hxxps://startrack[.]com-form100a[.]click/tracking?syf=qtQpMO

Analysis

user interaction
yes
max time kernel
209s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://startrack.com-form100a.click/tracking?syf=qtQpMO
Sample260731-a42lmatvbw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4572	msedge.exe
1668	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299324288638075"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{0303A59F-1087-4205-8346-FBB89C4AB230}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
4204	chrome.exe
4204	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
5028	msedge.exe
4204	chrome.exe
4204	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2136	5028	msedge.exe	83
PID 5028 wrote to memory of 4572	5028	msedge.exe	84
PID 5028 wrote to memory of 1628	5028	msedge.exe	85
PID 5028 wrote to memory of 1628	5028	msedge.exe	85
PID 5028 wrote to memory of 1628	5028	msedge.exe	85
PID 5028 wrote to memory of 3844	5028	msedge.exe	86
PID 5028 wrote to memory of 3844	5028	msedge.exe	86
PID 5028 wrote to memory of 2164	5028	msedge.exe	88
PID 5028 wrote to memory of 2164	5028	msedge.exe	88
PID 5028 wrote to memory of 2164	5028	msedge.exe	88
PID 5028 wrote to memory of 3784	5028	msedge.exe	89
PID 5028 wrote to memory of 3784	5028	msedge.exe	89
PID 5028 wrote to memory of 3784	5028	msedge.exe	89
PID 5028 wrote to memory of 4348	5028	msedge.exe	90
PID 5028 wrote to memory of 4348	5028	msedge.exe	90
PID 5028 wrote to memory of 4348	5028	msedge.exe	90
PID 5028 wrote to memory of 4344	5028	msedge.exe	91
PID 5028 wrote to memory of 4344	5028	msedge.exe	91
PID 5028 wrote to memory of 4344	5028	msedge.exe	91
PID 5028 wrote to memory of 3068	5028	msedge.exe	102
PID 5028 wrote to memory of 4564	5028	msedge.exe	103
PID 5028 wrote to memory of 3068	5028	msedge.exe	102
PID 5028 wrote to memory of 4564	5028	msedge.exe	103
PID 5028 wrote to memory of 2584	5028	msedge.exe	106
PID 5028 wrote to memory of 1960	5028	msedge.exe	113
PID 5028 wrote to memory of 4676	5028	msedge.exe	114
PID 5028 wrote to memory of 3900	5028	msedge.exe	115
PID 5028 wrote to memory of 4256	5028	msedge.exe	120
PID 5028 wrote to memory of 4256	5028	msedge.exe	120
PID 5028 wrote to memory of 2584	5028	msedge.exe	129
PID 5028 wrote to memory of 4072	5028	msedge.exe	131
PID 5028 wrote to memory of 4072	5028	msedge.exe	131
PID 4204 wrote to memory of 3332	4204	chrome.exe	134
PID 4204 wrote to memory of 4432	4204	chrome.exe	135
PID 4204 wrote to memory of 1668	4204	chrome.exe	136
PID 4204 wrote to memory of 4432	4204	chrome.exe	135
PID 4204 wrote to memory of 3672	4204	chrome.exe	137
PID 4204 wrote to memory of 3672	4204	chrome.exe	137
PID 4204 wrote to memory of 4036	4204	chrome.exe	138
PID 4204 wrote to memory of 4200	4204	chrome.exe	139
PID 4204 wrote to memory of 4036	4204	chrome.exe	138
PID 4204 wrote to memory of 4200	4204	chrome.exe	139
PID 4204 wrote to memory of 696	4204	chrome.exe	141
PID 4204 wrote to memory of 696	4204	chrome.exe	141
PID 4204 wrote to memory of 3484	4204	chrome.exe	142
PID 4204 wrote to memory of 3484	4204	chrome.exe	142
PID 4204 wrote to memory of 4924	4204	chrome.exe	143
PID 4204 wrote to memory of 4472	4204	chrome.exe	147
PID 4204 wrote to memory of 4472	4204	chrome.exe	147
PID 5028 wrote to memory of 5152	5028	msedge.exe	148
PID 5028 wrote to memory of 5152	5028	msedge.exe	148
PID 5028 wrote to memory of 5152	5028	msedge.exe	148
PID 5028 wrote to memory of 5236	5028	msedge.exe	149
PID 5028 wrote to memory of 5236	5028	msedge.exe	149
PID 5028 wrote to memory of 5244	5028	msedge.exe	150
PID 5028 wrote to memory of 5244	5028	msedge.exe	150
PID 5028 wrote to memory of 5340	5028	msedge.exe	151
PID 5028 wrote to memory of 5340	5028	msedge.exe	151
PID 4204 wrote to memory of 5536	4204	chrome.exe	152
PID 4204 wrote to memory of 5536	4204	chrome.exe	152
PID 4204 wrote to memory of 5612	4204	chrome.exe	153
PID 4204 wrote to memory of 5612	4204	chrome.exe	153
PID 4204 wrote to memory of 5756	4204	chrome.exe	154
PID 4204 wrote to memory of 5764	4204	chrome.exe	155

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://startrack.com-form100a.click/tracking?syf=qtQpMO
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffee8dac188,0x7ffee8dac194,0x7ffee8dac1a0
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,10519193808883010781,12826762740581617959,524288 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,7482890493271483214,12204073913020333964,262144 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,13410056602087256774,3384542128487478419,524288 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,8622811524859936761,13861293930847713718,2097152 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,18219630096078818262,10901613782153893559,2097152 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,10697811940700057894,2210343905329194766,2097152 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,16834170435249974934,1841663132245147973,2097152 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,16054180279454571159,1595022185846199345,524288 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,1863240113297371121,3769777023192571230,524288 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,5851034599100525693,17188684952433979132,524288 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,5851034599100525693,17188684952433979132,524288 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,15151015380596721928,1348879783798155345,524288 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,8540658883470273604,6864872479372242672,524288 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,3320812151522978313,7120777939514617545,524288 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,15042072357704375574,12479297171921364369,524288 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,4418871106671550114,2540524068103544160,262144 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3384,i,15947116117475132745,4180859639708854758,524288 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6244,i,14823864123876578828,8731057329393739406,2097152 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,6939424974898135661,6545316010889855325,524288 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,4205479657546743839,1885486040107202600,524288 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,8057074448665025977,8658588151320570735,524288 --field-trial-handle=2052,i,10675134059235642235,3170779490493759320,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:5340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffee6d9c728,0x7ffee6d9c734,0x7ffee6d9c740
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,1958417319724025191,4387828039741236265,262144 --field-trial-handle=1976,i,8781614436250318377,13395969239673268950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2016,i,10304322240055670789,12261711781782873492,524288 --field-trial-handle=1976,i,8781614436250318377,13395969239673268950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2040 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,3096786158131904028,10101769217329221245,524288 --field-trial-handle=1976,i,8781614436250318377,13395969239673268950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,974426249188293496,14091066718113144864,2097152 --field-trial-handle=1976,i,8781614436250318377,13395969239673268950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,2260956654507340934,10939047701912853819,2097152 --field-trial-handle=1976,i,8781614436250318377,13395969239673268950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,17337779400583440302,6413984288466790524,2097152 --field-trial-handle=1976,i,8781614436250318377,13395969239673268950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,2198509262431519124,10348189263960693824,2097152 --field-trial-handle=1976,i,8781614436250318377,13395969239673268950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,1343298645315994000,17655179270432771595,524288 --field-trial-handle=1976,i,8781614436250318377,13395969239673268950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5800,i,7309224991143647694,3980052881631570304,2097152 --field-trial-handle=1976,i,8781614436250318377,13395969239673268950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4876,i,9823685607248959980,7453778903895738186,2097152 --field-trial-handle=1976,i,8781614436250318377,13395969239673268950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3984,i,17591685013294370172,14743481168004153769,2097152 --field-trial-handle=1976,i,8781614436250318377,13395969239673268950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,847647880436629845,969127420422811763,524288 --field-trial-handle=1976,i,8781614436250318377,13395969239673268950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,13388499675157966941,15756676090799357283,524288 --field-trial-handle=1976,i,8781614436250318377,13395969239673268950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,14021946725655610593,13883175014905741204,524288 --field-trial-handle=1976,i,8781614436250318377,13395969239673268950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  PID:5772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d8f8ed400dde068e8ada30937c4ad2a136b6eff81af2a250760d0d4e1b006204
MD5 0a267f552f06203904588b583af34b00
SHA1 52b22adc73a6852481fb491fa3f88f69a71a8d95
SHA512 a90444643a6185715dded96b47dd1e7be883de2cc421ec8fe5e0205b1afd3415590505f62617e4049f49564f5a7ec8f1624347fb90c2330409bc1ea15f0fecc4
TLSH
T14EE02BA9C865DC2718FD0B19A0505786E754635B3A408D4F7A3C810C8FB1A374686C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 399ee93c4d132637c02fc31e026e0b803025fe27b760c94e1fb4d158203adea6
MD5 b50a5d64d450fc09810b66baaac1f476
SHA1 dcba25b796a8dbd506a0cbdde69f6d8d841932c7
SHA512 5b572296a5092367fcac3b3104545b6ffafdb0ffc228630b7ee4172628a610243a2d6f3e26035d2aabf47ca9cb04686e81f0a27d38cb10971fc05cdefcba5574
SSDEEP 192:VRN3PFYaRh+v70pAPRp2dj9+Hsb+WNno50SNdd2o2ezuarjailVyIsnAUgtaJ:VRN3ao6gUX68wg0C2SuOaI8
TLSH
T13742D82EAA50A97B6DDFC21AF9513757D7F6102221D02E80EAFC8A1C15D76CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5acc022bb1b4f1d3fab4535f64bd21fdc8295f4f06d65370ee5706f98c108e8f
MD5 fc86b0e9234f87e4c6e3554ec6f30cf7
SHA1 e3f81a03e36a5d8b132ef18c2a930da26daf1e8e
SHA512 e03a88294264a6ba9b5eb2c3beaf89e7762211ad7662dd502ec77729f1c9219fbd0a80d3b6b2bbf54e7f893d6d48e9d3faa1d1b5620abfae4f6686f7e827af30
TLSH
T128B01200C4415101C07203B011962488F1286F20960A170143F06922D8271B1C5140D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b62ae.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b62ae.TMP
Size 96B
SHA256 2519e85d471e89645539dfc01aa2250981ff5b8635bb008512d43a2daace026d
MD5 2351146ec75f97dea8b570c516009202
SHA1 14eb6db82e98e7213dc80003b470e16012a81858
SHA512 47922b906177010a60ee4b93ec04986b1e0522dfb29daed2ab5672261a443573197441fee03e2b18240ff72e927a71fe7685f2e2cc6ff32ce50d1688c78bb3f9
TLSH
T19FB00255C1227323C08323B025F5AAD871A0DF35CE03266392E01A6BDC2967145651E0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 000fef5cb0b3435a06d35b3a24d71ab68b8aafeaa1e06aeffe4a940b9c88a8be
MD5 c3278eee97e8f178c1f6e0243053de96
SHA1 5758b7b9a3b5c67e252d1043e6e90ffc92be5e7a
SHA512 24b007cd51ac06493c229fd138fe7c604a43dff2edb8cf351d8a68936973733145f387dbabb6833aef024d3ff597f2ca48cb44051871a71fcc490b57d69699ad
SSDEEP 1536:baLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:+qfd7NtZL8cHQRZEQ6Sps3
TLSH
T16FC30237ABC21F379E92CF64B9130FDA67B644A99030D301AAAD37EB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 dc50365d0f4c51990ba9e47707b906775f87a531708fecdfe0dbf0dd34093a45
MD5 51cbd63b7c67baf8ca912697f70cc8e6
SHA1 18fc58160b6c736ea963408f174bb1786c3be107
SHA512 5907057485574e92806d4f709248e518f4b9f9c75dc8166e89df3e742fe7d4e267f38a508ffdcf410f4912919d0571dae1ab771f1884ea488a9c45a2720f039e
SSDEEP 1536:ktGyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjt:UMqfd7NtZL8cHQRZEQ6SpsS
TLSH
T19BC30237ABC25E339E83CB74B9130FDB57B644A99034D301AAAD37EB6883591654249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 01dea5247e85a6fcae8c9dac383485f3ef4208364ed71c9c2385e32fb716dbe3
MD5 8d8ad1517a2d680fbff2437272091d3d
SHA1 c6fb811c740b20de0333d1ecd3f62cbcd318c8ad
SHA512 8aef557e045b0af63767352f843d6001ed848814b89873f9b53bfe75cce1a0ec0564dedc7a0ca356e763430178ac04e8e3ea6291f1e695838919795923cb6ba3
SSDEEP 6144:AQBQvfKBrHEYMjiHD+iYF0ky8qboqZ/ZLW3ExS:AkrHEvXF0kyloqZ/piQS
TLSH
T16C34232BFF826F33DAD19A24BA478E5D6AF2481444B0E390CADD3EAB2442D11794351D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4a9d7d1d6c91c8b233d57a651d088216354f971ce8fe19ef61ad41c3fe4b4c4f
MD5 18da134bc1a03263cd9b5b9e10dacc28
SHA1 3f8d763552f7811fa43f5dd4061383bc7c8af4ec
SHA512 1609e3392514c7b4817f2332332b0c4d791830c7c160599cfc2886e23eec5c95f7f7048dce86d12e7778d6fa9e47bafbdb56ddf2d4459149c25fa0e15fca9b41
TLSH
T17E71E5653351A4B1EFE5053CECD24AD979B0B0880A139EAA01705B3D3BDEB5F4C211CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c687.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c687.TMP
Size 3KB
SHA256 de05c59124cba551a92d4875bae42d9cbdb94afcb17a10c93729d4c0a15afca6
MD5 f5ae3adca7227453a121e27188e044f7
SHA1 06da8dee474becc99a3c5efbe192c6794201f614
SHA512 4ab61e5c8a9bc3e06932ddbd200bae33e0362d68da2c223982a1ecc9306cd0cc1a4d6333cc7d92e7c6fb5f09df9c284aa57464e23102463f73a99f4892d80151
TLSH
T19171C3653352A4B1EFE5493CEDD24AD979B0B0880A139EAA01705B3D2BDEB5F0C201CD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e73be5d67e9e09e103721d8914ce00f66d53aad78782b43dbe99c166613c4f1f
MD5 ad71d6f01404cfb698f5c7294d1853bc
SHA1 8395ad196991c1a7be825372854d33c46aa9e221
SHA512 45cf7b675ec8f64dd79010cf2c94f083f2277c86ad67f3cbb1e56ad792d2f5615141e665cfe4d52808c7dfc9db7cfd900658be4aaa674f61dbcdd702e68ecc29
TLSH
T18E21ACF7C2E582AE8A1157F0AA146E1BCE1E0905431C3D19C9D4EF5BA3E34B1E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 57ec1ab55e3f4d117fc667bbef34131d0515c85615171a7c9bfa52099f5bc229
MD5 60619552c964018a89f33d1873c2d7ce
SHA1 22091dd42bc0c9ff202ef50553119d74d77370e1
SHA512 b03672ef298b17b67dfd86f447879de7e89e6b0a69ff3055b5c82e6061d834ac672b2aee14705fccba59166f5153ad9d492b5375cd39e43c08ca7d5259feef33
SSDEEP 192:sxZzRRyM/jK1Ml8Mk5/f4s09z2vIdpFEHW6+WN5vTH/Y4j1Pt+IgrJ:sxZz3M5/f4sGz2AKHb5j/I9
TLSH
T11552C8166A349977CCDBD20AF955BF53D6F50472E2940E44ADFCCA0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 34d01ed192ce73235ceceb533acb36c239cdd618c9edfb6a2dc40a8302703b60
MD5 b9a49a04c3b38341abef9525f111b883
SHA1 f0b84282097158bbdd4c53232d7acec614148cbe
SHA512 321496dcd964d01f2ad0d0fdf2cd60b344d55fd5b73f5f41cbd4fe7eba4f481aa03052154361937a1b26a5b0e336f67bb55067e9d787c009fe628b00fd68c121
SSDEEP 192:sxZzRRyM/jK1Ml8UQ6k5/f4sD9z2vIdpbEHW6+WN5vTH/Y4LL1It+Ig5NJ:sxZz3qJ5/f4spz2AAHb5j/dB
TLSH
T1D552C9166A349977CCDBD60AF945BF93E6F54472E2940E44A9FCCA0C04E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4a3c2a86486d067c4a248b1ebaea5842bb3eda4af47bc0e253ffe44b8a4d6171
MD5 fa006e7e5067246b80e16246390ee04b
SHA1 57fb647ed3e802d79ea4673e0f9bba028aa4ae1c
SHA512 7a5468a183297e6380498a444e007b9b0923908272ef70bfac8b7a411eb0b8fee21b459d36c33c437a322936bd1a044e7a5d0aa6e3ae72ec3496d3586b55c341
SSDEEP 192:sxZzRRyM/jK1Ml8UQ6y5/f4sD9z2vIdpb4HW6+WN5vTH/Y4LL1At+Ig5NJ:sxZz3qP5/f4spz2AMHb5j/lB
TLSH
T1A952D9166A349977CCDBD60AF955BF93E6F44472E2900E44A9FCCA0C04E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4d25e890647fe975b04ec3d952f9d19ce10e75218e8785f2727c74035af774ea
MD5 d2c2b163ef6e2b0e4687dde1364c8b60
SHA1 cc66e68b417628a8469949217f6ec54e81a48a58
SHA512 64ffc71097bb167eaaef946b86bcfd054f7d7fe71770679c78cc5af6061ea8022a91e968dc4d7f50031a6457e0cfff79e44071e3ebddad4ff1ba672cac678372
SSDEEP 768:aA8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdxrofkSUn+:aA8iJPNWvx76ru1jahALocdK1U+
TLSH
T1B5D20B3B680CCB7E4F844E9CEC266F966ED801CB5B948D5447FA884C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0cb600c16df020971a70893f12d1e02bed883600cf134cf9fea11d56fd5cc31f
MD5 8f85caced3e1e6a0cf7a5f80e83dece0
SHA1 e47db20e5a70be08943924726c5d57f80abb35f9
SHA512 0e4f7c772bbe6e2cf54e5809ca4a47c8e97c60c51f2a8cc36d1891990812b2a40bf5800edd1bf8795b175d8c812163908f471d2e87ed61794d32fb49e8c1721c
SSDEEP 24:KdQf3kVaadCC+4SO+lIjY+Kitham+1EwuSmEMt8ofyXYtfo7Sa3df7z4Lv+CIjng:KoZIhKy00DyxCI/KnqIUjIRKgQEzyS
TLSH
T1E091574536BF07C62C7E2508D590876BDA82B2A37118E42B7B6C01B24FABD250DFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5952f8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5952f8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 48a8b1b5a4a184449060ec82694788928194cdab2fce2a0d3fd482d3db3614a4
MD5 c9cc53531dced84c071ccdd2865b9cb0
SHA1 2e78d5d9039949f1dc9fb5e11ec7e1c3195e8eee
SHA512 8914959eabeed07289d205594586d6373e7a2c015c8215f01b76b5dc64aedd4dbabdfc3d1d4bb093abbfc03764b72d6aaedc7a3ad4efe9314e4a4c4b7d18a9d9
SSDEEP 384:wXZcIhsNNfmbrI14kVHtitOObjI9G6w7jh:wfhm1Qt29M9
TLSH
T17C928E326C785C369EA39967F48A362B5FF48177E3C82F84A4DDA70D05EB5AC0317816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4059ab4d43570de1532d709ad2d943ad5f347083ecf265281e6129d8ed80b842
MD5 7260e0b89288dee7dec6fda14f9eb4fa
SHA1 88d9c58f07b4eb598a1f984e5dc30d52b19c67ff
SHA512 851fc6de6c47fabb8a198e1c55c3abf0ad07db9fa657031c56ac3482a4cccc76b413aed82721b6d088a83f3c80cfb357941c6c58be570d2e63957fbee19869c2
SSDEEP 384:qXiFiZcIbzsNX8TUNTUlIl2mbrp14kVHtXtOObjI9G6w7jh:qSFQPWwgd15t29M9
TLSH
T1A8D207F248D78836D9AE5B53A77D2D175EBCC167F2846A80B3C8960CCC960BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2018a43fc05384d16f377dcab8317f5afa523c45e83a8c72f0768233989f7172
MD5 985400abdcb169956246c14f7677f8c6
SHA1 b2f31a513b676b95b9ec7fb6b64dbce4c7cda66c
SHA512 ea1490283cde88e6c648392503e8af3bd1f56b479a69e0853c694d4925e63f68d45a9eff450b2da955ea1250de5c832640796a1e96f48b272650f6d9fb3523ee
SSDEEP 384:SXZcIhsNN2mbrI14kVHtitOObjI9G6w7jh:Sfhn1Qt29M9
TLSH
T173929E325C785C369EA39967F48A362B5FF4817BE3C82F84A5DDA70D09EB56C0307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 04c8496bb28d4a866fea91f90b70880d628a9c7029f184916ef501cc17eb8340
MD5 e14f972b367746ea760af9eebd336966
SHA1 48f3da25046aa39840a2d43f577d21fa70a6201e
SHA512 f4ecf9b5f95989aaea1c2081e6a93a97453f665cb72715e2cbf5a70eda03aac943e43b60572579c76c5fc522291f480c48dc980e304f7d84e42e3f66eb27a4a7
SSDEEP 96:ZqONkmGQsjpfmUTmDK5ih/cIPURHl8h4otop5a5DcBhPwivh50xy0SFYKRAxcbs/:gONp6kDfQmiUykwZ903YRQi1QU6
TLSH
T1B402D93568BC2CBB9EA3AE49B48737275FD5113BEA952F84D9E81A1C40D725C1307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bf90d0c6246d5ea83aab13a666048426dbd14327fd7738701a0ad7c114073a28
MD5 33a7495711748ef3ec2055ea9579aea7
SHA1 78a776a5c0f3efe61d594fcef09ccf0776945e55
SHA512 a3fa2e9b048ec917d83a1dd94541ef7463deb0fbe43b8a4eb579acd7fde55530d5ee5f6e343455f3ef189fb623735f4ba1bdc929160e9c7abb78828ab11b99a3
SSDEEP 96:iqONkMQsjpfmUTQK5ih/cIPURHl8h4otop5abDcBoPwivh50xy0SFYKRAxcbsa4G:ZONw6kVQmiUy0wa903YHHN+cRxq0U6
TLSH
T14F122B3668BC6C6B5ED39945B087362B5FA48227FBC97F80D5DC161C04EF26C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 328208737d94ad6db9092bfd99375289f1f19352add1b0b4ebe3afcc68376abd
MD5 4ce1d2d87c4d1ac469c31e7671c2c91e
SHA1 05d747c0b7d2b50b91653e34d96343281e42a1f4
SHA512 a969d4076cf09cd873c7221b893591065de586b3debcba88a6fdfcabe6b032662ea46f67168a3e8eab0fffba96fb2d2b426e5e0870815ae06419dda2a2d3bb12
SSDEEP 384:qXiFiZcIbzsNh8TUNTUlIRixbrT14kVHthtOObjI9G6w7jh:qSFQnAwgC1rt29M9
TLSH
T1FDD207F258DB8836D9AE5B53A77E2D175EBCC167F2845A80B3D8960CCC960BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

727dbe71-9f7c-4290-8d1a-a694c3fb734b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\727dbe71-9f7c-4290-8d1a-a694c3fb734b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 40f4a6f87cb29383286fe1ff71650a451822f3071b724a6c3106deddd0f52e33
MD5 5169a98100d0aa606ecaa4b6e234638f
SHA1 557b02035ca3fb5fa9b0ccddc3367192052303c9
SHA512 a22784aa36033d2877182b6e47c42bdf56c104fd0eed9005d1d239d82af2433b77f678ebc4463312a0411a04c2210b589be24fb0b977e0ebf698f1c56f80c231
TLSH
T181412759B6FA1148B3B76F5AABF7A96D483EBD372F0BD55D00010D8E0622A40C872733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2584-187-0x0000029357600000-0x0000029357749000-memory.dmp

Download