hxxps://manage[.]kmail-lists[.]com/subscriptions/unsubscribe?cy=U795yf

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 06:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://manage.kmail-lists.com/subscriptions/unsubscribe?cy=U795yf
Sample260907-hqtmvsfd47

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4932	msedge.exe
364	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332378237355456"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{5FFE969F-AC05-4049-ABD2-3A9B65C11C59}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
6084	msedge.exe
6084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe
Token: SeShutdownPrivilege	1248	chrome.exe
Token: SeCreatePagefilePrivilege	1248	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe
1248	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 1256	4732	msedge.exe	86
PID 4732 wrote to memory of 2020	4732	msedge.exe	87
PID 4732 wrote to memory of 4932	4732	msedge.exe	88
PID 4732 wrote to memory of 2020	4732	msedge.exe	87
PID 4732 wrote to memory of 2020	4732	msedge.exe	87
PID 4732 wrote to memory of 1120	4732	msedge.exe	89
PID 4732 wrote to memory of 1120	4732	msedge.exe	89
PID 4732 wrote to memory of 856	4732	msedge.exe	90
PID 4732 wrote to memory of 856	4732	msedge.exe	90
PID 4732 wrote to memory of 856	4732	msedge.exe	90
PID 4732 wrote to memory of 3692	4732	msedge.exe	91
PID 4732 wrote to memory of 3692	4732	msedge.exe	91
PID 4732 wrote to memory of 3692	4732	msedge.exe	91
PID 4732 wrote to memory of 432	4732	msedge.exe	93
PID 4732 wrote to memory of 4036	4732	msedge.exe	94
PID 4732 wrote to memory of 432	4732	msedge.exe	93
PID 4732 wrote to memory of 432	4732	msedge.exe	93
PID 4732 wrote to memory of 4036	4732	msedge.exe	94
PID 4732 wrote to memory of 4036	4732	msedge.exe	94
PID 4732 wrote to memory of 1084	4732	msedge.exe	98
PID 4732 wrote to memory of 3948	4732	msedge.exe	99
PID 4732 wrote to memory of 1084	4732	msedge.exe	98
PID 4732 wrote to memory of 3948	4732	msedge.exe	99
PID 4732 wrote to memory of 1700	4732	msedge.exe	101
PID 4732 wrote to memory of 4736	4732	msedge.exe	102
PID 4732 wrote to memory of 4736	4732	msedge.exe	102
PID 4732 wrote to memory of 4736	4732	msedge.exe	102
PID 4732 wrote to memory of 4600	4732	msedge.exe	103
PID 4732 wrote to memory of 4600	4732	msedge.exe	103
PID 4732 wrote to memory of 4448	4732	msedge.exe	104
PID 4732 wrote to memory of 4448	4732	msedge.exe	104
PID 4732 wrote to memory of 4448	4732	msedge.exe	104
PID 4732 wrote to memory of 4040	4732	msedge.exe	113
PID 4732 wrote to memory of 3548	4732	msedge.exe	114
PID 4732 wrote to memory of 1764	4732	msedge.exe	115
PID 4732 wrote to memory of 716	4732	msedge.exe	116
PID 4732 wrote to memory of 716	4732	msedge.exe	116
PID 4732 wrote to memory of 716	4732	msedge.exe	116
PID 4732 wrote to memory of 5116	4732	msedge.exe	117
PID 4732 wrote to memory of 5116	4732	msedge.exe	117
PID 4732 wrote to memory of 5116	4732	msedge.exe	117
PID 1248 wrote to memory of 4396	1248	chrome.exe	120
PID 1248 wrote to memory of 1176	1248	chrome.exe	121
PID 1248 wrote to memory of 1176	1248	chrome.exe	121
PID 1248 wrote to memory of 364	1248	chrome.exe	122
PID 1248 wrote to memory of 4056	1248	chrome.exe	123
PID 1248 wrote to memory of 4056	1248	chrome.exe	123
PID 1248 wrote to memory of 5176	1248	chrome.exe	125
PID 1248 wrote to memory of 5188	1248	chrome.exe	126
PID 1248 wrote to memory of 5176	1248	chrome.exe	125
PID 1248 wrote to memory of 5188	1248	chrome.exe	126
PID 1248 wrote to memory of 5268	1248	chrome.exe	127
PID 1248 wrote to memory of 5268	1248	chrome.exe	127
PID 1248 wrote to memory of 5408	1248	chrome.exe	128
PID 1248 wrote to memory of 5408	1248	chrome.exe	128
PID 1248 wrote to memory of 5696	1248	chrome.exe	129
PID 4732 wrote to memory of 5856	4732	msedge.exe	131
PID 4732 wrote to memory of 5856	4732	msedge.exe	131
PID 4732 wrote to memory of 5856	4732	msedge.exe	131
PID 4732 wrote to memory of 5284	4732	msedge.exe	132
PID 4732 wrote to memory of 5284	4732	msedge.exe	132
PID 1248 wrote to memory of 5852	1248	chrome.exe	134
PID 1248 wrote to memory of 4448	1248	chrome.exe	135
PID 1248 wrote to memory of 716	1248	chrome.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://manage.kmail-lists.com/subscriptions/unsubscribe?cy=U795yf
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffc9cffc188,0x7ffc9cffc194,0x7ffc9cffc1a0
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,1522811937376359815,6284817185448043239,262144 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,4160412513167036973,53785123620231722,524288 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,6144887882367519931,17149454467200047076,524288 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,3489769021110563761,10514961325381226513,2097152 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,10832473179498726595,16665821933488732506,2097152 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,7273987327153720011,1229981806237091754,2097152 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,10715400335008728127,15559549517363735842,2097152 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:2
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,17894089655659900392,15611056015687379142,524288 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,2131242872918049099,8525687440224132759,524288 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,6434795212092362524,13779196591939467593,524288 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,6434795212092362524,13779196591939467593,524288 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6200,i,16818373576593817890,16542884858238755641,2097152 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,1741406199662466695,8236195483223414628,524288 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6660,i,3319756907348265312,12836199729005255599,2097152 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,1413783937470732784,2921209990788980964,524288 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,7503337040973627057,10867713229495711325,524288 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,2352002851342093684,18284381856243233499,524288 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5940,i,17309482736240665431,8875499773881288965,2097152 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6232,i,7939215683314116532,10549424274496107328,2097152 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6468,i,8050699507720554854,17461495962751363096,2097152 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,5312634067553442290,4260315051497077602,524288 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,3095384457746970407,8089141408215085829,524288 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6492,i,3317093534541422009,13844823934596756720,262144 --field-trial-handle=2240,i,9573512857739414779,7722650120524650607,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc9c7cc728,0x7ffc9c7cc734,0x7ffc9c7cc740
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,1796531066102573946,9852395221716741683,262144 --field-trial-handle=2008,i,6231510658261604257,8030194972177185221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2080,i,13481640062040615061,15639166487193702252,524288 --field-trial-handle=2008,i,6231510658261604257,8030194972177185221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,14885090566277030337,78384752401164016,524288 --field-trial-handle=2008,i,6231510658261604257,8030194972177185221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,1134878147000916350,4920713728125073136,2097152 --field-trial-handle=2008,i,6231510658261604257,8030194972177185221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,14048305549976356052,12832886542765310883,2097152 --field-trial-handle=2008,i,6231510658261604257,8030194972177185221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3940,i,9045321146245194073,4994981919066999109,2097152 --field-trial-handle=2008,i,6231510658261604257,8030194972177185221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:2
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,8310221562069398681,1494764518410525019,2097152 --field-trial-handle=2008,i,6231510658261604257,8030194972177185221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,16470603586957637802,8452461643338984549,524288 --field-trial-handle=2008,i,6231510658261604257,8030194972177185221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,17990240664704907797,971346639404960622,524288 --field-trial-handle=2008,i,6231510658261604257,8030194972177185221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,9046526772593660588,8203653331653847918,524288 --field-trial-handle=2008,i,6231510658261604257,8030194972177185221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,399436449632199764,9562131935773867407,524288 --field-trial-handle=2008,i,6231510658261604257,8030194972177185221,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b8194362d8f777e08dcba650d6b2ac58b4029b91a1cff203f84b6c324e3dc2ab
MD5 d94930ee6abaeb9e00ef5f046e04cea9
SHA1 a1309eeb2c5b5fbeb33732c4e4f6bc2d9f5dd60e
SHA512 584cafd476662719318f978c2e611701b3f2afc7d2216ddc3cb362aae5c9a554ee2e95d0101503f7362a0958241d98a1c0362d868e171cfaf5f3d55fa4194411
TLSH
T14EE022E6C965AC372DFD072860924B45EA9923172A81991F3E3CD22C8FB072A418AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 700af00cd6231ce89a5f732b1e44c8906c4752a4dc0debdd102db9ebc8952b95
MD5 faf58fb1b3b201a5b59384a74ea99055
SHA1 6dee89ece18dbcd0790199d171b17a331850d0a1
SHA512 e36231e972296c1a6314911a9b8c6a0ebc099ca3d07cece2fc1a7809ad4474a87b29eeb790d5cf8ca54154569d74e5c3753680f57028fc728f58253618180daa
TLSH
T123518BF7D3E4896D851596E4EB216E1FCE2D0A24021D7C66C8D4AE5F43F2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c7832f41b980f18e865367aab184275e35f1a9d5b0ec25e41bbb0f977ac62824
MD5 c4d57a4ef867fe6edef50505c99b3960
SHA1 0bd4dee0f9e24234a78bf192815343db46b84eaf
SHA512 f6f158d6dc6aa96704e499ea1e24c0807aee8f05025aee45c6967907380e15acb913be2fd444f41bece72fd5d0f25b06557af71e106c1fb93b6fb21de1d1a4c8
SSDEEP 192:GRlBBL3XFYDhBjv7hpAPRp2W95Hsb+WNnH00p9eTjshEVyIsnAUgtaJ:GRlfwb9UXtrwU0OQA8
TLSH
T14742C52EA910647B5CCBC229F9227B57D7F6107231A42E84EAFCC96C15EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b5c5bd7abbf3160ff660b9cb0e3984126baa66da2ab9382e30d4c1274f6696cd
MD5 43a980c3ede3b34b64ec676a14de34fd
SHA1 811971a2599420cd5abd92837390ee4e06519ed2
SHA512 662534fee7b8914f819b0f0de31806942dd0f30f01c034e4c75018d5ac7dc3ef1aa2d1f03d7debe2bc2ef0fb31792d5305997a56f4139b403303678163ac3c8f
SSDEEP 192:GRGBBL3XFYDhBjv7hpAPRp2W95Hsb+WNnH00p9eTjshEVyIsnAUgtaJ:GRGfwb9UXtrwU0OQA8
TLSH
T13D42C52EA910647B5CCBC229F9227B57D7F6107231A42E84EAFCC96C15EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3a1e6f099e9893473c8ba939426fdd08fed6fdafa3339d9e06292356e65aba36
MD5 0789f3aa7de38460342aa774f3c68b28
SHA1 a749d56d8cc93a3a2649ed96b2aaafbb20252f18
SHA512 1ec468205d2c4ff20269dc135df5e0591c08ef8bbb42c054c4e33b488b7ae34839e678e5d3115cfd1bde539984187e28fcb606b1728548c16dca6ad92d0ab86d
SSDEEP 192:GRGBBL3XFYDhB4v7hpAPRp2W95Hsb+WNnH00j9eTjsEEVyIsnAUgraJ:GRGfwk9UXtrwU005Ae
TLSH
T1FF42C52EA910657B5CDBC219F9227B57E7F6106221A02E84EAFCC96C15EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 9ef3fd31f1a8e76475be23bf0af7c11ea9f3fbc576dfe7b0611c2e649efc27cf
MD5 ada8effa86d6fd34161956cc0f65ffd5
SHA1 77923bb62ff7c2159621ecadc09aeef41b063b75
SHA512 3a0aa1195a5131f419f7b27da1aeec52e50da7f4c9ce9c6e92e77379b0263bd925b747f3b5ca9910787b2d6ec845edd17603ab642e392b7a4e109c33aec86555
TLSH
T1AEB01251C0019503C48203BC1743148C71545F74960F170143F4E923C8251628039151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592215.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592215.TMP
Size 96B
SHA256 3dc2123c0899750b5f1fd642b9e8ccea25569f390790b61c28717e64e9ac3ac6
MD5 6448e5eddf2251538ddfaf3f500da253
SHA1 dfbae23844c2eab0cf9eb0ad23a1deb7ac943797
SHA512 25025a162a233f6aa848e039d5dd0830c0c7bc939507b72b50a3a786059118144e835de82ea519acd4181c3d39f0434eeeffb361332e7adae0ac4723c44917dd
TLSH
T134B022FAC0023203C08203B0208080EC30A8CF20C3030202C2F0AE22CC30A3000B20B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 66e38a3fe65e72e02675e5745821a77e96a7baabb82283392ae76d70f1b57f0b
MD5 f66a3323af6d97d86f339303ce7f8312
SHA1 aaa52526f8f282e7cad52c2aff63e737831cf549
SHA512 f9e781d03781a2def6acf11070e3eebe2f2056268f30440d29b00b46e815955ce86982859d1c574b109f9a9250a62716e58947ed74b904458a8ae27f83dfec15
SSDEEP 6144:/feZVsvtMb8gmYSpyMfCOxdqZ/ZLW3Exl:+ovtMb8guNfCOfqZ/piQl
TLSH
T145341272EFF75E330E46CEE860075B868EB685868038D206C75C2FEB38575651593CAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 ca667a048dcf0f8e910a107a5b7e4a0d7defd4a674230545ef6206e336cd64c0
MD5 79e005afb96d378d526b10f8dfaa35d8
SHA1 0b744a39de180f5d2de10bf6755fb5d2e61ecc34
SHA512 4b9dcbb72b68b08b261d9c66bef99ba4de5ee70674f42d884066d05ad28fcabdd9d36ec0f9097ad784663be95a7f6689e0519e1693dd546952ded17a280806a1
SSDEEP 3072:ZnBNQZOULNpSEerzntMb8gmD0SpflYte1wefCOx9lfxqfd7NtZL8cHQRZEQ6Spsl:zeZVsvtMb8gmYSpyMfCOxdqZ/ZLW3Exl
TLSH
T169341271EFF74E334E8ACEF820075B969AB245914078D202C79C2FEB38575691593CAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b9caaf91cbe1cf12677b7f0f3f87206443e40920b0bd56c7956d1687fa245cf9
MD5 6844c91fed795dad9306df382fd2ce43
SHA1 ecd3621416c5b7038915b36bc9c04bef4dc15c01
SHA512 b60d4cb86fdf7036b0b08565384a27c8f7520777db56d225c8399c7b492ffc1be69aa43d6be92aabf9fb9d455e1daed59058b982f3743b6f1f321229e9684230
SSDEEP 1536:6tyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Sqfd7NtZL8cHQRZEQ6Sps9
TLSH
T13CC30237EBC21F339D82CB64BA534FDA97B644A99030D301AABD3BFB6C93451644249D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 121ab8a797cdfcce90e43d5ecd1ce7c6b1982e0ddc1c1a50e086993a5a49a9b3
MD5 91511166c51176bb3db0390a9cc38891
SHA1 bda3d15c38c408cb2601c8ac659288b03847b156
SHA512 6842c96deaea953443b68384a33a6b4cae0a05ad2b28355903d54f6c0e852d13add55e5b821df40cb5ea631697afc84564208828ad1471a1d39e02dbe4ccb5fa
SSDEEP 1536:Lg/yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjH:8Bqfd7NtZL8cHQRZEQ6SpsY
TLSH
T144C30237ABC21E335DC2CB70B9130FD797B644A99034D301ABBD2BFB688345565824AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7dcf2a14bba664849bf701517d48d8f2dfd1333a3bad08f76b944fd59ffe4701
MD5 66b8b7c28ba954920f9fdb57cd40c08f
SHA1 3aa193f4b99d19313ce1652e5448480867501dc5
SHA512 441addbca7cab675b709272cfd80c1d612b153b5e58878491d54ecf5913724bedc94d1352a769c21bb6a7b70df1e1381637cb7b0db1298e9b19caaf3a65a48a4
TLSH
T1AED023207C9CF8C0D111003843104F00375D14813003A10FF1500C2E4CB01C243E4FD2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e79c093f2d2292eb111103cbe70b233c33f70d5e77654c08b9940c655e9a8ac9
MD5 ea48782a7357cb11c2407055529c94f8
SHA1 030df6919edd6532adeee13673640a0b77f6ceae
SHA512 9701d033f93210ee2f34b00a049aee1212b0af1738d9cbaaf2d751ea23204745543e43256f1bcefe39512b6b9962b8d0dc09c1943f8062f1aca23cea9500efa4
TLSH
T12B7192D403C5759EF7A23973D2D232917770D1CA0E077E490260A8FC9AC6BF55B2AD19
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4f793b75b5fb1ca08b714992b492f99c591158b22dacbd3f7fc1f18347c0bf6d
MD5 e048c4d42038ad70a2dc60ca55e4ca38
SHA1 29e42ab95ba5546ebd64a73a3493c26a8bf5bc69
SHA512 dcfd52c8f8929be3b6dfcf818daa2a7c3377a56c501b7079cd3134db18a24f52b63643770e2a83ed72b684cb4a4ffa1e8f936524d4cfab556b911b5ac075f479
TLSH
T15F71A0E403C6759EF3A23973C2D232903770D1CA0E03BE480150A9FC9AC6BF5AB1AD18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586e26.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586e26.TMP
Size 3KB
SHA256 46e44f9a1ca1f7fd9705f8e211f4ec010b974993638cead49a2705ddba1a871f
MD5 d6020b656c2a6331b63595171b300e22
SHA1 edd9bd9409f64283b3619b3e21cb40b8137fd3ac
SHA512 bff9b7ee2ba84096790803bcb5a2fb0af5260c2a22b0fa0e34e5fd80047ad61c7227b1fd5cfe3cdec2ffc4a9f81c55f36eb76e50cbf3d6701283e813a9e4b9f6
TLSH
T10B7191D403C6759EF3A23973D2D232917774D1CA0E43BE490154A8FC9AD6BF6AB1AC18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 db14518f1a76432c9b98f8236367ae0979838f062c1933643c84eb362bda7e4f
MD5 4bc3e4fbf8d1a01df4a6a3674d858318
SHA1 ae9c041e08c0832ff624e39255cebfa7904e7bfb
SHA512 84394650b6d59939dfadfa8809ca07f5d987de9f06ef083c2d52f5ce509cf943395b870c6dc7ac01fa029ddf676387c0e314ad252f7294ab08586db9d1fc411c
TLSH
T107519CF783F0855ECE1192F0AA18AE2BCE1C0525432C785A86D4AE17D3E3471E10678B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 fbc0c039d40bbe97c87885a68daf1ca3122b04c9956bb4ac1db8c67bafabe801
MD5 861b03f11f54be8238604b92ca29dac0
SHA1 c26aa4a4b55e7d79722d78f304b904da97a9e58e
SHA512 066909074edc72cc19e320295c355416a1debc2fce79dfebd5865a40ec5f845d3b99dca40118ee2ace156cf0e54e341be099b6c33d9f76c49af8b3a78fd86a25
TLSH
T10CD022232B0174BAEABDBED1916AEC8FC72A246208C3EED421D09999053A46D0F1B145
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58cb3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58cb3a.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3f66f9610430ce504ac19cd13dabc76bb2eda47803bb2f9099312957dfa3a169
MD5 e5168ea1f4d96c45099e869394c2d7cc
SHA1 fc39592da1002bcb278d30ccd632e69946104353
SHA512 4dd61d25c9568612f137d16be3ba21943caaddf9a85e13afe01641c60578bd95f8c88558b12f672434365aed2736686de5fb727cbf9bf54ca8f68039b3a708bc
SSDEEP 192:sxZHRgyM/jK1Ml8Mkg/fasJaG3Idpy48HW6+WNajAe/YLxhVDJIgrJ:sxZHCMg/fasJXYGHb2/Ez9
TLSH
T17A52D7116B385977CCDBD20DB951BB93D6F90572A2940E44AEFCCA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6c0e997ace45d9c80ddffc4ab9fd7f7e39401815521bae35c1a92853c14618a4
MD5 6a3392ae4602e9409ee824bcaa705579
SHA1 9b5a5973c0d9d2269da991d3f2fc93d1711e8555
SHA512 5cb86a16d32d990154772762ca8fa0e517e5d0a8a1314b8ea71d3b29636bbca19cc3bf6c480250831d26744bfadeb9695f6e1e1fbda99600df67dd279e167984
SSDEEP 192:sxZHRgyM/jK1Ml8MKg/fasCaG3Idpy48HW6+WNajAe/YLxzDJIg5/J:sxZHCyg/fasCXYGHb2/+f
TLSH
T12952E8116B385977CCDBD20DB941BF93D6F94572A2940E44AEFC8A1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dd73d542f570d23cdf4992fbf38b07cae20aafa42a42d8d376a2d91a2ea6a548
MD5 e581d41215441f76745cec00e5e55bfe
SHA1 b548ccd2d4f659678e6716c29d3bda7d3dcd8868
SHA512 661ac53cafe3536441224b42a09385a17bbc9bf17675337b3a369ba6287f85f73e54bdb3b577af58baa8d8beba1768b329c234df015109dd86906464cba9cbe4
SSDEEP 192:sxZHRgyM/jK1Ml8UQ/Ig/fasCajjIdpws298HW6+WNASjAeF7IJYLrBnHJIg5dJ:sxZHCqQg/fasCO8jHbzyJ0h
TLSH
T1DD62D912A6385977CCDBD20DB541BB93E6F91472A2941E446AFCCE1C04E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fbeddae6d094326a5685c8b63aaa5cc2988747eafdeaaee76537d1329cc7850d
MD5 c76714723e859d0a641dc12b24e70f12
SHA1 4ca0bffcbe0c3905e2bcf992e83d64fe0ca21c5b
SHA512 ba501e140fd7ef51fd4f36e6de12e39f6165cbc6d43e921b0a1b9f93d695a4bb2289c2bfb791c3c9fa6aa90fd92b19a3ddcccde2f124429a09ea6db9e083bd9a
SSDEEP 192:sxZHRgyM/jK1Ml8MIg/fasCajaIdpys298HW6+WNajAeFQE/YLpQDJIg5dJ:sxZHCwg/fasCOzNHb2Z/Rh
TLSH
T1F662D811AA385977CCDBD20DB941BB53E6F90573A2951E44AAFCCA1C04E6BED6203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 696004409c2c6d20ccaf176119a94faa41b6c05b043f24545855757aaf3968bf
MD5 0223ebd9f49ab0a298626fd813336a8b
SHA1 19037f1caba669d01a069bf064ee1ec9b51d6330
SHA512 1a985bdf5fe1c917f6c3c4421e75820ad6f3e79702a2839f7b6983901a67533d2b4ff2ebf61b12f0ed12f8685b5ca20e0ac626a7db49017ca7b5afde2820adf4
SSDEEP 192:sxZHRgyM/jK1Ml8Mng/fasCaj3Idpysz8HW6+WNajAeFSy/YLP9DJIg5dJ:sxZHCfg/fasCOYQHb2d/Qh
TLSH
T11D52D8116A385977CCDBD20DB941BF53D6F90572A2940E44AEFCCA1C04E6ADD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b9a257afebf2b5c2e6fb0637d69617dd25abf040b0ef36a252558b9ed5b760c6
MD5 9d2afb8c5c2824e5b55a8a4d4178d611
SHA1 b6303909e1ac874fc378ee6ff535176cc51b8f78
SHA512 145771d72c2222097dddb860c1780f79442a642fe27d4a5b4ceb981fffed232a4db6c3d6250c18edd22c2e20537df60e0d9bc9c766763a1b96be53cbe5de81a3
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyF9IVK2QwHytnIlKUU4fyxsInKxWskux2:KUAAKtePW9OK2QSOn2KUUiisoKxWZ
TLSH
T135C1281336B702122C3E390C93A497279782B7633018E96B7FA860715E66E384DFC5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0a75b5f-7d43-42f3-abbd-ee7fd39b7e82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0a75b5f-7d43-42f3-abbd-ee7fd39b7e82.tmp
Size 30KB
SHA256 e0df80f610508a2156a47c57a3cff96a4882d9e02e4a28d0634c327599c9aba1
MD5 21e26f20955ef773f1847870e1a759be
SHA1 d5bce39bdc519f6092e3c80dae2db85fd0461847
SHA512 a64b2ff04ab4aa205b1abeebb81f558c507d1825193ece740aa496f789d93f0cc88851259b273b62fe51764194048e479e2c6451cbec507b01edc9cf67333822
SSDEEP 768:dBs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNyroFz5f:dBs6pD1WvxzWju1jahILIsNpFzR
TLSH
T1FAD2FA3B680CCB7E4F841E5CEC2AAE966DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fdc4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fdc4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4352c9b29b150b9fff40c68e9d05a310568cc8a3c089f2d242cda0149ee58b09
MD5 6bc8a584da2151353e9563c4a7688e3f
SHA1 abe15ba69644982723f7a16abbbea249bdd8d75d
SHA512 361515f6aadc25614bce4a91a3f406697ce50d1da4ce6e0dd2aa1b1c0e5b572b4dd69e717a211799aaa49c12150709d2ccf707100511c2cd732c9f255865b320
SSDEEP 192:qON3EV6O7+3hQmiUy7tGttb05O29h2qgGweU6:qONC61qGt9gO2MsbU6
TLSH
T16802FA346C786C774EF3AE45B5873B235FA5102BE9952F40D6D81E1C00DB65C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7729f54c9f1d0e913a449b1f42f398b76d246a6f1f80b8a0b7f64736e6f9e33f
MD5 f0bede3ec0b9e1f83d1a792ec32d2b75
SHA1 ee33cb7ba83137a29b0b7597bacdf39177778760
SHA512 0117558d12292a5fa33a07032961f3dadc7877dd57da195b3e96084c9e8b4bb77a103d683ffe5ed966ab3fd175bd5092d832d927fc886b2a394d08c90bcce7fe
SSDEEP 384:egiiFrZcIosNq8TUNTUlIlSdso9lfa9gO2MHWAQ7O6R2Feo/lZo8:ecFzo7wg4RyuOBRQ7TRQn
TLSH
T150C22AF258DB883AD9AE9747A77D2D038EBCC063B5859940B3C85A1DCC965BFD306C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b0133d0eba409e09480d3a0d817e2f4b5e171592f852fdb7b1f9964145945dcd
MD5 b59d3db58caf115d9971f622f755e4c5
SHA1 58a1645ae9b448538114c46e1921c4a1eb06ea56
SHA512 cd7fe7288ba5375ab6ae6b2baca5d08e96ce7a48da3ade0ba95b9b2e021a38921d59a30f7e5326eed1b1c82fd6892aecc167d8e6b07b2a8d42876e4c0a0611ca
SSDEEP 384:egiiFPZcIosNq8TUNTUlIlSdso9lfa9gO2MHWaQ7O6R2Feo/lZo8:ecFHo7wg4RyuOBRQ7TRQn
TLSH
T143C229F258DB883AD9AE9747B77D2D038EBCC063B5859940B3885A1DCC965BFD306C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b225bd044861b6a320e49ef4fb00eb60fde1721c7d3bf907c04b04206fd57735
MD5 4940881ef9be0dd58b56c015312112d9
SHA1 7a201fcc0cd71f54ffa20e4bdddd87302994c55d
SHA512 04647717f549ca71cacf3b6aea1b978de1b592c907dd56b3df5a129073c4bff281c1d2164b1ecf01a7f25b50e16e985b9b432516e245eb2e86f377396929cb68
SSDEEP 384:ugZZcI+sNSDds+Cfa9gO2MHWMQ7O6R2Feo/lZo8:uK+DsyuOBhQ7TRQn
TLSH
T146827C716C789C765DF7E146F94636038FB98067DACA6E40D5ECAF1D00DAAA8230BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 62108fb05ad4f76321909687b3caf289fbabe5bd086b8836d7f5e8ac7856a43d
MD5 374ad7baf7f48c117ecf4a9043fecc10
SHA1 10e773fab5ae3037c0f4d07dd5035c7135f60a75
SHA512 d435eb1f25815db02d4ba3e0f725926191877cd327fc1dd62486fa23d178f816b602d863bd1fa8087c8b93e52758446a5799aa5456ca5ba56866f3b70b839b6e
SSDEEP 384:2gZZcIWsNSmdsCtfa9gO2MHWMQ7O6R2Feo/lZo8:2KWcfyuOBhQ7TRQn
TLSH
T161827D7168789C765DF7E146F94636038EB88067DACA6E40D5DCAF1E00DAAA8230BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a7a164b02cca3de44836d84d17a873dbba9b840d131b278b065d791b0c886fd3
MD5 19796f70275d5d33f30e8ba1c13f18e7
SHA1 4a48fd2eecffa9626d1c422ebb7542422a8d709b
SHA512 237b3fd35a48bc5d2ad4e9044ae0aa46c2c312002104fe0e722bef975f7480aeb32cb16a2218cd999c59cc077b85881b412d8cd49a7a61356be6b45b344e2569
SSDEEP 384:2goZcI3sNSSds/Vfa9gO2MHWpQ7O6R2Feo/lZo8:2Z3MsyuOBkQ7TRQn
TLSH
T111827D716C789C765DF7E146F94636038FB980679ACA6E40D5DCAF1E00DBAA8230BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2260b3dcc71b6b832c3bc6968a1af2ac1bcf71a93c9ec7ee7917153a136452ff
MD5 1f986d8f4cc498b1b87263eae5ae189b
SHA1 db82833d670cc2518497c04e4d9fbfaa9ca12b31
SHA512 151db91735e2b789ee645e2434947b5275281ff2df65952e763c06c550c6cec3b19acbae50d33d4bc4a8772e015713d18374dd9f66268ffa7b1e99c475273add
SSDEEP 384:ugZZcIhsNS2sdsQvxa9gO2MHWMQ7O6R2Feo/lZo8:uKhrlkuOBhQ7TRQn
TLSH
T125827C716C789C7659B7E146F9473A038FB980679ACA6E40D5ECAF1D00DAAA8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 130d66a9d19481cbc966f70540864e689760ad3a65ef9b382629c1c3269bf24f
MD5 c3d35d5aa97f7b9d7a14889553ea3a12
SHA1 bf805fd3cd0af3ac131fff9c5ef6e40490d01a72
SHA512 c08ca53ca6ad0be38c7c948846d98338b9f83a261e1e0eef1beb88d7ed8d5866c6e888ebf45cd389ee46d9734e744728c5eee109965999cd7260f5eedcd604bb
SSDEEP 192:7ONz6O7+3zQmiUyatDttb05O29h2HoNEcNDq8OU6:7ONz67VDt9gO2MHWtQU6
TLSH
T1AE122A35A86CAC771DE3A145F58736178FA8412BEA866F80D6DC2E1C01EF66C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3f028dd415910ca04b44489b2ee8605432d12152f2c5e6bbaa67b13598e43765
MD5 ecdb9f3f2f24d91a02d7a3cc8a530d1d
SHA1 60e0c8122c0b4bd68ca8b5481c2eedd71f11b7eb
SHA512 48a510f631c0604b7e17b2df39239f3f87af9fc60fcc3b0b25020984bfb8beb177ccfea68e5c6a486c4388211731658ffcd8b6e08c3a70a5b912697dfccead0b
TLSH
T1CF410759A6E91108B3B76E5AABF7A86E487F7C672F07C49D10110E4E0A63B00DC61777
MD5 SHA1 SHA512 TLSH

Submit Download