hxxp://dushezcatering[.]com

Analysis

user interaction
yes
max time kernel
42s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/09/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://dushezcatering.com
Sample260926-2f9e4sshje

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4660	msedge.exe
3948	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{C6C1B25E-8F3A-44D1-8B7F-3EFBFC04E91B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4860	chrome.exe
4860	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe
Token: SeShutdownPrivilege	4860	chrome.exe
Token: SeCreatePagefilePrivilege	4860	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe
4860	chrome.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 1976	4276	msedge.exe	86
PID 4276 wrote to memory of 4660	4276	msedge.exe	87
PID 4276 wrote to memory of 4636	4276	msedge.exe	88
PID 4276 wrote to memory of 4636	4276	msedge.exe	88
PID 4276 wrote to memory of 4636	4276	msedge.exe	88
PID 4276 wrote to memory of 4684	4276	msedge.exe	89
PID 4276 wrote to memory of 4684	4276	msedge.exe	89
PID 4276 wrote to memory of 2904	4276	msedge.exe	90
PID 4276 wrote to memory of 3508	4276	msedge.exe	91
PID 4276 wrote to memory of 2904	4276	msedge.exe	90
PID 4276 wrote to memory of 2904	4276	msedge.exe	90
PID 4276 wrote to memory of 3508	4276	msedge.exe	91
PID 4276 wrote to memory of 3508	4276	msedge.exe	91
PID 4276 wrote to memory of 3516	4276	msedge.exe	93
PID 4276 wrote to memory of 4304	4276	msedge.exe	94
PID 4276 wrote to memory of 3516	4276	msedge.exe	93
PID 4276 wrote to memory of 3516	4276	msedge.exe	93
PID 4276 wrote to memory of 4304	4276	msedge.exe	94
PID 4276 wrote to memory of 4304	4276	msedge.exe	94
PID 4276 wrote to memory of 3836	4276	msedge.exe	98
PID 4276 wrote to memory of 3836	4276	msedge.exe	98
PID 4276 wrote to memory of 3836	4276	msedge.exe	98
PID 4276 wrote to memory of 4368	4276	msedge.exe	100
PID 4276 wrote to memory of 1004	4276	msedge.exe	101
PID 4276 wrote to memory of 4368	4276	msedge.exe	100
PID 4276 wrote to memory of 1004	4276	msedge.exe	101
PID 4276 wrote to memory of 1804	4276	msedge.exe	102
PID 4276 wrote to memory of 1804	4276	msedge.exe	102
PID 4276 wrote to memory of 1804	4276	msedge.exe	102
PID 4276 wrote to memory of 1524	4276	msedge.exe	106
PID 4860 wrote to memory of 1428	4860	chrome.exe	116
PID 4860 wrote to memory of 3948	4860	chrome.exe	118
PID 4860 wrote to memory of 3272	4860	chrome.exe	119
PID 4860 wrote to memory of 3272	4860	chrome.exe	119
PID 4860 wrote to memory of 1884	4860	chrome.exe	120
PID 4860 wrote to memory of 1884	4860	chrome.exe	120
PID 4860 wrote to memory of 1864	4860	chrome.exe	121
PID 4860 wrote to memory of 1864	4860	chrome.exe	121
PID 4860 wrote to memory of 1712	4860	chrome.exe	122
PID 4860 wrote to memory of 1712	4860	chrome.exe	122
PID 4860 wrote to memory of 5028	4860	chrome.exe	123
PID 4860 wrote to memory of 5028	4860	chrome.exe	123
PID 4860 wrote to memory of 4088	4860	chrome.exe	124
PID 4860 wrote to memory of 4088	4860	chrome.exe	124
PID 4860 wrote to memory of 4684	4860	chrome.exe	125
PID 4860 wrote to memory of 4208	4860	chrome.exe	128
PID 4860 wrote to memory of 4208	4860	chrome.exe	128
PID 4860 wrote to memory of 4240	4860	chrome.exe	129
PID 4860 wrote to memory of 4240	4860	chrome.exe	129
PID 4860 wrote to memory of 4328	4860	chrome.exe	130
PID 4860 wrote to memory of 4328	4860	chrome.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://dushezcatering.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x274,0x7ffd3aeec188,0x7ffd3aeec194,0x7ffd3aeec1a0
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,699293651913228578,15368584515262986204,524288 --field-trial-handle=2932,i,16089972687444533335,8150967999621461652,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,15435646525814555187,11624570110224077155,262144 --field-trial-handle=2932,i,16089972687444533335,8150967999621461652,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,15970133876078726146,17012422155339356692,524288 --field-trial-handle=2932,i,16089972687444533335,8150967999621461652,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,11579825931820281944,14921181202036904198,2097152 --field-trial-handle=2932,i,16089972687444533335,8150967999621461652,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,8074277936100414127,1502755428875672388,2097152 --field-trial-handle=2932,i,16089972687444533335,8150967999621461652,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,2932284126760187657,1263289984592336484,2097152 --field-trial-handle=2932,i,16089972687444533335,8150967999621461652,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,2008621131740253448,1094855993918627753,2097152 --field-trial-handle=2932,i,16089972687444533335,8150967999621461652,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:2
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5076,i,18053944935865914803,2441537645291341390,2097152 --field-trial-handle=2932,i,16089972687444533335,8150967999621461652,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,4977765426278195003,15093847129907086196,524288 --field-trial-handle=2932,i,16089972687444533335,8150967999621461652,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,1964963610188073808,2454424110975988224,524288 --field-trial-handle=2932,i,16089972687444533335,8150967999621461652,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5636,i,10886285064498673995,17547955956080669215,2097152 --field-trial-handle=2932,i,16089972687444533335,8150967999621461652,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,7752092881661500784,9175624558953108527,524288 --field-trial-handle=2932,i,16089972687444533335,8150967999621461652,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,7752092881661500784,9175624558953108527,524288 --field-trial-handle=2932,i,16089972687444533335,8150967999621461652,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd2df2c728,0x7ffd2df2c734,0x7ffd2df2c740
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,14037065623046181391,16018958091801766073,524288 --field-trial-handle=2068,i,2431605353822084012,1853084542014494539,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,9325674795339124186,7266998680372337789,262144 --field-trial-handle=2068,i,2431605353822084012,1853084542014494539,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,3740074241157686634,7700840455724863521,524288 --field-trial-handle=2068,i,2431605353822084012,1853084542014494539,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,3471220682011625991,13168460533274216311,2097152 --field-trial-handle=2068,i,2431605353822084012,1853084542014494539,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,15494988477589216745,4466939449679322433,2097152 --field-trial-handle=2068,i,2431605353822084012,1853084542014494539,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,12488185189458652936,2505628056956291091,2097152 --field-trial-handle=2068,i,2431605353822084012,1853084542014494539,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4496 /prefetch:2
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4668,i,10933142293887311012,8013516766144241208,2097152 --field-trial-handle=2068,i,2431605353822084012,1853084542014494539,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,2876222866549308154,2537400805665120244,524288 --field-trial-handle=2068,i,2431605353822084012,1853084542014494539,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5544,i,5486648111457313536,13936890899540576171,2097152 --field-trial-handle=2068,i,2431605353822084012,1853084542014494539,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4752,i,5906169822219465378,18344230142910709333,2097152 --field-trial-handle=2068,i,2431605353822084012,1853084542014494539,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4748,i,7522701474042051693,13998773455530618663,2097152 --field-trial-handle=2068,i,2431605353822084012,1853084542014494539,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ac8896f98e077f9bfc127379bbcce7c100771d7680f91daf9a34170502c65cc6
MD5 b7ea9ae319bd55bb56808d0479d7ea7d
SHA1 e66c9b58c71a12c48b95cad4036153d4db22f298
SHA512 8d86e413061b142943ad99877f5e19c7b6716064bab238fa031a66b17d1478acf8747660f14b0f3cadbac6f98238d475c16f91681bb36acd1111cfdbb7148949
TLSH
T151F0CDF9C932FC3718FD0B6920951B4AE75117672A91895F3B3D410D4FB163746C691C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 34KB
SHA256 f62725849a6846b7dbbe4012f6bccdfe547f27176e4611ceb042383315de74e0
MD5 11c4823848eb41a7605ae02857375bff
SHA1 e18fdf7c7872272da71921c6edb487303d7d1538
SHA512 cf69ad385e36f52abdaa15e0cc6cfb818a8dee0285a3fc13026192be35524d0387acd9caf0e3337aab47d1dd76d90b5c5636151faa9972406d6911e3a0030d28
SSDEEP 768:cPVknCgWLvK+IpN5fsdCCEy6NzcmgKhaISNNhnZSFTQEIt6U02jG:cdkncu+IQE9N4q5SxoTn26
TLSH
T1C6F2F20F36E5556CCB29E9C6CEC06304049A49C4CC9DB3991AE89F29DE27A53C5F2377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 918ea31fb24f16d11863a4cea36fd40a683c3e653cee8b11b1366847f9fedff3
MD5 7204156edf4577a664527884132276e3
SHA1 4d98c565aa924f889c5bfd42e98d31f964bf4243
SHA512 d54e4a6dba3e605c04c6af40b6336ccf7e2c68beb220b7fe65685274a80a63a0e61ff5ed5b9b8e11ca968f5f4ef77564279a1ad20ca858ba2ca23af7882460fe
SSDEEP 192:MRhZfsqL5v7+pAPRp2no9THsb+WNn22gPFp2RA2/eQrMRjVyIsnAUgtaJ:MRhZLZaUXN9wfgj2G2vq8
TLSH
T1F542A42DBD10793B5CEBC229EA657B97E7F1103260942E44EAFC893C28DB5CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 f7244d120f1e1fd537d7a1a617c7236ce88e56917fd316dd4664d6bf97654d21
MD5 a25c703f80a7bf8e343c26cd5e27fb66
SHA1 b7a6f787e4550d2b6c9fe694fa64395dad0bb48a
SHA512 87d8e6ceda0ceee252fbda9a83939156ce40ced4d216c0e9b11cb900950ecae802aea2631a50432eb807fcaf3f83fa08e1315300fbb13d9f27eae84203ce45d3
SSDEEP 6144:PmJ4pq+zni7cwTl5oFJUO0xp2dhn+hFD+7t56OD9ZfSApprm:PwA6cwcXU5xp2dhnyFSXD9ZfS4s
TLSH
T1384422A3F9A4CCBB96FE6144B0CF1A049DF279E681CE171E80569E86944ADD50273F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 710cab6662f16a98c4d656a787644e589906a4374db489defdc231cd71acaa1c
MD5 398a8f49c64009650b91271cbb7046cc
SHA1 f2b0b9f6b96fef3af01fcf8e3723598cef187112
SHA512 6fca97ba752c890871ba3e48498e327e1a03a112b1d5cb16926261e153ab1c857ba149d82362f6529dfe12ed35b4ca9c715560dbd5b4c19050030fadf1761ad7
SSDEEP 3072:o+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:o+hFD+7t56OD9ZfSAppr2
TLSH
T117D31232AA91D8BB89FC6541B157A304DE72ACED81DE3A0944495F8EE09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2437f753-b04b-4942-ab3d-dfaf008dc6a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\2437f753-b04b-4942-ab3d-dfaf008dc6a2.tmp
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db998f2ab3bc4e87d03b65e45c5cbb178df73d3cf3485b0f37651dcc2814f3c4
MD5 5f5f54c76a35e981894cc5fb6daba05e
SHA1 f502dcb8644de3724c621965a3a911c911ca900d
SHA512 5b35d9868c8c7bc14be58b8d1c82589ffa8c6d4d639a122de36a7603d6e1fdaa95347b26ba4692476227aad23f224b54f96b3ed88d347aa1c403e5ce05da56b9
TLSH
T16FD080B5D9756AF4E465253C02230604714C95425D433105D55145960D9D7C354D7DE9
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5b7418dbf4e534724496a7f93534449b3d8016d11c0383648e679bf36970e074
MD5 7aeb1d1a0863f79f66fcae8309a9a1b7
SHA1 529e2b6921c86c98d860c6dea211f99cdef22ed0
SHA512 c3db65b7a52d01bc0d551ee2a1a11bb33effa335213d49b3e462eb06c1ae9958d15388a81be19795a494c4eb58ed63a55d7d5590ffed1f2dc9b6edec1d5b121c
SSDEEP 96:4843HHicKHNeLmJpJeIjmmGT+2AlLwEQiC4T04KWw2:7qHHicKteKJ+q2Am9be04K52
TLSH
T1E1A173F65394DFCFFBC874309EE25B9636F869529BC21E6A2C50D8A73C06B88C019113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d90f2095ac32ffe199607b10412b71e5e47aee3eb65bb667dcdaa779b346c144
MD5 a075aa1aa2994d651e92fc72381ff72b
SHA1 24cf234a55885e992908241dee7e5c7d13845866
SHA512 8d19960218cf03621cf1f38b70ed4bd76bec71f51a94ce5b8840522d5ef04206f12d816612eb265a1ad29cb3427e598e0e82c40463a214757e3359b086a5a184
TLSH
T1F861CEF793F8A52D8C2196F066286E2BDF2D0914435C3C4DD5E8AE8FA7F2871E10154E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 44a401948882a58d3374f20e82af62a119a81bf27a0d7363a3a57dfc89ddc230
MD5 f9ad101a29d5c9d141e0e8f3ee41a88b
SHA1 a3ebde611f8eab23f84525313d85924a364cb539
SHA512 7c2a46891147912fb4efdb98d46e4123fbedbabda95748e15f54385ef0dcb92b0a9e80f04cddd67a6bdffb09cc8c36ba1c2d996da3d5b566f272668942d269b3
SSDEEP 192:sxZTRIWW/f7s7LIdpKqHW6+WNtPv0/YrII+xIgrJ:sxZT1W/f7s7UtHbtE/8I9
TLSH
T15722C9526E34A93B8CC7D21DBA19BF53E6F9507261D41E48F6FC861C04E7ACE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7c0fb58e163f525ead05724298c867fc580b72ccdabd95064f987cecef407e83
MD5 458945a64d4b835cbf73cc1591564978
SHA1 f0f704e8240403b6ee5ee97ce97c8977dc6b20f9
SHA512 be9c4ee7cd685acc543a838c1e035b395cae68681324978a3c3c0adb93b5285ce4b3c406a6bead2e76b2db5f2c0f8bafae43e9133298bb5ae24f70139b4f568d
SSDEEP 192:sxZTRJWW/f7suSWpV5MIdpKuHW6+WNtjOxP3sXYr9ILrjIgbIJ:sxZT+W/f7sVWv5VdHbtSxEXxLXg
TLSH
T10C32B716AD34A97B8CC7D21DFB15BF53E6F9507261901E44AAFC8A1C04E77DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e0616953ed534eddf3edb7780d6a510723347a4b14459673349bae701b5dd3bc
MD5 735271f11502aae02e4156cde32e9b17
SHA1 80029fb399882fcbb83b34b7894782d9cc0d574f
SHA512 b17a3ff658fd980951ff2607b8eb5c513b47acaf9858ad10e39b616adfac39864d051bae21f29ceeea0c3ab21373ba4ac2f9f616e40b032acf32e20b3fa15b0c
SSDEEP 192:sxZTRIWW/f7suBpIdpKzHW6+WNtP3sXYrwI+xIg5IJ:sxZT1W/f7saicHbtEXEIO
TLSH
T1A322C856AE34A97B8CC7D21DBA15BF53E6F9507261941E48F6FC861C04E77CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 212660d8a8e939c3cfeff423e99b3012075a4b01553a2a55de023f1004645867
MD5 f3be21ebb1bce4049020074aed45d8bf
SHA1 cf106ce167d5d7bfd9fc71fdeeca0e7294e4aa27
SHA512 bb497d3545279bee437ba2187c74db1d2a793b939e266100936672a07289eb112fb6bf3fea05ca3ad450fc2923f31eb31e4ee0a46e63e4fe68f963d41b5ea366
SSDEEP 768:3Yy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TboroRkX:3Yy4J/DWvbtBhu1jajiLm0bTKX
TLSH
T13AC2FA3F644CCA7E4FC00A9DED5E6F973E9802C79A948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fcda430f66e6c8b7f249e0152e7678dda8d43af20ebe2e10031b6d4f63d12fa6
MD5 23f1860c979d8ba8a184561deeb58cb8
SHA1 69dc717c3e709332fc961d56b18fc31ab1fbbef6
SHA512 928241e4b4088452e77e2cb2f80de560f10c941f3ab450a2723e11fb15a5ff4727a576c310e97f313c76a791a9560d92f7d14a8e8102698a488d6e17fb59e954
SSDEEP 48:KIDI1Ks04jyLCNQ8CgARbcrMISURK9Y1iRxaBYDUAyyLitwciAgxb8LsIS0xK94n:KIDCKs0+mZCKSQq2Z6KiIi14nDd/e
TLSH
T1CE91BE5530BF120138BE258891B58B1A524636B7716CE63A7FBC80A54E6FF086FFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8b09ed26cc7b25503183ec6370d63316375ae3dbb4cecca00533b75903221845
MD5 cdc09d4ddf424a441c1c79646088610a
SHA1 c1142d6b0e5019c965cd5fc7456ef53be068544d
SHA512 0c01d4a59a95950635b4983ae5f1a6fb3a041f355c953affe86168538035f2a95c4d3b55e7546630446ea9632280c8071c0546af96c46206a5f35911c1e11288
SSDEEP 384:GZcIhsNMULAreLZpRaHX58EN8j2X9LngqmtgOIwZOyEvo9f:UhrYVcap2ZngqmXs5Gf
TLSH
T144827E3698B8AC375DE7E145B54A35039FB88067E6C86F90D6FC5B1D01EA1A9030BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6c3bf516b2bafb1a305740d5bc243544b984ac14fca391644db13a33d275872b
MD5 d619005aebae4fa447a77d15ea220d2c
SHA1 5f5e5abf089be16f7dba91f527cde5914c58685f
SHA512 cae7af1beb4013f0b400e6a08a689342417ddd43585cca637bc2d9dfc85d413f5ae73abc0cc167beb2cbc11fad61b3dbaa308be0edfec01d8dcab781966a82fa
SSDEEP 192:1ONm6wlDZQmiUypc2G4X58gZxjzorQo2X/FIEnkveqqCmU6:1ONm6k3iG4X58EN8j2X9LnPqmU6
TLSH
T1F7120936A578AC3B5DE3A545B58635039FA54127EA492F90D6FC1B1C01EF2AC131AC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 d84942447b71259f708002afc99ef3110bd9e1b0ae56dc41423ba81d986d445e
MD5 0b30c815ca85c17497ebbec40ead7194
SHA1 b4149276a409b2d1c6a73330f22c979015ace09c
SHA512 5b4df60da05ae88e1f107f23e998e4e7c5ba965c84c7028116b51afeb201f767da8ac41487bdcb8b4cd7c9c36873a09f66861fcdad9c9e1070317e38eebae2b4
SSDEEP 384:rZcIhsNtULAreLZplaHX58EN8j2X9LngOMASttn5swkLutgOIwZOyEvo9f:zhYY5cap2ZngQSmwkLuXs5Gf
TLSH
T11CA25A75D8A86CF744E6E9C6A546E6037FB8107B82881A5CC6F8BB3D305F5F80312D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a5c88fba188985523fb8aa9be17d5b513037254a87ba5d90c510d75110b0da7b
MD5 e4f43e5deaf6807ee2d39d381fba1868
SHA1 bb1d91e78419c81970ed3daeb56acb3a43247435
SHA512 92d9906e358218de1e837c096b39b37fbd04917c8c5139ecfdce5f44d36769d4e47d93a25b99af754a9dff1b11480eed8acf05de35468648c479785124bfdeeb
SSDEEP 192:1ONs6wlDgQmiUypJ2W4X58gZxjzorQoWDlm/QU6:1ONs6kg5W4X58EN8jeHU6
TLSH
T1E802F935B9B8BC7B8EF3AE49F48626139FA5102BE6952F44D6FC0A1C00D765C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d0bb814a354afc717c8f780e86633396245ae06e330b2360afddb405de911b7d
MD5 a1d75b837c38aaa3e9c4e82c49723a2a
SHA1 d3a30538db9aa4d93df15b730ff7ae8109355c8a
SHA512 59f6960bf306c0c5593d8bd1eec76ab7a4dfba7d28fd9aec55e6017a5c1be89f00f75726a19bfc312f5f14625fe2cd23c0b199d2a8acb42b6b9da6690b18c96b
TLSH
T16F414D5CA6F51158B3776F2A9BF7A86D887A7C372E0AD45D00110E4F0A22B44D9B2737
MD5 SHA1 SHA512 TLSH

Submit Download