770060369832,524288 --field-trial-handle=1980,i,7099428018027147497,6736850797958139368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,16630967661672194445,9362935278262358899,2097152 --field-trial-handle=1980,i,7099428018027147497,6736850797958139368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3584,i,5730896562780216203,7552574901519936600,2097152 --field-trial-handle=1980,i,7099428018027147497,6736850797958139368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4620,i,183756477052054536,5783819489773727676,2097152 --field-trial-handle=1980,i,7099428018027147497,6736850797958139368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4596,i,6997599539195788125,14263041847850508360,2097152 --field-trial-handle=1980,i,7099428018027147497,6736850797958139368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4932,i,12696489116583949678,535771130325627966,524288 --field-trial-handle=1980,i,7099428018027147497,6736850797958139368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5060,i,1545730892815152368,381727976511377782,524288 --field-trial-handle=1980,i,7099428018027147497,6736850797958139368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:2716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x214,0x244,0x7ffa306cc188,0x7ffa306cc194,0x7ffa306cc1a0
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=125584844636336 --process=256 /prefetch:7 --thread=2776
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,3310609175068401610,10354753671773138519,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,16273781326343452262,696227302407886639,262144 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,4158572776399856842,8295868745950496595,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,1876591147153715540,6435545977485522138,2097152 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,13482398589256522438,996562861723037329,2097152 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,18004427213005599844,11677988146678589604,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,10538289671947889259,9454802256662041003,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5036,i,17011581547253627006,4874206375054032969,2097152 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5104,i,18280172414338138820,5656552285982468512,2097152 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,62488569970976900,11083796327159379239,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,9641842845999379035,13429430029609445067,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,13048023332588262602,10749960559784772340,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,13048023332588262602,10749960559784772340,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,8340761660048053999,14915016376095838154,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,3788043751456607315,3344767238782762231,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,13120505836785937359,11972091699312789741,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,13906027160969937564,16294203419410793465,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,16095610771628394996,949712479358864555,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6248,i,8376160145144163907,16837452992630832344,2097152 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:1
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6728,i,15881949079812873804,11123871272443651879,2097152 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4040,i,9892307338514603763,17744444061966504256,2097152 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,6494361111570178883,13223669685590785005,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:8
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,15477016866353300553,15645087318460530265,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,4356039337964228137,16016573745507216966,524288 --field-trial-handle=2072,i,1583915604698181393,17427109521199499317,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
    3⤵
    PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4764

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffa306cc188,0x7ffa306cc194,0x7ffa306cc1a0
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,15663484410726480822,9995725479624655027,524288 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,11601618068002140507,10940961074190582420,262144 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,1489117718937046192,18426900218668725460,524288 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,4082110304692148006,11134356036741690627,2097152 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,13340192821316985124,3577256537142469163,2097152 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3980,i,10506435540702904140,5322400114081294454,2097152 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5168,i,9293731435850697619,1459800096955462932,2097152 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,7988525108075424278,15180470003579045826,524288 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,9654145796976305258,11410518353786189943,524288 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,15972803793404022733,16768711359442044069,524288 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,15972803793404022733,16768711359442044069,524288 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6068,i,13884867126640924312,11175322834684592248,2097152 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6348,i,18242162330096048502,14062337704150096742,2097152 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6828,i,5277754030348050936,4974599001332578347,2097152 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6956,i,14477898303830776800,9176694253833825346,2097152 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7204,i,17975237246319368988,3570872308020518522,2097152 --field-trial-handle=2160,i,10505928637997263768,4230786599363981422,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1188

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\2b97b35cd8d74f92be5269a44898d045 /t 3620 /p 1812
1⤵
PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffa306cc188,0x7ffa306cc194,0x7ffa306cc1a0
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1804,i,11752066054021287379,3946014272126650373,262144 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,2348072064807189867,4962459233892209438,524288 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,17724517786035828127,15617223313795801020,524288 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,4440327714159859293,2687747546736780755,2097152 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,2194621537039781982,14582857875315538154,2097152 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4004,i,16939579264197873141,13304764163090083006,2097152 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5196,i,17777728890938670473,12815277684706768768,2097152 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5280,i,12064609959760562682,11525630494165238339,2097152 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5556,i,17596634986603359955,3613944583289886999,2097152 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,16887180113362796060,6862108143395269575,524288 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,173937762076156055,11484731685467340391,524288 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,10892693591637480286,5667039803546360242,524288 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,10892693591637480286,5667039803546360242,524288 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,8603704409548679126,2701702459635604534,524288 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,1438214203745811132,3463488787702517838,524288 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,306915055912621402,17155036039770629897,524288 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6048,i,8414639618645281483,17958220883655454681,2097152 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2460,i,11449081748547533392,791644928750881867,2097152 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4396,i,2887090883695157318,14498753217117690902,2097152 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,9787722538524912136,9724731627467950622,524288 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6800,i,11777272288555757001,8191914230253831160,262144 --field-trial-handle=2072,i,13270829092869585152,14636167401632191737,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa30bbc728,0x7ffa30bbc734,0x7ffa30bbc740
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,3830068326424280173,7468665899518471471,262144 --field-trial-handle=1988,i,7731670958760693637,7933894742454483976,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,13170803043712600249,12682477731291068301,524288 --field-trial-handle=1988,i,7731670958760693637,7933894742454483976,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,12900972787101080252,16677772308170175763,524288 --field-trial-handle=1988,i,7731670958760693637,7933894742454483976,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,15282512726323747746,9197732825511689035,2097152 --field-trial-handle=1988,i,7731670958760693637,7933894742454483976,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3488,i,7143055878454891695,3757377496170899201,2097152 --field-trial-handle=1988,i,7731670958760693637,7933894742454483976,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4544,i,6336358398669236430,9855953404256053120,524288 --field-trial-handle=1988,i,7731670958760693637,7933894742454483976,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:8
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4664,i,4802870447496187211,5427566239885352209,524288 --field-trial-handle=1988,i,7731670958760693637,7933894742454483976,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4820,i,17205296274936061537,1661689962855451372,2097152 --field-trial-handle=1988,i,7731670958760693637,7933894742454483976,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5108,i,9504872832947061710,12428959242885716785,2097152 --field-trial-handle=1988,i,7731670958760693637,7933894742454483976,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,2880287630593720053,2779911707609690729,524288 --field-trial-handle=1988,i,7731670958760693637,7933894742454483976,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5188,i,2544839330061949265,1993502552438211291,2097152 --field-trial-handle=1988,i,7731670958760693637,7933894742454483976,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5636,i,10180706331888738957,17426781804243221987,2097152 --field-trial-handle=1988,i,7731670958760693637,7933894742454483976,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5876,i,18170369727925732084,2703547213817524038,2097152 --field-trial-handle=1988,i,7731670958760693637,7933894742454483976,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:5892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3956

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 77bcdb2c3160a7fd4141144587938963255d18e2280ca048bae35e2b889daae1
MD5 f444c4b91d48467daad7fc304bf0b2b7
SHA1 0a54e0644c006f7b684b802915a76b0b9e907f2e
SHA512 954788cc6221a65dba3cd53452e7ffe912bdce7b20bd8cf2525ecbc1a2e6c0ba3448dfbcc8997d4347508beecb9ddb77704805450cb4090f76ac02aea569ca9f
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 21ae54f00800cfbe30fe38acb246b1ee3349d9804a5b316beeae932829f0abcf
MD5 0306747bb453f620b79c2348875cde52
SHA1 22ec7823b1a6d55bd8fcfbe1df40e5b8792bf94b
SHA512 2fcfce06153faf577b7d5b8a82710606b9c4615d88468ef0c70ea5e290c4960a1833eba81f9b63495fb9720ae5c4964a5f74ab9bfa5a6ddcc93bcdd8c6ab6dce
TLSH
T17EE0E59AC9219C3718FD071950A14609EA5513662E80491F7A3CC21C4FB162A4186C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d61835fc5739d76179479df35ca1cb16db77eda86571528490d3dc41b3f3673a
MD5 f389825ae21ccf96d13ea00203029a02
SHA1 803de7cc72dda0af93a919778a8fa0ecc3e77a73
SHA512 4a2e64295f2246e1e491daaa10258c4f19a5b77655fc0e6af857e93eaa0d8c58fabf11afaa5a9088e92f4b55a665c8bb1a88328c08a0973064e3f54f9143c361
TLSH
T110317CF7C3F4D97D8A1092F4AB156F1FCE690A24531C3CA688D46E1B43F2972D20069E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 17b227786636af46fb6b96404ddaa8c006ac98522aa95c9fb2778749bb8937b7
MD5 8958ee62bd8307045fdd5fec37b3bc38
SHA1 2917273294733d13c8238da6d47c130e0db7e9f4
SHA512 f6d2621109ec5c115e9bcee2b8d852f39b57415026d54bc7fb2d0ba1529884a4eb96301801a12be112d585e9885b5999052dba030e318e355e580a005a8cb132
TLSH
T152F0506BD66E701710BE45B71E04780978B56430039028F4CEDE412DE0824E31B17447
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3cc4dc2b6a959cd503863b8e793410d367a881efae7d94af1e92e25cfbbad17f
MD5 6d3ae7c3372a70c37a0a06cb98fdc2ee
SHA1 f00ac9b9e2e2422eb5c380d97910a0147b579cfa
SHA512 57a8e988427f8b5e9bd291e1442da4615b4478e6520e603bed82a06f4df523ac2ae00f93c4cc71b5a8cf9a67fa33a86e10d9af558e96c5eeb813eadf7275d306
SSDEEP 192:6RpYLGi1jbD+fv7hhAPRp2mPGw95Hsb+WNlmpJmIua9r2Yq2ySce4dQ+VyIsnAU/:6RpWPF+398XzrwTA232ySydQ28
TLSH
T18F52E82EB960553B4CDAC229F9117B1BD7F6107235901E40EAFC8A2C15EBACC331741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3d78f8bef32d82e3fe54e4126fa9e5c36f1347d759b5c23705c2d2928b28ded5
MD5 e097b6014068b75f0cfdc1cc164a5a37
SHA1 766a8d517e9513c2d16594b1c297d3e6a00050f4
SHA512 f348b9fdfef04e079f4575b1b10d7f4f7e85f5befd861b1326e365b12ad6678aa0e7971460990e4a6f1e0052a27f3a636e9ad42453edf3d6b535aee8e754d0c8
SSDEEP 192:6RpYLGi1jbD+3v7hhAPRp2mPGw95Hsb+WNlmpJmIua9r2Yq2ySce4dQ+VyIsnAU/:6RpWPF+f98XzrwTA232ySydQ28
TLSH
T19C52E82EB960553B4CDAC229F9617B1BD7F6107235901E80EAFC8A2C15EBACC331741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9ebb031181f108be855fc4d83465ae10c8c400158fd491f3a82fb760eb8620cf
MD5 7cfbc1ba921e76602bce31c2cc9aac74
SHA1 30d9fb28df4a30c9ad749e0f242471172b97d682
SHA512 46a9491c7bf712b861abc4385fdebb310bdb781594778e1ebde5e1239dde0d8f71eff4d2d654d8fbbd63ec72c31e5fd46ef11d81f5ca9db79571e6bbb1deef0a
SSDEEP 192:DRpYLGi1jbLAv7hpAPRp2W95Hsb+WNnns0XoQPyIsnAUge:DRpWPJc9UXtrws04ae
TLSH
T11A32B51EB924A53B5CCAC229FA267757D7FA146235E02E44E6FC8A2C15EB9CC2313417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 df94e25303a2b2417f6d5b64bbda2abb62ef853df8f1dd2492282f312eed081b
MD5 ede2c264c3a7b82ba1f30e32df8310b2
SHA1 e12f78a418f09b8ca8a0cf51a38e9d89989b70b3
SHA512 e9d515ba2fbfb3b216cf673e8536aacb1bb4516d94ab71d4ab9fbb41e91965bdfef4dfd251caaa6cfd77a862b13361b8f5b664cf65fb74a81118a18ad9b02ec7
TLSH
T193B01260C4015201C00306B4150258C862149F20A909A70543E07922CC350A18325050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590c1c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590c1c.TMP
Size 96B
SHA256 04ff946a985950434c2ba6c45c19fd5bad7b9b6879c5e774c931789a0d6ef760
MD5 f128e39661d228741f2cf6f1c77afc26
SHA1 d9a30e081e965a41013e01602927cf6b37b1bef2
SHA512 b0ad609ee798ffc87cefae0da2bf4212c8c496daf3e68cca317859be0bccf580b8bc33cef675d755ad3111c627d2dd08e7642184d6604b5b5dd4195ad6b6e60b
TLSH
T196B022E2C002B302C202C3F0388080CA3220CF38CE030202A2F0CB2ACC202B0002C0A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 eb5998b7d7cc9188a7018bff0055716ea13a24070747f22d9e4d76cb7e5c9cf6
MD5 5f48386f596a9b2d6773d214d332571a
SHA1 5e0e6a6b0eee6a5af442870b4e1b25b14ee7cb55
SHA512 a3e0c0160c4bb7aaea022d854ff9a548a3f153e7152e3750305dd9a880a9396904a6d429a438e770c836279a599c56ebe4ece52dd94bc6f33fec0cb8972e6e24
SSDEEP 1536:6hyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Oqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1D2C30237EBC21F335D82CB647A534FDA57B644A99030D301AABD3BFB6C53891644249D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 3c45190c17bf563f41c4a29b7da67f9db1b3667e1d731ada810482d244c881bb
MD5 0b07e5ebf1c8a7ded5dc13804e44173a
SHA1 e2e219648791834d4270abfdc812393713bc0eec
SHA512 d2d34004154ae4db6da100dab4112107cc8dd4bb81ccea79f74613a1cd2b677a4d09a5ef95ecf7903a86fbcfd4a13411bf89a5383957c7d32fb1d31af8a865b0
SSDEEP 3072:O0xWTTVERDuXJ3kz6ErweLMXhfS2NOBwmU6hFmvdk8qfd7NtZL8cHQRZEQ6Sps+:/xWTOs3UAQ2mU6hFh8qZ/ZLW3Ex+
TLSH
T14C34133B97D51D229D83CF20BE1707996BF1487784B4D303BBA926EB58C79824C83D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d310d540836e473c23ba0f15711080eba93cdc859dbcd1090db1d06aef804612
MD5 f9ff5f153376fc4cb15600a90e8e0c87
SHA1 2f1ae7bfbba475f98b9bb71db887f66dedb6a4c1
SHA512 90f13ff2611993382ce357a477a14ad2d6dcb63d4fe8191405c02bbc4ea72f8885e5c22e5aa35ddfa626436940e9a85bf8ef089101fc6172c61f1ac00ac62c67
SSDEEP 1536:/TByD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjH:bfqfd7NtZL8cHQRZEQ6SpsY
TLSH
T128C31237AFC21E335DD3CB70BA130FD757B644A99034D301AABD2BBB6883895658245C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
Size 212B
SHA256 0dc99f34ec144127187e045985da1899c3a3fd1ba1d40be4a65594e96c4228e6
MD5 a5357da388b273781253e973fd6a0984
SHA1 7cfb0736775e7375cf8d90fe027c0e621cd2dfa2
SHA512 61984c5fc141b59e57755b787c1073ce1fdddcea7a8fdc587e20f39493b7697f4201db930f59a4168b5a86f96666e2f9da232653a63dc7302c6d2b4f88cc0b13
TLSH
T10BD012517F663182D01A41B441E56766B72CE651FB479598800763E4143B245A807454
MD5 SHA1 SHA512 TLSH

Submit Download

23c9a0b9-22a3-42e0-b246-c2357be3158a.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\23c9a0b9-22a3-42e0-b246-c2357be3158a.dmp
Size 8.6MB
SHA256 e47c7b35f2c7c88921a3336fd04424b8e8507d599649fbe0a5b15f5beadccc2d
MD5 42d251396299451cab5d0428cab2d3af
SHA1 8f07d2f7978d4c5359e2755ed2e50f5e1e6c1d84
SHA512 c981ce7d23ea97e666ac03c6914c3261eec5729cd03508262fa2b7a2d6a0548dadf8fadbf55925df9d15815e66454071eda34b1e576e74c38f3f7d94d6ac00d2
SSDEEP 24576:Jxo69mji80e9Rb7Tm4u8Cn0wnudfB9SvprrfrqoLJIp0IeUn:bo6958r37Un0wnt3zLyp1
TLSH
T17796A457A396C59BF41D42728596BF58FBF3ECD18A86C3672280339E1C773486FA5A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54810af6-f14d-48ea-a04c-e374ebdb08e2.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\54810af6-f14d-48ea-a04c-e374ebdb08e2.dmp
Size 5.7MB
SHA256 461131e9000651c89e2f1bef3facf77fa549a282333a4b40bc478fdcee286cac
MD5 39f612a2bfb82ad95428a088896fbcd5
SHA1 81256ad66a43dc7c0b23b75efd24efec9a04c7cb
SHA512 b6b795110a17af9438fd185722247ccbbcc865057c1a7ab7af267f827b8437d47d84eda7b4764f89bab6c2957556938d4194a128d871e18d0409870d1e816be9
SSDEEP 24576:ogo69mwi80e9Rb7Tm4u8Cn7X2dox6Ibb2K:ro6908r37Un7XH6I/
TLSH
T1D656E557F317C687E40992708986FE58A7F3FCD18A8553A3229173DD1CBB7086E6AE10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9388a40-5fd3-4d09-bbf7-514aea3a0518.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b9388a40-5fd3-4d09-bbf7-514aea3a0518.dmp
Size 5.9MB
SHA256 ab55e178779ec81da24c7398ecce6e20cf8674c539ef380ac8dc2022dabfbe40
MD5 8a4e78c88385a604747e1fb34a41d694
SHA1 9e52ba8f211a0bcc0e86f87462b5edf737e67b95
SHA512 4efbb89fd02a6e97d96de5c5a949948c4f391e0d27aacd2f6fd77a5db56106309ff92a89e2d597a266f6019d3f8d2d49aa4aca77a67e702d8b7bd06c501db500
SSDEEP 24576:6Mo69mwi80e9Rb7Tm4u8Cn7a1E2Y1OSko25zGMfDW6S:vo6908r37Un7a41IDWh
TLSH
T1F656C457F366C687E40992708A52BE54E6F3FCD18A8543A36281B3DD1CBB7486F67E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4f78b72-83d1-4c9e-a0d1-a435c951e1d6.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f4f78b72-83d1-4c9e-a0d1-a435c951e1d6.dmp
Size 8.8MB
SHA256 9df58abc5541495b43f6d86c6b3262119b5d1122d8ac5b6f90dfc3229f33578c
MD5 cef1aa885712a0b403af2a8b0a5db05d
SHA1 e3352cd2a51bc5141ea1f810f03530a2b776348a
SHA512 8a73662318f2018958119275eb55e8f5262a6f256e1dfba09453a785e89a33c135133c9e44542a37085d8d4adc83d1bd81f48852ef92f473b44d1c81145da169
SSDEEP 24576:so69mUi80e9Rb7Tm4u8Cn00fGPiyFaJpi+S7Ibq32:so69s8r37Un00fGPiygJpI7ImG
TLSH
T19B96A257B392E797F00992708692BF54E7F3ECE1898683572690B38A2C773486F61F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d3f3ae6081c67aa4c481889fc3015c070ef89eb55d89e1bd8bf512190719c23
MD5 afae5f2c3d0132ae6f4f45ea515abe4f
SHA1 1f2547d53baac6ecc5cc9221b2159e342a5bb113
SHA512 2f70557f9be1b1b8288ffee3e8c5f4acc733e4120c9fcdc2bca8d3b2bccc9694c22b6d24d381d5470c674bfce078e6c4d3cc6ccaf526cc2ad501cebdb5de4ccf
TLSH
T18ED0C0203B18F842CB041170D421CF007B361050301FC806E19B880D0CB51C0C3DF381
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2ef533deb8dda8bb36096f53b61af4aa51eaad5d418ba748b00ca9c6cc8ce31b
MD5 93c8bc44819c935e49f9ee10d28d0496
SHA1 c1d76bfa5110402b48f30738713c85c198f7ea65
SHA512 6c7f94bb9e3399bfc37ea2681b2e4983ac134cccc0fe1e29f09525801df254a69ead648bd26ee5095ecc7fd795eb33948a81a84e564b0add38b733c71a46ff25
TLSH
T10AD0C0203728F842CB0411709012CF007B361010301FC806E297C81D0CB51C0C3DF381
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bc9699b470fa213b44a2fc581dda2c5ba6071b9995e63cf8aa709ef1cc8ebe38
MD5 b4535fa4034548e031f68166cc252b48
SHA1 84a747a40508c8302c05c3e30da7c7d59d603f0c
SHA512 9eddc4208e19355653a81d6f15908910bde46c01b397129d94b5b1b6a29e7546648c5b5dc3870c7ba1856604c8568a412f98a1a5fba751452f19cb908e930aeb
TLSH
T1D6D0C0203718F842CB0411709011CF007B361010301FC806E197880D0CB51C0C3DF391
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2deec6a95ec52614194a78a23d73e7d01a237bb1c36f177b2d079e01904bbb02
MD5 1a081c1a44490c52836d469b86ac0024
SHA1 afd36b8efece8f0b6da93e52448b0b0b92b7f2e0
SHA512 19264593eac6e8fc2b1fc661bfd6a9ea2c8b80318a9fd4358c9f04722074d457d449cbd4766b079f4cbed4f9218c79e4304ea56aee93a1d3484cb9deae7c7b51
TLSH
T1F8D02320763CFCC1C628117191218F007B355452315BD14AF2558C1D5CB50C197D6BD1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5b2a01687e33870947bea1bf20b1440dbb2c514a8c359ba15d3d02b53768f8a0
MD5 ed474d6745ee20f6130ff9d8f83151d1
SHA1 5867dd24170ef334943baa66d509902237b5b20c
SHA512 48dea616c8a266a61b916ed3cf732d7d87577d42475d978f1e07d860279ecb345d56b22be22a00c66bd5668f143e3856c3291875216a9cf0003143c5fd2dca3d
TLSH
T14DD02324363CFDC1D62811B191218F007B395452315BD14AF2568C1D4CF50C1D7EBBD1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0ce1ddd7416eca56c6d26c702613ed6390d3e0428f8a36a9d9324b02b079813
MD5 29e7728bba4de5ae54ce9a33bd5b89d1
SHA1 b2b7d7a88221c521a137770a5b6e69db09eb23b4
SHA512 faefbe5e5ff2810d10f835b8bd55855137695fd14b6845533626b927bd139b6868900093d9790cce615eb9f027c5e01b8e0f33eb9aa20814432a4a256c7eb4d9
TLSH
T110D02320763DFCC1C628117191218F007B3D5452315BD14AF2568C1D5CB50C1D7D7BD1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e1d9a782b78f7e42134243842f86dd27eddef1c23581c7d2e1dbf6bd78e1c5ae
MD5 d4cf1809ccf1cde583dbb46acb10ad30
SHA1 679ed7e92164f7af1aab7d7208065a36afc0fdcc
SHA512 6650bf74c71a351244eec55be39c3c261159edbdf312c8477adbcecb43489905048655f69da57f69a4d04976590dfaf7de6badaa1ffce5c658fe3d18b966da35
TLSH
T1D3D0C020371CF842CB0410709012CF007B3A1010301FC806E197844D1CB50C0C3CB381
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b1cc644c06978ce252012f4444918f0c40bda1227ba1c13ddeb935dca23ae808
MD5 b2b66a7a8e2bb3c8ea36655cd55182c7
SHA1 a40c64a4cf56b529c745a48c8e051fc697bff23d
SHA512 aca3e9d231c53f83ec21b66068dc0dbbdd5fdb01bb7d84227afa114bbbb9b2d005af3c01d53caa120bc5a9a56f5fbe8d1d8645f89d08111624f350ac83a5adf9
TLSH
T120D0C0203B1CF842CB041070D421CF007B3A1050301FC806E19B844D0CB50C0C3CB381
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 cab439a7b0328370fe314e74f80e239d24f5aed193d1598c428bb871b6a158b4
MD5 7ec6b0dd865d7e8c5d9dcb379d98b5cb
SHA1 f51ce99a1799f7e27eb548da98b416a8da9c8f85
SHA512 1f978f4c8fa7038fea73fab97172c10973d937c14bb74013a5134e68b4d3ae321ad662a8cb80f794d9acbbbf47535577f2ec691fe5ff43aa43955e604295ca55
TLSH
T132714F183E928B50F3310933E4E5023A367C51B58D33DE56C25074BC9A27B25AFE94CB
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 3538efd97f4eb33e1fa5499e8ef5109eea8ededbda275e275ab0490adb846e23
MD5 ab6e59e17223e422418bebf1aec4ecbc
SHA1 e8990e29a1f21e02d78c3072ec5148b7a7d87ffe
SHA512 9e658d46c6bbfbd174add4281d4c805edf13ef732555f81eec08c788e92ff99138b8deb920a099c31f35ff3f2eddd13fb751155abbb75a42b50b6fc576b463b8
SSDEEP 48:zSTVV1Nu0MiiTJnrM9dQ2WJ9OOMYvtMwYyyIiZ6YVlnBDjIV2/IyzG8AIXV+Mpq3:zyMj9FMbOa6YVlnBDRqMgAZCW4l06
TLSH
T191A15E7279A90791F7A90C33D0D68535333C8A768833EF06C26070BC65177A1DEE8487
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 5b7479ebccb18a8e510e14d9ae3b1e3ee1da2b4c46c0c7d335172ab0f525ccab
MD5 a711a2a42f19d47ef3b1942eb6b6eb06
SHA1 ff8772002d5113ba809107952f8f56e1297aac19
SHA512 25ade6f3aa6d970408d0232611538d8030c8851a44bc2ae02a90d97b278302f52eb055325be739183933354762988361aef3bbe1106636ff3aa6fb495005eb18
SSDEEP 96:TA+QwhdJzkZtNBbiWVPbw6pvCH4RCd99Jgl:TJQozgVVc6cYwdvk
TLSH
T1D5B1F72079E82AC1FB250C33E0D608663B3F66754837DB02E224B4BC651B791DED458B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c4c2bf0ce62e8f458650033956a7568292292cfd206775bd9fa929699fdbf246
MD5 7a0bb70b0e8b8b5c7fab4b3f6ff0d1c0
SHA1 be8bb035394c4176b6895614209fe033b0fba639
SHA512 153755b7ed3761747448619ef92225471574ed236e4e984237d805da5805306fdcd65188270daa993e1ccaf8e39c60ef1a27a40ad195d7d58dfa68ff3caea229
TLSH
T1F86194183E924B51F3320933E4E91275357C41B88D33DE55C290B47D9A27B21AFE94CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a85cb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a85cb.TMP
Size 4KB
SHA256 6a494259cea291a01474eba22f7deb58ec625a1af06677e590e03724bc458d14
MD5 a40e3138238732083f1e9178daef29a0
SHA1 eaf17047d78700499021e94e25a0b7e748e04226
SHA512 e8860a9a0c9634ad499eeb652fe09d15b30fa42b37e1c0f89a2973907124d3fa564234105a287d40ab97e813ab9b536179a2495789a7270107b0552d4dc73d41
SSDEEP 96:RqgCbdn/jHWkZDePoslKBA9X9GfIOl6Mr8Mk3SVS6BDDZZWkQqyyMdGICqBgrGdD:MgCbdn/jHLZDePoslKBA9X9sIOl6MrBK
TLSH
T198A1A4343AB94BD9F3380933E0E652A9333C96744933EE52C26074BC5A27790EEA5586
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 ab38bb4966d8e7f139d2b0bf080141cf92281de8233bd9e124cb708520ec08c5
MD5 bf17db1a443b452ad8719727c0e3f600
SHA1 7dfeeb2ba88fe00f076de2e9a2e425d644e9df34
SHA512 ac5063583a56c4847036e98054b8af1a353b086a52f7e84785ebb8d1571e9c9ea4af6ddea10862bff105d8bee65a5c6ad54e568a7378757c19599cdc8b9a584d
SSDEEP 192:3aELLTH68Ym5TvuPet5Yg5qcgBhq45kbS8mmO:qELXH65WTvuGt5Yg5sBgZb1b
TLSH
T19FD26CFB6BB1A005DB472A3F160F2839D53B754C6FA2D908701940152CB658EB4786FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0
Size 44KB
SHA256 b0661a656203d75125ec172df8d19683608f6aed0db17d608421c5ad5b31070f
MD5 7a9ccec4b72bfed5c49e15990f06cfca
SHA1 bcf5889c9a08a79a33d9d8bfa2eb1cefa9ec9c64
SHA512 52051091098ee093295c9764bccc9732959e68cdb7fb44d7e5fc08832da1f7cfa3bdbe0700fefcbd50ef48da30cdaadff5dc7979e522c54ecce785be16f5fa4a
SSDEEP 6:/Fii2CiyO9UkM/lDQaBAXthb/4OtSPDtcLGJ:dq3EDjBA/TDkyGJ
TLSH
T1C013123C9780290BDF06797C995F1F757321E70861B11B5140B86422544A7533553B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 14700556f985f47cb3030121561022291e53b233ceb8eb72057b731e0474ee67
MD5 23de5571c7e137b04e089b49131b2af3
SHA1 24f1f029965f7a256a3889eeda92b29a1497cd4f
SHA512 86b5a6f138b8fa6394d8ce072d006ca84265602cc822ad634fa76c86ac46bc58821f23ece380d12d527f3c9944c8f1816061b61a883c88e9b2f4a6bd65fa9c91
SSDEEP 12:U/MWX6kpzJW26iqZX8LiLpzJW2Mpd6ILctpzJW2NZnIOlmiLpzJW2nhobGf7pzJ4:J2BV2Hp8qVecIKVvnIOlmGVL+qV4
TLSH
T127446D2378540C83F926C9B5BA336F6AEBBC92C5E1936F53131006659DB18B58FC6584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2
Size 1.0MB
SHA256 3b8ed88cbe33add570dcb000d9db8ca4476550f46a870e22ae5942515af30bc0
MD5 3967158e41d11567e19c6734753b01eb
SHA1 74170f5b022aa0b1b6d184ccfeb9e395409d07dd
SHA512 a2537b3eafc851e7c8e775591ba8e05dd173829100b3ff4f64daba2846f77718e70b4e9700b2c1eb0c2ab6ea1f860d25d1cd2e49ec413d1cf7880271b4803575
SSDEEP 192:MdxZdCEYENlyZysnEYRwymUWLTgBPl/E6Fwlyp7L3sgi72jl:4j2ENlQdbVy8bsG7LViC
TLSH
T1BE25B0F6769207CAE28AC473243614EDDE3717278965391D890901E5B7CC3469E82F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 3ace7034df68da82d76cffe517608e2ae230b054923ee43c0541ef23cb52c607
MD5 34dee6189be69159c10a77de7f56f624
SHA1 aaee572ca689099c2547640c9663708fe3bf0fcf
SHA512 c8dd211b9233d73e2dccdaf752fa31abae2a507db0cde2d34a99c95db54dfa38e5f220a2bcf60e73dd71094ea3223d236d15f32bd9953d48f6ec0eac671a6541
SSDEEP 384:YVlinfJdN/83uICtTBBsVEIWT6LI9AL6LCy7DXspU3id:Y4fJDptTBBhIWTuI9AL6LCTU3G
TLSH
T14114C8BF1B711310CD6E4276299B9867DC6DF02E8F22A695B8650058CDE3757B03C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 24KB
SHA256 87166e2cdc03ad5d66a8ec05c09059a89e4f8c361a60caa4a5ede3228c627ca2
MD5 46496c707dbcd5d347d560f73f0b5ac3
SHA1 2bb59958d554ce555ab21f9521934f1e4111ea40
SHA512 197ce7ee49445626b1d5042a03940b0d687d5f80038bb2b1a12d1f87a4a1a029e02a53f23a0b96615a4084d4b500b6d780cbae439f3a286891d6c7b3ea6c2be7
SSDEEP 48:z2uZ1ojRhv0K7ht9m+0Ak+zdAyVeZhXI+Y8h:z2qA11k+JAyVeZhXI+Y8h
TLSH
T1AFB298B03C791778D606A33ABA41FA5BEE8311E1EB57BB83B48E010C456070AB7588C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 5KB
SHA256 6891dae1732d9452d1aabdaf323a355a5c4e0a5d3791817902baa460f16b05b5
MD5 0f592a8ae3edd4f87fc317c748fb4a62
SHA1 c5d28d57f21f8173fdad250a3fa686a4de73d8b8
SHA512 6aee4d9f8569ca78d04a443b688f574bb0905852e18096f0b965e28587b462af252e89b5fd5cdf36787d5658920daa9dd6fdd8587df38bd33fe45d2bd901681e
SSDEEP 96:dcxo5C11JJ980kOc50pJBqqGQFIt2VwW37oGlq/6ELiGWjiL2S:SC8fJJ980M8GkeqH8Gw/6xBjiL2S
TLSH
T1EEB1D65ABBF31070E71260F80E80FD785762229905B0BEB6C354B98DB36235596338DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 b2ffa1bf418ba5ca2d2ce5629668dd33f5977ff114608028e0d7b6b2e355ea04
MD5 6c24662c999af22e665ca4fae993df69
SHA1 8a725fadb9db8403c1f5b78a771b54de374c9b2e
SHA512 ca4de70745cea7abef46441f3117c1e1e4035b4237375fd16630729de3fbc95f884b9ad6909a7cac232313627f527e8979b963fa34a1b7bfc775030b003ed2cb
TLSH
T177E0D87488CFC25AA514209782246709D3B0340AE6892E852B05D889B202105F7E32C1
MD5 SHA1 SHA512 TLSH

Submit Download

888f688e-4852-4946-a54e-79bdc6c3a8d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\888f688e-4852-4946-a54e-79bdc6c3a8d8.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1e2750fc847d12c81287bde62c6cfc7703d2347b47f4dd9c4c6f9037bae2b6ce
MD5 60eba010672247ff8cf479ad03b2b864
SHA1 4c2cfb2d13922d79fc714e40a940299415d47607
SHA512 c758167761e40105e8921f4562f56b3eecb9330985c7337b921539bc8f2c6acb2c1f607470a2cc632f2f9a4c60310f3ba699da47e413d6b5d20fad45229cda31
SSDEEP 192:sxZHR1yM/jK1Ml8MkR/fYsNouIdp3qzHW6+WNEDJ/YLuLV+DIgrJ:sxZH7MR/fYsNo/YHb+/Fq9
TLSH
T16F52E8226A349977CCDBD20DFA45BB53D6F50472A2901E44AAFCDA0C04E6FED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 eebb1eb7c17c12c8fd0615b450ee8e96a66d7b0783c487f818d8aa2f1892146c
MD5 c6dc7a9c637aa975af78f1d4769f1dba
SHA1 36c1e7e3bfbf0f54e49b295a26b68116c91b5555
SHA512 52833f73e17757b1b5993afdfee71e5a5103e3952ee8e716df71952ceb1a218be7767910a28e41d74e6c00fc075ff2efdefdd143cb51f85d7319fb38f4831183
SSDEEP 192:sxZHR1yM/jK1Wl8MkR/fYs+9GdprQ8ubBtiodp3nAucSHW6+WNLT10IuobU9WSXm:sxZHJMR/fYs+90ps31NHbqG8EfeqNITE
TLSH
T1F492D816A534497BCCD7D61DFA01BB97D6F85462A6904E44AAFC8F0C04E6FDD230386B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 956d15d3c3492def197d608cc29f962ee915ff512c1a6f128de81583431176f6
MD5 1a9b8ebd6b1756a7b919c98d527d0047
SHA1 22ecb5ea38bbd8b8038def0b853ca08d4e34975c
SHA512 f462c0b0c172999af7add238c7f918bab927bbaaf19e9907289884c00132da97f460e26aff7db5822fd78e6437e989bdd960a4dfb6b3ac66f521f613ffd90ad5
SSDEEP 192:sxZsR1yM/jK1nl8MkR/fYsZxzdprQyxbXsiodp3nxLuAHW6+WNLTK6FpuoWJDxbS:sxZseMR/fYsZxRpsCulHbqNZeDXjNP
TLSH
T1C192D8566534097BCCE7D61DFA01BB97D6F86462A6904E44AAFC8E0C04E6FED2303C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 ae79b3a6d6dde564439741b445d69c76aa374611bf26c0c1ab4e16f41a41a2d1
MD5 6e734137910e286b7963cac9a8694b38
SHA1 f3dd27c859d5b8f9a1b229229912ffab66d6da59
SHA512 28fff63a7122db76f767a270b9443883ea8e31471eb63b0c3a62a30c7f3db0b45bcff62af4b36a277f45c89043647dd695badd7d62265bc0f9805d58326426a2
SSDEEP 192:sxZsR1yM/jK1nl8MyR/fYsZxzdprQyxbXsiodp3nxLuAHW6+WNLTK6FpuoWJDxbS:sxZseaR/fYsZxRpsCulHbqNZeDXjNP
TLSH
T1D292D8566534097BCCE7D61DFA01BB97D6F86462A6904E44AAFC8E0C04E6FED2303C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 8db05111f06eaf96a17a736843ec1430b28e7798e91b0ce7382bfabae5bf8fa7
MD5 5b7ad85d30dc0698913d8b45a0293c80
SHA1 c1a6c24f205632f1d121cd35bbe7a448bd7cfc9b
SHA512 e2d58a5bf7a595f25f284bf5586c6e4abaad797afffa2ca7e612d4b55e9238097f5634b2cd1077a9e733cd49dae7ff47ce3c42dff2510ba59646d15c56b0e95d
SSDEEP 192:sxZHR1yM/jK1hl8MkR/fYsG6Gd56bWjiodp3nluh9HW6+WNgEluXDJqtK/zjLozv:sxZHUMR/fYsG60X/+HbQL/FRK
TLSH
T1B772F716A634497BCCD7D61DF901BB67D6F81472A6900E84A9FCCE0C04E6BED2213C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 82de91d5273c630bd4c8797c94e73f1ade9b8606564082b0c29ff2bbf99a1c01
MD5 a00318439ed52ddedcabb621403cc449
SHA1 c95ff0492ccea8e6644e0f3d247abcc687e4a655
SHA512 cf4c0bba80acca3c396f836576d4a22559028134b2e705a2c3aaec5a11497357efe2f99cd704f4e85b8a18b7c2b212d91a03e7081e3de0e4ccdc3014f55ff4bb
SSDEEP 192:sxZHR1yM/jK1Ml8MkR/fYsSo5Idp3quh9HW6+WNgpuXDJ/YLuLV+DIg5zJ:sxZH7MR/fYsSoSnHbn/FqD
TLSH
T14052E8626A345977CCDBD20DFA45BB97D6F41472A2900E44AAFC9A0C04E6FED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 4b4eb6172dbdfdc8f91afda10f5baab57813d00df1f23fab86eabc170339ed9e
MD5 2e21a011347fef6646947f97a35301b8
SHA1 2b7487d24e430a515db8d35904eceb34783605e4
SHA512 785ac7465d273a43630189d3b76ae4110ffa420420a207e0c384b73a49274545ffc508cadf998f4880e6ffa51eb719acaf6dc39c32b24686604ffe8a2f5d54eb
SSDEEP 768:geg6pNM7pLuL7L1WvxzAj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdY+ILlWwJr3ro+:geg6pNwE7L1WvxzAju1jaYY+ILIsrk+r
TLSH
T1B6F2FC3B6C0CCB7E4F800E9CED297E9A6DE8018B9A98C99447FA441C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 033d096ce1bfce248789f02e4ebd02ec718b12c260f5a58541ece9b995d89acf
MD5 e9ee7de8740ae9c06c46c2fdd387bde1
SHA1 331a85862c3a0ccd9d1256b7a1975c14fe1b252a
SHA512 9889b44192d2b817b92b073338b61e7b32c0730be0aaf30f65fb4d2036ab489d5d185a2249230221456057a7b6c237820d9afd2dbcca034b4164e86d44ee9ed4
SSDEEP 768:gSs6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN3roqX:gSs6pD1WvxzUju1jahILIsNkqX
TLSH
T10EE2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB54899447FA484C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 3KB
SHA256 b6f6327bceaea8d48cd740f0e0754f0955b2350d93f6b996919c442d1345b7dd
MD5 ad46392713c7dc49192d67ad847e6731
SHA1 ffba6343789be7765e67f7d8529d7a0baa1d8884
SHA512 72d396c29b9977fbf67e342d5e9887696f2b0bbc6a80722f2689e9b6b1957f6ce1274020ac5729b862f622a23bad428b0ef4368e182bea032c15ed3d30c97473
TLSH
T1F351E94D0C832716DDAC62B364F204482F3978EC79488B1734BCA5356C8333A18A8798
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 1KB
SHA256 dce85802b092b8563faa3f32f5afaf192c5c36b0ce686137f1e57de6705b8b4d
MD5 b4596835e8b2f806934775f26c85644c
SHA1 2a78e27f0d260121b92694f390926ac7ea4115e8
SHA512 221e9c896fc55760cda1a23bb996bfc3ce575545a9c216e3e7917d393458b654533bffc1b08a0e4e0d8450db6d7e36cb184f318b99e0b8ea01908b43920a14de
TLSH
T172213E8D4EA0898FFCA580B61072F5A47370D8DC4B22A2135C3C32316E233493A0B5DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592716.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe592716.TMP
Size 1KB
SHA256 0cb4c8cedd36be99c123163d2c52b01c6013ff4306e1c78c65e5bb2478a5e53c
MD5 befdd31f81affdfdc2ab29df7183dc9b
SHA1 eec22220926fd10f5a9a0835c0c431b055633551
SHA512 ad3e936d3ca02537efd39c3929f6a1d133fa10b03662822fb2e5ef8055c2d515dcf88f7ef08d20e2925105ff680460a2d950964b31d15834b187285945cdf687
TLSH
T1EF21108A4AD18E0FF88450BB1963B8F8733088005712B393693C22395D21FCE1A4F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 d81e92135ba10648093c5022ce1734516c5c4796a8df752e95d4b4ab7974a9d9
MD5 1e9a71e6007e115dd0673aea62e96b87
SHA1 45483743082bd2c098074433abf26f6eb1f846d4
SHA512 bb337a5c81b7aa5fae4acb8580275a2b779de94a22fed84d39670723961ad9746fe00a1f2d70034ca002f4f049561cee88afdfe824417d59fd53fa89787b66ff
TLSH
T116A0022A03C904C3C50223B029D602626212DD15A621230661900654CC605B5455340C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 0826724806b2f0cc9d1d313bb100a155aeba075bcfca4a991c2b13b084605a57
MD5 6d6d78789a88ebb0d482164a0336764f
SHA1 862d95b5b0214429be47b89575f8ff16799fdbc1
SHA512 f63b14d57d8ed29095fc4a25103a4c70e2b771e8430944fac31a9a5485f9e43ae3e35757c54c605a13278a6aeb330ce634c538dbb1be760559b9f0355ff093a7
TLSH
T1D2A002111380000AE81361B6295342951740DE101244930740D50158DC524C44D8110C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 b5957cf0bd4156c4befeaf488ccc3d7ab37ced68b7dde8480cd59971565c7e00
MD5 adb9d124d9946426fafde5317d98ca4d
SHA1 e614f537b83ebe6c61105ede5c95803717568654
SHA512 ebfdea6acb39967f024af3806d2a9c45c04a29da22152dbf8305884bff52b6d904ed0e8619a47031adeec5512da0a1a9ffd83fb74f30dec2bbb21f28f9bd1e83
TLSH
T121A0021512C01003C00636B025D6016223235A51E616135661D152C4DCB06B5464304D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 efe55d9a4484f24124f2f7f055752fa73ad43cbf4434099f3c81940332beab39
MD5 95c902f081047a43a56de6d574d34bd9
SHA1 0c734855d78760298a77ed8cc647745569d4aa3e
SHA512 f4a4425531662b861212418f7042dfd8047a54b39808d469a07fb738afe86f4248f9d765728b59b20ea4f0638eceba44cbeeacaf50e7cc533e20cbc9eae2ed58
TLSH
T113E0DFBB6EE76820FDABE3E72870A4B50641382C8805BC4F686A96C350B13657856C65
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 f883eb2adcec4aa84b71fb4d78e87c775ff20eb35ec1a189cd8a389d89f0e1a0
MD5 218cf957be881602cf4f0da57a44c663
SHA1 08801a7f6889c252e2f311f6070e54430668b1f6
SHA512 6eacef83e4fc412d8d35cbb055084e41d1e5d02b1990a722dce32b9c61a3c88bd3334c6e09b38197729d875ff6fbfdc72831493a5cf0a9604c3d1bb2f0c51536
TLSH
T1E1E0DF7049CAD27B7015308306248B08C3A5B55FD2CE3A863F01CA846386685B2A3190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b0a97780850989f5dc2345e3f22f9b735bd191495800fecefc1c107f943db517
MD5 6791692d3a71842604fb87938b82a2c7
SHA1 df5d91f58c39488be793523296dcf8f9c0ec7556
SHA512 f35f83ff4c64fc8e0211229ca7c99684baf98c1c2ae51eb8cfbc7d956079d0604934a745ecbecfcda95dadce7724ebcffc243a45181b395a1ddc5192891f54b3
TLSH
T19AA002B2826A1CC1F0100275B44543D4E211D9100645221383E5D754A8931904127044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597d06.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597d06.TMP
Size 48B
SHA256 d85948c060e5453a078e06bc3d6f97806fe1b1d56dc33641419ad70fa34af6c4
MD5 a0d85820711d3695180751bbbce461fb
SHA1 abd349c811219a6ca1bea026a6c4b4dfc648ada9
SHA512 4874b4ab0484c8c3083a5dfb10b0c5f9c9be77e2f8a9bcd0c598304cfafe69e6dda82f0af6c341a4834c1d6bde2aac8ef0f11667c6674e15163a335afe768f6f
MD5 SHA1 SHA512

Submit Download

Session_13426835150137341

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13426835150137341
Size 35KB
SHA256 da0dca5b1d7c7eb1e0dac01058a9502278da7663aec13ead3ab4bcb48188763c
MD5 5f71b5dcedfe8fe86802dd3655fe83ae
SHA1 57dd7aec211095485b51ee19164b7ec51c0d6f88
SHA512 437bcb99039b0ae2577d2025599904cce3960aeb4d3b0780ee95a87401211c8fd034868aec45a38615a0574b8fe8e691af115a4d8e49311175eed0446634a0ae
SSDEEP 768:RAYcaYXYeY18sCsCfMX5Vuli8MtsCfMX5Vud77ql/riaOsCfMX5VOt7q4e8M9sCr:RAYcaYXYeY1DCsCf48iDtsCf4Cd77E/v
TLSH
T11BF2B5356AE2053BF67F427E99FE60B2F1327A4276918E1E912012580E237035FB4E6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 172B
SHA256 068c31378e14a5136ad660cc7b948afa8b837bc5ace431f96d1f71e6512ae59b
MD5 702f6d31e3fc5e70c0bce7ab38e16fcf
SHA1 1a49d506eb2435296a08309f2e596c1c1ef7e2ef
SHA512 51310b6e0d842e82555b01425d30151a063f087999c9af20032f508ca514304bd9863671e7922acf67de0b7286cf2060353cd544e0cd156b434eff4393c477d4
TLSH
T15BC08C48B3808062EB0A19B1368E4B80A38DF18284E10007095E2A340E0332839A20B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 addfa2165a11a6c02abe98e79e6ee64290d6e65e606d6e49b3c6c04992a90316
MD5 5da05a602f6ccd5aec0ea97f27cfa3b0
SHA1 a2b006c22f7451883edbf3602844fad000e31e39
SHA512 6dabb68ee6516cb10cae20bbec3c937533624d866c29e777dce7d38a73b78557dc4a8d4eb270bf6aaba978c76b20f319b332c1f03e439e6ab16f84abbccbc27b
TLSH
T1F0E04F709ACBD37B6145309B4764F30CC3E2B54BE6DA399A3B09D5C8A306254F3A3685
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 f642094069d6cebb3f75f1da0561477c13b31e079f8d2701d32ba86eea468a3f
MD5 b4da971770d8d9bea959862b848f19cf
SHA1 661bb486a40b0fc66d90c6a44d2232848d1cb4bc
SHA512 95d1d9b56a8b2457b0f5efad33461d818bd2b23b8c4f6056bc54cb1595160e13be1ea3136e4ce958aa8b60988b751d425899f0db1407a7c73f9d4f3815e23979
TLSH
T171E04FB48DCAD33BA444B0834674971AC3A0B94A979A3A8A6B189488A341664B3B7580
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f51c7eac9c0071137e3c88186a62bca1040c9357ad58577f6aa07988ce68518c
MD5 b3995d82d781c3c7f0921f37d8712f9a
SHA1 904baec661e49fd422c5cc4ef4df4dcc38cdb825
SHA512 dd7d195781aefd18ceeda7abe5cccf27dc240651c0a13aa4a231f7f7601eef0cf792fe197bbb3855e4d0b1ed523f78a8cea3e013c7d2532543d55a2727f89202
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFy5IZKakkzyzZ4NJ7nzkDn6PI6BkK1B3:KUAAKteP+y52KakSa2oKDiY
TLSH
T1B7A1F50632BB12533C3E2958A294C7279746B1B33158B82B7BA811724EE7E344DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7c16ed3-363c-4da7-8ba0-1c60e563bbea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d7c16ed3-363c-4da7-8ba0-1c60e563bbea.tmp
Size 414B
SHA256 aebb52663cd43988b7784f6a7727f3848509f73126b794018805d94e914bdf7c
MD5 f3317c60451ebaf98f9573c61118cbe7
SHA1 a0d8a8c00d7c83c454f37ff66eba22433795f85b
SHA512 da0dc3c56f830ba3bb3d20486aaf91a5a63d7f6e73da347f5fa76c76b30334aefbae3b3483b1bb816acccda7fa498de46f09c3e4fddec9a9298561bb126eb612
TLSH
T1E9E022AAC866DC3B09FE87D820144786EA51132B2A81861F3A3CC50C8FBA63A45C6C5C
MD5 SHA1 SHA512 TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 51985a2878b7fe79d2c1b9d19b957d50227d0edd10a78b30c32337d981e395ff
MD5 b17205a431efd3ae8db3be6c57120229
SHA1 a0d3a76e5f845a0d694d90ea99f0297325b0549f
SHA512 f2abd9bbb4070fdfe64f1187a5dedbe0ffd5f7b7b9dd1d6c69b90530a999eca160972c86ae5f66b096ecfeafb055f6d171f30e59e93db8c2f92c865c45250cb0
SSDEEP 49152:6H8/tff0u0SB6NHI+ZuWOkWcasLQVnhlXmYZh+3XFPCUhufwNK/BoQBLliIM1bQ7:N
TLSH
T11F160DF37C1A41AECACF9178D52BEE48547362654520C9D0AA3C08C37BB89CEFD75989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 24e4a8f02f00c010387a65d5f358d7ea0d4bdd8ee6faa4006d59f4ba5bcd7d87
MD5 a5e81a0ca324b23afa9ee259338accce
SHA1 bcc91941bcafa08414cdcaceeb031a2d843dcfce
SHA512 43a6f0bbea619025faead4cc26704167371ad629f7b53006c3ec83425a47201cb700a36fc731ee60aae4fef69664f697e927d2443169a56177ec0b2d1293d974
TLSH
T12F216D51F335C259D1454A3AA03E6B151334E8128FFCEC1F057620243F73E441D8B2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 cd8017c8a6e4d4db5a59254fed3a84b11e30ad0bb55cc10823044601b0465002
MD5 023da10b82afc658ef990d66a1ea5760
SHA1 964d96bbe31ca8a27fda0c2f9046f2a527cf07e5
SHA512 e6024f3b37be62f1b3554f3b278dedbd276166c8a32823866392a989eb8e9b075b08000982cd9705290a851a92c8c36e275fa4451ae16ca55839ccf550a34893
TLSH
T14BE04870A8C7D29F6015709306749358E2923C47FA852EC52F06D98C5702297B397181
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5c12b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5c12b5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 d014fef74373b2a173a6d0f80b442effb61c33d94f3863dabcae39159f80d870
MD5 622fe81eeff172179985b3a7867554cd
SHA1 02745fa422abc7cdeb3f5a987e67d463dabfd3fe
SHA512 cadd2a2eae552d95148eb738419b6a8c79d371dff84b65e09f15f041762159621aa07d80054e78b8aa8ae547f6a9fb344dc161cc1dcbb31d9712bdd5c8cef781
SSDEEP 384:nitNn/s3n9S93sNVDr5TdA+bTa91ONMGgzJrBP3dkGu7a0mn15wbAjESR:ij+943OHDWPO5Eh93eO0mn12bfSR
TLSH
T174A27D3A6C384C7259E3E109F58732AB9FB850B7D9C62F55D5E88F0D00D7B98231E926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 6aadbe89ba96f36bd53d50ffb3b31d1b2b7f17341a0af97b67500618fb1b8fee
MD5 24e932579daaa843ac19c9a957f2859a
SHA1 6eedf89e464ebdb66884db81675598b16837ce3a
SHA512 9eb953683d56ebce0abd0a8fe8f17350f76dc5543b76d61c9377d7548c05d8b6e4e6bc6d1e4e2c591d97cbff510a2fba862e65f33fd115c20d9aaa8bcc738efe
SSDEEP 384:nitNn/s3n9Sh3sNVDr5TdA+1Ta91ONMGgzJrBP3dkGu7a0mn15wbAjESR:ij+9Y3OHtWPO5Eh93eO0mn12bfSR
TLSH
T114A27D3A6C384C6259A3E109F58732AB9FB850B7D9C62F55D5E88F0D00D7B98231E926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 9fdcd6e6732a46b0a8b209d3bbfd756285e0610071eb198cd79021f7341cfd0e
MD5 5bc5d4df5e9b5316e0d4dec077492ab4
SHA1 4515b1d899ba360db90d2cc5cc09e1ddc96a711f
SHA512 43f40611eaf654beff0019d9feb2c52abda3fe4427c205d96ea7fabb3db235956dc52021774f9403e1aad2146dd2090504a04e0a143fa17e54c76eadf7f55aeb
SSDEEP 384:nitNn/s3n9S2sN3aTdA5MZBa91ONMGgzJrBP3dkGVYmn15wbAjEo:ij+9V1tUPO5Eh93lYmn12bfo
TLSH
T146A27C3658284D2358E3A149B68736AB5FB841B7D9C52F95D4E88F0D00DBBDC231E92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 e6de1eccccd5368c5740df4acf44727fdbb5869c5f57a4acdf85c70dfccb603f
MD5 e91d21b2002978bf840848459f36fef0
SHA1 a87286ba8678eaec49f65f1fe16a4a473cff399d
SHA512 02ab83368fccacb16bc4ebc819605bc3f47255c1480dad91f80f2be04b0eeef339684e060eacf81cc5080c07de8c36363f3746b78b2fd3030ae2f0d904c9922d
SSDEEP 384:nitNn/s3n9SD3sN3aTdA5MY/a91ONMGgzJrBP3dkGVYmn15wbAjEo:ij+9+318SPO5Eh93lYmn12bfo
TLSH
T106A27D3668284D2358E3A109B68736AB5FB841B7D9C51F95D4E88F0D00DBBDC231E92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7ad6dbb7122c3bbfed8f5d24baca1020184028bb1428f26e263e57d398b995ed
MD5 5a468c51734a732e652d41ca134c1e22
SHA1 ae63e0d7dab075d0effc9cdb3c82d7626d979452
SHA512 2e0bba60b8e631a6f2d9565f8c8158b092a68f4d85d33a694ded6556595de24dcdf4ab82a76df2c4e0832fa82d93a0d63317edf45b5b452342a2d330c414210e
SSDEEP 384:ttNn/s3n9SfsNSH1AZbp22a91ONMGgzJrBP3dpstmn15wbAjEok:tj+9U/G23PO5Eh93Pstmn12bfok
TLSH
T1A6927D365C284C736DE3A589B587316B9FB54077EACA2F9494EC5F0C00EB7A8231AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fb64dd43bde498bf6a5ae743192a6adafd4faaf277c4a1d3896c941790ef5769
MD5 557044892a48d525b6b15c42ae34b4fb
SHA1 9623e0a2798ee38392137614a4d4fd5e3d369449
SHA512 8816e0924f0453457977b9e9f5a2f335ff7a73f0bb5f165cdcdddbed089c8628367980a2c954af0c64e79ef5c57a028ae0fb0dfeb53508fae05ce56fde08c583
SSDEEP 192:qON86O7+3hQmiUyMoGttb0oO2bKh2hgGt+RU6:qON8618Gt91ONMBYRU6
TLSH
T13D02E8356C386CB79EF2AE05FA8737275FA5112BE9A52F81D6E81F0C00D765C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 89daa5a0210bb69d122628e8ba4a4bb864e5706d4c43e92c4b11c006ff33fbb1
MD5 209342da5e6f9b32823373be534bdee4
SHA1 f2a15a46b3621d4a33182568f07f18aae60e6c2b
SHA512 51a40d13f6307ec5faf1981d0db402e629a78c36363ba7999f67d3e5810cd95d3b11e51fc700c6b11f47a8ca1d7bcebe89a4916bc0f6db347838481aa980bebc
SSDEEP 384:nxtNn/s3n9SwsNS8TdAFjBa91ONMGgzJrBP3dUstmn15wbAjEJ:xj+9f4UUPO5Eh93astmn12bfJ
TLSH
T1AB928D3658284D331DE3A149B68736679FB481B7DAC52F90D4EC5F0C01DBB9C231AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5859e9bbe1f8157bfdc8b3b2c5639fda03158a33d0129e249bcb5fc9c6f1a605
MD5 f030cea295b304f292ae035212f479dc
SHA1 6c7d86707f93965f0edc2420b4254225c4491d82
SHA512 140a0e66428972abda1db9c6863a336cf1eac44deadef409aef42513fed96983bf3b8cc5893623e34ff7d33fc9691d47af051fde30819200bddca18d9201ad58
SSDEEP 384:nitNn/s3n9SwsNSRTdA/KBa91ONMGgzJrBP3dUstmn15wbAjEJ:ij+9f5DUPO5Eh93astmn12bfJ
TLSH
T168928D3658284D335DE3A149B64736679FB481B7DAC92F90D4EC5F0C01DBB9C231AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7a65e51bc6b6b4e3a4ea9e2675f1147b1b34eaa61e4ccae0b4ccd3fe1ed9cae5
MD5 fcd6538f75a223e9e9e32d9fa5fb4404
SHA1 53eaa80c13721911f9757edd966cc21f4815bb4a
SHA512 754d7033794bc6f9c6c96cd7de4de4d6b726ac407ba4eb8dba4352820524221e76400fd839c91f17f42da1fc1f5c6717f13abf5c2b31f0a16d380492bdcf11be
SSDEEP 192:PONS6O7+3XQmiUyFooPttb0oO2bKh2GkF0SJrocNJqdUU6:PONS63APt91ONMGgzJrZXU6
TLSH
T100121A3268289C775DF3A545F58735278FA5412BEE8A2F80D1DC2E0C01EFAAC234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 cd26fb9112b7b791bb671109c361b941bd565a53b14f7e34f58b88b9630baf11
MD5 a89c7cb6c3838ce1235c1c75bdf44a2f
SHA1 69807f85996a0cd7114b27d1c857b5d464c4b7c8
SHA512 cefc1ed316d7cdce197000dbe24a9c01f24e5e3adc64a36eeb92eb3acfb16ead198fbec6059bfc31a451e09f74138b4b5124f2626cdf67677c8b93711b86903b
SSDEEP 384:ttNn/s3n9SfsNQUH1AZbx22a91ONMGgzJrAXmn15wbAjEoN:tj+9UM223PO5EhAXmn12bfoN
TLSH
T17B927D365C284C775DE3A489F58B265B9FF44077EAC52F9490EC4F0C01EB7A8231AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 f0eade3197ab4b8ffae779291f8c8315571d0beadf70ccfb05010c14006538b4
MD5 5dc723401575754086e5469d94839b88
SHA1 9fde4ff442b7cc5946bca27a9bc8f02d0920baed
SHA512 39d69530f76d59c499d55acff495fb7c7aa64eed239c289ce5178d3d1df872a3bfe6f7d84125b0f173adbe59983ff1f7f37dcc2e502ff2b1676d227932129468
SSDEEP 384:nltNn/s3n9Sh3sNVPr5TdA+1Ta91ONMGgzJrBP3dkGu7a0mn15wbAjESR:lj+9Y3uHtWPO5Eh93eO0mn12bfSR
TLSH
T139A28D3A6C384C7259A3E109F58732AB9FB850B7D9C61F55D5E88F0D00D7B98231ED2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 e56ecb2c48c361ff83a8a5b7cec4cfaef182036cc32fe5d5b8cd20bf135b76a3
MD5 a37b0df6c6860e6e67acff30e0fcf12b
SHA1 a699ef13baebd7b3f696b09c021747be7dfaf77d
SHA512 ae62aaa507d018f519eabeca416a6ff20459783cbcd8eaa1901716ed550c8d46524a29ec61cd21b0c7da0afe0ec6f982b48709ffa88b56b128181b970bd542f1
SSDEEP 384:nxtNn/s3n9Sh3sNVPr5TdATXTa91ONMGgzJrBP3dkGu7g0mn15wbAjESR:xj+9Y3uHSWPO5Eh93ek0mn12bfSR
TLSH
T1A1A27D3A6C384C7259A3E109F58732AB9FB850B7D9C51F55D5E88F0D00D7B98231ED2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 42fc48929d78b144bebab027354afc1ca6c48d8ddcb62e831fc87aae230b09b9
MD5 8000b13413402512c8c7e6ff159623ba
SHA1 e3c6e69a844bd3d2abfef4f1d382c4a92b4fa602
SHA512 d95382bb0457cdf5a95a4058b839f667a2c2902bb343074d654c6e44f4913f39e4b18e8a16ad45a1c7f6f64bb77c7c810d7c2c534b93b85b13af53849ad55ea2
SSDEEP 12:TLyeSjPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isuQQtyd6zbdZ+aUx9:TLyT5UOl0afDdWec9sJD+pejB5fc
TLSH
T1E592A2236D351033D8DA877AFD8345910EB8139EC9A7B844CDD049660DB1BC1A6955FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 642d5fda3a065b86db1ba4cd326ac24c739f0ed5fd0c5f2366e9b752dbf0ad88
MD5 e7360231c60ffef578e86e18b7c6065f
SHA1 e679366d4bfa501277832719900b3c48016839c7
SHA512 0039388dfe0dafb5b19b29674d04d0f025293e4129e5768d9194b5294b410f0c0e1004770302fad706abb01deae7ecf6cbdfd37b99f7d56b219672d916932854
TLSH
T16EE00207D75050FCD03802700187273517E3C23011A283078C1412557C532802F60AC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 47e3cff103e6026c6c409668bf4d819e57ae9a8d49c1337194f352722cbf565e
MD5 0aa080f106eabe546069250a3079b56f
SHA1 21888e9283ab2d51d8d945b190662cb15923465e
SHA512 cb57af9c584d1b3748486a123d575806eb8d325d78252ce8a04023035dafa13ab16af74820a7850bd01c67ce9b392583054f8fe2f9e7dc2f76bb036a4814174f
TLSH
T1CBE00106E79064FCD03807700297273557E2C22416A28307881412657C9B2802FA0AC1
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f2c2fd58310e2bec32c0aef63cd29b3063e58143a8304157b2c7c9851303d906
MD5 2bcab5857a0d4948645613c4acd8a38b
SHA1 0be7c962a1f1b748df74100cd0c378f6d1a01aeb
SHA512 8dfc4a41d43c497889b7c06b952975df3c167a987fe45ce9df2b3028399832f81d8ecd906e2ee80c2f37b965fc0dc69bab499bcf975fcb4e820e39b7a700de37
TLSH
T1F0415B5CB6F90148B3B7BE5A9BF2A86E447AB9372F06D45D10010D4F0A62A40D8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

680c7c1f-0764-4b5f-9350-2b852dd34d7b.tmp

Path C:\Users\Admin\AppData\Local\Temp\680c7c1f-0764-4b5f-9350-2b852dd34d7b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

fb9a57bc-5555-4e4f-84d6-73e7aeaf22f0.tmp

Path C:\Users\Admin\AppData\Local\Temp\fb9a57bc-5555-4e4f-84d6-73e7aeaf22f0.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1628_1587313334\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590ad480-de1d-4dc7-b13d-8f3d5dff7ff8.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1628_1955742365\590ad480-de1d-4dc7-b13d-8f3d5dff7ff8.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download