hxxps://datastudio[.]google[.]com/reporting/e7d1fa33-5e85-4386-aab4-c630e813337a

Analysis

user interaction
yes
max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://datastudio.google.com/reporting/e7d1fa33-5e85-4386-aab4-c630e813337a
Sample260910-jr5bessye1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4440	msedge.exe
4468	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335005198862260"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{0A089B1E-F3E4-4081-B971-82F2950EB6A7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5264	chrome.exe
5264	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
3824	msedge.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe
5264	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 5116	3824	msedge.exe	87
PID 3824 wrote to memory of 4440	3824	msedge.exe	88
PID 3824 wrote to memory of 3052	3824	msedge.exe	89
PID 3824 wrote to memory of 3052	3824	msedge.exe	89
PID 3824 wrote to memory of 3052	3824	msedge.exe	89
PID 3824 wrote to memory of 648	3824	msedge.exe	90
PID 3824 wrote to memory of 648	3824	msedge.exe	90
PID 3824 wrote to memory of 904	3824	msedge.exe	92
PID 3824 wrote to memory of 3012	3824	msedge.exe	93
PID 3824 wrote to memory of 904	3824	msedge.exe	92
PID 3824 wrote to memory of 904	3824	msedge.exe	92
PID 3824 wrote to memory of 3012	3824	msedge.exe	93
PID 3824 wrote to memory of 3012	3824	msedge.exe	93
PID 3824 wrote to memory of 1624	3824	msedge.exe	94
PID 3824 wrote to memory of 1624	3824	msedge.exe	94
PID 3824 wrote to memory of 1624	3824	msedge.exe	94
PID 3824 wrote to memory of 852	3824	msedge.exe	95
PID 3824 wrote to memory of 852	3824	msedge.exe	95
PID 3824 wrote to memory of 852	3824	msedge.exe	95
PID 3824 wrote to memory of 2296	3824	msedge.exe	97
PID 3824 wrote to memory of 2296	3824	msedge.exe	97
PID 3824 wrote to memory of 2296	3824	msedge.exe	97
PID 3824 wrote to memory of 4560	3824	msedge.exe	100
PID 3824 wrote to memory of 2104	3824	msedge.exe	101
PID 3824 wrote to memory of 4560	3824	msedge.exe	100
PID 3824 wrote to memory of 2104	3824	msedge.exe	101
PID 3824 wrote to memory of 1196	3824	msedge.exe	102
PID 3824 wrote to memory of 1196	3824	msedge.exe	102
PID 3824 wrote to memory of 1196	3824	msedge.exe	102
PID 3824 wrote to memory of 1252	3824	msedge.exe	104
PID 3824 wrote to memory of 2400	3824	msedge.exe	105
PID 3824 wrote to memory of 2400	3824	msedge.exe	105
PID 3824 wrote to memory of 2400	3824	msedge.exe	105
PID 3824 wrote to memory of 1220	3824	msedge.exe	106
PID 3824 wrote to memory of 1220	3824	msedge.exe	106
PID 3824 wrote to memory of 1220	3824	msedge.exe	106
PID 3824 wrote to memory of 3012	3824	msedge.exe	107
PID 3824 wrote to memory of 3012	3824	msedge.exe	107
PID 3824 wrote to memory of 3012	3824	msedge.exe	107
PID 3824 wrote to memory of 816	3824	msedge.exe	111
PID 3824 wrote to memory of 1164	3824	msedge.exe	112
PID 3824 wrote to memory of 3500	3824	msedge.exe	113
PID 3824 wrote to memory of 1568	3824	msedge.exe	114
PID 3824 wrote to memory of 1568	3824	msedge.exe	114
PID 3824 wrote to memory of 1568	3824	msedge.exe	114
PID 3824 wrote to memory of 4180	3824	msedge.exe	115
PID 3824 wrote to memory of 4180	3824	msedge.exe	115
PID 3824 wrote to memory of 3180	3824	msedge.exe	116
PID 3824 wrote to memory of 3180	3824	msedge.exe	116
PID 3824 wrote to memory of 3180	3824	msedge.exe	116
PID 3824 wrote to memory of 4952	3824	msedge.exe	117
PID 3824 wrote to memory of 4952	3824	msedge.exe	117
PID 3824 wrote to memory of 4952	3824	msedge.exe	117
PID 3824 wrote to memory of 2864	3824	msedge.exe	118
PID 3824 wrote to memory of 2864	3824	msedge.exe	118
PID 3824 wrote to memory of 2864	3824	msedge.exe	118
PID 3824 wrote to memory of 2240	3824	msedge.exe	119
PID 3824 wrote to memory of 2240	3824	msedge.exe	119
PID 3824 wrote to memory of 2240	3824	msedge.exe	119
PID 3824 wrote to memory of 332	3824	msedge.exe	127
PID 3824 wrote to memory of 332	3824	msedge.exe	127
PID 3824 wrote to memory of 4876	3824	msedge.exe	128
PID 3824 wrote to memory of 4876	3824	msedge.exe	128
PID 3824 wrote to memory of 5980	3824	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://datastudio.google.com/reporting/e7d1fa33-5e85-4386-aab4-c630e813337a
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff81ad6c188,0x7ff81ad6c194,0x7ff81ad6c1a0
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,13045364507609803335,3362513265962737998,524288 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,14101928785892950424,2696220936062983313,262144 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,17443791742871429243,16660303417533916288,524288 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:8
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,12370293669385118462,9522811128609829454,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,4416573118715665874,6237794760651518019,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,267129570350034328,10692867705900971398,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,10847340693982785041,4518459322002384640,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5168,i,219190384453483007,11404008736612486300,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,17461964967682224599,13513564810418975034,524288 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,4079106842668842807,123141428709444569,524288 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5792,i,11616966413326642716,6416477797579803654,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,9394876031692174683,15913840310088651815,524288 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,9394876031692174683,15913840310088651815,524288 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4972,i,12396969468297191674,3420303366774092677,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6192,i,1400237449381183338,5078495035462588114,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4528,i,8264405938121581254,18249262225907988603,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,8212785712933702575,7956836778972865407,524288 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,6306743110790948870,11251989234734446057,524288 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,5884143658931264448,17881113509459718244,524288 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4916,i,6266562064460566586,4748903442622448127,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,14607729147060992226,14698784889872666998,524288 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5344,i,8103160716598053958,10727144696456214811,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6756,i,14271743551381811699,15223255543930123128,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6212,i,582846109139232993,9906577759362263962,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=1900,i,17251995513037844916,4127117959213440485,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,14517695818616376269,3498420376641077233,524288 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,757748685555519934,12045891641413751014,524288 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5728,i,921832064414581078,3380972947467311903,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6512,i,5509485923739724425,5218013684737679288,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6120,i,10269638545621420251,8047090443675365146,2097152 --field-trial-handle=2244,i,14521850021547214971,4005784792780503375,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff81829c728,0x7ff81829c734,0x7ff81829c740
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,226573739388959147,7582028303202868300,262144 --field-trial-handle=1908,i,13258590878481850323,13094876368435885525,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,10395189819276968402,7273470883319300614,524288 --field-trial-handle=1908,i,13258590878481850323,13094876368435885525,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,15129721027511407559,14120078073818962114,524288 --field-trial-handle=1908,i,13258590878481850323,13094876368435885525,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2316 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,5887478456224316348,7494096916349018368,2097152 --field-trial-handle=1908,i,13258590878481850323,13094876368435885525,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,17418145419731398675,8097801317813444550,2097152 --field-trial-handle=1908,i,13258590878481850323,13094876368435885525,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4496,i,2771982129746817180,13166490312669446444,2097152 --field-trial-handle=1908,i,13258590878481850323,13094876368435885525,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,4752440816187884616,11999361285535431856,2097152 --field-trial-handle=1908,i,13258590878481850323,13094876368435885525,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4724,i,1353856183932381479,11017686367644561179,2097152 --field-trial-handle=1908,i,13258590878481850323,13094876368435885525,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4788,i,8908278516191751694,9662456093761228693,2097152 --field-trial-handle=1908,i,13258590878481850323,13094876368435885525,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6500,i,17818333158365026625,8283739500796997292,524288 --field-trial-handle=1908,i,13258590878481850323,13094876368435885525,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3316,i,14692926266303408084,4044371711745961910,2097152 --field-trial-handle=1908,i,13258590878481850323,13094876368435885525,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4768,i,153865437844738291,15057828380655331203,2097152 --field-trial-handle=1908,i,13258590878481850323,13094876368435885525,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:5836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0252d212f5092917f57e132f38e161ac747d24a44aae693d52f5067168a62547
MD5 c329f022b417058f565cf193174d55eb
SHA1 f12d5f298462f98148c5325bda7331222683411c
SHA512 d82bd0d6d27e09c81a89be83f80dd0e4ecb00a90206a26f30ebfb806374f377aaddc54b82fb4f70683d381d951c61203be7c1f505cce12663023db69a0866a2c
TLSH
T1BAE022F9DA63BC3B1DF91718A8794706EA4223572640AC0F373D814C8FB477A418AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 91516f1d4e76a93655615dc1d01c410dc76b22c8304b0f02665fd2d4c9dd9cec
MD5 b284e98e99b1e3d9910c2a6257172533
SHA1 7faf972f5c8730112d51e25e7285cbdc419ff0b1
SHA512 0af27890914b8fb8a3fd2947ef8d5fa460de8c974157a348731c544978b42bc3b9b12f5170ef9170e21fd998eda65b0a32a3c6b02e886c5d8c0a14c0f8da004e
SSDEEP 192:QRN7Iq0Okspv7MF+pAPRp2D69HHWdb+WNn2F0802iSkwJzVyIsnAUge:QRN7xkspgoUXB1240J2iSTe
TLSH
T10942A4AFED1129BB9CCBD629FD527B53D7F5102121951E80EAFC8A2C15E76CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c0e24b3389b31750ca2bc57d195ba3df40640647d7853da8b02a7ccad5498e4f
MD5 aaf09ceffaa3b806f0d3fd00d2347f09
SHA1 42f29ae9c43584031449a2a9d57ee46b88ea1a6b
SHA512 c06e3eadc0b90c9084dc14a90305e97fc0aba6cd9a3aebcf993a34daaec3ae7804957ff88c60d79992d8575dd25faa61772a29a59842c1d503457af3915776b8
SSDEEP 3072:/OGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Jm7Rkm1tYpBeh2BAoM
TLSH
T1F4C312275D75E9375879BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 46059045798164771daa61006950e89abdb247a59e277dc21e927f00390f30e7
MD5 f49a9e1befa8badaf7d18ff8a32825d8
SHA1 41b836e616073cd19f90a2c60a3926825f1dc91b
SHA512 18d09b9398ceeffd8ed1fd522278f723ab87cb604e9bcffc1f0b87b51fe921fad30dce93121fc212319a0feaf3e57be9a2357c68661d6925e64bcc9013611ac8
SSDEEP 6144:damqf4pvhtmkKAXz43+eC1r71cm7Rkm1tYpBeh2BAoX:dLqsvhYmX8ueivh9oBGcAoX
TLSH
T17634220FDE75A47359AA7B1C708F2B1F4AF10E68CC30DAD0E996A5047BF6BC80546A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

855ba8e4-00e9-4d98-8cd0-39bb13dc9888.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\855ba8e4-00e9-4d98-8cd0-39bb13dc9888.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 344KB
SHA256 c1ba7027e790c346842569dc60319a75bb54ad9875b3a114cd3d60febdc1ecb0
MD5 a76556d1143eac7869c5cdd2ba75aee7
SHA1 62ace25f7a400460ef1550bd536b8006aff57655
SHA512 b6763ac3d83198054c3e24685aab797d60c39df22f0eeed2ff4217bbfb891efa1f2ffda857b079443e0ee66fa3e0b2f1cca34867fcdd8a709b88abbd93c33e4f
SSDEEP 6144:+1/dG8Lx2NjYH/1z2cvc5NFLhVke64uBSCGJ0qHQzr+LZ:+voj2hrvcdnlJWF8HQzrQZ
TLSH
T13F74231F614B6C6CECDE01C7216E44D5D32B8F52CB231ACBE649D16B04E749C8ED9A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 e0cf6b237617f5fcc0f5eae30fa1b8987694db2927af48f13038d7a099b93dce
MD5 8f0b4592614a1f61d6d6e33082b4e0aa
SHA1 354b8e0a560b1f402934f6dc9f38412ea1cbe530
SHA512 0ed51aad4dcee38bffae4c2e8c0f01c4fba05adf8f84f81f907cec6f9f913d5112ccd58341eeb2dcdcf0870794730f041f04df611ce18783f6c952eb6739f9fb
SSDEEP 96:LxpUECJDtmH+EVWsYpm+2KM9aoE2pps8mLIdcXOwWdqTtTBEzBj2zL7CR:LXUECJA/VEH29o2py8mLYc7WYTBEt4Lu
TLSH
T15DF1B8B114AA6058EB8DCF70D2D80D927331ABF2FC271F979C93E7BA96177900869035
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0fe0afd48912456c45938d9f0b934f57ce0efcb0c50429793ee004e736b776b9
MD5 47b301bb1093e79e98941b91c435203a
SHA1 f1405485c447c0d2e6e1eb88fef98a476f666cec
SHA512 bca608b2d74e85f9dd0b373507dca29e842899c7668dedf3ea59d1ad8ef7b39c56760bbf757aac7fcfd06f12451eb4f12c1d24249bf5d5038a66a0970b5b3de5
TLSH
T138813FB4016E229CEB5A0F71D0ED419173329AFAFD3B1FD7DCA2A2BFD901750482A024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 71b4b03f4fef7977d91cf049b5b9976d619984baaa5d1a4666b1dc5f7f3af44b
MD5 ee6917cd5c19fca5e093ffa378c077f3
SHA1 542f77648dc2b5ae5461577a6c968a8f9f4d97a6
SHA512 f0bb4023dea1f078fe83a3a3d334d32bb4842b3af93924b933e1c9549920c1e49831044501c60e57c19ff4bc2163086fdeaaacdaa9651115b16c5d6c9c3b0ede
SSDEEP 384:DQzGoSsT9qxH+8Gxz3wLl006erqdaDYNhnXE0jrCk5HNGvtKLiZM1rWV2+HNDtpy:K
TLSH
T12D42BCF7C3E9862DC85256F49B157F1FCE2D091843283D2A88E8AF4BA3E2471E15174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 9c77de40d439257bc55d54198afd94da3d4a15549cf0e618ff7318fb01d590e0
MD5 c21e5d09b6d236dd4a364bf0a39109e3
SHA1 56877a8b917e484c5babc7f0e52319c1232be360
SHA512 8aab136e4bc522ed2c30154b2810ab83486d9ece86889286129725bf723684c2000c98d45157cc2a7a48817294e29aa91d692f9fe09d444ed0d62659721ae9ed
TLSH
T19FD022335A4132BAAA7E3EC991AAAC8FCBA600204942DED435D0A8A8163A96C0527185
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5921e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5921e6.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 00f460cecbceb3179030c07638c51388ddf43ab627b35587afe2f2625d1581b6
MD5 0a7afd5fa47156b89fbdfe4515f83f39
SHA1 eedb665d4330a18f0adb5cf89d2a3a6345cb641c
SHA512 8e5012945f677dd4a800aae402c3a77b4f23d05c7b5c32b03b7ada13e9520695d76824319ff8fde9d04e782ddfba45643ff44a9cfbfdfcd1c9792c1a7a8af482
SSDEEP 192:sxZKRByM/jK1Ml8MWP/fRsb3wVZIdp79HW6+WNgsE/YvhrsolIgrJ:sxZKzuP/fRsbB5HbY/NC9
TLSH
T1A842D652AA34697BCCCBD209F951BF53D6F95472A2900E44A9FCCA1C04F6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 40119d605dc908c9af075ee3368444249b174ca9c36f2e817af68a3c0a873e09
MD5 c9b5e7faaa12bbe492f3f189e7ac6475
SHA1 55c1d1ce40ef192543f524f59f3b360b0b8bb4af
SHA512 fd80c103dcc23c262237bc1fb23d41719d7d1972c8cf670cfd4a5d19d25f387c60186468c17d4c4e4ee53f5b6e52572f20ec5d689b8aa9b1ef828019c4054731
SSDEEP 384:sxZCnnzWmzP/fRsbOF9HtxxbLktK/hPCVjf:sUnCmzP/fG0Ht5xGjf
TLSH
T19E92F853A52089B7CDDBC658FD31BF12D6F454629E904E48AAFCC92C04EA7FD2216C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 64512bbe4574536a7a961c562e2b50d58dc4666132b5de3a508e4f822185ef70
MD5 e4d1dfe9c40b54162e92d60b6d6338a6
SHA1 b72dbcf7f66181cf32e743e5c58ed893fb60bd2b
SHA512 e2680a949700ad559836bc6512076af3acff98104a3646f79ffaf92e8d3f36d822818e91b3043a6dfcc9bee138eb67ba8d6628de57e331e2c1caac0f417825a7
SSDEEP 384:sxZuzWmzP/fRsUDF9HtxxiLktK/hPCVjf:sWCmzP/fpfHtYxGjf
TLSH
T17782E843A52099B7CDDBC658FD31BF52E6F444639A504E48AAFCC92C04EA6FD2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cf03e474ec4e80e95c622160c400e72c19fc1885478e61f38f6597edf7b54f66
MD5 528012b17f269098e564e8ad4d6bf0b8
SHA1 13cf40e2a8de639cac0fc46aae825aa74ed10fa1
SHA512 2ac9734e9d62f705e40ffd3f674ce5feb549ffc177fb3a05cc3aff22c4ab61ca2ad86e2c16e62141d09b759fcbaa6eadb5fb89d2c9be5fc56e6e7f82817c73d7
SSDEEP 768:eEseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppxroE0:eEseJ3xWvhfynu1jaVcL88pK7
TLSH
T1E2D20B2B680CCB7E4F844E6DEC266F966EE801CB57984D5487EA880C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 d32976d7cf277b9878ccfa96f7502cff1aa968c158be15328796c8ca0c96093a
MD5 d0dfb7ec4e329cab96db83448d9e3439
SHA1 7029b5059939fb7ba025b24df4cc656ddc9d40f3
SHA512 9da59877cba8d319775474d34a43d9041806da20eb8379dbb2d6411ccb5c87a30d32dc938f952a2c0f4c0bb7158eb34bda2f6a561d5ba430c3552947df0e4c72
TLSH
T125A002340A921009C84662B425A621622B10CA6142515307C1D3D855CC769465D8911C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 7727e45e7dd6b1027adfbc8f7f2169aaa7f454c20f3614eaf0041917b322b53d
MD5 6434fe56b981afecd5f17c37524ffffc
SHA1 77ccdb6f3c50ee536c9f597867b6f46b52d4d8cf
SHA512 82e5992ee2588b2966d99beea92621c3982fb8fb9f476108019e50c06675fd1392004417d9e28be78f4a1ddd0dda232adbcc635a5f82866d978be08849f290e1
TLSH
T14EA00230CB8040C5C42256B1295707493319D8A42D15230B44910145DE604805D4101C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3acffaad-edc8-4855-b9e5-78d01b238fa3\index-dir\the-real-index
Size 72B
SHA256 8377f9aa2601bb3b16c3604aef55569e200bffdf1e30dd294bd53d4209fd4113
MD5 4ec85d12076510c5455c0343780c7254
SHA1 2f324d18c4d413f6a46d5e76c63e9647833d0ce7
SHA512 eb34b98aecdbea9d964bcad8d62b04a5c01354cfdb55555d5acb5eeaf8a894494e678306a147eaa200871ce3a0aad6dde8a123d571fd6c064ad6a6fb046ef25c
TLSH
T1D4A002628765415DC01842B425436145FA694994120F624A43D1E0E68EA2D56D211164
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599725.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3acffaad-edc8-4855-b9e5-78d01b238fa3\index-dir\the-real-index~RFe599725.TMP
Size 48B
SHA256 a5cf6a6e9b4894892ffa4d268d9be3a2a2353f8ca447f6b4dadad3d77c425035
MD5 bdc852fc524325efb0ca24b340ec1cf5
SHA1 a684db4716780dfcf24a3cbd5762eaf263319b73
SHA512 7274fc9c0d5f14ea6c86a946e7a5fdddcef8725dd85b173a518d42ab07d811064470bb33c9c9596bf4a24509260c2c6f3f56bb1830ac96983425f08b62dbda07
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\45dcec6f-aa01-4d60-b08c-c87ce78d75a5\index-dir\the-real-index
Size 72B
SHA256 c303d1c7d02cdafe92c6de660069dafe19bfb6cf4c1813abc7e6a38a9bdd56f0
MD5 2ad3b1a7b876c4e0c76ab930e54cc89d
SHA1 7aee960d73ac381fd6dcfa179834ae4be854eabc
SHA512 51a7a2d92166ccce368b9e64f0c058f88b55d54c360202fd676ff6a6a33a622ce5f2206ae95969fdd69040583deb83e95b44c111149ce406e69146f4121ea03b
TLSH
T1A9A0022C416D64A5F00456B45A8116592318DDD94101470775AC8759CD5256F8E82452
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\aa7e33c5-9f0d-47f1-9318-05cd9243ea77\index-dir\the-real-index
Size 96B
SHA256 6c66c930f59988d327238f667fc56e3cc50cc9ff711a666e17e7fc0e308175cb
MD5 caa1db1552352104baba6982974f9cae
SHA1 2c9d21c93e88ad7940c0e036164d9569f5409889
SHA512 99ea7c3f954315e1bd3d59f42ec52883c866d657fed2a5750c904d5b3db5248c2ed820ea1f232e6ad11759ea2b813be6622566dcbfb57ad4bfa4a74926d35fe1
TLSH
T1BAB012143A424645C40F42B11182440536904CC02A053616728050748F103C01432094
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599725.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\aa7e33c5-9f0d-47f1-9318-05cd9243ea77\index-dir\the-real-index~RFe599725.TMP
Size 48B
SHA256 0f56f6958f81695bc8f271010311b78b203dfe3fe6a0bc593c700f195cd5ae02
MD5 29c380ebdf9c2865f982e78b93ba59db
SHA1 1089ff81c4696c1761964608741cae5d6141c559
SHA512 3d3c8aa60483c1d7cbbbb9c115367dbebfb0f9ca76b852923497ac466c955c307c9d1a7064dd4bcb48d74b4475ea132c9ca0344efd2dc2ada1e7a38513edd961
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 624B
SHA256 b67cdf4c1237819fd75aa642e0b60f6de353b14bc7109a3b464548fe1053306c
MD5 2e5a24307f06210095f0c41852c2c4fb
SHA1 37b01a3c2af2f7f14f6158e17c650085cdcc4351
SHA512 7ae879dec3b0c9a3c4ed006685cdc0caa7e54d45fa9811441260a7d2ded28154fb8e5fed48cd3bf116c2c8e87009f38f6d1fee4721cf579315ecbc5783ab6520
TLSH
T16EF0DC144E800C26EA2845773AF7A0E0A3704DECB331997B286C5C7E2D253CCB45A3EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 3KB
SHA256 41be4667f550d24e92047ee7961bef58977f4dea53cbdd166fd0dc7b611833fd
MD5 51d246d58c1858c7bd9d6c25c6501d50
SHA1 3c884e9565e6940ab14390e0927a5925b2133d3c
SHA512 b79f441d0e0fc053632a3e0bd0db9c2e28bbf419900a3fbf37af2e4333d30f47b8f493448935c7c27cb7288f9d1e8eeb5c9587d2264e4ac3229359cdf7c82d81
TLSH
T15E51C54F0E136FABDE9C217504B504847334A5CC5398A92BE4FCC134FCCB7142869BA4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d210.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe58d210.TMP
Size 624B
SHA256 b9af22ad833478b16058b0a1845bc607e3776693fd88fc9db639d4824bf3aa59
MD5 191aacf306b6649473161f030a378445
SHA1 98db1699184958575c69c9ecf51aa355cfadabba
SHA512 92bd92791d153404de1ced16a10bbaf8a66493b17948dc89b5c9271be1ab9359417acda666bb44a14d9f18d04972b74df4be4600978951b30dc0d6c989999939
TLSH
T1A8F0A3554B910D11D4600A772EE694A8F3304C507732FAE7346C683E9D717C959422DC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 a8236125de1979086fa3e73594393ee5b9e1cb9a34fa30f849fcf5a8201ca849
MD5 86584277ef717c33160c5c76fc98b01e
SHA1 d30c946631d17601b9cc514768579701a6bb7b32
SHA512 52e40a7a71240b934c4831154b282f05b61d9381713ca6a1dc750d624924085fe889f32892b91e82a2b293cc9a0ccb82ba0306cc77bf532bf5194eba49d568ae
TLSH
T1E9F059B66EE72810B96FC3E554304490051A3C48D904BC4E9617B1872073315309AD36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 e15f0db37a646757fbe0f58095f3aee75697ea08716792c9acb0755c4b64e74a
MD5 83a02808e0717b57e3d1c28000c1f4f8
SHA1 45895be12aac7a09978ea201cb7337c6eb0658d6
SHA512 2be51e932a3df221a8a530e72bf655f0ff2fa5751d7b30ed3f81c96aab2a41e0c37705651d597df24b8d5b3cab933dcd4d7eb1cf072609bb01542d7eb3826034
TLSH
T133F0A6B37FE72910F8EBD3E060300060020A3C8CCA14EC4F9A1BB29B20B335520AAC32
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 323e600a3a067e0b5c53f52a0edc70ccd3fa26c8c8ff949ae88ddd1ffdeae841
MD5 49f5eeec901fbd5d437cb7afe86993dd
SHA1 10b96578ee301714d4a2038768a0c41b73731c08
SHA512 48b329ccc90e074de830429d47f67e9addb4d0972e507c56da79310d06d644c51182f76e86a672205ccd0e9b9aa33919993cc8ef2efbc6dbf2f156c106de100d
TLSH
T151F072B37FE72900B9EAC3E4603000A0060A3C48C904ED0E9A16B29B20B331620AAC32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6d6efe5dce420d963d8da1ed6288d89eb9e675a9cdf31e9aa81ede177259cba2
MD5 8f7855643a19b8262bad3a2834a6cbfd
SHA1 efbe38393d30eb9e3a9d7fdcced064d88338f293
SHA512 de2bf16f091c524b957a9003f9ebe1e6d1adc0f75d3e5f7427f90c3ff0914d77d4f2e6f62ddc986537233a7de829bd8a7c1df304805bb41c4eeece2445bbd8a1
TLSH
T16AA00225896BD009C4154774906659447794A9DA02453A41C5E9D1AACC95141D5E3171
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592754.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592754.TMP
Size 48B
SHA256 f1622159e4c6a8a14e25b8e4c6756c1d18d395096227ff0ef03581315850f9e8
MD5 4d105db571757a323505a90c7c6362cb
SHA1 0437a86d839ec3dcc7b62f72fa235e41a3af6608
SHA512 0bc41f10afc809663e4bee5abdc22bf18767b8b5f23e166b46ea5af0be2f6d95691152110f7cc11fe7dd4e70e7480862fb8c86710f8d89fdedabc1ef21eedf01
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 8271265ba28bf42462f4e61c229871349b9b53ab957ac4b560e2dd695aa5e550
MD5 f4f64005f89a59cac9945a478a896d73
SHA1 7b2c18d887819c24f8cad8475a646db6ca806c5b
SHA512 4487ee5e932f60b1ad21fd4d974668340b442e24e14eeb09a2176eab665a73dcdd6f0a613e02b2863189051bc67185d2936ad5fbe6bd173365177b5ce0fa28b4
SSDEEP 48:KYHIhKggkXyR8IHKZW0DypKIPKrCYfytJIZKSc0J:KYH+KggmC8gKZWiKK0KrCq2JyKScK
TLSH
T130C11452343F0202387E2958B2A39E3A8E4271A33454A5FFBBB900915E67E155EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5928fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5928fa.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 88592b22ef85c4f95abb7ed03d88c096f6e104d562800839672b404b4c7001a0
MD5 cf173708054f2f3dd02a2a88fb6a7b3f
SHA1 32924dc248d4eb079d60e13c5fb2ce1ad0a95a84
SHA512 c595a233b977e4117571951370dd12a706aaa538116589e4dff81948cd07d0c8ab599770f1d7b5f09453e3b005707af44da559262c9e54e22de85475161b1149
SSDEEP 192:uzm+xasuheOwQxMGsN05Q2FdP/N0M75SSQmiU1MQP4MTZS+FdLK7Fd3Eh8z1Gqxq:ZZcIhsN05BHX7YO3gGdwdUGlEv
TLSH
T199626C725C746D3BA9E3B681F4863A134EF8C03BD7C45B50E6EDAB1D01DA6A81307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 88dcc2a978cb0d52db6cb0203570df36932df04b3aaab05ff951eb2187a9bb5b
MD5 6aaa742c2806366760b2397f4e05ced4
SHA1 447070b074a9b9dcb84a719339d08f724043f247
SHA512 1db40d71868ed48709acafa36666a8609dd86b00e6cc7a6ec4eb8ce6e644a5351ccac74d3590e82715f4f48338eee6075656a9835dbb1871d06c646a952af095
SSDEEP 192:lONnZ6vMtPQmiUyF+ThTZS+FdLF847uSU/u:lONnZ6UtRfTFdJVU/u
TLSH
T173020735AC786C6B9AA3AD45F48A37175FA4507BEAD05B50EAE86F1C00D769C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 4dc52b402b4e1ff30ec5b1969ed2461090ff837d458fc180529f78f98dfa2309
MD5 eba60a224a5dbc5be5c0aa9e0d85372e
SHA1 db7d6f6c3b831c423df993e262db7a73f46171a2
SHA512 ce325aa21a1c353e6f6a423fa35a7df6ee1f489daf75303971eafb7236cd4d3409d9d48d9b821a06e1df6b204873b37bb37ba8b56d51a174ca456bf05b803ed5
SSDEEP 192:unm+xasuheOwQxMGsN0uTp2FdP/N0M75SSQmiU15QR8BMTZS+FdLK7Fd3Eh8z1GH:9ZcIhsN0uTEHX7YOcR2GdwdUGlEv
TLSH
T172726D725C746D3BA9E3B685F4863A134EF8C03BDBC45B50A6EDEB1D01DA6A81307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 d55904fb608a5449ccc0b25f8b1fa8838eeb1849e6c85e619300114dc116594f
MD5 1cb558fc36f81a7ee46df21ea3f49fea
SHA1 622f3ab04eeecb11cbcf5a9dce0e7d0d9a14fa5e
SHA512 00be8d952d0788e64592a1703b6ccc45d1fb58b4bd7793ef98299bcc11a8e2cd2c4538926dc013deba21ced0955b7666723b9559f1d49aefed53ace6210df479
SSDEEP 192:unm+xasuheOwQxMHsN0uTp2FdP/N0M75SbymiU1fQ9OMTZS+FdLK7Fd3Eh8z1Gqs:9ZcI4sN0uTEHX7YDuMGdwdUGlEv
TLSH
T174726C725C746D3BA9E3B685F4863A134EF8C03BD7C45B50A6EDAB1D01DA6E81307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 322374aa380e9127209818e5004469cc9290faf72e46494523e2cd70b5cb78d7
MD5 33dfa252a355dc66bbdbf5aa10feae6e
SHA1 4346b899dd012e91fdf322e8be69f8524305ba8b
SHA512 68f44b7934b0ce7b70b8c50a11429ca466bef2b2f1780ccc379b4486780809ff0b21faa79b522ac4dd606d27087a1d7ef44a11b8e6549d42d9ceb4178f081f75
SSDEEP 384:jEiFiZcIrsNW8TUNTUlIluTEHX7YywMGdwdU6lEv:jfFQrPwgXHXm5UU6lEv
TLSH
T10D823B735CA4993BADF7AB85F58A36038EF48067DAC4AB50E7DC9B1D009A2E81307C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 3c64bede708b6840071ae3afa9599a58f1540b42b4d555127d71c08e02fd08ac
MD5 b8e38be1ba69c90d1d96de14eb3e71c0
SHA1 cb3cb05e3748a791ebb8904bada872a313e53760
SHA512 ae2bb07cd33ef7942ab4d4ba4526843ab0c3b8d84bff51890ffbac1d656c52dddc50f87e3449bd8806bbae52c078884cdc32f51ea51d52c6016469240b67e99a
SSDEEP 192:RON96vMAPQmiUyT+AhTZS+FdLK7Fd3Ed80IGqxU/u:RON96UARHAFdwdUilU/u
TLSH
T1A2121B72AC746C2BAE937585F48A36135EB4817BEEC56B50E6DC6F1C01DB6AC1307C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 acc3b3b3b3e2d37aaa3700885bd29dcc200934fac32425005c5b626b3642d68a
MD5 9a34200df521ef1918b64e5ba0fced82
SHA1 8e7a713a17050ef477696dd2f49af8620240af0d
SHA512 024a848a990f8a9518f991e559890e5cb71e1a03adb8661343a0a983d4cce3d54172555be16d88974df867f1634a92cec1fac9172a96084f7eb6f5b5f91566ce
SSDEEP 384:jEiFYZcIesNB8TUNTUlIlaTEHX7YyCMGdwdU+qlEv:jfFmeywgHHXc5UUFlEv
TLSH
T1B2824B735CA4993BADF7AB85F58A36038EF48067DAC4AB50E7DC9B1D019A2E81307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c7d81642435fbe7d55823fe3ee500c532b2e7d48558ae82ca69a05cdcdcd12f4
MD5 05950d087815b793aeb530ffe99148e5
SHA1 95d0487cd0955405600327d144b84bf83ecdee2a
SHA512 66792f8fdda1abef89d38ab31435366b14ba8b024b2230a0a66699c08a34340e8c499e82d4971299a79cc279ec086ef4aa3a2c41797e123bfbd32387263502bf
TLSH
T194E0012B771011BEC078073114831B307BF3C03483B2036B5A2106B85CA33406E74FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 004ccde42b21eff0961daf44037cf6f31c9d4cb95732ee442a11e8c58a460c44
MD5 ffddcb41a2b60c3e1419dec7cb21756d
SHA1 864a1615b92e656d8dd06708419d712bff0ab68f
SHA512 a2ae2ba56b9f3b0807cc20096f57a89e08fe6152638846aa2b73e5a381249851e1be310246e988e2e128758be252654d5102245311b8c7154857365357b80e7c
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 934e3d2886aae9446c7256bfca2660618f3d97d7510cdb64715b1ad7f1e7bcb0
MD5 065a1ec084e457cf42b836029a110cca
SHA1 aa1be60df6c101d3053079e409dffe18cb4eb377
SHA512 d5789fa874a7b996b496fd66fd93f38cac482f1eb030d1d542d9bca382689b786712c19a35078ea27a36534bf0080ad0d9b539d0176d20e4a0ce215831a06806
TLSH
T1EBE0012B670000FEC078073214831B307BF3C03442A2036B5A2101B84CA23406E74E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58e1b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e1b0.TMP
Size 392B
SHA256 be3b0762b2fc289627b49e74d68c8d3365695f2177792b59160c69ab6bcc3a6c
MD5 a63118b404f3ad3f73df942baca6c062
SHA1 e28947ec65caa9c3eb36c4a0caf8762e8f07c941
SHA512 4eb27c785b9d14f7fb83bd8b9e5308d0e09cc5a117e26badce5af3df21d6d56267cf227114bbc4942793d445284357ee82589f93a7e722602008f3f3757b72f7
MD5 SHA1 SHA512

Submit Download

5af9bc92-c03f-4ca1-837c-a3e9a7875ee2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5af9bc92-c03f-4ca1-837c-a3e9a7875ee2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 666e65c7cca3168d96921faa14061bc817d079067493c6b9f991b5f10785ea1f
MD5 418fe3bac401c14d6f0f63a9ecc375b8
SHA1 81a61f0075ece633b9bcb071b1db34954e91562e
SHA512 215355796f4e5fbc67cbc2a46a4ba4ee8f41a0b1ff8230a14c1668f22e6cdb151fa1781d3e0408820f48471b86cc037a0998047762c8cecfe339982bbf373969
TLSH
T16A412658B6E91148B3B76F469BF6A86D447FBC372F0BD45D10110E4E0662A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download