c031b6e83922df10f948ddfa5667050ad9f76c64f72871ab6435a29e1ca81178

Analysis

user interaction
yes
max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1uiSr.html
Size 70KB
Sample260425-axtmfaf19m
SHA256 c031b6e83922df10f948ddfa5667050ad9f76c64f72871ab6435a29e1ca81178
MD5 f385d7852c612a4fb7e537dfbf3de73b
SHA1 b277e581b4caeca20821f365cfec64c35441f6ac
SHA512 d1fb81eb0090b9ce5204a6463a6118c567ff2ae7837b531011765544b5fd68ad8af217ba322a59c9624dedd4446efcd9d956f1e71f75d918ef01498f24d2d502
SSDEEP 768:O8dhfCeFNjHrCYNr0ODTmd4TS9KYhQ1XAs3cHqrpo2tD9gMhZpad/zshuML8f45G:O8dhKebQOmaTcQzsd2t5dhZwd/z06p
TLSH
T1ED63E78B3ED6B86B032324B3241B611FF5A61807FD49D054F2ED2881BF69F498576A7C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\sechost.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msvcrt.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\DWrite.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\oleaut32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ucrtbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\sechost.pdb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4592_842454005\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4592_1841623571\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\DLL\kernel32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\dbghelp.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\exe\msedge.exe.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\msvcp_win.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\ntdll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\ucrtbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\rpcrt4.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\winmm.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\ffmpeg.dll.pdb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4592_1841623571\smart_switch_list.json	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\kernel32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ws2_32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\ffmpeg.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\bcryptprimitives.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\advapi32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\msvcrt.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dbghelp.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\dbghelp.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\DLL\kernel32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\bcryptprimitives.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\DWrite.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\msedge.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\msedge.dll.pdb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4592_761616197\manifest.json	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ntdll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\DWrite.pdb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4592_1841623571\manifest.json	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\msedge_elf.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\advapi32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\winmm.pdb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4592_842454005\manifest.json	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\exe\msedge.exe.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\msedge_elf.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\msvcp_win.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\bcryptprimitives.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\advapi32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\ws2_32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ffmpeg.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\ucrtbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\combase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\rpcrt4.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\ws2_32.pdb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4592_761616197\protocols.json	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\kernelbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\oleaut32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\msvcrt.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\sechost.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\winmm.pdb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4592_287343046\manifest.json	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_elf.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\oleaut32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\combase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\combase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\ntdll.pdb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1252	msedge.exe
3148	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134215510046751069"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714754311-527593155-1440850301-1000\{B8B1787C-F746-4914-B6DA-2D8BD186112F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4332	chrome.exe
4332	chrome.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe
Token: SeShutdownPrivilege	4332	chrome.exe
Token: SeCreatePagefilePrivilege	4332	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe
4332	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 520	4592	msedge.exe	84
PID 4592 wrote to memory of 1252	4592	msedge.exe	85
PID 4592 wrote to memory of 2964	4592	msedge.exe	86
PID 4592 wrote to memory of 952	4592	msedge.exe	87
PID 4592 wrote to memory of 2964	4592	msedge.exe	86
PID 4592 wrote to memory of 2964	4592	msedge.exe	86
PID 4592 wrote to memory of 952	4592	msedge.exe	87
PID 4592 wrote to memory of 3596	4592	msedge.exe	88
PID 4592 wrote to memory of 3596	4592	msedge.exe	88
PID 4592 wrote to memory of 3596	4592	msedge.exe	88
PID 4592 wrote to memory of 4312	4592	msedge.exe	89
PID 4592 wrote to memory of 4312	4592	msedge.exe	89
PID 4592 wrote to memory of 4312	4592	msedge.exe	89
PID 4592 wrote to memory of 4600	4592	msedge.exe	91
PID 4592 wrote to memory of 3700	4592	msedge.exe	92
PID 4592 wrote to memory of 4600	4592	msedge.exe	91
PID 4592 wrote to memory of 4600	4592	msedge.exe	91
PID 4592 wrote to memory of 3700	4592	msedge.exe	92
PID 4592 wrote to memory of 3700	4592	msedge.exe	92
PID 4592 wrote to memory of 1512	4592	msedge.exe	95
PID 4592 wrote to memory of 1512	4592	msedge.exe	95
PID 4592 wrote to memory of 4364	4592	msedge.exe	97
PID 4592 wrote to memory of 4364	4592	msedge.exe	97
PID 4592 wrote to memory of 3288	4592	msedge.exe	98
PID 4592 wrote to memory of 3972	4592	msedge.exe	99
PID 4592 wrote to memory of 3288	4592	msedge.exe	98
PID 4592 wrote to memory of 3972	4592	msedge.exe	99
PID 4592 wrote to memory of 332	4592	msedge.exe	103
PID 4592 wrote to memory of 4820	4592	msedge.exe	106
PID 4592 wrote to memory of 4820	4592	msedge.exe	106
PID 4592 wrote to memory of 5104	4592	msedge.exe	107
PID 4592 wrote to memory of 5104	4592	msedge.exe	107
PID 4592 wrote to memory of 4044	4592	msedge.exe	108
PID 4592 wrote to memory of 4044	4592	msedge.exe	108
PID 4592 wrote to memory of 2128	4592	msedge.exe	109
PID 4592 wrote to memory of 2128	4592	msedge.exe	109
PID 4592 wrote to memory of 5100	4592	msedge.exe	110
PID 4592 wrote to memory of 5100	4592	msedge.exe	110
PID 4592 wrote to memory of 4364	4592	msedge.exe	115
PID 4592 wrote to memory of 1508	4592	msedge.exe	116
PID 4592 wrote to memory of 4036	4592	msedge.exe	117
PID 4592 wrote to memory of 4996	4592	msedge.exe	118
PID 4592 wrote to memory of 4996	4592	msedge.exe	118
PID 4592 wrote to memory of 4364	4592	msedge.exe	122
PID 4592 wrote to memory of 632	4592	msedge.exe	123
PID 4592 wrote to memory of 632	4592	msedge.exe	123
PID 4332 wrote to memory of 3500	4332	chrome.exe	126
PID 4332 wrote to memory of 3148	4332	chrome.exe	127
PID 4332 wrote to memory of 1184	4332	chrome.exe	128
PID 4332 wrote to memory of 1184	4332	chrome.exe	128
PID 4332 wrote to memory of 4792	4332	chrome.exe	129
PID 4332 wrote to memory of 4792	4332	chrome.exe	129
PID 4332 wrote to memory of 4684	4332	chrome.exe	130
PID 4332 wrote to memory of 2096	4332	chrome.exe	131
PID 4332 wrote to memory of 4684	4332	chrome.exe	130
PID 4332 wrote to memory of 2096	4332	chrome.exe	131
PID 4332 wrote to memory of 5132	4332	chrome.exe	132
PID 4332 wrote to memory of 5132	4332	chrome.exe	132
PID 4332 wrote to memory of 5304	4332	chrome.exe	134
PID 4332 wrote to memory of 5304	4332	chrome.exe	134
PID 4592 wrote to memory of 5896	4592	msedge.exe	135
PID 4592 wrote to memory of 5896	4592	msedge.exe	135
PID 4332 wrote to memory of 5504	4332	chrome.exe	137
PID 4332 wrote to memory of 1508	4332	chrome.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1uiSr.html
1⤵
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa4b06c188,0x7ffa4b06c194,0x7ffa4b06c1a0
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,11606262288181647213,3414109127617331026,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,6221159017903585227,8644949113980737552,262144 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,16609239287930444779,5228157556906850776,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,11468680615881291646,10830211008275280386,2097152 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,15343592906101092425,2358961523877993625,2097152 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,1198588839899658389,6136581878392791855,2097152 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,13161319812380229508,501367920657341628,2097152 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:2
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,16424706530755989087,10187138572883417079,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,16416398771035353923,3584114124072041939,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,8213848806160113835,2196599533315730288,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,5930515389348230930,9485803054345116858,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,1058978858673865368,9954159991964074436,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,1058978858673865368,9954159991964074436,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,8870811055887960145,7519968330290333404,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,10361560128654463165,16315480582982698579,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,8731543288939843079,12955191922898074574,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,14817343152725623994,328766692354550853,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,11421698562819636576,6944911418135365360,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,110095673690505366,7269848687492947633,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,10045133068621804269,14828325855172763946,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,10421694705312319115,12807203068593958810,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4616,i,13163629639790034142,10144307907679310603,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,8959513006547731747,1563573327612045949,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,8959513006547731747,1563573327612045949,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,5990726512511337295,9628688116653205441,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,7155935526326445604,9078664755897346059,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5816,i,7143746885261003984,7419316890585201867,2097152 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,15407922078221951276,13178288854663961997,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:8
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,6407319892134922340,2079976946168184831,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6504,i,6907782656707882895,15913156140168205590,262144 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5848,i,2280169026371241953,9021906149985599158,2097152 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=3756,i,1964276341845052639,14614148795979415098,2097152 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,10068854008443293862,3285571618491461953,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5508,i,14584373253139606293,17552778184617871374,2097152 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7080,i,935027005338267006,7184936649105234321,2097152 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5236,i,186019611168365064,13522750984443593233,2097152 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6392,i,10036578524515597509,12149877560503903282,2097152 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,9828194934735310168,6607459431121794871,524288 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=6540,i,16870349657914587383,14733604617996649411,2097152 --field-trial-handle=2328,i,8131262592247379747,14596702855541399809,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa48e8c728,0x7ffa48e8c734,0x7ffa48e8c740
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,2603913805519629472,11937467116119163004,524288 --field-trial-handle=2064,i,17476577666827808788,11633863904274121339,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,7789850250533373271,17228283046552180369,262144 --field-trial-handle=2064,i,17476577666827808788,11633863904274121339,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,5666554014959039731,16546701542306825251,524288 --field-trial-handle=2064,i,17476577666827808788,11633863904274121339,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,6464671792739919684,8908268182108034550,2097152 --field-trial-handle=2064,i,17476577666827808788,11633863904274121339,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,5866777786572986895,757532809818447495,2097152 --field-trial-handle=2064,i,17476577666827808788,11633863904274121339,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4364,i,17068428168501387833,18066998513967050724,2097152 --field-trial-handle=2064,i,17476577666827808788,11633863904274121339,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4376 /prefetch:2
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4792,i,15102310488302550501,236681276160140372,2097152 --field-trial-handle=2064,i,17476577666827808788,11633863904274121339,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,693715339011845441,1747550843325274195,524288 --field-trial-handle=2064,i,17476577666827808788,11633863904274121339,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,10282781451658242833,14774542678073201051,524288 --field-trial-handle=2064,i,17476577666827808788,11633863904274121339,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,1389965248687606096,4843596348216180294,524288 --field-trial-handle=2064,i,17476577666827808788,11633863904274121339,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:4480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4592_1841623571\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4592_287343046\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4592_761616197\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4592_842454005\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7000b89158351462a92bbd14ab2798ae8ec7c4b16001935804cb74f436241301
MD5 7091da7970c25dea318444a1b21e08f1
SHA1 3338868fbafec52fa54737eab6e328036a510c90
SHA512 bba2f99d5e35d2981236dfb8869c35e91f2d49fd390563a2f469913f3d141c5d9b62fc9129fe773329081adc871f0d82bfc42018e3f34d8a92086f735ba03755
TLSH
T1D0518DF793E48A7D851196E4AA246F2FCE6D0924131C3C62C9D4AF5B43F2972D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 69b3a486f0cba71edc07f3654a980a39923b52be795e4f557da5e7f3c00fd735
MD5 f8717b505dc40b90e50e038a64cbcf3e
SHA1 37483f1f8ac5b536a06f838f2dec550bc7b245c5
SHA512 de16f89c3b364ab60760832e4d8ffa2d11fd043104aa7206d9f3a31a05f061ee7ad667f3e21f10752c9e06053b886956c0b32a8c88135a43a2e3404f87efe723
SSDEEP 192:7YRndQLEJyMQyInv7rhAPRp2m98Hsb+WNnL40wSa2Xm0kwWZav+VyIsnAUge:7YRnKxvH8XF6ws0+2DIav2e
TLSH
T1D642E92EBD14387B8CDAC229F9297757D7F6102161843E88EAFC8A3C11E76CD6117057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 03973a25da0021eab19b8f1369a5523343654f3887234a1e1cc301245a48728d
MD5 e96921d5ae30116aafe48367f7ac6695
SHA1 c6641ccac61c68d82ff32eff425c15feb5074091
SHA512 7547cbfa0fc206b66f70451b792b574afeb0e98365fa6e0b5000e8553976425c99b5d9d4c5ead0b18d87bd8ab8100bb185fc97363145cbc0d2cc4cf9b3e8d865
SSDEEP 384:MajIf7KxkXqKf/pUZNCgVLH2HfgslPa7pLuLcifqrXODID+ErU36SHG6+AwTlTNv:MKIf7KxkXqKf/pUZNCgVLH2Hfgs9a7pb
TLSH
T1A1720B777C4C9E7B0F94C6C8D8167E4FADB6024A65DD886482FB982A03D4BCF114A1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6d7b1eec26bd6f63070f641d031d3c4db76167950d08a07ce7496e10068d3bfb
MD5 3419b6df9a2f0052ed822928e6ecb7ea
SHA1 d0d481528e597bb55facc9613670b633787b026e
SHA512 a9a5c99c396a8f3d464155e5ec65c1c6242441980641ff3782642516c7d9220191a77d4022c6c3733b922534282a07c53158531b6d4ae7a800b853b17db9c3d9
TLSH
T1E6B0125090029522E04702B5118304D871189F119B0D274163E07AB2D8261B140391D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d1cd.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59d1cd.TMP
Size 96B
SHA256 3e7de5a1f293a790c829629086189d7c14288adb7f237993ee08c14dc35b4f2c
MD5 c756383615ffa5b87ec911d8650012e3
SHA1 1465ea3c6d48f7c5df1368a877a3a1dabe9e90b1
SHA512 ef20a7b5ed404ffadcbe1db938b188ddae182c703254fa308049183a47bef25c367ea1f8bc9bd0072186101a21fbbfa61074c92c1ac262ba9a444e7ca80895e3
TLSH
T1A8B002A5C102F352D08303B029E7D5E97160DF67DE43571AE2E11A76DD3967946261B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 79a6150d35526da21b0e2e36809721f674a028ceded55d60f5051c7d5cc351f7
MD5 f9491368ba5b3ebcac567f26205bc726
SHA1 ed2d44cee05dd2bac4a9244bc26ff8277f027f99
SHA512 a5e0f10db22c54329cadeb2279375520234cec4699e23dc283ac6cf82d8498a98515e8ee7c98e96582f16c2043a540ded2f788c9cbf5562b521d51907be1f85e
SSDEEP 1536:gUcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3b:F3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1189302BA5E2A46E7957E469176AE7809CE12130D709FA8CC316C639C31D01C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 9dd63349ae67f6225b9cd262ad1614058676bbb57601fe67506309f552c2d685
MD5 b36516df0a773dda74f674467349ad44
SHA1 12ccd7d43ae7c7bab1907f24002ba5913ce41241
SHA512 ed803b00d25b328cf81209d4c5147ebfff468e0db5a85287905f8f9f1ce9f61927a9418daedcab12134292d75bd547a0347d8e0bc45c1ec3478a3f92d16d57c5
SSDEEP 1536:DrKcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEi:i3Qw/xLANk0mUW5GmRntSFCjEENE
TLSH
T18C9312BE5E2A49E755BE46D1725E380ACE12130E719FA9CC2268538D31D51C92B73E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 1eb7b5a874deed2b568ca2c8c06e44058429d7ec315bcaaca67cc4e6f1c60b39
MD5 b90386457b6678be2016cc0c929567ec
SHA1 1b60919604492ccf3308a62d849e2543091b54ef
SHA512 681862c4352cefef55360d54d76eeaca424429e9f91c378eed29d4bdf02bbcd9aba454f86bc779016dba1ae1f401d80d2b10422a0323b8e335b29a6904093099
SSDEEP 1536:4rKcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEi:J3Qw/xLANk0mUW5GmRntSFCjEENE
TLSH
T1449312BE5E2A49E755BE46D1725E380ACE12130E719FA9CC2268538D31D52CD2B73E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 efa63c38b6cebf121c1b544e83e7bcdca31f8061ab50748b05bf759dfb866380
MD5 7de741ce92d0e4f1075a1eff32697c0f
SHA1 5025dd87aa32005ce760e444eb3e7a4609448af7
SHA512 b179373912d6943d6d66509c334f96fc7675f08e847a3b655219932e4873cc146fd4abb9e5460976fc4d976a4d49ec5ab7eb9f97b299d48551fa965d54bd37c6
SSDEEP 1536:4AJcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEi:t3Qw/xLANk0mUW5GmRntSFCjEENE
TLSH
T1239312BE5E2A45F355BE4691725E7809CE12230E715FA8CC22A8538D21D42CC2F73E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

c8fc991b-ab2b-4c45-bc44-5144b4f39f38.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\c8fc991b-ab2b-4c45-bc44-5144b4f39f38.dmp
Size 736KB
SHA256 487cbd4d4d98a011e22a9577e537f3d9f7316af12ae828b1917283ffabf5178f
MD5 9a026d5cb5114c2790df2d1dde30df25
SHA1 f592ad9e8d3b5ab4640e314f76b01db98f5d3a33
SHA512 6a3b19fe1cc9d75951aae7ac29605432ffa4aa47edff0333bee633f99510a72f2901d94eed1b2451231e62b1e0e5843d6ab98a1394d4a0a94406e9076cbd4af4
SSDEEP 768:k9LMsijJOhPTJVpT7hVFdgI/bWHqoz4THJK21lg:kxMsJJVpFd7bWKrK9
TLSH
T117F40D47E7994CFBE0188B3116E7A72277F2E5A84BA2071F5211417A3D6B3946F34F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 329f09584b2d1b595fd09386d31dbe1eec1906f7d450ee40fb405617035e9b3b
MD5 c89978251aec9d90daf9a199726976fa
SHA1 72d52e478c5ea1ddaee134eed8228a6bfada9c3f
SHA512 898671bc521bd5dc24824557f42f33f18007179c03133a4c176d62af1a4afb01dd96179fb320915cfa4fc4d3e62c77cc770436b76ebeb4b092c4a313f9100f39
TLSH
T140D0228CC300A820C3CC88B220ABAB88282AC820820282082CB2080C2C82282300E082
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b04489861797cec03fc7404687d31ed4755ebf931038495ba158cbbf77e5994
MD5 8d5497a0d6d631f289ddce3b8713b067
SHA1 e9a86741ddb9ad11d98682073f961e7ab3f714c3
SHA512 509da8d02aa51e8910b1998ff4f2dc501dd78e46a217b34ab4cbd3c8fb5b35e21fc44077baf2fceb5ca1c6a95e4d892ddf87e1a0c25401516589fa338e6d3d4f
TLSH
T14BD02374F796E005C32C00735562D291375A850135938454F45D845DAC683F677D84C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 34KB
SHA256 d27f23c77e9f765ff3b019a8016c04dd8ff4cb4fd2592776283adbe2c3a7f806
MD5 237b4fec77123003fc35c0992efc1a1d
SHA1 1c54b71cc9c55929c2d297f963e4fdda1fb35226
SHA512 3388536be0cc74f5bb77e64723a2908003f382b05614f15165eada4fc25f2d605da6a003d9337b88f9ff16c42e6424a899e52c47954f3df95ed68aaf24b8fa20
SSDEEP 768:tGKnhTmzHW9mqMmKHGGAzrRubGexo7xh5AmhrF01n:tGKnhaLW9x8GZFuaexo9vrFC
TLSH
T17DF2F14FBC2176ABA6BD6FD005F3015796AA2C86D1A3308DF3EC591C5216920A81FF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 99KB
SHA256 45d8164d2e22711378970c1b6d96ebd90f0d0514efb2de35b7c702f24b4f1ebe
MD5 1e9209fba915a260b9f6dffb968ca03d
SHA1 f4a852b5cb5cca01d3841be3d4f46cd86c7d2289
SHA512 d094724bb076323551aace44393f7e91ba96fac228b40be3da977b1087993613d069da938af4255367ac0ca220602e1b36769cebc70b3c044efcf132f2086d37
SSDEEP 1536:+v3mVu1fGdCFKFdom3LJ7ap2/iAVUb0ExyHeqrftYFuMVdJqruDhr87WmDtxh0ji:gSWu5Fd34RAyRqecOF4yA7/DtxAzyp
TLSH
T175A313DA89012E0CC25E39E3D17D7E2AAFBAE7750E527C8981EE87C48580719F21CD35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 66KB
SHA256 44618c16ca7c0d04916cb86443597ea4e6359626f411555c338a130c4f1e22b3
MD5 964bfd0b1b9434085fd1723a1a920d35
SHA1 641297ffc756de83cb06c40c6def51a59a7663f4
SHA512 b38d1ebebb61a96bd5d3d8d18f87ac73a4840b70b255f6d12a1123ea2eb226986386c58413318a8ef6e438592ff4aca1f33c291e36dde9dea92662d7d99aa4b7
SSDEEP 1536:NdHnpqrRq8oWQ4mKNewdUVYPsiEr7CW3KvSDtv7nXS0bRNoYKP4kbdvGy:DpqTwPT4UVYPsR7n3lD5OXYKPfky
TLSH
T1CB630257EC5C750A3B6F391049A4124A8DF60CAFCD99CA50D6F9416EEC335F6B2D8072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 402KB
SHA256 88bb04a2574ddf71f2c2b6e8bdb47105067736a37a8d48cd502caeea75435692
MD5 c76b60ebadc129b2faf964bde4ff35fd
SHA1 f7a2b20def7460fd3a0f67940e7a2dc854ac6f8a
SHA512 7ed36ca2c482cba8c2c0b6999e505fca093c758131e9f866967a948d4d0e1626a3e3de40906c83196b27161c24aa5dd34638a912eefb6992be65a79558283cac
SSDEEP 12288:NsUOHoY+wRFp8me5of+EOUYpVOXfZqUZw9MN:NJ1wXp8mZOUYpVWBy9i
TLSH
T1289423FD5B13D580F810F3CC7A7C5E38EA690B49D93E7208D099FD161CB88AAD1196B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6
Size 64KB
SHA256 6e13482e6bbea976d4ff0c846996762216c1d4eee7613fc94d0bb5f9194bb57d
MD5 7d6b352229fca211c83b4fbadce2538b
SHA1 cfe0b4749c304dcc2ba846c7f86f21b1420c2449
SHA512 f9441966e117b8c2cd56f43643b1e37aaf0ab8c064d4581c51acca57e07ef1259420f30c2061b5c91bc73e53a07f86c49cfed7a8e292afb8860ab41186603c95
SSDEEP 1536:YvFEcsTFnpavfH4WaFzcMFjBMkBJAVgrFkIClBu1exxxI3O:IF8hpanYWozQEiaF1gQ1i
TLSH
T1B0530243FC24806462EF02F4BE69C73F220242C129F15E38F5A59BDBA955AE36476D90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c7
Size 42KB
SHA256 a5e6b1ef5725bb114c069895263109fbbf5c019208cc5bd40b9c6f3aa0434980
MD5 c2fdf6093ee73bff5915a0c976f2a42b
SHA1 93dc82fead1e8211fe1565d8e2c74d7ed85b279c
SHA512 6a0e8fc4af5f13df5c90f0e564a61cfa443911f93a711eb33d02857e735544d116b0c9ae402056222d71b131da815044bd91fbc8f2f1cdde6a26121188ea98cb
SSDEEP 768:Yq80DPWJS/wF6bcvqCFzt9zsVPaXwCEyrlpjYqTGN2bWnPgubO:Yq5DPWJSQAcyCFzrzmPaND8qTS2KIn
TLSH
T13C13E1C3C22854A9B69FC04DE4A956F32E310F47457690364990CE73E7A06AFCEC5E8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c8
Size 37KB
SHA256 fa2aa67d5121893dc99411c58053ee8844fa176f7fd6ef0eb14d7ab97fb91a59
MD5 dc6cdcf09480ecd7373bdee6ce55ae0b
SHA1 b7563ae556c2362dee48b263ef8b5952008ac536
SHA512 eaba7be81389394eab26e5a26837f59066a21638987105256061d4e81b97a7f8309a91fdc1e1bb62ad2f52ffd580d0ada7bffe39f73be80502be3088c9efc043
SSDEEP 768:oS/nsbJk1KKTxaGKsdKRUurX6iu9ADGvawLO0WDmmLgcimyLJMR42q4vIuDOA5:R/sbJCKI1fKUqWO0WSmEcVyOY4vIO
TLSH
T1C803F186FE1B2B66E05F8D7918E5E0CB1DABC505FED201C7C25FE212422243386D2D7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
Size 20KB
SHA256 fad35d4a250f46736ef2e8da90f28fc3ad1a56850e2428f1ed65e3c11f4230b6
MD5 ceaedb43b7cc5e95d1a19aa78491025f
SHA1 fb3539017f2c94c2a423e5cfea1cc6e2eee47933
SHA512 7a409119fdc0d3e6e1f7cc601b9b0d320852fda3da80828cadefb2616eb65a98475d1a82c725c1f8da79e515180d57f0cf19ad73d6cb56c19621f27ee17e35de
SSDEEP 384:tCimFXS3sHgmjowhQr8HWuNJjyN86C7nglw4Nf79O9ytVH+vauY:tCiWS3svcqHLA86Jl9Nf79QbCT
TLSH
T13DA2E002E3D7F78426AC25E7BA4089E0844835585748BA8E1227F15FFD7E5BC8BC6325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ca

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ca
Size 31KB
SHA256 25e792e7398d9f1249aaf6a529f501a91dc4c4dd732874e07cb933a84d9fedda
MD5 bee4a7af2f02dc4bbdefa4ee72fe1c0b
SHA1 0e959eaa655f52049493c754941592933ac66b8f
SHA512 a72dbd3dbe99f0b0432960ec25e49f9d13181b221c20cdd2f21a4c7a6c7bdba6ed740e51b5a9369db39c5b6ff4f713dd5adc872cf5197a16677445e67d741dce
SSDEEP 768:/C/wGz6+9WzDuxSizJgiu/9mDs1xZXmnUnW60fMqi:KL19DSplv1XWUnufI
TLSH
T132E2E08289D42B4ED901B8CD40075E1E9C8D2E9D87EBF49B86F96714627E32C158322C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
Size 20KB
SHA256 610f010fec8dbdedc6416a8a8aff247d059ff6de57722fdb7b9205f8eacc2eba
MD5 59ea12bdfe9139e8f6ff975b4aced53d
SHA1 c82a65e49e6cba6e05f2e8e366860cc1d4d82376
SHA512 3b6c0ca691fa473f5c4da0a2f5c1ffd79a8c309ca6dc1f4c62e0370573ce394c8641ce421b77a17ae53477c57bb88c6e10e57997a173a656d56ccf8d3b376cb1
SSDEEP 384:VdqIjEU/ft3n/6BRURw+VkQG5LWAFjvqbtUPaCBuj1g0P6z6wxesxBi/2vyHt:vqEz/ft3KmRw+y5NCBYxBuW+Ejo/jN
TLSH
T14992D146A6B155CC7169BBD46D5C12BAE067FCA740E7A5090CDD2FEF24B78904C3348A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cc
Size 24KB
SHA256 83d43c09351fd0205b135d8134e888512529015a5813d887362d85e1dd7b49c0
MD5 a0e2f48c70f8b4d98c3dd3a7d8822a3d
SHA1 7bd5675df9646c12557d38ab80ecdc98fa7bf348
SHA512 23ee731e066efa4cd04a58a113a1b383f2ff46b08e5b437dc7f4223d93a9170f967b22c194c2f8fc05d66865ea7c29e2d5054acdf36dfd87964f92161f92b9a5
SSDEEP 768:yTr1x/aY6m5JZ5G3imv5DEEuMm342ngPP:01IK5JvG55DEExR3
TLSH
T1B1B2D114CEB8262CDAAD04D2ADB45AFD2E1D198DBDE83C5B1E65643D30A16B8301C39C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cd
Size 42KB
SHA256 0f1ef3bb65142e2f01e60382ffa7e132e2b7072f31e70cd42a0ff8b5be0a3d4c
MD5 9aa5e347e6a25858f63fd890de15ba39
SHA1 6385fc09bc41c494f8337ad5668d80e45dce7cd9
SHA512 e304d338e95db94987bd4a63017882df50cad5d0f486c20f9cd9ff2c7501f92ff19b4baaea5b2f3d48cd9b7942381297696caeec9e86d06f9a61e1292d250a09
SSDEEP 768:hIvFiUjWLBpU4QYRrec2oJH5OsQrUp18GDOoMASk3xUnfHfoKy/Td:CFHjqPFH5BQrUTfDOof1WfABrd
TLSH
T16513F1BDEB5FF9F1EF2C9EC2BE153D9027EA262D54609443671CC058A03D2D07642260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000df

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000df
Size 47KB
SHA256 d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0
MD5 dcf31ebe107435bd68e0164d59e19b87
SHA1 b68160c9333af833fe483928b3ef7128c07a56a0
SHA512 130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08
SSDEEP 768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE
TLSH
T11623F218F29471F7EDECD4D500A18C72BAA528D442F116ED07B8D53CA36CA817A729FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d5c60ae099669511559847f97f107254514ee2bdf7e7544793cf067a751fbf84
MD5 b7c5405949f4e00d05343f2603990dce
SHA1 154ce0554217d6129eaf94c19cb52cb0e9e94a05
SHA512 9fba955c7dc6d4ab86339271ecd153bf562d2582638206299d72c77d8a50ba9288ecd1883b8de44fad7c2b553e139f138ab41535e4f39e58244cb484afe2bf59
TLSH
T15E61D84B836194EAE3E411B71EF969797D3883E4CA1B2E253EF4657F7801F11D084AC2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 19f28acd23a0c0550172b0457991834ba5eb70df42b286725cfc8f025770cb1b
MD5 c398f2c3e0a4f4e01384d089b05815c1
SHA1 42f02fe8821ed0f9d69a86144de503d1f13774e0
SHA512 c9bff8e94e1c8af52ebd4fa8a7a6a40e4589d9085dfce1f02b0202e368a519ad0661872566d75cbab7de6fd403ae869c3a3bf66db4fa72b926c0b8f78581f635
SSDEEP 96:DuOsMzJ2TUyRzhOzx3AHCZEKP1VbrpRQ3sjGwBj6ql:DdsMzJ2TUyRzhON3AHCZEK9prpRQ3sjz
TLSH
T15FC190BBC2D8876D881256F1AB297E1BCD1E055A82383C56CDF4AF4F63E2570D10269F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3cd302c132816e6f7ad77eb2bbb9b91fb23dcdfc8766218b57ebfd7fdf9520be
MD5 cb3e1997d1d94ba3a14f47708ae445fb
SHA1 36ba05d9ca2b85b37947aabcc025cdafa806ea17
SHA512 4b43e5b4ce2cc97f88e88a7b9c9183dcb8acaeb56d8ebbdfbd982a7acb9213a33733cacd7cdc6c4626e5d03aa960bc019c597aa5a11502d4e0d0ac4ddf75e51e
SSDEEP 192:sxZgRYyM/jK1Ml8Mkg/fqs5Q+LlWIdpdRHW6+WNGSN1QWzB16Ig4J:sxZgqMg/fqsC+1vHbGLc
TLSH
T17152F8166A34597BCCCBD209FA45BB53D7F54473D2940E48AEFC9A1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 612091f23300b4a54a95747f2105337b01485299910e9db4f60f1e897ec2ea8d
MD5 ee12806cf5f8d9f07ec04efd6bad8901
SHA1 d0f6643f83dae25d161072e9aca37029d65efe48
SHA512 568184f9c3dec2a7a267e00cd23509d62db21f90ca9a8a17e8208991bbbc1561299f6fb18e38e8fc0d52bef050a70fee84d470c46dbe14f809d44de1f7f4e858
SSDEEP 192:sxZYRYyM/jK1Ml8Mkg/fqs2QQrLlWIdpHRHW6+WNGSN1QWJ6u6Ig5OJ:sxZYqMg/fqs2Pr1xHbG9U
TLSH
T15362E8166A34597BCCDBD219BA45BB53D7F54073D2900E48AEFC9A1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 7da49ab98e37f9328afe46cca3f7a979824e060699aee70cb48e7b616da7b029
MD5 55d5cdca66f584bd08add221bf270f16
SHA1 756f6d968901d201fdbc00f8fed072f2b7be633b
SHA512 ece466bcb6a2194bdeb6579995a202bceee6277f82e138d564c81f121e90354189ef03adaea2db40c6aa4a889332b02fd43ee3aa8e2b551b25a1e584a702b29c
SSDEEP 192:sxZZQUnPRYyM/jK1Ml8MWOg/fqs2QQrLlvUbLMdp4iRHW6+WNBLU/SN1Q6/4u6I0:sxZRnPCuOg/fqs2PrI8jHb+/dSApiop
TLSH
T13092E8166624897BCCC7D519F9257F53D7F80463DA940E4CAAFCC90C04EAAFD261782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 361ef9a6edeef28c47d1aff8f7c585117df5192ac112828a23f431096c40bbca
MD5 f239586329a5592be4d385ab7d455ada
SHA1 93af7f1103e0b350a6b7a7498d9d44604e64c7b2
SHA512 d88e8e7245a5bc7fc43029616dddd27327197c5ebc84ff773f9b86198c353687e7c2252176645007de35d61206c53100eed9df0225e9002e3501968551dfeab4
SSDEEP 384:sxZRn0Cq2g/fqs2PrgwMAHbWL/GuSApiop:s50N2g/fkPrg6Hb44A/p
TLSH
T10DA2D857A520497B8CD7D519F925BF67D6F40063DE940E8CAEFCC90C04EAAFD260682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 cdfacb034f719ac55dfd48ad3e111704ee67a81d3cf823864571faf7f65c5fba
MD5 d26409665a206acc69d469ccea5b504f
SHA1 4b6595969e14b6a9d8b5f6e24bbd2533eda36108
SHA512 dac99aa44625afc8f3f35ada5decf53d6fd947ed43bfdbd8769bebdeeebd282804b34b43e1fb079521b1aafd4ae1c1eacaa2e4b938ead6777a16bb88c26d78f2
SSDEEP 384:sxZRnPCqhOg/fqs2PriwuRHb+/dSApiop:s5PN8g/fkPrizHbE4A/p
TLSH
T19F92D6166620887BCCD7D519B925BF53D7F80463CA940E4CAAFCC90C04EAAFD261782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 00d13c84401dfbb7f7b70c0d6a3040f66b6ea2e7eacd9f43b0185455635eb072
MD5 ef0b55edaa78f942a1cab370ca3da830
SHA1 b4afe34c042861b5feb5564f0147c0878697c61a
SHA512 36afe57415945cf18a04d18fc94e1d3f52522372ccf8199a5e3d3e8c5ae23f1996fec281d32e39877b263cfa83481590c719d0aaa8b0a13e06106c78e3935dc2
SSDEEP 768:Fx0G9L/7pLuLnFJWvFnSP8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvS18LlSMdF2ro0:Fx0G9L5EnFJWvFnSPu1jaqS18LcEFNCJ
TLSH
T1FBF20A3B2C0CCB7E4F844E9CEC2A7E9A6DE8018B96DC895447FA844C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1984ab13-19e8-485c-bd56-a8d56b72a44e\index-dir\the-real-index
Size 624B
SHA256 b6223b383458602b5a9a5350264723f4b3f361dad7302fda5ea95ee9c0c232d6
MD5 a9af1f0a599fc1992d21dc0bb77307e2
SHA1 2f781283c8c28c60e807fdb32a02185272807fe7
SHA512 438c709ad61aa9417f4071872f13b549067033a25d5c327beb5691e852f0ca4b20215d7ffcffd28966f83e0d7a56812707a96671daf27ee5b4e3693b5da54a2c
TLSH
T1A7F0DC68DCE11D4BE89351B460B69677332489CF8848D30B695CA6AA0E0B5D2A613205
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1984ab13-19e8-485c-bd56-a8d56b72a44e\index-dir\the-real-index
Size 2KB
SHA256 1f8631409548eac0689b151bc115779ea32ee93bbec2a84ee77220051d0c9e52
MD5 5590241f0752e36df30dced4845f8e38
SHA1 2c9305da6bda30c50b85f0c72f99455174b4e540
SHA512 5b4289dbaee86091b7958da5a6e04fc2872242ffab043b6351db251e2949c4c17202f864f9dec9deffb2ade3eca2dcc2f7f60de7f9459eac9b9f734048e849e0
TLSH
T14851D48CCC494FA0D9A910B20CBB28A6337118CC9ED80A6BECDC4CB034932790F1E616
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fbcb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1984ab13-19e8-485c-bd56-a8d56b72a44e\index-dir\the-real-index~RFe59fbcb.TMP
Size 624B
SHA256 34c9ba0d1b76d8baac763cb7c423e027f328ea7a253a0b31fca6b155adbb60a7
MD5 9351f8f1acb1ba1f398afee9073d7627
SHA1 fbfc2068148666a560f20e363e5f2254acacb402
SHA512 28c82c86a688cfe4f90b871ab6f4455306a80d21e8b7f6b6abc241ce368837392239c961746ca7bc751bb8c8a15fd5fbae4c24e0f4237858aa6897f6a0360fc5
TLSH
T190F0236551D41D03C9527134E08DF0973322D48A4850C60BB9A48632DD8B2C05912144
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a76e37c7-8440-4a48-a1ea-253219d8f42a\index-dir\the-real-index
Size 72B
SHA256 5874cffe665113cb9c74f36e1146a6c3ad053ee143da0e01417d6e0119d77b72
MD5 d364003a5d0e885dfd7560f68d90de46
SHA1 9d8fbecef48d2c3fcf75893867b0537a27beef4d
SHA512 5682140fe4ed916216d4dacfb3f2182a3f48f0dbf847a9b0be2801b0da38a3d1d91e2d310e8fb42347e8f8b34097769832e62b45a4931b7e07d960f99617978e
TLSH
T151A0022003C02045D01316B15F52024133018D112B402A0751D10048CC98943655225E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a76e37c7-8440-4a48-a1ea-253219d8f42a\index-dir\the-real-index
Size 72B
SHA256 207d1f7af580149f6a43bbd62b2440b65c83cfcb0096cc9e726a9be97c4807c5
MD5 677f969860c39fd163d98392ed38bef4
SHA1 44328e78c15111c3eb1a234b37fc0061928221be
SHA512 dea6685bd56265df9923235c1b3207ec0e06d05d67f77a83e7ca7b0258035b3069983c55b0df793cfea171f4557795f97cff2411b7f379ab1eab2c2157dca723
TLSH
T1E4A002261B976611C1171EF0F69653463311EB111202170F51B014C9CC646D55E4104C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 1b61ad793224617802f117ab30768b476aaea93750c2177c4e60e4808d4e72f4
MD5 1cc08392e75b5e6239fa27cab90e1b7f
SHA1 f5694323a0ec58fff90055987c10aa5ec529fa22
SHA512 b81024c3a4e59b50f00498a7fd1687e9e490832f208faab4fda345adc0ba64f70da844f5c8f13909960957506ef5b433c3ec854c7b80169fe9988fb54b69c9a2
TLSH
T1E6F05CB75FF72814FCEFD3DB2872947284047444C515EDDF142EA5D750B27242086CA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 5536703cd6cf93329453a53a726013b8b3f726327032cd6e3d0d759e8679bf73
MD5 96e4ecf93e933149aa0111b63cc4715e
SHA1 d746d6fb71dd6837b7ec62849cdd5fcfd5ae8a59
SHA512 180b8463752182db6324d5c1d3c8fd3c24b0312f07f84b3ae80deb634251d5861a5b52ce584c6c53409ca4aae0e1eaf6271c7525ac1bda1b2e6f092dd62ccced
TLSH
T1FBA00220C2CA5011C40507B030A6A9437B504E13014597074891B8B9BDAB1805A49219
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5238.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a5238.TMP
Size 48B
SHA256 ae65dc1bad8fffa0a274726ffa111332c09c2e0e2eefbdea029ba49815600351
MD5 01c9d2ec7c96c4a791a264795e910602
SHA1 a198e9953ec684fc2df48f366792f9ecf0863388
SHA512 8873c52aa45e98f81c7540b34bbbcff1ff4bb18af9deac990e241784257547fbf866afa3f119c5ee230e14a5526e366ad6f36ef218afcf15f9e9c1d50542dcd2
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 18ab70367405cafb35a35f3fb1d076cb041d297d96432f61f59eedaf5848be33
MD5 b26232beba63880af57ee4117d07b342
SHA1 57373e610b7904b1c9de3ecb44129b05680f173f
SHA512 c5537e55d4f8738f90e628054cc8b054c0c81172564c6244ce46fc94adf1ee7dd5cc4db385e8372cd2e05d55e05319680912b5c188cf49769f067aaaa5535477
SSDEEP 96:KskAKt2WWrmKo8TGgKDK+pCPCeCRCdCXCNCY:inJL72
TLSH
T1D1919520707B06A13ABE295D95D4B55B52C334A3706DB92B37F854A20F2BE248CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cec2ae6aac90b659002cf1b65192480e33b2be3e54e2bbfffdfaf8bacde15ca1
MD5 adfda28a277c5067e0aa6903017ed934
SHA1 5afe3993717adb1155907cd49607e795e902008e
SHA512 a09af67b9424530ead7b015a0a9ec4bea30e36ab99783ab30d022a95c19eae6f37271fbcbcb4777b8ca06d32b545a174560cdd6be72260268013bc25e3dd4a26
SSDEEP 384:nljccCs+Bt0S3vsNOuycCZ5glX+yOlr7kOhZmTV5fP01f3w:VccQP0CAJ7OVkOhZmDcw
TLSH
T1C8827D3629741C7B9EE29A15F54A3B439FF4507BA6C52EA8DACC4F0D058B3DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 5f8345f1932fe22f03052f636c7bca5d41fca6b44ead5b693ae18f9e3cc787c8
MD5 cb3a900e3947d06a871750981dfe3c1d
SHA1 e1bdeab13b1321e12eec5e3e08a22c8273dad50a
SHA512 f846ad88aabf570cc4b493826a5cbe8fcae7d6a143d0baa2d01cb8070071af4948e2eea594c1f033ac43836bae16f2b95a92a86fc8a95ed11f173e31395f41fa
SSDEEP 384:nrjccCs+Bt0S3DQsNOPycCZyHlZDfhL+yOlr7kOeYZmTV5fP01f3w:HccQklCgRL7OVkOeYZmDcw
TLSH
T1AAA22939E8B49D3BADE28781B64A7B879FE0506796CC1DD8CDC85E0D04C76DE170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 b5dd5b32e912812f280c5f512cf0dd50a3c970e1177df3d097414373fd8c9f11
MD5 46ab9528ef0749b5e77e41558dc6e3d6
SHA1 621afce389d3df7d1b89e87753640ac74918e7ae
SHA512 0d2ed7c6dfe753271ad99a70d7fe656bf4e82009336679c71e7325a5b2a797d11647af53fab4f70699d41b0fa16475dd3dd9abdc288d8f4d3d1c26b3eb48bef2
SSDEEP 384:n8jccCs+Bt0S3DOsNODycCZdglZDf4L+yOlr7kOEZmTV5fP01f3w:6ccQyVCooL7OVkOEZmDcw
TLSH
T109A21939E8B49D3BADE29781B64A7B879FE0106796C81DD8CDC85F0D04C76DE170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 060e9aeafebefd7b7ed2444ba0c8f576cc7b1d1f9435f2df7ce14ce9d1cd13ed
MD5 6151fef780d1aba312f6cc181712dc3f
SHA1 bdeadab4797c13eaed41396836a33a956df238fd
SHA512 7f5082c7a70e114d4af47a721a3795fee546173277d2069e7565ccea4f173c0d6e3ba78d4a92462b0f998ccd61ee6f8ec58c8cd38f33cdf9b3eaef84de787107
SSDEEP 192:qON36TZ0dQmiUyugXab+jeOVTr7HEOXcX3qKU6:qON36TCbmXg+yOlr7kOCZU6
TLSH
T1D6121B3569386CBB9EE2AE46F44B77175FE4106BD9852B94D9D81F1C04CB79C230B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 02f20beda8ac35b00dee64ee5f65271743b326eb866e427253e88705e96633c2
MD5 f483e7a986c1e58ac28e3166a3d0ee0d
SHA1 ee78c0514b5c46f83cde6f9e62831cc45bbd6865
SHA512 b201397dd28c1d2b117c0251b2cbe26f64f65f8172445acc7c7ac9dea4fed063b8e508785f4732398ec3c45f56653548ced768e730175fcc3ead4ee7ab3a8f70
SSDEEP 192:YONDR6TZ0qQmiUyuglab+jeOVTrYo8wEU6:YONDR6TCm4lg+yOlrYxU6
TLSH
T19C02093568286CBB8EE2AE45F48B37275FE4106BE9912B88D6D81F1D00D779C2307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e7aa1485e0a990f44ec7dee21b832aef5e852a9802dfa8bc1a43ce7ca53333a3
MD5 6f1b0b4df6124d64b7022ad82c86102f
SHA1 6ddd257cdecdce607effc97b798f95121b13bef6
SHA512 d8f675bd7f32581850e9d052fd742a2fc5df8ac405d7caa7159c5b8de6f22fd7fd0597225e71ce06216468aeb4becc26ea508cbb517095bb7ec8f68a85212488
SSDEEP 384:nzjccCs+Bt0S3vsNODycCZ5glX+yOlr7kOhZmTV5fP01f3w:fccQPVCAJ7OVkOhZmDcw
TLSH
T1B2827C3629741C7B9EE29A15F54A3B439FF4507BA6C52EA8DACC4F0D048B3DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6dd61482cb73db0643718412679d640215614229f36f10b4cf321e9a3d0388a8
MD5 14b24bfa68d26d1484a129461806d0b8
SHA1 a65930f0d10c04f6286ffdacf682156f48966350
SHA512 1eda3fc624fd30fe31288d61145db88588b7297a1ac181e5ddf195c3c307f6d376b7a0538dd81b1d18a458af665cbbe326648ce024550236a1cd597b5c8b1928
TLSH
T176E00401134410F5C014033400C31F301FD1F431137103075734415C5C333003D34740
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a7be8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a7be8.TMP
Size 392B
SHA256 dd41405e01f8a9593bfa69957320a0d6ac7584de7ec4c27b3787ed6f757f549f
MD5 d73bcf1fdec756b038ffdb7e18869672
SHA1 1d3848aa715f7d530f2e5305a80f7557ca45a6af
SHA512 7a6d7e13cc5e56789b48549d56a8153e043ae6ed32ad97e74af8cf63e7f282efde395dae2c44464044204f2f55c30a2abe97132973689aebade895c21b0a6bd8
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

28df9d7b-1470-4054-b9b8-5ec34f6ca631.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\28df9d7b-1470-4054-b9b8-5ec34f6ca631.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2fba2c5266d1887d0860285bd30ec339f7ff6d518aca27bf474f76f028c4dd3a
MD5 f22745d90abe39c5f15e3deb2650ceef
SHA1 4d1ce055dadf54b89fed74445c4204e4f5357455
SHA512 7e86d77e40f60e2a01af83b8be512478e0793ec0c070ba145505b11f46fe20327bca10373348c8078d0ca7a2537abada6bc97bf3b75da5b1cb12e5eb70cd34f3
TLSH
T19641FA58B6FA1158B3B76F5A9BF7A86D457E78772F06D45D00010D4F0A62B40C8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

0c10d4e6-0686-4f3e-b61e-726cc5143369.tmp

Path C:\Users\Admin\AppData\Local\Temp\0c10d4e6-0686-4f3e-b61e-726cc5143369.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

1513c535-84ab-4a35-9d39-393f6b999394.tmp

Path C:\Users\Admin\AppData\Local\Temp\1513c535-84ab-4a35-9d39-393f6b999394.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95e7382f-222c-4468-9bec-0ed82d38bf64.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4592_330227878\95e7382f-222c-4468-9bec-0ed82d38bf64.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4592_330227878\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/332-495-0x00000288AC9B0000-0x00000288AC9E0000-memory.dmp

Download

memory/4364-578-0x000001DB54DB0000-0x000001DB54DE0000-memory.dmp

Download