hxxp://KRX-Client-19[.]5-win64-public-v1[.]36[.]1[.]html

Analysis

user interaction
yes
max time kernel
149s
max time network
78s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://KRX-Client-19.5-win64-public-v1.36.1.html
Sample260808-cb3dkafp5z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3596	msedge.exe
1788	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306277210452551"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{7882D553-3DF1-4D5C-80A8-2ECFCFCEDCE6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1088	chrome.exe
1088	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1088	chrome.exe
Token: SeCreatePagefilePrivilege	1088	chrome.exe
Token: SeShutdownPrivilege	1088	chrome.exe
Token: SeCreatePagefilePrivilege	1088	chrome.exe
Token: SeShutdownPrivilege	1088	chrome.exe
Token: SeCreatePagefilePrivilege	1088	chrome.exe
Token: SeShutdownPrivilege	1088	chrome.exe
Token: SeCreatePagefilePrivilege	1088	chrome.exe
Token: SeShutdownPrivilege	1088	chrome.exe
Token: SeCreatePagefilePrivilege	1088	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2176	1696	msedge.exe	81
PID 1696 wrote to memory of 3596	1696	msedge.exe	82
PID 1696 wrote to memory of 2548	1696	msedge.exe	84
PID 1696 wrote to memory of 2548	1696	msedge.exe	84
PID 1696 wrote to memory of 396	1696	msedge.exe	83
PID 1696 wrote to memory of 396	1696	msedge.exe	83
PID 1696 wrote to memory of 396	1696	msedge.exe	83
PID 1696 wrote to memory of 4588	1696	msedge.exe	86
PID 1696 wrote to memory of 4588	1696	msedge.exe	86
PID 1696 wrote to memory of 4588	1696	msedge.exe	86
PID 1696 wrote to memory of 1260	1696	msedge.exe	87
PID 1696 wrote to memory of 1260	1696	msedge.exe	87
PID 1696 wrote to memory of 1260	1696	msedge.exe	87
PID 1696 wrote to memory of 4936	1696	msedge.exe	89
PID 1696 wrote to memory of 2040	1696	msedge.exe	90
PID 1696 wrote to memory of 4936	1696	msedge.exe	89
PID 1696 wrote to memory of 4936	1696	msedge.exe	89
PID 1696 wrote to memory of 1580	1696	msedge.exe	91
PID 1696 wrote to memory of 2040	1696	msedge.exe	90
PID 1696 wrote to memory of 2040	1696	msedge.exe	90
PID 1696 wrote to memory of 1580	1696	msedge.exe	91
PID 1696 wrote to memory of 1580	1696	msedge.exe	91
PID 1696 wrote to memory of 1068	1696	msedge.exe	92
PID 1696 wrote to memory of 1068	1696	msedge.exe	92
PID 1696 wrote to memory of 1068	1696	msedge.exe	92
PID 1696 wrote to memory of 4388	1696	msedge.exe	93
PID 1696 wrote to memory of 4388	1696	msedge.exe	93
PID 1696 wrote to memory of 4388	1696	msedge.exe	93
PID 1696 wrote to memory of 3016	1696	msedge.exe	95
PID 1696 wrote to memory of 3016	1696	msedge.exe	95
PID 1696 wrote to memory of 3016	1696	msedge.exe	95
PID 1696 wrote to memory of 3924	1696	msedge.exe	97
PID 1696 wrote to memory of 3736	1696	msedge.exe	98
PID 1696 wrote to memory of 2512	1696	msedge.exe	99
PID 1696 wrote to memory of 4452	1696	msedge.exe	100
PID 1696 wrote to memory of 3736	1696	msedge.exe	98
PID 1696 wrote to memory of 1660	1696	msedge.exe	101
PID 1696 wrote to memory of 2512	1696	msedge.exe	99
PID 1696 wrote to memory of 1660	1696	msedge.exe	101
PID 1696 wrote to memory of 1660	1696	msedge.exe	101
PID 1696 wrote to memory of 4832	1696	msedge.exe	102
PID 1696 wrote to memory of 4832	1696	msedge.exe	102
PID 1696 wrote to memory of 4832	1696	msedge.exe	102
PID 4452 wrote to memory of 988	4452	msedge.exe	103
PID 1696 wrote to memory of 4360	1696	msedge.exe	104
PID 1696 wrote to memory of 4360	1696	msedge.exe	104
PID 1696 wrote to memory of 4360	1696	msedge.exe	104
PID 1696 wrote to memory of 5012	1696	msedge.exe	105
PID 1696 wrote to memory of 5012	1696	msedge.exe	105
PID 1696 wrote to memory of 5012	1696	msedge.exe	105
PID 1696 wrote to memory of 4568	1696	msedge.exe	106
PID 1696 wrote to memory of 4568	1696	msedge.exe	106
PID 1696 wrote to memory of 4568	1696	msedge.exe	106
PID 1696 wrote to memory of 2148	1696	msedge.exe	107
PID 1696 wrote to memory of 2148	1696	msedge.exe	107
PID 1696 wrote to memory of 2148	1696	msedge.exe	107
PID 1696 wrote to memory of 2260	1696	msedge.exe	108
PID 1696 wrote to memory of 2260	1696	msedge.exe	108
PID 1696 wrote to memory of 2260	1696	msedge.exe	108
PID 1696 wrote to memory of 4120	1696	msedge.exe	109
PID 1696 wrote to memory of 4120	1696	msedge.exe	109
PID 1696 wrote to memory of 4120	1696	msedge.exe	109
PID 1696 wrote to memory of 4352	1696	msedge.exe	110
PID 1696 wrote to memory of 4352	1696	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://KRX-Client-19.5-win64-public-v1.36.1.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffc0cd8c188,0x7ffc0cd8c194,0x7ffc0cd8c1a0
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,11499728050781355836,16076157882769748418,524288 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,7386791731581013254,3379241825704767326,262144 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,5535293908153066633,3310166663955495006,524288 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:13
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,3107674518886330434,543749240361122213,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,4766780227227293373,3964686923106739535,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,812587590466764426,10949295082814921634,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,15359141286719092103,12168776839609997870,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:9
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4280,i,18082548190470566924,16389997768758213001,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4404,i,14546057601072554591,5411217957329694543,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5144,i,8066705963350887125,11258372507993505233,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5320,i,5917440326639327038,7516139552280326611,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,9782203893397032080,3471387495356334319,524288 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,9782203893397032080,3471387495356334319,524288 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,16976584057172271320,13655005500389798656,524288 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:14
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,6194721437950209254,13127905630792556292,524288 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,10108823530038710021,15261897777726097023,524288 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6328,i,5900150912184558054,623542458915687598,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6368,i,3062752031276634470,824731884552380183,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4388,i,1396279612663514222,11218165013092385109,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6796,i,2694746222488541120,16995327980554302099,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6920,i,888456143996682727,17054993285027219437,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6128,i,9976215970481869244,256713691548471701,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5928,i,11858333472868079034,9013470371660668257,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3892,i,15748694643849766244,10284863290835317695,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4524,i,17001266915399285913,14214847377882138554,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6512,i,10541790866406745120,5422398893574043646,2097152 --field-trial-handle=2080,i,15300873344489162938,9543051657215683229,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0c9ec728,0x7ffc0c9ec734,0x7ffc0c9ec740
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,10064948742125130773,4709149738470575894,524288 --field-trial-handle=2064,i,12526003522147061150,16656141093516480236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2092 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,11336587237264365234,15964414364057498269,262144 --field-trial-handle=2064,i,12526003522147061150,16656141093516480236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,4516620317720206429,10847810462171892215,524288 --field-trial-handle=2064,i,12526003522147061150,16656141093516480236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2416 /prefetch:13
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,5558881181748155717,4353102427071130576,2097152 --field-trial-handle=2064,i,12526003522147061150,16656141093516480236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,5014680400657728328,10322880484823282250,2097152 --field-trial-handle=2064,i,12526003522147061150,16656141093516480236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3196,i,9401816609464367541,12284999628934233013,2097152 --field-trial-handle=2064,i,12526003522147061150,16656141093516480236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4276 /prefetch:9
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4652,i,10567629176425051476,2818133402086680427,2097152 --field-trial-handle=2064,i,12526003522147061150,16656141093516480236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,1663362050870496560,1941885053922157977,524288 --field-trial-handle=2064,i,12526003522147061150,16656141093516480236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5736,i,10602276112938470028,6669035485944447840,2097152 --field-trial-handle=2064,i,12526003522147061150,16656141093516480236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4528,i,9582671771006424694,2789906802955113286,2097152 --field-trial-handle=2064,i,12526003522147061150,16656141093516480236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3372,i,16500382768516870357,13292718793652295828,2097152 --field-trial-handle=2064,i,12526003522147061150,16656141093516480236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 db4d95e13776834767afb129d9f1cdb6913fce5d935afbd582e210859e73b66c
MD5 f83ee1a0572ef2a288c68b9133cd422f
SHA1 bf4648ce1b26a35a592b396796ea10944e8308db
SHA512 f63b18c1f143f9f4e213c14227736c27d6b2cb93d89465963b8fb0aa386c89a0785500f71d66a0d2b02f1d71828804dd3ba0abd063d93f12e12211da33aa6a8f
TLSH
T103E022EACA21A82B2CFC171964484B86EB4003A72751894F3B3E92198FB16368581D1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ea65dd8c6ff2b82df1b64fc176474f54be6e7e2c7a83d1dc3241168f55c35680
MD5 21272140751949471577e30d9c25075a
SHA1 982d3443a465ecd2d93a53e6d167341909c8954b
SHA512 c61f2e17e50ac3ef1219a45f1d94ce99aceb63797d9dc4fa32413160afcc5401485733399c27a0d0e34fcd0c2b339b3384b13b347676d8bc19f576c955197185
TLSH
T1AF2136F71370997E8710D2E4EA15AE1FCE790121131C78B685A46D2743F39A2D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8224944675159eff98e1dc8fb6db2cde6cbc9804a169094c1101d63d6b423ac2
MD5 bbae738ea79bb733f9f09a3d191bf1ca
SHA1 c401dd4de0bfc74ccc8764e8b8260efe94acf5b2
SHA512 b1f6d457181672946e3c1844747495ba8607aa3e6593995caefbc27d319ece3dd932d1db810b0c18cb702123aa7560587e579883a4c268f61bf08d6fcab778de
SSDEEP 192:KRlcBe31/5MZoQ56Tv7sBpAPRp2rX49NHsb+WNnpp0PNnkwGM0PyIsnAUgtaJ:KRlmelq6r8UXBrw301nmz8
TLSH
T12442E82EBD10697B9CDBD229F962BB23E7F5202225C51E84E6FC892C19D75CD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
TLSH
T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 66485f6ed366e09491cd33d490578c9e9653132b54e07b4edeb6eb41d5f3b3c5
MD5 4e424c0c3b91c6813e0d2064f21c42c3
SHA1 00c505446c0417edb1c5de3752de154c487c112c
SHA512 744f3665ee94e3fed445c10fd699fdc282b12be490b94bd9300855200fdf263cb976d037ab119da366190287573348321a2393a09f73302a71af563bfbc5cfef
TLSH
T1A4B01280C1415900C01245B41103548C65049F54DA0D170283E46977DC350618015050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594bf3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594bf3.TMP
Size 96B
SHA256 10ed99de3aeef245a11d5914187560466097ed530453d8ac177155ffd0c60bab
MD5 435ba46095c6a382cc1421fda42d8e99
SHA1 c4a2988d9cf0a9c663d060e86b270af232339976
SHA512 1421d61dfbce20373d68716cbd6deabb5f4181b461f9ffe23c7210d8a9867d2bc96e869856277a56926ec76832bdf38b9cefae2f5c046bf3d7db309c3a0f77cc
TLSH
T160B02200C0332202C00323B020A0C3C8B020CF22CF030222E3E80A32CC3A3328020020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 bf58d9708906e55f905e6fa510ea44aa8bd74cf1379088fa5d25af924845e761
MD5 14d7033548c454af6a0094b45477737b
SHA1 54e29a8e48855ef12239f0ec004eb60385678b11
SHA512 09e75dc571396996ea938099885660727acdaaca2de1da0e9fe54fa60c3c935f543d46b61348080552aa56f3eacc480cb0898190b34af71a61eaec0f541e7bc3
SSDEEP 3072:PGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:em7Rkm1tYpBeh2BAoe
TLSH
T108C3123B5E75A97759B5B70EB08E0B1F1EF14EA6C920DE82C8D85B0437E97CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 eb0669804822c018a9ef2bcda96abb01794e64e5481ad296257f175ea05955e4
MD5 0b73a00f58dd08240e24f3d08e72b01c
SHA1 4cd223c9d07b7acee4c1a7cc6c531c54529016be
SHA512 67f349c8f1de3e64b818316de5615d6f9dec3b79d9c82ff8c930cdf10af593bcf837b6a4d254ad0055bb603897e1707f660548469686ea8ca572980ded216ac1
SSDEEP 3072:OGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMn:Jm7Rkm1tYpBeh2BAon
TLSH
T1C0C3123B5D64A83759B5BB1EB08E0B1F1EF149A7C920DE92C8D45B0437EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 45f521737e34108fcec0f24251f1736a9124dca7794b71ae2966e26d8a05fc0d
MD5 cd7793cdfb9295f447572efb6e70bf81
SHA1 dce217c94f7231f2559527c77b17604e0c11be61
SHA512 14938c84baa985800075d40695a2c29c097db067e02c4e847dadba963bcb208d88cf963091e96a6bfb0bf1ee245e50457f5f714cbd561eed42d6bcb9f59219f5
TLSH
T190D092317F5AB451DA46123A9841872A2DA5444A2AAB9207A261888DFDA50A8A3C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

1dff92a7-1a2a-4e92-abef-1292c4822594.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1dff92a7-1a2a-4e92-abef-1292c4822594.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 98410e973ea7cee86c68e9d27bdcea624260136bcf047f0041d8acf1d3b9d51d
MD5 7ac976f0f1b1efeb14289b1546eb11b3
SHA1 1fe2098d542ee43779fed793b0f685915c045fd3
SHA512 3773308c2832f106e152ea25e4bafb6c018b7568036687c4c92c38e2958b1fb03ec546626d54dbafe0ad6310a49a5a7b0cd34e2a02f57a8cce4c8a9a8048ba2b
TLSH
T1D5610A0935DB5A93E7A1047294E25E04FCFE83990F376EC602809EB4DEC77E1C955C49
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 52c67a1831cc54cf2c782d6eeed86c33b57b3d6ca43bc0e0d71ce529310fc60e
MD5 bb89a2af865aec4dc73c551a87b6d483
SHA1 6a921b1f6f4de258ff8d8dc0a36b4bb335b284a3
SHA512 ec43d249b2c4f6f92d09fdeb195ec6677cf752a19234beb45c6af9538b474a920ece051a142de871152132f4086979debbfc7fe6a538d89fde0c1a68ee327d6c
SSDEEP 192:sxZfm/yM/jK1Ml8MG2cBlJN/fpVsaSPRdpbkB5/W6+WNGY0asWKmkIgrJ:sxZfm7e2mlJN/fpVsaSNg3/bG5Ye9
TLSH
T12642E715AA346977CCDBD209F955BF63D6F9047392900D44AAFCDA1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5a3cc1d2cd66f75244ac1ba891e5cbfca556712037792065aeb7a3ff9de4a73b
MD5 c9a6ac5cab752d8e7f8899d94553066f
SHA1 17464d82371aee543ce6dabe06ca76e95b3119e4
SHA512 cbe60edfa6d8af6e73437e2ba3a6c4b03b660533c02de48ced9750c04ad243d891e5b130c088a12bf0539b3bf4cb43460781b0b7ab71307ca3d516c529b8e193
SSDEEP 192:sxZfm/yM/jK1Ml8/HcBlJN/fpVsr8PRdpbkBl/W6+WNGY0eVWoZ+IgbbJ:sxZfm7YmlJN/fpVsr8Ngb/bG55BB
TLSH
T16C52E815AA346977CCDBD209F955BF63D6F8047392900D44AAFCDA1C05E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 88079ca7761d42bcb8b2c540bebe74f0413175f5aebd0f87fb36c7fde6459978
MD5 d048af9dda0933a25288bc841c401b56
SHA1 a75199b27570c6c631c6c066390fe992eb77871e
SHA512 75482552fb452344269e0d1a21bd80ff04a5493b43599675f89180b0d8ffff85a67fc3940d490c3e08f10b938865df09e4e21669d993a44250a40c26ce28b1e7
SSDEEP 48:KEWIHKvDWI3K/aYnymcRAsq26gWOPzIrkgKs1kSgw0w9/y8tyZUIDKhiEo:KEWgKvDWcK/aKmnKK4EuqUAKhi7
TLSH
T15DB1178233BB12067E7E6518A3D68737AA42B5633018B93B7BA854724D27E105DFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2a2bebb-aa59-43f1-b6b1-5ee7e74dc74e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c2a2bebb-aa59-43f1-b6b1-5ee7e74dc74e.tmp
Size 31KB
SHA256 e24bf2dae796b3503aa8253e8dd3e44ab40579043ade6218c6180882ad5c66e6
MD5 ef2907960c5e4dae1e7e5ea901c33b7d
SHA1 1ba9e15162a9874b5bc3426912000e887a4a0f96
SHA512 fb5bf6fec054cc25239f5650daeded164bb71ff24d66bf97b1580e7d7107800c1329cfe06474d57e8b4fa04f02f9304b1d1d16d21f82770e63fbaefb179cba1b
SSDEEP 768:S5/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0Vpxroww:S5/zh8dF2PkWRmEcQXwu1jaKWjLp2tVe
TLSH
T190E2F93F280CC77E4F844E9CEC26AF976EE801CB66684D5447EA894C03C76DB521A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 52341bb37bfc8f3697b9d8b5e1a9cbeaba7264d6bb1864ffb4d6fc1e19ef3895
MD5 1039c53e010bd53fbc6ae7084502cfa2
SHA1 aaff34ce4d544b3f1fb5f9ddaca930cf5adf2a64
SHA512 81859d2adb406b28c4f76e323df5b32ef9a0cb82bf73110c60086be30cda143f88c7e12c0a9e97cf4b5ac0ea21cecfb2c18448350d199857dd0bd3df4f03dd5d
SSDEEP 192:HL8N6X/QL72U7I5KQmiU13CU+8Bnv0nBOQ/7SzYxsq+UI:r8N6X/juI89T+2nsBOU7fxcUI
TLSH
T1EB322A726C785C374EA2A244F4873613DFF85067EA892F94D5DC2E0C02DFA9C235B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 c79d8555788444fc4ed2e036cc111d7b3490ed2bc3f1ed46084e82c9669b400c
MD5 b9dd588b291ef31431b6ed52aecbd888
SHA1 937bd2d5a0d6432ac622767df920c6450320ed7d
SHA512 5666ec397f38a5e1987593866e966f9466d59128823c02d6db9e4defa3599fdbe610987706b97e29aec5f89d09e5dde1ff410fe21f7a9be73f803d93f1dd5897
SSDEEP 384:u8N6X/juI8Sa+2nsBOU7f6uWm/Job3VFekj5EUI:uNri+KsBOUD68/u3VFj5EUI
TLSH
T1C382177D9C244C3F45AEB708A18E3A238DB8103BD9785EA8E3D41B0CD177A5CF786925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a7b783940adc0d8112666bf5c4b39b95071aba59a0ba1ece217add23e5a18ea1
MD5 e896c1cde5774635a0793874882ddbb0
SHA1 b034096b0be1a707fa3d352bae3c1f7c0f9f0904
SHA512 a2c67cfa1e7ffb777dffc5e69b24bf0cd9b46adbcb519a7a1a77cf70ce4b775c271a01478ba6e2a8eee87b34e6ca903f1797f36f72f9db541cb72b38442a8248
SSDEEP 192:HGNj6P2UXQmiUy4EsnGv0nBOQ/7q0Bxsq+U6:HGNj6eOZrnGsBOU7fxcU6
TLSH
T101121876AC785C771EA2A544F48736178FE85167EE892F90D5DC3E0C02EFA5C234B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f01e88a1ccf130e58042c3fa6df94c98ac9eb32e5736f3724f1871c440a4358c
MD5 a5034e5efa5f0573bee5264bfb97e133
SHA1 8dd772f89d64e460cebc4629468f44bea6fb4051
SHA512 8ccd45a34070e9adecb028f731d586701d3daf2cf4e681dc6c11e950a4311f8b83a7adb77c70d8d2748ec0c796a0d77441ec911b8a7a04b77db19a2c058d3f04
SSDEEP 192:BGNZ6P2UOcQmiUyVIUsqGv0nBOPwSxl92U6:BGNZ6eXsiI7qGsBOnx2U6
TLSH
T19802E9356D782CB79EA2AE45B48737179FE8207BEA952F84D5E42F0C00D7A4C2347936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download