hxxps://r[.]search[.]yahoo[.]com/_ylt=AwrLAu4NW4BqaAIAPPIDjgx[.];_ylu=Y29sbwNpcjIEcG9zAzEEdnRpZAMEc2VjA3Ny/RV=2/RE=1788006413/RO=10/RU=https[:]/steamunlock[.]com[.]im/RK=2/RS=Vsdp0nJ7NnhbLJSwtM2gt9FRM6Y-

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://r.search.yahoo.com/_ylt=AwrLAu4NW4BqaAIAPPIDjgx.;_ylu=Y29sbwNpcjIEcG9zAzEEdnRpZAMEc2VjA3Ny/RV=2/RE=1788006413/RO=10/RU=https:/steamunlock.com.im/RK=2/RS=Vsdp0nJ7NnhbLJSwtM2gt9FRM6Y-
Sample260815-pmsdysweqa

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3764	msedge.exe
2028	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312704524649105"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{A9D43FF6-A417-4E88-AEEF-32789C94C21F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
5956	msedge.exe
5956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
2504	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2748	2504	msedge.exe	81
PID 2504 wrote to memory of 3764	2504	msedge.exe	82
PID 2504 wrote to memory of 2928	2504	msedge.exe	84
PID 2504 wrote to memory of 2928	2504	msedge.exe	84
PID 2504 wrote to memory of 3936	2504	msedge.exe	83
PID 2504 wrote to memory of 3936	2504	msedge.exe	83
PID 2504 wrote to memory of 3936	2504	msedge.exe	83
PID 2504 wrote to memory of 4920	2504	msedge.exe	85
PID 2504 wrote to memory of 2864	2504	msedge.exe	86
PID 2504 wrote to memory of 4920	2504	msedge.exe	85
PID 2504 wrote to memory of 4920	2504	msedge.exe	85
PID 2504 wrote to memory of 2864	2504	msedge.exe	86
PID 2504 wrote to memory of 2864	2504	msedge.exe	86
PID 2504 wrote to memory of 3608	2504	msedge.exe	89
PID 2504 wrote to memory of 3608	2504	msedge.exe	89
PID 2504 wrote to memory of 3608	2504	msedge.exe	89
PID 2504 wrote to memory of 4280	2504	msedge.exe	90
PID 2504 wrote to memory of 1552	2504	msedge.exe	91
PID 2504 wrote to memory of 4280	2504	msedge.exe	90
PID 2504 wrote to memory of 4280	2504	msedge.exe	90
PID 2504 wrote to memory of 1552	2504	msedge.exe	91
PID 2504 wrote to memory of 776	2504	msedge.exe	92
PID 2504 wrote to memory of 1552	2504	msedge.exe	91
PID 2504 wrote to memory of 776	2504	msedge.exe	92
PID 2504 wrote to memory of 776	2504	msedge.exe	92
PID 2504 wrote to memory of 3656	2504	msedge.exe	94
PID 2504 wrote to memory of 4104	2504	msedge.exe	95
PID 2504 wrote to memory of 3656	2504	msedge.exe	94
PID 2504 wrote to memory of 4104	2504	msedge.exe	95
PID 2504 wrote to memory of 4180	2504	msedge.exe	96
PID 2504 wrote to memory of 4688	2504	msedge.exe	98
PID 4180 wrote to memory of 3460	4180	msedge.exe	99
PID 2504 wrote to memory of 4380	2504	msedge.exe	100
PID 2504 wrote to memory of 3360	2504	msedge.exe	101
PID 2504 wrote to memory of 1620	2504	msedge.exe	102
PID 2504 wrote to memory of 2464	2504	msedge.exe	103
PID 2504 wrote to memory of 2464	2504	msedge.exe	103
PID 2504 wrote to memory of 2464	2504	msedge.exe	103
PID 1652 wrote to memory of 3200	1652	chrome.exe	105
PID 1652 wrote to memory of 1884	1652	chrome.exe	106
PID 1652 wrote to memory of 1884	1652	chrome.exe	106
PID 1652 wrote to memory of 2028	1652	chrome.exe	107
PID 1652 wrote to memory of 4292	1652	chrome.exe	109
PID 1652 wrote to memory of 4292	1652	chrome.exe	109
PID 1652 wrote to memory of 4536	1652	chrome.exe	110
PID 1652 wrote to memory of 4560	1652	chrome.exe	111
PID 1652 wrote to memory of 4536	1652	chrome.exe	110
PID 1652 wrote to memory of 4560	1652	chrome.exe	111
PID 1652 wrote to memory of 1744	1652	chrome.exe	112
PID 1652 wrote to memory of 1744	1652	chrome.exe	112
PID 1652 wrote to memory of 4992	1652	chrome.exe	113
PID 1652 wrote to memory of 4992	1652	chrome.exe	113
PID 1652 wrote to memory of 2888	1652	chrome.exe	114
PID 2504 wrote to memory of 2500	2504	msedge.exe	116
PID 2504 wrote to memory of 2500	2504	msedge.exe	116
PID 1652 wrote to memory of 5288	1652	chrome.exe	118
PID 1652 wrote to memory of 5296	1652	chrome.exe	119
PID 1652 wrote to memory of 5304	1652	chrome.exe	120
PID 2504 wrote to memory of 5956	2504	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://r.search.yahoo.com/_ylt=AwrLAu4NW4BqaAIAPPIDjgx.;_ylu=Y29sbwNpcjIEcG9zAzEEdnRpZAMEc2VjA3Ny/RV=2/RE=1788006413/RO=10/RU=https:/steamunlock.com.im/RK=2/RS=Vsdp0nJ7NnhbLJSwtM2gt9FRM6Y-
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff96517c188,0x7ff96517c194,0x7ff96517c1a0
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,14578398992526927132,16036415072236814390,524288 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,14710240338091450970,1644648565720396520,262144 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,14827456867576238415,7941685531555091821,524288 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,18038387125752484835,15216771298359362346,2097152 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,17520203181761254082,3661157144068295249,2097152 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,557247716049663782,15597462345903748220,2097152 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,14178062188526503842,11023565844940417697,2097152 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4248,i,2196220258442699384,2101578764797327005,2097152 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4296,i,13945494723319711321,8238820673688263922,2097152 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,12605148099197808327,16418818019714218086,524288 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,12448975122638653679,17692600984762325785,524288 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,6193149473672271136,11500615496336007296,524288 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,15711893924443912208,1349875553224130009,524288 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,15711893924443912208,1349875553224130009,524288 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,10151320326490963551,14654661008411658071,524288 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,13372505636053649154,2340544870711750739,524288 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,4046494566667785752,2549438724539222193,524288 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4780,i,17283041408767018136,4052647076737008538,2097152 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,17518296553007300494,13922521252132866222,524288 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6500,i,5543940886651045465,4838062067284827859,262144 --field-trial-handle=2088,i,15097394865446104560,17672030437796107221,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff962d8c728,0x7ff962d8c734,0x7ff962d8c740
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,12131511634078577442,16956384924537249775,262144 --field-trial-handle=2036,i,12027591784726791416,8902606411413840820,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,9890300192051659693,5993764417728352171,524288 --field-trial-handle=2036,i,12027591784726791416,8902606411413840820,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2292 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,11640948524133918900,11395591304353352840,524288 --field-trial-handle=2036,i,12027591784726791416,8902606411413840820,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:13
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,18032537770555908716,16056178090113031125,2097152 --field-trial-handle=2036,i,12027591784726791416,8902606411413840820,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,15067032843031166247,5715033932409015754,2097152 --field-trial-handle=2036,i,12027591784726791416,8902606411413840820,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4200,i,671897890563382516,5849504586109066143,2097152 --field-trial-handle=2036,i,12027591784726791416,8902606411413840820,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4208 /prefetch:9
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,10131025650453573235,12990252702260259869,2097152 --field-trial-handle=2036,i,12027591784726791416,8902606411413840820,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,16284393236681295416,6693716930949526768,524288 --field-trial-handle=2036,i,12027591784726791416,8902606411413840820,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,13779260825397560124,11079092916270272435,524288 --field-trial-handle=2036,i,12027591784726791416,8902606411413840820,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,7662164438601723916,10122944595754181777,524288 --field-trial-handle=2036,i,12027591784726791416,8902606411413840820,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,12416953424840471205,5903739580867933014,524288 --field-trial-handle=2036,i,12027591784726791416,8902606411413840820,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:5304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 eac451cecf587371f5e84de54a2a855d970739a184dbdb235dd860828122205a
MD5 3841b0ac9a0fd708f89aae23aeb2c68d
SHA1 4558fd142ea88797f5f8aff8324fed5a0f810a38
SHA512 ba8d3a46dc61bc2015abad81cd944558c02ace1c9fa3f94ceea7bbd390367b593809eb5ac703d4701c0ff711058ef60ef84e5fcfa6c178c4f9821361ac7477d4
TLSH
T167E02BA9D922EC3B09FD275A90504747F75413272680490F3E3C911D8FB167A45C6D5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 21d8db2c0a65647f032d6a9fefb04100f408d773fabe5e00148214959dd3a0cd
MD5 5cafdef5facb1a40173930c236dc7527
SHA1 f51d35619154e03c28ee0f122ed818050c91b78f
SHA512 927f79dbe2c3a8714e167fead859c388ead401b624a5f1e16dcea1e0307583d93c4b74c827df2a60e0776d2bc4097b76383a92f261a8246b8e37ea27c6f1567e
TLSH
T1E0519EF7C3E4957EC51596F4AB256E1FCD2D0A24022C3C56C8E4AE1B53F28B2E21178E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dd9efe26cbfb671c7bc85109dba6c44c38300ab26fc43b71fde4b67f643c5f17
MD5 94e60d737fc4e5001a692ce1bcc70191
SHA1 6afcd20d8adf2fe85e7a86789fa1a09839e3efc7
SHA512 58a0c2ca10afb99d27caa91533b89cce17b4eef373586c2793c124ecea5eb9db498e2dd588ff5addc42f17b4d2a1d922e5f76174c76882577e56468d8a68a878
SSDEEP 192:vhRttjCOoNvv75pAPRp2A98Hsb+WNnwFE/0JUk0oetBuo+VyIsnAUgtaJ:JRtt2RnVUXLuwB0X0Th28
TLSH
T14E42A669FE10797B5CDBD32AFA223B67D7F6102225941E80EAFC892C15E75DC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3e3b58e9ef3e9352e18520a1143a2fdb82e419f49ed0c0c5647f9fd1520a5b19
MD5 cc27c8a27a21b4a5162504c7ded619c1
SHA1 970653db0c39d489558338fb8fb7d692a597f8d4
SHA512 0a7b3a1a212080e05754c23699f47de2069f11db4bb49ef71780097e050bba683cb378466f1a176e0acb6384029fc9c2a4d9be2d258b54c4fb4db6310c146952
SSDEEP 192:vhRtt9COoNPv75pAPRp2A98Hsb+WNnwFE/0Jdk0oetBuP+VyIsnAUgraJ:JRttMRHVUXLuwB0o0T62e
TLSH
T17942A669FE10797B5CDBD219FA223B67D7F6102225941E80EAFCCA2C25E75DC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6580b9be38e043e5d2436ff4ae9296f74b369cbea58296d9af5604bd4b1cc474
MD5 64d379491386bdf9d2b82bfed49740e5
SHA1 522dcfd2f4d188bbcad58538c6461f8bbd43b2e9
SHA512 5d58b317ff66bb8f8373e7f5972247e20a553af50c4ad2756a022edf34ee0bb5688a058056e953d457420c82cddb02044d6062aa1788af614d0c7bcf05ddc3bf
SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLuLcSjwxXODuh+ErU37PHG7iK:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17pV
TLSH
T10B72FA67BC4C9E370F94CA8CD9167F4FADF5024A65E9886482FA9C2503D5BCA11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3d9f8b458f803e5bef236a9902646b8bb5a435176072dc79d030421a46ec6d64
MD5 7755aaa6818515eb849a84d5f58e5576
SHA1 7e95398b2901f2ade3e1e5c22bea6173c3c8251e
SHA512 f472296308c01569d485deeb947798e8a2c27a1baa476a859879b02f0fbb111a3d2ae78fce82abf3762489a79302e8f0de9db9796fd58b8a9d5ad9bd7a52ba46
TLSH
T19FB0122180025101C08203B015C2349C71145F20970A1B0543E46D27DD25261C028050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591c39.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591c39.TMP
Size 96B
SHA256 ad5ebdf0991362586f3d0bbf0971a128d215b33b5946ec8b9b42bb93bb097f96
MD5 b95d6579b921c4d06f5820bf50207fdb
SHA1 f1efa2de8a020ee8d30918098bb62dde9de0847d
SHA512 7395cc60d69f0635f1b0ac2ce84eb106e0e5342d77e0cbd63b5e74084a57204f51f2786943a7dc8919ce0413b79e9484aa532d155931c96b2b32dd2225ab3ccc
TLSH
T151B022C0C0022202C00283F03CA880C83020CF30CA03020382E00B2ACC2023200200B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 3b8932315409e6220f1f595466e05387b4ceb8c45964c1aeffe985f4ff066751
MD5 b70635243dc001710b44c5d72eccf265
SHA1 9b69d58b90fd756f73ec67743268f02e0a9557ca
SHA512 e57a31876497adcf2aefba980857c25060a8ef55c11a862702b60f3c07f9c8955d4e424d25a2238ee8af62015c57d4b2bf5e33c9e7a26ef9e8e1f6208f22141a
SSDEEP 6144:Sdpsve+UYQMjzr+hA4Km7Rkm1tYpBeh2BAoa:2AePYbzCKU9oBGcAoa
TLSH
T1213412331C1939F78EB92754B68E6F2B1EB198EB9718A985CDD47B403F967CC0609834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 875d0fa06e7cfaa01e513af2cfbfbe93145ecd0693ef263b8159aa750b9d48dd
MD5 44e4cf36d32ba82a59755fdd5c01a738
SHA1 57144da4e05c4bab9212b0574f6711b8fcce218d
SHA512 b83f2855596f2a501f19173dcdce2610fe7d3b07e05f7e94501549405c50fa79fa8a5b51a53cd9a9dcc146f30843170b25dc26a2507610bb209a801edae6bab5
SSDEEP 6144:mNpsve+UYQMjzr+hA4Km7Rkm1tYpBeh2BAoa:m7AePYbzCKU9oBGcAoa
TLSH
T1CB3422321D1939F39EB92714B68E6F3B1AB19CEA9618A985CDD477403FE67CC060D438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 198ee3ea55bb1c1f7610cdc7c75fe3905b88f2cc5e54ea4c299409f2154f3a95
MD5 8eb748da99fa61c7d6fa6fc5fbbb549c
SHA1 659fb2b8d2b9ba253fafc21088592159758a2d90
SHA512 581c1cbb6b9992b88b2569f75fec693151e85c60d5a071f7e4156c299c057c4d3c5e758d3e6344570db159a6387bdc9c753a54baba13a7bf701e2e72f6a45f28
SSDEEP 3072:YGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:Tm7Rkm1tYpBeh2BAoF
TLSH
T1C3C3123B5D70A97759B9BB4EB08E0B1E1EF149A6C930DE92C8D85A0477FA7CC0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 a1acf3dbf03e81b6564d97ecdbc0b3a1dc30aef85d42194ea471655efc7e2e2c
MD5 52652f698e562436edff821496d25812
SHA1 b8259dbf3090a3a949e53c1509373ddf0b09310f
SHA512 ef925fba2361327597c9a785ea2a70f8ce9b221fd13fe2d0669e6599ba19ab888bfbc5b2e3404c238ffacc05200e43e21c8d26f26d6f3cc56044338cc074a160
SSDEEP 6144:ZNpsve+UYQMjzr+hA4Km7Rkm1tYpBeh2BAoa:Z7AePYbzCKU9oBGcAoa
TLSH
T1F33422321C1939F39EB92714B68E6F3B1AB19CEA9618A985CDD477443FE67CC060D438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 fdfa2b05beb03dadf9960c74292b8be74b38f850ddf914d11f64d1d8a7352f7a
MD5 934efd173892299f3adf68ad4d48db35
SHA1 a9086a9a8d73f90d456d795f755f34357e1ed2d5
SHA512 0c55601cd0d440fac0b2f014159a5ea968cf28872f29c2ec91548dc8e7f74075593e9faeda5a7c4e70d4a4dde6696b180dd37ef1d1dde94cd123e96c746d71a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
TLSH
T1F6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 74886a367972b7490e68b7b2f94d3c8256e556870bb4955ab235be6f672b8330
MD5 fb9199c63429e82c6bf92aa2b2ba9024
SHA1 c60b4774c2ef314c1ce12da383bb5681d4ef88d9
SHA512 a4f27f68be781f324249a145ad31d8c447b8d5557642c422cabfd4a727dbde648f99a7aa73e3d2e31edeb6a0a8e61425cb192c14c2c80dd625fdcd19666b55fd
TLSH
T191711ADE0131184FE75C307263E3A3A13C7183D97A337E6945E825FA1912F2DD094D16
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5875b8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5875b8.TMP
Size 3KB
SHA256 a82a21edcd473da1161ac818f49fb5794d47398c7b036199f8fa16de035e8b12
MD5 dee9ddca04f91737f3afae9b31d647c0
SHA1 0403d7e205d38982767355f3a25254485845dd5a
SHA512 33ea7ca1cf861e9b8500e6609ead8c03549515401f388a07370fdf1ad4330a5611f1baa722c9ca63b5822d0f52996902342c80e225f0cbbd8e8620e18e0cb3bd
TLSH
T1DD71099E0131184FE75C307267E3A3A13C7183D97A337E6945E826FA1912F2DD0A4D15
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c636e85ee1c6a65b40651de95186cf95717d9a0752d3495d80e9d324f8043b16
MD5 5e09d2daf8891befda3796313e01d0df
SHA1 84d285a630c5d9429e52a813b3654c9226d1a247
SHA512 f8048f53212b885923b403cf101d6924c4f536aeecbe555d40f2d23075e695423ed332affa33228e2c1b991910c6e41fadd0256f98108d104340cdd26df7adb2
TLSH
T10D4177F3C7E5852EC91156F09B24AE1ACE2D0A14831C3C6A89E4BF1793E2871E111A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ff0f86eb0b88896bb63dd93b65c34d8af9a1a1697ffb16a7d0b600c1a3c9b8e0
MD5 99e24c055bc200e6666f3bbf9ebfffdc
SHA1 7c4b4bde478c31fc0cf72eb5244e982337054b2b
SHA512 484aa2adba960880954c778d2e50af63410e1262149f2ef2e2479910bcbf582e22fe6df3874b6e0efb653213dc1fad3b32054818da8d8f352e8cd9bc6df4d764
SSDEEP 192:sxZeRGuyM/jK1Ml8MFy/frsYWnjVLIYIdp7d/W6+WNVDx/Y0uBHutYVIgrJ:sxZeoGdy/frsYWnRLIpZ/bz/5uv9
TLSH
T1A952E9126A346977CCDBD209F955BB53D6F9047392900E44AEFCDA1C01E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 058a9a2f3bcb8909abb459413b0e7cd1b1c05095dc399c4fc144eae215f39d15
MD5 c72fe181671498456aa79f1681a2b261
SHA1 436d16c397020b674b0c6946b84eb5d7eafb8f73
SHA512 3394da5cc770bb40ed6a13824a7c40605b3979763c683882e16250d7292b4bbfe482e684a16ee15dc0b6b4e7559da59368b578282a262810c95824ff39139263
SSDEEP 192:sxZeRGuyM/jK1Ml8UQwFy/frslWnJpVLIYIdpE56md/W6+WNQ5N85RFtADx/Y0uh:sxZeoGqmy/frslWn1LIp1e/bIuC/5uUk
TLSH
T13962D752AA346977CCDBE209F955BB63D7F9147391900E44AAFCCA1C01E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 c7dfe43b96ee0f29e6a03f26715baabc24da28c31cb56e562a768d983bbd9c5f
MD5 354070db4e500cb5a10cffccea5b8500
SHA1 3830f2cc7f905dfac55186767684805e6db1ed97
SHA512 f18545863e36d8b5a8fc4a378652356f499ac6eef2011362937a1dc47f2d156bcf397abf943bbd79d39908c89cf38e6f3fdfea5a0f9688f48269a8923fe0e4df
SSDEEP 768:uZ/Lh8dF2/kWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KjLl/060lpJrozr:uZ/Lh8dF2/kWRmAcQ3wu1jaKKjLp0Dl2
TLSH
T1A8E23A3B694CCB7E4F840EADEC266F976ED801CB96684D5447EA894C03C73EE411A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c4cbd0b467b3a1bc4925cfb2387b56918c27779c4b3ed1eea08a185f9943166f
MD5 288cdd1ceae7d18d1a80c27107c0cce5
SHA1 3081ff8509d78a68a8895e6ad2ef5d45466e5dcf
SHA512 0f5f0426d5c3b90d93d49aa9024a4a66aa1f93e43486edf8412879a11c9706ec6412179b97d0ace66741f3e0a26c6f03e9a94809e6526b52b83e679509549781
SSDEEP 24:KdHfel8a5dttd4pl+QIjZdKiqhaXd1EPNSm3M7fiB4addRxh4VR+8IjNhKiehaji:K08I/KFGsPUILKd68fyLkIbK56M9f
TLSH
T1F691269631BA02123C7E241CA6A5973A5F42B7673458E82F3FB840791E27E110EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59111d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59111d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1f13e485bf0948df117b1535076aa7c460cafb91378073cbc3f8a4cd4ef80d70
MD5 e59467586f64981f94fa97278c8dde2d
SHA1 76837e134746d2fcb88892567088f4f2b614a5e0
SHA512 541b8b3977e0d11c6d963e9e4017855d5fae5a6bb0e83e81e5b70ebfe1eb958a978d20bfcf7b2158e3a0afd49b4a376facec94ddb71c76e4452ed067680c1175
SSDEEP 192:uRML8NMbQcL0M2940HSrJQmiU18FKJ40F2oP18ZkoSY1lpWNqEU8:sq8NMbEP40HwneKW0Fpt8ZvSYENU8
TLSH
T19B321B365C745C375EE37995B4473923AEB5422B9AC43B80DAEC5B1C41EF3DC130A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8133379b7a1707240c78d8ab173b243febbd904fb7f6cc217efd018fcc7f20da
MD5 7dddbb08c65ec39868250b672d661caa
SHA1 31c13ea87e9869c06228152efb16fedd9327f8d3
SHA512 b631b12cb4d6459c1f8a6d4e822745e9fc5093ba80ca7f79574fd59e5740ce23ed21ac7b1b73695208a97dd89f015e0e8021a0dfbef9cef5706b7b7fcb011609
SSDEEP 384:TiiFRZcI8v8NE8TUNTUlIlcEP40HwnmKW0Fpt8ZvSY/NOOPrXLpe8C/kwBr:lF58vtwgVpdKbiFSqNOi9Pzqr
TLSH
T190D23AF248E74836EDAE9B83A77D2D139EBCC167B5806640B7D8960CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c3188f343095b27a6956ded13abcf4a83fab3e984dfeb74c25691ec371ec15ce
MD5 b5e15e9e94df43b60e52d735549db419
SHA1 c8f7e00bb60ac7e729dffde5bf960539d4fae0c0
SHA512 35894490af018aea9c058c9cf2fdf5649c8d0fc4dac79758ac8bba10909b38a006a1ccceb7a8e0a343691f4bd5754b632400294c3e79262707177068d5551e63
SSDEEP 384:rfZcIh8NMgEP40HwnBKW0Fpt8ZvSYENOOPrXLpe8C/kwBr:zhnpyKbiFSXNOi9Pzqr
TLSH
T187929E7158785C376DF3FA95F5823617AEF88137F6C43B8495EC970C05EA69C030A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 93ff503a5b47eb2c98b0037a7274581b9da488a2d535bd06a0795625ece59865
MD5 df2fa9af425951c4abd029970bea94a1
SHA1 6f51a4f0a279ffb21cc9ef54e16a058fe5485a18
SHA512 e7e42a36b076d734129a04f8d3661a729eefc02379a0f4ad8702c69b46b425d3abfe334e29f4fd6098dd116bd984a0bf7a1c89986180355516a77f90c9f3d7f2
SSDEEP 192:qGN+6d9402QmiUyDvQTBF2oP18ZkowGw1urU6:qGN+6740SIYTBFpt8ZvmgU6
TLSH
T1BD02E8356C782CBB9FF36E46F4873A275ED5116FE9842B84D9E81B1C40D729C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 25258e7791e44a7dc8ec6e4df2cd4da6f42470cb5d3de7208f56a4f187f33b23
MD5 102242e899d6fb97eeb9dd7fe462b114
SHA1 0a43321038f8c0de1f919da06206e045df75bc75
SHA512 4eb665e02cd005cccfa988fc340b86e5f4684b2aa3eff3de3a891cb5048005a78c0bb4bb32cb3f4f06b3dfaa9ae8514c7e055c9ce5b6b7331c95fab0a073532e
SSDEEP 384:rGZcIf8NMcEP40HwnBKW0Fpt8ZvSYENOOPrXLpe8C/kwBr:gfDpyKbiFSXNOi9Pzqr
TLSH
T1A9929E7158786C376DF3F995F5863617AEF88537F6C43B8095EC9B0C01EA69C130A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e634ada123ba283aa42055cb073b1e0b62737521cd31b33ea032ae0bc1bcf1f2
MD5 ea2f35071ddde1e09eabf5b2b5ea15fd
SHA1 c3b0e09965230a6fa4243ff2a933af52d4e5fe72
SHA512 6bbbb59f097c8b3cc4230ca595cf39241523f613084c473f7eac368a1d53cd9b1bc02a4edbea9bedf4178af0a38f5b33e246bb5dd7b8619ce863fb4a7e2b8056
SSDEEP 192:KeGNd6d940tKQmiUyeQKCBF2oP18ZkoSY1kiDNqEU6:KeGNd6740tG0KCBFpt8ZvSYfNU6
TLSH
T1E5121B3258786C3B5EE3B995F48739136DF5822BEA847B80D9EC1B1C41EF39C130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da3b2e59-27db-4101-afab-5cdaab2c13df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\da3b2e59-27db-4101-afab-5cdaab2c13df.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download