hxxp://github[.]exe

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://github.exe
Sample260802-wgs7made98

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2292	msedge.exe
212	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301668566033358"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
896	chrome.exe
896	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe
Token: SeShutdownPrivilege	1108	chrome.exe
Token: SeCreatePagefilePrivilege	1108	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe
1108	chrome.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 3288	1380	msedge.exe	85
PID 1380 wrote to memory of 2292	1380	msedge.exe	86
PID 1380 wrote to memory of 5024	1380	msedge.exe	87
PID 1380 wrote to memory of 1800	1380	msedge.exe	88
PID 1380 wrote to memory of 5024	1380	msedge.exe	87
PID 1380 wrote to memory of 5024	1380	msedge.exe	87
PID 1380 wrote to memory of 1800	1380	msedge.exe	88
PID 1380 wrote to memory of 4124	1380	msedge.exe	89
PID 1380 wrote to memory of 2228	1380	msedge.exe	90
PID 1380 wrote to memory of 4124	1380	msedge.exe	89
PID 1380 wrote to memory of 4124	1380	msedge.exe	89
PID 1380 wrote to memory of 2228	1380	msedge.exe	90
PID 1380 wrote to memory of 2228	1380	msedge.exe	90
PID 1380 wrote to memory of 1616	1380	msedge.exe	92
PID 1380 wrote to memory of 1616	1380	msedge.exe	92
PID 1380 wrote to memory of 1616	1380	msedge.exe	92
PID 1380 wrote to memory of 4808	1380	msedge.exe	93
PID 1380 wrote to memory of 4808	1380	msedge.exe	93
PID 1380 wrote to memory of 4808	1380	msedge.exe	93
PID 1380 wrote to memory of 4448	1380	msedge.exe	94
PID 1380 wrote to memory of 4448	1380	msedge.exe	94
PID 1380 wrote to memory of 4448	1380	msedge.exe	94
PID 1380 wrote to memory of 4396	1380	msedge.exe	98
PID 1380 wrote to memory of 4396	1380	msedge.exe	98
PID 1380 wrote to memory of 4396	1380	msedge.exe	98
PID 1380 wrote to memory of 2304	1380	msedge.exe	99
PID 1380 wrote to memory of 2304	1380	msedge.exe	99
PID 1380 wrote to memory of 1188	1380	msedge.exe	100
PID 1380 wrote to memory of 1188	1380	msedge.exe	100
PID 1380 wrote to memory of 1924	1380	msedge.exe	101
PID 1380 wrote to memory of 1924	1380	msedge.exe	101
PID 1380 wrote to memory of 1924	1380	msedge.exe	101
PID 1108 wrote to memory of 4140	1108	chrome.exe	104
PID 1108 wrote to memory of 5000	1108	chrome.exe	107
PID 1108 wrote to memory of 5000	1108	chrome.exe	107
PID 1108 wrote to memory of 212	1108	chrome.exe	108
PID 1108 wrote to memory of 4320	1108	chrome.exe	109
PID 1108 wrote to memory of 4320	1108	chrome.exe	109
PID 1108 wrote to memory of 1000	1108	chrome.exe	111
PID 1108 wrote to memory of 1000	1108	chrome.exe	111
PID 1108 wrote to memory of 632	1108	chrome.exe	112
PID 1108 wrote to memory of 632	1108	chrome.exe	112
PID 1108 wrote to memory of 3232	1108	chrome.exe	113
PID 1108 wrote to memory of 3232	1108	chrome.exe	113
PID 1108 wrote to memory of 2632	1108	chrome.exe	114
PID 1108 wrote to memory of 2632	1108	chrome.exe	114
PID 1108 wrote to memory of 644	1108	chrome.exe	118
PID 1108 wrote to memory of 4400	1108	chrome.exe	121
PID 1108 wrote to memory of 4400	1108	chrome.exe	121
PID 1108 wrote to memory of 1208	1108	chrome.exe	125
PID 1108 wrote to memory of 1208	1108	chrome.exe	125
PID 1108 wrote to memory of 4668	1108	chrome.exe	126
PID 1108 wrote to memory of 3060	1108	chrome.exe	127
PID 1108 wrote to memory of 1780	1108	chrome.exe	128
PID 1108 wrote to memory of 3296	1108	chrome.exe	129
PID 1108 wrote to memory of 3296	1108	chrome.exe	129
PID 1108 wrote to memory of 896	1108	chrome.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://github.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7fff0ed9c188,0x7fff0ed9c194,0x7fff0ed9c1a0
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,9684228583820642646,12724309681115027761,524288 --field-trial-handle=2352,i,11438118873083305227,907057256488060481,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,3963429894201746858,10908347663125716278,262144 --field-trial-handle=2352,i,11438118873083305227,907057256488060481,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,15295362188527822965,1580650239687069403,524288 --field-trial-handle=2352,i,11438118873083305227,907057256488060481,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,13975842100760508772,7207159996080545371,2097152 --field-trial-handle=2352,i,11438118873083305227,907057256488060481,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,9631515718545120022,12272977009515804768,2097152 --field-trial-handle=2352,i,11438118873083305227,907057256488060481,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,13117397291923382505,4752561498723865230,2097152 --field-trial-handle=2352,i,11438118873083305227,907057256488060481,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,948859166519032385,10006196339123293301,2097152 --field-trial-handle=2352,i,11438118873083305227,907057256488060481,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3616,i,5476201295993678195,14504597875698154605,2097152 --field-trial-handle=2352,i,11438118873083305227,907057256488060481,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3468,i,5847084164328998455,13804046552179945455,2097152 --field-trial-handle=2352,i,11438118873083305227,907057256488060481,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,2414421862447611948,913765086142845824,524288 --field-trial-handle=2352,i,11438118873083305227,907057256488060481,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,4237866427276804534,14977736776937661669,524288 --field-trial-handle=2352,i,11438118873083305227,907057256488060481,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5940,i,17279225964702168159,13480646204830022880,2097152 --field-trial-handle=2352,i,11438118873083305227,907057256488060481,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeff00c728,0x7ffeff00c734,0x7ffeff00c740
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,11408557969605101390,1614140420606123371,262144 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,5624525161734733399,6767223647883104694,524288 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - System Time Discovery
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1800,i,8045407170661410244,2223247318710246865,524288 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,13408936789261053460,4525153601646396716,2097152 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,8053926916073394770,7101409761253222671,2097152 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3944,i,9037127359522254008,5351564731425520668,2097152 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,3559984441950348227,5281292614894288748,2097152 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,16427421800759550159,3460179750007418052,524288 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5856,i,9637028469227998240,8650532977430652003,2097152 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3520,i,12222297191506282782,9012300131459754076,2097152 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,12912393072955214005,3643531793980456327,524288 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3860 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3464,i,16282433718935096979,12944885015905639751,524288 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,7404381891947215034,3479863962938221764,524288 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3128 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6052,i,56699449368908379,8575579648867751339,2097152 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1120,i,2402363992738795899,10603919084323966977,262144 --field-trial-handle=2000,i,1414439666429039739,5025717387986280593,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 68818c9c07ee50249c567b5c1d628e25b248e206b6ae449378b062b768c4c371
MD5 becbefd2aebcb12422a1c0ba0df567ae
SHA1 036a3c5a98711544aae01b9103f3ea4b6ead8577
SHA512 b2403e97af6f5bc60559a99ad5e0e64b87138a427056e32d4009a3e570ec7d2978639b00d5ad5df2a9c64bd9246c5d4c348162c54a44631b2b3144176b0a4201
TLSH
T15AE02BA9C921AD2B08FD072D246C0746E654235B3B40457F3A3C96198FB96371986C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c081165453dc0dfc6a7216559dfae40ddbabc2329a36f9ad13a4f108c02174dd
MD5 faccfbdb0563466fa8d3f2837d5b7d00
SHA1 37ffb21752cb94361fd0ad56512c71b59ebebe76
SHA512 86b475096c353ea7333edd2ce6bc2692afab26a04bc322315126d49c05f5671a6cf2b0234dd5dcefc00dcf48b9abc354cd18b09c1a3425c4074821d89d2e7581
TLSH
T1E82189583822C4E5CF8B567085BC85A5C4A02DBEF434A25F3D70C47467622B38187BCE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 8384092944aaf30608bb50644746fb816aeafa8a155acc9f977c89c3b87fb4fb
MD5 f39f38e43f5071f4f1fdabaecf2b8838
SHA1 5f5fc9e3b1500b2377bfc82e90ec52f8a832aeae
SHA512 33935395f555aacc652e2334cc6f0184c86522f18af88570dd3d8675d7d7e920b3089e46b08bc4ccfee13614e79cbf29d1ed6c85d2e18d961a4fcdf047d463f6
TLSH
T1953199047562E4D4CFCA567045BD85A0C4A02C7EF838A29B2D30E07567272F3A58FBCE
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 7fcff0f4917f9b4b0e42bd0ef3edefcb2e45794841b52cae9181f351aa7e0fc1
MD5 0cee7415505e20895762b9b1e3dbd666
SHA1 ed8664a9e15b8ae5c675895840b3571e8e7b08bc
SHA512 829fc6dbd4df0977d1589c89f99d4be544e2355f6706adf0d6ae37e33534ce18137bef61aafe64cfe3076598e38ce0440b0955f6673dfceb1a988e9243a85e0e
SSDEEP 192:DsU9UKYXE9/tZJ8spaRaIBT/+9NQHwIdb/IXISIe2wcNPhm0waPxqzfcfPnW9ft/:DsU9UKYXE9/tZJ8spaRaIBT/+9NQHwIo
TLSH
T168326AF7D3E8D62DC85156F4EB156E2FCE190A28432C3C66C8E4AF5B93E2472E11164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 82d41815242c42163f6540c97e668ebc8b06de5954d3304483f67d6b0be36ee6
MD5 84d947513d4ef57cb10d797caa3de05c
SHA1 fd8e7c808d1e686691be2ccc752a91a8277c267a
SHA512 41f929d5f618874095a453b9929597009bbd04c9fd54cc5495a98eca6dc7788fca7e30447e7af3549cbc4a6ea586b3134f1154a9ee9418deaf8ce530726e2fe6
SSDEEP 192:mRDcBhyGr75Av72ympAPRp2MhtP95Hsb+WNQvJG4OjeGI7D2yWkwu+VyIsnAUgrK:mRDmhyMcQUXJ7w7xe77D2yWO2e
TLSH
T16252D82FAA206977ADDBC225FD127757E7F5102265942E84EAFC8A3C08E75CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1bb62b307972ffbd3c53d88c00da60e3c2c351ac71a53bcb3d88177000768b43
MD5 37cf5f758bbe2bcc6eb4e49e414d274b
SHA1 74423e7c2953004b0332967afa7ad3577623782e
SHA512 0c56667585e4fdcca37e5fca955e877b183f55c9af38d210bd1182203496cf4b64e8d37dc101d894569f1faba3320ccdedb4a0ac748e45ab48166ed425de9813
SSDEEP 192:mRDcBhyGr75Zv72ympAPRp2MhtP95Hsb+WNQvJG4OjeGI7D2yWkwu+VyIsnAUgrK:mRDmhyM5QUXJ7w7xe77D2yWO2e
TLSH
T1B052D82EAA206977ADDBC225FD127757E7F5102225942E84EAFC8A3C08E75CC721701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 29ad7050da16c2c9ffb07187892b2cd2571dd06ab33f1cc931fe32cb35be1935
MD5 3557424e7e260dee61556f2b7ceec33c
SHA1 39db8b8cc5730acc5b7e29f32b216ca2fdfc0b1f
SHA512 cf942abb97bbf283dbaae48ce0a11f501ab83b84b31f94ac1508877eaf7f3d50bd8815ccfb49e0ffe8ec0d5caf9b7243b0e0c7fbd74b188d8ec63dabde23e5a6
SSDEEP 192:mRDcBzyGr75Av72ympAPRp2Mic95Hsb+WNnJG4Na2cI7D2yWkwB+VyIsnAUgtaJ:mRDmzyMcQUXt7w0t2Z7D2yWh28
TLSH
T1AB52E96EAA206977ADDBC225FD227757E7F5102265942D84EAFC8A3C08E75CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ea0112ccac588bb2bfc3c01033134ba12a40b4fd27128b144fdc83442c850a98
MD5 a3cdaac69950f670127d335298472594
SHA1 21e77e3ddd16edcc65c8393c5f079d615f397259
SHA512 a977a16fa3ef3abd5e7fe1759c528047bedbff4f575d3f9c39462fc7f18c9043dc6fa632616276ddbdf6e827a0033e587d6e863c5afbf78fcde668b68738c34b
TLSH
T195B01281C0029641C46302F8129214887314DF20960A170547E0A92288252508028050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58848d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58848d.TMP
Size 96B
SHA256 b2fc6e7d96e050fa5da6d2fec6844bd1f64ff7eb8095cc0b1e883a586ed199af
MD5 03427900d3a59777a259c80b38ae063b
SHA1 3eefebd03f135d29dff17750cfe8bfc4621665d2
SHA512 e5b4096627129be97711665666e93f76639bf07d9ad3440f6a48a84ffc3f797afa2b479d91b725031b0b613503d15a63d804a1b3dbc8055ff38b93b56d4789f6
TLSH
T120B00265C102A2A2C04603F22DD9A6D87171EF35C603271792E41A66DC25AA14536575
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 458787f36c9c8c70423385fa2c4fe83ab72cd59d7200341eadfea5c5e428b4e6
MD5 c5b9242e22ba26bddadec6e5140b5240
SHA1 7d65033a293664230b692f0c1e6d92893f8b3488
SHA512 85228e1911acfc56876b5eec7afdddba1cc39891e5d5c92446ca4a852c463f76cdb4bbc4d39f29f82d1bf91de2fe1c6b8f789854b68844315b6ffcd22ef3d44e
TLSH
T165B022A208800282C38803BC03C008C233338C3CA3C3828382A888A3CC3220A8303A08
MD5 SHA1 SHA512 TLSH

Submit Download

e495b656-4579-400a-a9d0-2c1bc0dca195.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e495b656-4579-400a-a9d0-2c1bc0dca195.tmp
Size 13KB
SHA256 0f4cfe278fffb856b2484206bb377d0d46452b967fb9056bcdc857a952c568dc
MD5 c3f93c534be8256f5636f5739abda988
SHA1 1e05c8b85aff9f03950b523164587a7027a0fcc8
SHA512 9d8ad0fa20a56f27574b9a3b52e8c32770564082ebae7468d897f5d12c2d282f4d0ef281408dd7ff2fac08bb85f35c987155a5309d0b5956838ce2807df00ca8
SSDEEP 192:mRDcBhyGr75Rv72ympLPRp6MhtP95Hsb+WNQvJG4OjelI7D2yWkwA+VyIsnAUgrK:mRDmhyMBQtXt7w7xe27D2yWg2e
TLSH
T1B852C76EA9206977ADDBC225FD117B57E7F5103265902E84EAFC8A3C08E75CC721702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 b59bdd6ad92d259e1fb1be38e8b1831705bc0440acbbf1721aaa4fc90e966fec
MD5 16b27843f4c40d5af8e736e8e2a6df1c
SHA1 f89e0b67eeba5f4c99936ee4eb467f4e53b127fa
SHA512 1e21279f2eacc0fb223fa9d853350e8baa1230d1809fcf32780e7ba3219fb81c3d5a31df45f8664ecb81a87b9a3784790e2897cdf2789389b33e85c7e6d0ccec
SSDEEP 3072:vLdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbAhqfd7NtZL8cHQRZEQ6SpsH:vL8i0Aw9NDv+qw5ZtAhqZ/ZLW3ExH
TLSH
T18F342237AF034D338FC59E7468135B8F5BF4A82AD064C78AB99C37BF99078A52817418
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 7292cb5222dbd66ee31b9edd626c94af8d961dc8b08df7c616639f97bbc5c80d
MD5 d6a7ad2016c623555de66005f4a8a6d1
SHA1 3e424380d467cbc00f7b6ffbe39c1bb5045fda73
SHA512 14017edaeaa981373b66b48ced4489263fbdd659e3a8167e1e5b93020d3789bc6427e19d11c449924ac519d31450a4b1125f555cf289f7a89002d580631c01a8
SSDEEP 3072:kDdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbAhqfd7NtZL8cHQRZEQ6SpsH:kD8i0Aw9NDv+qw5ZtAhqZ/ZLW3ExH
TLSH
T13A341237AF434D338FC59A7078278F8F97F4A869D074D786AAA877BF59038962417018
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 52a213eef912b050d4507635816329d193a83c91067809710aaaf2e0afc189b9
MD5 1a294870d15e23721d5b44348562644c
SHA1 36109f41e826acd90b9cb066f5a58be3c0d26cb7
SHA512 f63131f8855aa786dfac18f76168c2c38f2cf9c0f1cd2c89fe2e3537e90443ea6b946c725c4c75581b6c2d9cfd4f01eea657fa30094a8813c667b6c2ac6e5635
SSDEEP 1536:T8QyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Nqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1D5C302379BC21F339E96CB60B9530FD697F644A59034D301EAAD77BF6C83891644289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 708e876707839da9f639c204692b3c7a035a923d8480bfb6c7765a2198bb38e6
MD5 71fae70e2f75e14b7fc750c2504962a8
SHA1 dca44375c034bad5f03d4e7ff5bd98f142aeddb7
SHA512 0bac6462d77f39f1e98fa8981fba5b3b17f08e4847d969397284b28faa95d662242739bcc7a1f9ad6a62dd9fdeaad5c0e4263a0673b24d45eecbbbb99c0fd5db
TLSH
T15AD0A722791D7495E32F42359522D21056691073A6625305B314CC1D99784C456D1BD6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 613ee2ee21562a64ed7cc7cb1ac0a40c566dde98b3e06a39aa627d718bf51f37
MD5 2961ce966afe723eb325c7499f69c43f
SHA1 100908045f890b2b06ab175aa74d73c21d1e2303
SHA512 5fa299769b2626fc9506966d6f620f6fa89d3a55e55e9400eb8548cfc270f7dda56c8f2d8a30213dcc90c54e1722340b3ca538baed8d860b03839a7b72d8776b
TLSH
T1F2615CB90A6349C4F3210238B3F1321475B2459809DFEE1A38077FF865C2BBA6125A2F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582b9f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582b9f.TMP
Size 3KB
SHA256 72332d8bec88f8f44479dc5564dd97f5ae99445a9a75b32805e3fbc7bf319868
MD5 32c915e11593c03808fac46a76853cdb
SHA1 a9950630949aa720cfc51579cf3fc584d4dfeee5
SHA512 89429b52b569d1a03d756c3f6012e5a56b80de425a80dd4cf373af646985d87fd2bf7f1748d7e81c8c0245935b9dd0f6770e58b65a646144ce3283a3c6717abe
TLSH
T105614D79066315C4F3210238F3F1721475B145A8099FEE1A38177FF465C2BBE6115A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 4e03a0f9adecd2e75fa1269d123cb05f984b51b8511b98b9b6d7ead86485fcc3
MD5 a6fb09338b44f01e41502a0f01fa71ec
SHA1 5c1af72423c214b7516883fb25298c85adbec649
SHA512 f3ce9f1f6df19c378953c542ee8ee935d202956933961a9128edb7cf3e29ba5685598203f1ba8856bb99e4768c454b200b46d308d3362d6dc3e9830e01f0f443
TLSH
T10D11B1F383F5896D8A1156F09A149F1BCE2C0547435C7D5A85E4BE1B93B3475E001A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7587dc8786281b5fe9e11cb52b7b8b19dd7c4b9ddda9dd7b03995f4980be63be
MD5 f7e71de0d7bf0185adba230bcff16a3f
SHA1 e61e860515cc8ad750d516dff9878a0f5b6c7966
SHA512 79b05583475d3815f50e03498efe6f63d38589421fb4bcc0739d76038704b47f796acd0cecf2134bcf8cf144e4f9f9a4eba29d420f176e70a54f1b1dd72e98f1
SSDEEP 192:sxZ/BReWyM/jK1Ml8xkJ/fIs1WpVBMbPdpmwZHW6+WNdioII/YnmEEjIgFJ:sxZ/BFjJ/fIs1WvBMPnHb7/Dv
TLSH
T1FC52E812AB346977CCDBD21DFD517F53D6F91462A6900E54AAFC9A2C00E6BEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c31c6fe638a4f85e2e19f86d24fb9d6ca4c5d46080fcfe53855f8b1269ab40c4
MD5 fbd454e78d9e6410a30a9fb34dac6451
SHA1 e0fd9d75830517d56eac1ea7b165317422093e45
SHA512 64f210eed4e635aa6bd572fd2524a2d1546db747ff5ac4671758c60a769ea2494f21741f17f57ad5f10796bfeeb01dbe2e939ff66eff47c0a215d06c7ab4b317
SSDEEP 768:3iUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4REroV90p:3iUZYTMWvg0Pou1ja7eLZmRP8p
TLSH
T130D20B2B280CCB7E4F844E9DEC2A6F967ED801CB5A584D5447EA884C03CB7EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 353bf3e08c0580ccfb0d2507fd31a7c6f337b18ba554adb80aa29c335314e379
MD5 858d7adf6c154e99e3546bcf9ef6c94f
SHA1 f0fdd2eaf61e978fd67a552d5ee816382e39fe9b
SHA512 338b1071cedc502840725ce00bd25eb2df3b14a60700eb5b9274d8d38a567ca00f0de7cc44b30a67d6d31293a676c6fd067b256259c5a6d3bf4ebc39bc563523
SSDEEP 192:yONJ61VWQmiUyBMgGX5Obd+jIjzorynm2k/aSi3oDLU6:yONJ6WvgGX5od+08y9zSZDLU6
TLSH
T1AE02D835A8687CAB8EE3BE49B44737135FE4216BEA552F84D6E81B1C00D769C2316C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 86e596239a058ba1e5915bbfa87261597d460a7d5a83e4a227a4b293e62cf191
MD5 4eead60629ac282f04c73ff0047985d4
SHA1 c76a842fb3654922c63645d2c312ca40ca518732
SHA512 6dc743d1ea8adeb4dc2cc1527fd975752934ff5b635e9d2b56d7aba196de4b641b17313a2c794b2caf4aaa2128f59c8504ef9474239609a033d64bc410143950
SSDEEP 384:GsNLLT4EKqB4HPHzX5od+08y91XeDcHFAStkaXpoLwkK4i41aMX7:Gfv7OreDcaSSRK4i41aMX7
TLSH
T1E18208B1E8A56CE708E2E0C9A906F1136DB45137CA8D5A4CD2FD773D309F9F86316462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 15d20c34ffe9f6afaa6dea18473b7aed8e7e1b7fbc90d88db7b7a6e8781f33ad
MD5 68f7f4ab71f15a771e92bb78ce9b093e
SHA1 9ca3326ba5fdb89c4eea32fb67443ceac9a12d40
SHA512 a13453b088e21861a992301b9396cafc2d6af56b3cd84cf055dbaebd852c2059fad315c775afce1c08fe1a5e6949cb607f8c0b70739ca9e90dc128fe06ba92aa
SSDEEP 192:bONe61VWQmiUyuMqGX5Obd+jIjzorynm21XaDhjJS4q4U6:bONe6eSqGX5od+08y91XISCU6
TLSH
T102121932A868BC6B5DE2B485B44731135FE55167EB887F90C2EC2B2C00DF6AC531AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d8d905a2df9f888a5b7b2a07fc23045320078a5ceab70f149e7faf492c940747
MD5 c149c27bae3da60d9c3770f21555349b
SHA1 3d86ba314f9ce1b144fed005bb51a4ee6a40bf2d
SHA512 35717dacba7c9611e2429ee5914fb2a5c5e263b9ce4e74557844ea1e2248ba7ffc667caed85da99b30482c2e2042652cc567397b79b8b56635a0a4e730668411
TLSH
T19041EB5CB6E91148B3B36F4A9BF6A4AE487B79772E06C45E00110D4F4A22B01DDB1737
MD5 SHA1 SHA512 TLSH

Submit Download