7bfe35b0cd63c2320b05c0653fe4c41ac6a1f99721f7d74f2078aa9124ea1777

Analysis

user interaction
yes
max time kernel
72s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emulat_r_TR.html
Size 41KB
Sample261104-yr2b4ac141
SHA256 7bfe35b0cd63c2320b05c0653fe4c41ac6a1f99721f7d74f2078aa9124ea1777
MD5 88fd10ebe0e2b14925d487f7f37c12ad
SHA1 93bb4cde179649801be1e5fb766c54474a58abde
SHA512 ff3a72144924115e88f885ba853247f26b51acdafd534edac53c3ba794034aa23efb014cc481a9737d2c540dd3c84028f6a79c0753142ccc3befd3a886ee5778
SSDEEP 768:I3+83DZVtXYcw6EGJGDFsqdCR7gA6FSGLE/aVdh/Me:O+83DZVtvpgA6FSGLrVdh/r
TLSH
T149133A8A68F31026A59359DC37630B5D76558243DA02DC67BBDD42B0DFCEFA268A334C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4868	msedge.exe
4240	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{1B373840-687F-4669-BF48-11978763FDBB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 404	1640	msedge.exe	84
PID 1640 wrote to memory of 4868	1640	msedge.exe	86
PID 1640 wrote to memory of 4308	1640	msedge.exe	87
PID 1640 wrote to memory of 4308	1640	msedge.exe	87
PID 1640 wrote to memory of 4308	1640	msedge.exe	87
PID 1640 wrote to memory of 4340	1640	msedge.exe	88
PID 1640 wrote to memory of 4340	1640	msedge.exe	88
PID 1640 wrote to memory of 556	1640	msedge.exe	89
PID 1640 wrote to memory of 556	1640	msedge.exe	89
PID 1640 wrote to memory of 3224	1640	msedge.exe	90
PID 1640 wrote to memory of 556	1640	msedge.exe	89
PID 1640 wrote to memory of 3224	1640	msedge.exe	90
PID 1640 wrote to memory of 3224	1640	msedge.exe	90
PID 1640 wrote to memory of 4784	1640	msedge.exe	91
PID 1640 wrote to memory of 2676	1640	msedge.exe	92
PID 1640 wrote to memory of 4784	1640	msedge.exe	91
PID 1640 wrote to memory of 4784	1640	msedge.exe	91
PID 1640 wrote to memory of 2676	1640	msedge.exe	92
PID 1640 wrote to memory of 2676	1640	msedge.exe	92
PID 1640 wrote to memory of 1404	1640	msedge.exe	96
PID 1640 wrote to memory of 2376	1640	msedge.exe	97
PID 1640 wrote to memory of 1404	1640	msedge.exe	96
PID 1640 wrote to memory of 2376	1640	msedge.exe	97
PID 1640 wrote to memory of 2284	1640	msedge.exe	99
PID 1640 wrote to memory of 696	1640	msedge.exe	109
PID 1640 wrote to memory of 3608	1640	msedge.exe	110
PID 1640 wrote to memory of 1516	1640	msedge.exe	111
PID 4292 wrote to memory of 856	4292	chrome.exe	115
PID 4292 wrote to memory of 4244	4292	chrome.exe	116
PID 4292 wrote to memory of 4240	4292	chrome.exe	117
PID 4292 wrote to memory of 4244	4292	chrome.exe	116
PID 4292 wrote to memory of 1652	4292	chrome.exe	118
PID 4292 wrote to memory of 1652	4292	chrome.exe	118
PID 4292 wrote to memory of 3112	4292	chrome.exe	120
PID 4292 wrote to memory of 2748	4292	chrome.exe	121
PID 4292 wrote to memory of 3112	4292	chrome.exe	120
PID 4292 wrote to memory of 2748	4292	chrome.exe	121
PID 4292 wrote to memory of 2392	4292	chrome.exe	122
PID 4292 wrote to memory of 2392	4292	chrome.exe	122
PID 4292 wrote to memory of 1564	4292	chrome.exe	123
PID 4292 wrote to memory of 1564	4292	chrome.exe	123
PID 4292 wrote to memory of 3796	4292	chrome.exe	124
PID 4292 wrote to memory of 3796	4292	chrome.exe	124
PID 4292 wrote to memory of 2504	4292	chrome.exe	125
PID 4292 wrote to memory of 60	4292	chrome.exe	126
PID 4292 wrote to memory of 864	4292	chrome.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\emulat_r_TR.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffd3aeec188,0x7ffd3aeec194,0x7ffd3aeec1a0
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,3868955515853252441,15731012104937388996,524288 --field-trial-handle=2476,i,11605252881650881366,11916123332411702449,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16858526988980192956,17766400193751237961,262144 --field-trial-handle=2476,i,11605252881650881366,11916123332411702449,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,2235401171882901566,7927816834138268040,524288 --field-trial-handle=2476,i,11605252881650881366,11916123332411702449,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,14147294259735864473,12709217307043346620,2097152 --field-trial-handle=2476,i,11605252881650881366,11916123332411702449,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,2575837126247579187,2690967911986073820,2097152 --field-trial-handle=2476,i,11605252881650881366,11916123332411702449,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,5218473043186959844,14771201932036975754,2097152 --field-trial-handle=2476,i,11605252881650881366,11916123332411702449,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,16178719824329619389,6966524496110027548,2097152 --field-trial-handle=2476,i,11605252881650881366,11916123332411702449,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,7981216985963215008,6044555896261705408,524288 --field-trial-handle=2476,i,11605252881650881366,11916123332411702449,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,4241528242433276219,17659833476485505240,524288 --field-trial-handle=2476,i,11605252881650881366,11916123332411702449,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,2169711391086763966,499962764125727373,524288 --field-trial-handle=2476,i,11605252881650881366,11916123332411702449,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,2169711391086763966,499962764125727373,524288 --field-trial-handle=2476,i,11605252881650881366,11916123332411702449,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,7877900942272243059,9627819490170728979,524288 --field-trial-handle=2476,i,11605252881650881366,11916123332411702449,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,4887483234158568020,8496537340397441083,524288 --field-trial-handle=2476,i,11605252881650881366,11916123332411702449,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,10429779586646953254,1515522873825146758,524288 --field-trial-handle=2476,i,11605252881650881366,11916123332411702449,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7ffd2d5bc728,0x7ffd2d5bc734,0x7ffd2d5bc740
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,7983501478575827166,10863692036070732994,262144 --field-trial-handle=2124,i,13333757862987096765,14872448980044868367,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2180,i,6774701401116373585,14059602387307733839,524288 --field-trial-handle=2124,i,13333757862987096765,14872448980044868367,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2416,i,10465648916097278396,1134698992058243746,524288 --field-trial-handle=2124,i,13333757862987096765,14872448980044868367,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,6824747043376954478,9932711412817865337,2097152 --field-trial-handle=2124,i,13333757862987096765,14872448980044868367,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,12709239603035551917,18007417734804615528,2097152 --field-trial-handle=2124,i,13333757862987096765,14872448980044868367,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,12433177458274774499,14378264073289482785,2097152 --field-trial-handle=2124,i,13333757862987096765,14872448980044868367,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4480 /prefetch:2
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,4597917206337159342,12739252646672906850,2097152 --field-trial-handle=2124,i,13333757862987096765,14872448980044868367,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4768,i,17545174160504754242,15533257075754814369,2097152 --field-trial-handle=2124,i,13333757862987096765,14872448980044868367,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5248,i,2258598439431442049,18399013982240905211,524288 --field-trial-handle=2124,i,13333757862987096765,14872448980044868367,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5252,i,9956122895956626264,16596315374130054303,524288 --field-trial-handle=2124,i,13333757862987096765,14872448980044868367,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5260,i,5726633047893549895,7922190516418108203,524288 --field-trial-handle=2124,i,13333757862987096765,14872448980044868367,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0256e98c-a05d-4b3c-9dcc-e7b1bfe28d2c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0256e98c-a05d-4b3c-9dcc-e7b1bfe28d2c.tmp
Size 130KB
SHA256 28e1d30e66962983c7b31b791fc088ac6c08ecdc7f328dcf1918a544c08fe6a8
MD5 aa27b38ea3198dca2e2fc43c9e9f4a93
SHA1 3569cb5bfee552a01f2d074483585c36d65625b6
SHA512 976c0921a1c5384faac9cdd09267fb50af90c21744832d3a264ac3c23f7e0a88f5f1b0a4c3d1a51bdaeba3d3b56f69afd3c28a8c38634d22b3cdca0cbed8961c
SSDEEP 3072:5+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:5+hFD+7t56OD9ZfSAppr2
TLSH
T1B6D31232AA91D8BBC9BC6541B157A304DE726CED81DE3A09444A5F8EE09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57067f53-54fe-4419-8a13-4d266fb27c66.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\57067f53-54fe-4419-8a13-4d266fb27c66.tmp
Size 131KB
SHA256 01fd32e887fb7fd82022686ed48954c4697328342fc693464094b3ae94ca7101
MD5 e2fd3a796cdfe59c5eb2826a3ca16aa7
SHA1 b0d464ad7b9c3657d17cd0cf47b158b0b79609d3
SHA512 c32684f96bc0cea45b54a4a31416d136805e5d55089d3649be202d5de292338dd128dc3ca949a095dac99812bf415e166762c8bf2628c0a54598bdb2dc4bbd18
SSDEEP 3072:lD+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:lD+hFD+7t56OD9ZfSAppr3
TLSH
T1F2D312326A95D8BBCAFD6541F157B304DE6268ED41DE3A0984464F8ED09FC4D07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 4804f5345dd7a1abbf91d44a7d836e7cbb1ee9fa6385975e53c6f8ec96c6c47d
MD5 32c88c9b05a228b002f5b75dfb4c0817
SHA1 3cfbfb4201df76afff930c067ab2c233fa2beb39
SHA512 89395192d03f0f9a91b688fc636f3d51b65a076c4acf3bf3ba0fdfc95cfd25b45ed242cdb8af832a41a19e32ea5d26632a963197aa1d5794faf628696e9cfac8
MD5 SHA1 SHA512

Submit Download

176764c5-bc19-4a82-9cae-73bc970b8c00.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\176764c5-bc19-4a82-9cae-73bc970b8c00.tmp
Size 12KB
SHA256 6efb0d8a4095ae3cb4acb3e8fffe56ef0a0ee703f504fd3503582914f6ffa9cc
MD5 3ab2539252f962c7aec25788ea0719f3
SHA1 6756bbafda6040051fb0734606c1699e00ed6e3e
SHA512 dad58da5b00f12545463d85fea20113e7a2bde30a281a519e728e7b1d0d2d08f44bdaedf89f735534614ca31549289a91e70a4a8e6bf42b22deb7b55069db30d
SSDEEP 192:tRki19uBk5Tv7+pAPRp2i99THsb+WNn/D09l2xcRkwIadPyIsnAUge:tRki1TraUXt9wr072aRoape
TLSH
T13C42922DBD10753B9CEBD26AFA217757DBF9103165901E84E6FC892C25EB6CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40c91b97-bae3-4351-a666-faa47860019b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\40c91b97-bae3-4351-a666-faa47860019b.tmp
Size 12KB
SHA256 3367636531e2158d100e49a82e5b26cd44231e765e4ba3d44de5cba2eb0a255d
MD5 c43616e3797ddf9b3ad70eb732503c20
SHA1 2177139de06ca9986524f3e7e305524cc7bc3db0
SHA512 b7d5d045809e6b0a87dfcd0d7a8af464f58c3a8ed0807ad549eeeb4e8dbf4c4c3d48c0da8cef039db2e1c2c3f6ba7dd562f043a729c8a6bbd5ee2044b38570c5
SSDEEP 192:tRki19uBk50v7+pAPRp2i99THsb+WNn/D0Ll2xcRkwIafVyIsnAUge:tRki1TwaUXt9wr0R2aRoa5e
TLSH
T1C542A32DBE20753B5CEBD22AFA217757D7F9103165901E84E6FC892C25EB6CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25d06b0f-75ab-4492-9687-6c73d507f7fb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\25d06b0f-75ab-4492-9687-6c73d507f7fb.tmp
Size 1KB
SHA256 a7188796405d0d28a1048520687aebe34896374c50882a4e146fad8b0b2cbdb4
MD5 8d51b6430e80d51de789a05987c0813c
SHA1 e0e84f79b67758a4faf169e0af6dbe90d466ff48
SHA512 3e9f5506b1f41c2ea850740c12f72582075366adc754ea559a7ed293647cf3530d817bcf370bdb14b1b398f9b56b24006a803d80565a0dbc75714bdd9acd17de
TLSH
T1D5117BA7D97EB47B80FD0A771F44F8152876B830138168E4CE5A83AC60D48E31F46473
MD5 SHA1 SHA512 TLSH

Submit Download

4d259fc2-29e9-43f5-b78e-2eb9ca1892f1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4d259fc2-29e9-43f5-b78e-2eb9ca1892f1.tmp
Size 3KB
SHA256 1dbc45efc19eb27cdb8079306889f13a545cd56b853c3d64927b62ff21806391
MD5 b8697cf04b6dc75b6efc96535d2d0363
SHA1 5435ae33daea6cf8bbc5b8806e1051958726e552
SHA512 5d1177944e7390ecaddca4545739cf171ee47c72ca8cb54520c279a6b862d8238a9948c02022cb4ffd08632d0d8a4511a19210c24b36dd93e945a0e2d774a55f
TLSH
T154815BFBC3D88A7D851192F4AB256E1FCD2D1916532C3C6788E4AE0B53F68B1D24129F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 c8a7a29fad99d590c9d2c060e2b4df1b54762c2f3da7a2c8e8537fc41e7db689
MD5 fb526b3ffaae6354d5d2ca2c5e705234
SHA1 b9cc0649053d7aa00fb66e57e6bfd66b5d22900a
SHA512 3d62878a310f4927ae1553fe8ed181bea0efe769c8ba9dfb9c242ccea206b635754c13736cc30ac5eb60950d4e118dbf72ea15daac5f4597b94f807491f425c9
TLSH
T1F3B012158042A312C08702B0155414983658DF10A609130F41F40E81CC351A2C11B264
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 6407fa2914079007213813eaf8138a4d8e07c202f650514cc153bcb68a65b851
MD5 34a4b110caf04ed545faad9eda1a4de2
SHA1 1cd65105e05aadf1c63b23993de51886cb413c12
SHA512 b8ff5994992bfb94dda6b77afcfa05613a76017df1599d3053069bc41e72cd57e719e288d02f901886ce316a78005c441c1bcd3f5abb5f1f6cf1e0153e978699
TLSH
T195B0220EC2032A02C20203B0208080C83220CFA8C203230BA2E00FA3CC30BB000300F0
MD5 SHA1 SHA512 TLSH

Submit Download

ef1a5d50-5108-4708-b06b-f45db0ea2786.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ef1a5d50-5108-4708-b06b-f45db0ea2786.tmp
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa920069-f13e-4ef3-be47-952bbe10a54a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\aa920069-f13e-4ef3-be47-952bbe10a54a.tmp
Size 131KB
SHA256 82b2ba931799b1577b038e7c054e68a331a9b1e0da5a65d9bbe207724b5040c1
MD5 ecdf30131760077e86cc7beb043e23b5
SHA1 56f8a3087ebe67a9d38727e58e62fa360e112896
SHA512 3095865735ccc1b2ab257f0d5e7b3cc4d01a104b6b7540613354ae792d714208d3d21f00936ee44f4595e7ad32c3c14f77a1320c4ced2db793a9ee44080d11de
SSDEEP 3072:LT+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:LT+hFD+7t56OD9ZfSAppr3
TLSH
T196D312326A95D8BB8AFD6541F157A304DE626CED81DE3A0984464F8ED09FC4D07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f576a12-3274-4127-bdf6-bb6b2f9b1f3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5f576a12-3274-4127-bdf6-bb6b2f9b1f3c.tmp
Size 22KB
SHA256 dcf37c348b0cc0bc892584845b2614080e35a859ab90bca80729802cb481af4a
MD5 73df0d5852e54101dc8497d66024671b
SHA1 6533ad25f8471ac4ffe7ff7136213818f3779e93
SHA512 e0da69a8ae184b192f63682deef43f16d7f89cb809e12f98b4708592dacdcec92d97e441291584cfc42d02fe8ddbe44cf86a4087c0001ba6d1569bc5794f9e60
SSDEEP 384:DSQkUSv0sNsoGZZx58O/CHX58EN8j2X9LtPPAIttd5oEMKwIr+W/H7vBEpnIIly:e0fZ2Osap2ZtAIs5KwIr+W/H75EhLc
TLSH
T1BDA24AB2D8A4ADFB05E2E5C4A245F103AEB45137D68D1B5CD6FCBA3C209F1F81366912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70016b12-468f-43c9-8841-192536034e8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\70016b12-468f-43c9-8841-192536034e8e.tmp
Size 8KB
SHA256 c9b25b0e7c22cad63e247a9d836179004e39c78b584b4f8b3af14b790603fbc3
MD5 229448bebe3d054b24df9f04e20ade17
SHA1 bb0f74ba149dbe685d7503793f2cedcea235d3ef
SHA512 40918ead4b2ba30c3402837cb77bbad0c8d88399f278a1413eb87196576de364ea21bda6f130536e131c20fee637e1e21e2589e95b8b03db00ec51a7d8122bcf
SSDEEP 192:1ONs6wlDgQmiUyR/OW4X58gZxjzorQoWDlZ1/QU6:1ONs6kggOW4X58EN8jeZaU6
TLSH
T14E02F835B9B8BC7B8EF2AE49F48626139FE4102BE6552F40D6FC1A1C00D765C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8857b6de-116a-4d8d-a76e-63d4557b6201.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8857b6de-116a-4d8d-a76e-63d4557b6201.tmp
Size 18KB
SHA256 63a7387c3ba44182c75fcb9fa6b1810d93edb137207b0b02f1e760e7668cc95c
MD5 ed82eb05cc1c27a244cd20a34572eda9
SHA1 5d6f08f1ed64e84c300704c66c41aeeb55c00848
SHA512 fdfbc7aaf4f817e7337972ee8e8c70bbaee9e7574a97e9df50092901309f782643f339f8c6ee755b98e3fbf7d3afe8f4fa87f6125b5c5efd2959db6abb48d2fc
SSDEEP 384:/cQkUSv0sNxhGZZx5WK/CHX58EN8j2X9LtZCH7vBEpnIIly:E0tZsKsap2ZtZCH75EhLc
TLSH
T1DF827D32A878AD3B4AF3E545F24E3643EFB4901BD6C82F50D6ED5B1C01DA299234BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d847c44-378e-4407-9c71-3c6d3acc306f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d847c44-378e-4407-9c71-3c6d3acc306f.tmp
Size 8KB
SHA256 765d85fa594a52e6709d6bdd3913edc86437fb4b708fd6f9120d572a297741dc
MD5 a81baac25fc216925c0c4e148896e750
SHA1 d8f646557a4979c515e1a7f86f98ad27020935b4
SHA512 87122adba4e43e566d922b87554cf63ecfa098006acf36876a8078fe147d7411d9a65fd08eae805be06c1119657382c6bab933098a9570a4e4ed06583e56cfde
SSDEEP 192:/iONM6wlDWmQmiUyX/O/e4X58gZxjzorQo2X/FIEMveZ9q/U6:/iONM6kWCYO/e4X58EN8j2X9LnZCU6
TLSH
T142121932B8B8BC3B5DE2A585B58A31139FA5411BDB497F90D6FC1A1C01EF2AC135AD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19998a2e-8cac-46fe-aaf2-18f14f9e3cdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\19998a2e-8cac-46fe-aaf2-18f14f9e3cdf.tmp
Size 105KB
SHA256 dcc5e5a44077d428b0e344ee45b3099e7eff2ebbdd8273ef1ec772721b41a5af
MD5 2b868614fa0b813f62a2463cf5176c67
SHA1 81b9a2da4d126d229190379b81cd945cd7b5b900
SHA512 34e1f30cbfede4f1f7f1c635e707b7391a5a20f0cfa6a316714dca4d73ebf5b8fc4dbe0bb321a92d46b6cfe02713df76143a1642643c1fe3dcf2ca3319f0ecb5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7P:fwUQC5VwBIiElEd2K57P7P
TLSH
T16FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 49ad6872da0e53fa2156de2ab29aae15d756e399214100166ee3b981776c9e71
MD5 ec47d7bcfb6fcae0bf0c2b01172a50ce
SHA1 20474467d868ddc238b4a6f05bd8c60a9a69235e
SHA512 38fc241b6dcada0c5d074fcd3a03d2786292deff2b4e86af77e745f823ab3f7a20920fec3c454838305c94f586355a5c360fd844cb107f4a9279878245548c61
TLSH
T19FD0807175273DFDD19D667C05515A405104CE53595115108A134D551E9C6C27CD3EDC
MD5 SHA1 SHA512 TLSH

Submit Download

019c066e-61d2-467a-afef-5448a1779bc3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\019c066e-61d2-467a-afef-5448a1779bc3.tmp
Size 9KB
SHA256 e604217bd35f07af1f17313e23ed66462f35c4f896850d304f4d94c350810580
MD5 a919f242bfb26b692cf9c0c3f6629f0e
SHA1 b61902a1fae286e50a1430d5fbaf95654c02603e
SHA512 2165bcea8fe3ce56ccdbecb4bb29fdd89d553369fd45c89fdd0c24a97ebb147a0b2f53ea0416b27f8088df80fd7705f36a3eb9ad0cd460daac7b5399ea84d2cd
SSDEEP 192:sxZoREW8/fJsQtIdpdCHW6+WNGYrvPf4IgrJ:sxZo98/fJsQO4HbGJ9
TLSH
T12022A7516E78A93B8CC7D259FB25BF53E6F9503251941E48FAFC851C04E6ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b9e1090-2abb-4fdd-9567-6f22ce689687.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4b9e1090-2abb-4fdd-9567-6f22ce689687.tmp
Size 27KB
SHA256 465a3f3e32d697b0fa9d0d65ae6d00f0511f7bfeb86b4859e89b7d9177795ca5
MD5 94858d0a58ee96da38e9227814592522
SHA1 5ae4cc8964c109176c6fce1f0f85238c4186ffa1
SHA512 58a80df8e99402964e025dfdf68bab65d87a02850e8ca0cb463d29c76cc35ecc9c3b7e10c3b05765fc44a3e72f101d9f0831a63e674b9d88a91db4ea7d850349
SSDEEP 768:a/y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbRroRff:a/y4J/DWvbtBhu1jajiLm0bqFf
TLSH
T136C2FB3B684CCA7E4FC00A9DED5E6F973E9802C79A948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5dfbd86e-0156-4716-88f8-8008b084c07a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5dfbd86e-0156-4716-88f8-8008b084c07a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9fc5af21-c715-4121-aa36-1fbfc03aaa86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9fc5af21-c715-4121-aa36-1fbfc03aaa86.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004a
Size 32KB
SHA256 c6bbf3267d1f555af16cf30aee534c9f4311443b5e5a4e16e7158ba088b5b5e5
MD5 7efcc9281929c28807bc109c568fd990
SHA1 ddcd3cb41aca42c7ac0358751d35e3a0904c7241
SHA512 a3ffe5f7cc7ec59c900f22afb51ed294670bae2e7be0ccf9b0cec38af895a25d7059d970bd0920478f67996a4ec046116c3db20bd19c99e346debdcd7688e73a
SSDEEP 768:s4i7QxjuK9EGeiMie37k71Quh95y3kv/yY1B0:1txi6EGzA37khQUOA/yQa
TLSH
T1E8E2F2932B439FCBDF17E10CFB44A8084EA49F6FCA0A6CD782C5591C762665B15C48BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004b
Size 55KB
SHA256 8d60df2cd4df9dddad8ad56f2c1e0c95ff5a4c0f059cb964bef3581bf0de351f
MD5 80e5ab60c911c3139e9cb9435446b2dd
SHA1 19251735fa6e6a9addd9d7c7a4b66c206d3f398d
SHA512 74de58de63bcb3b98ae4739dbcf3240f80cc46606ae437c9fa141c89766c1e531d796a31926b219e63c4e163770d745d4777f1a650922665a00c43db956f6990
SSDEEP 1536:vQFoh0zYAG80Y5lsz11B/2IevtExOKr9vjowwH6nP:Y6h0sAbiPxevWxPrlowqI
TLSH
T1324302BE91C6CD7EE896EF50986AF376D9845F4C2888980275EE0F03C0D9827FD9584D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004c
Size 170KB
SHA256 a86a39edd0583487548354fb5f3014c90a61f0d1fe89e28da9f81aa12cb13572
MD5 931fc258726ed21d44a88968e7776a4c
SHA1 e07366389872ccdb5563353d17ae528c0f27dac6
SHA512 44daa748de84e2568bf809200e5f28832a5df8c63ed238d7a3d3851f3422c1615d699ea89f9b93cfe9293b585b4bdaaa1e0753157f930cbe558ad049085b089b
SSDEEP 3072:drSzYpN+mqPyJlF/hHu6CdO24q24//ztxXIomMVvUVmcBL/EWGr:dmEuPyLrPr+/HWUa9EWGr
TLSH
T1FB04132990E4D7D042D7CC3FEC1046EDA89B772D256F951D4EECAFE0A3A824618E38D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d
Size 24KB
SHA256 1491d9dc8ea180be9195c8a8cca9e2e27f0fd96c193b2269f612f102f77ba699
MD5 4b2054f497e2e6d166ae4314f8b05cd6
SHA1 f9134f5591c74a63ae1217ec7b792c331316a701
SHA512 2c975b86e44a1b77609fa5afc25c7fd116fb1bb865a2a1db005718ccd4784ea3024a04240614ff7da424acebfed61e646675726cbea1e2a65717a7e39325115e
SSDEEP 768:5AsGHx9P3KrTqOA1scdJxH0NVfxmZezksRU3/:5AJ5ORYaNVcAYsA
TLSH
T159B2E1B2C8F00D65C092E5991D7CE99FABCDABB115FD4E73B000AA1127B54E146703E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 3c6ca76ff346a75fb21449b3348e8ca5102a1f08a41ab5cdb57cc94c5fbeb2e7
MD5 308eff17e837f2e6aaae716ef9430fdc
SHA1 9dd06b2a95a410081a53d8a200613cb8c511771a
SHA512 50570cd0b29bcb07187a077e50c11a07e14578966fff530eccb2d2059cedbcd1f1f20d0241a9b914f4f0051ffcb5079a0e4dccfdb8b179f0b4dd1100ea77181b
TLSH
T1AA51B7F26760EFECFBD878718FE312873AF849815DC35E5A2990D8BB580A744911C043
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 c827b07f570b48ebfd45be74912a455b20ea192fc97b88b3859a8aa27dd06948
MD5 ba846892499c82722007fdc8f8584b71
SHA1 ebe7a0a98749acef1431bf283b79116d7b7881b5
SHA512 08f66f1757a8d19ad1bce13aaed0513455466de7125155997a89797a58506dfddfbcd0920f8f98860cc4ce5a5ccba364d3d177b99393f3469373c976def1f98c
SSDEEP 3:MsEllllkEthXllkl2zEklVdll/:/M/xT02znf
TLSH
T1E74404147FD40517C5001030441DD3D01774F45C05335747345104177CDD5400C00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

392c843b-970e-46ed-9fe1-6e942ad9d4a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\392c843b-970e-46ed-9fe1-6e942ad9d4a2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

712e2f32-646c-4b91-b428-21dcacb83293.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\712e2f32-646c-4b91-b428-21dcacb83293.tmp
Size 2KB
SHA256 430c5c4f485126b192174c3015690fbed70db54f6b49957f2bdf891787b13449
MD5 8aefccfa94e12a8334936a374d6ba681
SHA1 750afec9c9367db9c2af2baea843ca8e5a663185
SHA512 81442481ad51e1f887b5ca94a68e7155270a4a9bad070a4293ace1c1e666a4f1980332ae97b77813bebbc1cfab1a1185060eef1ed27302f2633b50eb6530d17d
TLSH
T119518FB7C6D84B6EC81156F15B247A1BCD1D150A82283C568DF4EF5B63E2474E2411AF
MD5 SHA1 SHA512 TLSH

Submit Download

9cf10f45-c057-4e4a-8bcb-32443695f743.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9cf10f45-c057-4e4a-8bcb-32443695f743.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d4cb3a05-c233-479b-ad49-e0b78fa411d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d4cb3a05-c233-479b-ad49-e0b78fa411d7.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c4b49f75804879b521a183a406aa4ccab9863b244df174e90468f10017885022
MD5 1b310db9da7968f55e7210452cca997e
SHA1 d954a6bd0a49aa8ec54dd85dd24f0e6d6df742b3
SHA512 a0ff741293862cf00cb6b59ab1d67254f72b5754a225be50de13784e2879c441d760b16236cb6a3efb44d510af62a9e69a7599d98ca91c6cc2d9ac8781c7a84a
SSDEEP 48:KIDI1Ks04jyLCNQ8CgARbcrMISURK9Y1iRxaBYDUAyyLitwciAgxb8LsIS0xK94r:KIDCKs0+mZCKSQq2Z6KiIu
TLSH
T1B791EE4530AF220138BD298891758B1A124636B7716CE67A7FBC80A54E6FF086FFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c93bacec-2d43-4eb0-9ab3-6b6ba623501f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c93bacec-2d43-4eb0-9ab3-6b6ba623501f.tmp
Size 11KB
SHA256 c4b724b9ead95c91f2cf94545f51d2963a8bb20725168cbbe57f136f81d8afcc
MD5 969d96615a2c48041c28e1b7354950ee
SHA1 0d082bdfaedf650ee55834b4a3fbb1c29d018b1c
SHA512 2b160eb3c31c4e5c3c9c872da49dfac7a204e2686c6c2169a3b7dda94663f02f99e459c832fa82d8df7dd7d1480a8e7739194317585f2c54915f4c1751e11370
SSDEEP 192:sxZoRPW8/fJsSWpVdtIdpdSHW6+WNGYrkyUOIgb/J:sxZoY8/fJsSWvdOMHbGQF
TLSH
T1BA32C7516E68A93B9CC7E24DFB257F13E6F9103260911E48AAFC861C05F7ACD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e995da41-ea26-4322-a74a-1749f4aec794.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e995da41-ea26-4322-a74a-1749f4aec794.tmp
Size 10KB
SHA256 32a75017bfdfa3349f79b094c4a08bf224733a6a6b491d990ac3d2d26e120b86
MD5 0d31d92a2ad31d1fac0ea826d476599a
SHA1 db3b2e4c12f597f17fbe3907cd1649bb141d0757
SHA512 461758b7638a4d518cb676d5ac72e27850f4518bfa64fd994df64290b3d791c20960e599a7444f6d02b96179b4dade3bc30fb139474815fdc028b1809dafe003
SSDEEP 192:sxZoREW8/fJswtIdpdCHW6+WNGYrvPf4Ig5VJ:sxZo98/fJswO4HbGJF
TLSH
T1F722B6526E78A93B8CC7D249FB15BF53E6F9503251941E48FAFC851C04E6ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e702af6e-5f05-44ae-b7a4-0b60f3c1e90b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e702af6e-5f05-44ae-b7a4-0b60f3c1e90b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 32830e7d72f175a8155c1997db502b8f6cf3b31a49814ab76976e35a3b6cc5a7
MD5 0c52d953ea9194d654aba63cd44a7eea
SHA1 31ef3d50e4fbebe2f614cce326d7ea7531eaab64
SHA512 2151546ab8d6c45b6e7fd7fb4c3a685812a1c35ff8248ebd84366541e5134839fe96d546b9fa5d14438041560c1b2be1fe04abea8a7133a821d19be123b3eda7
TLSH
T199412858BBF91148B3B76E5AAFF6A86E547BBD772E06C55E00110D4F0622B40C872737
MD5 SHA1 SHA512 TLSH

Submit Download