hxxp://vmeasure[.]ai/

Resubmissions

28/04/2026, 19:19

260428-x1ptzsht4k7

28/04/2026, 19:15

260428-xyew1adx2s4

28/04/2026, 19:09

260428-xt65pahs6m4

Analysis

user interaction
yes
max time kernel
148s
max time network
157s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
28/04/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://vmeasure.ai/
Sample260428-xt65pahs6m

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\it\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1438736284\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_2059688054\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_41150752\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_41150752\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1438736284\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_2059688054\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4796_1844285017\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4796_1092318541\_locales\ka\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2420	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134218772603294344"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2605425648-1229640847-2920638550-1000\{7D7643E5-AD03-44B4-8169-35E02105A2C1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5784	msedge.exe
5784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4860	4796	msedge.exe	84
PID 4796 wrote to memory of 3908	4796	msedge.exe	85
PID 4796 wrote to memory of 2420	4796	msedge.exe	86
PID 4796 wrote to memory of 3908	4796	msedge.exe	85
PID 4796 wrote to memory of 3908	4796	msedge.exe	85
PID 4796 wrote to memory of 3016	4796	msedge.exe	87
PID 4796 wrote to memory of 3016	4796	msedge.exe	87
PID 4796 wrote to memory of 1344	4796	msedge.exe	89
PID 4796 wrote to memory of 5132	4796	msedge.exe	90
PID 4796 wrote to memory of 1344	4796	msedge.exe	89
PID 4796 wrote to memory of 1344	4796	msedge.exe	89
PID 4796 wrote to memory of 5132	4796	msedge.exe	90
PID 4796 wrote to memory of 5132	4796	msedge.exe	90
PID 4796 wrote to memory of 5052	4796	msedge.exe	93
PID 4796 wrote to memory of 5052	4796	msedge.exe	93
PID 4796 wrote to memory of 5052	4796	msedge.exe	93
PID 4796 wrote to memory of 6004	4796	msedge.exe	94
PID 4796 wrote to memory of 6004	4796	msedge.exe	94
PID 4796 wrote to memory of 5104	4796	msedge.exe	95
PID 4796 wrote to memory of 5104	4796	msedge.exe	95
PID 4796 wrote to memory of 5712	4796	msedge.exe	97
PID 4796 wrote to memory of 5100	4796	msedge.exe	110
PID 4796 wrote to memory of 3088	4796	msedge.exe	111
PID 4796 wrote to memory of 1532	4796	msedge.exe	112
PID 4796 wrote to memory of 3532	4796	msedge.exe	113
PID 4796 wrote to memory of 3532	4796	msedge.exe	113
PID 4796 wrote to memory of 5140	4796	msedge.exe	114
PID 4796 wrote to memory of 5140	4796	msedge.exe	114
PID 4796 wrote to memory of 4940	4796	msedge.exe	116
PID 4796 wrote to memory of 3168	4796	msedge.exe	117
PID 4796 wrote to memory of 3168	4796	msedge.exe	117
PID 4796 wrote to memory of 3620	4796	msedge.exe	119
PID 4796 wrote to memory of 3620	4796	msedge.exe	119
PID 4796 wrote to memory of 60	4796	msedge.exe	120
PID 4796 wrote to memory of 60	4796	msedge.exe	120
PID 4796 wrote to memory of 5784	4796	msedge.exe	121
PID 4796 wrote to memory of 2324	4796	msedge.exe	122
PID 4796 wrote to memory of 2324	4796	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://vmeasure.ai/
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff989eec188,0x7ff989eec194,0x7ff989eec1a0
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,5053936147752362523,4439253051247555073,262144 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,12984111735567837129,5571579608617506368,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,16998315071924999288,18051485895140779849,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,9389091851341774063,12125307519812966620,2097152 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,11622049449145473198,11829175268154984570,2097152 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5020,i,11071719869760412543,5587414988670199606,2097152 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,5900810952182371744,14132481921649668418,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,1980276364401859022,6213241004808969175,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,6295694375312643325,3181109583803341015,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,6295694375312643325,3181109583803341015,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,15783925299932128222,18365261743446428406,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,3646311966237519675,14907027908660123740,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,732069841102293181,3567736655729263481,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,14934421067326842393,675637955377231747,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,14588665326511675328,14975359398418078893,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,9094502288281350232,9742822094827034742,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,9094502288281350232,9742822094827034742,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,9530121039515894308,7515981252877994248,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,8656865250905766245,7922361730889249092,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,11267443944417658398,12544955516435699439,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5260,i,9990477950124492108,788558353413787836,262144 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,11258419163214803281,13294963861176824701,524288 --field-trial-handle=2300,i,11305517336449777151,11489419197770304044,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1877fbc0c43a45e793044a62162a5fb8c5c9dacc6820f192e229549bf23e282
MD5 d7f6a0a3a239b65bbc4d7200cee11fea
SHA1 bc633583358feec3947b57794222463c529d6a40
SHA512 ac97a2816b8d8e6c559e30dec4991e0c20f54b4e6f42611680d63a9ff163e987f62a0d16d6d81e1b2ad20caa1759922ad0c71c527bcd24a2b835bea2edb0a9ba
TLSH
T171D08008A2777C30C4A8D470244F7B453919C5774653571558723D685C6305114469D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 693630de12772afbca58d0e311382ac6546952d2c7417697c9cf04290bb383f7
MD5 650f9e39d68dc868fc760e52f68f7fb5
SHA1 8b7b2b313c1da23b2f296a7f87709a346e2744fb
SHA512 98ea53683e8cb8bc12fffcf18d524224e29f680dfca75b769a7dd80a6420fb8b47b781e800f0fc1baa2bdb4aa711d5432260a9c09219b84450a279883f25dcbf
TLSH
T140D08004A2737C30C494D470248F7B453A29C5774653571558723D785C6305118469D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 44e7ddf4ff34b3594e7dcd06f4e4413452ace52ef201f65f6d045aead7bfbee2
MD5 90f94c351bea67eb1520bde669b68902
SHA1 ae38604c69b3a568aa9f61470b9b4bd7b636bbd3
SHA512 c2cc468d942cb8bc353484154d7c241562589f7c3c13362f8327d461efe6a035ff61316fc611252dc066b0166a5ab61445ef34fb7b487d782f698e775e5c2f9c
TLSH
T19FE02BAECD10EC3709FC472868480746E69113272B91894F3E3E92098FF1A76419AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 913f7ac8f7c9d3b67eb10d7ecf6c0ca7ae59ab95245849563c64d9697c1fefb2
MD5 9e35df230dfa64864adc1ff04aa09e6e
SHA1 b75907f892d1362626af3ebb0540fc5f1a62fdc7
SHA512 133af1ee42787ebf875a1ff1eb74f45836c0b69d174d60d69c12c478238b8c95c07f44f3f8fe92100112b6a79845e496a018b49c2056eeca3da6f8996df3132c
TLSH
T1DA6173440CC39462EFE0B974C6A32AC93A3006EFF21E5F0346B9A57C66D679350CC4B5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 268d71952bb4c732731edd5779f3242e851a76d84274f73e5a9803465626d83f
MD5 691eeb4dd42b945a49b80bdbed804e5e
SHA1 784038ce20337a4fffe9541f2433dc0e01659da9
SHA512 3517a392b43908ef6723752ae4eb6d60d738d33a233e6bf44aa5a35afcb296383587c2d9d773812f9335af5087b63fe168ccefa669996c4738a1a40bcf07c38a
TLSH
T1936161480CC39421EFE0B9B5C6A32AC9363106EFF21E5F0346B9A56C66D679350CC4B5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5878d5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5878d5.TMP
Size 2KB
SHA256 0b08194a5d9f70aa8ed165e0f7d65627a5a4ff9e666b2eb6e22e1065a9915341
MD5 4e99b6c05507b01dd9009111970fc0a1
SHA1 75b4062b345689cadf995d56093f879dd675e364
SHA512 e871032a804be2e29debd0ad2cad4370acbdd4c65d7d8ba356f000f1a3e8159e463ce9c827c4b71a804d41b0edf281488274e22f52af3335c256c2b41082167f
TLSH
T1D75108940C918424EFE175B5C6A701C9363118FFF71E4E030AFA093C56E6B6740CC8B8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 407a258651fe94718a1e4f473f6aa6f8d477211e71afe73ae60507b8f66da681
MD5 0324434a2e9fe7f2a3ba7dd1fd8a4738
SHA1 060e806708f14967b193d298e844b75172c14d79
SHA512 4e7ae4933b54df9a4e6528ede66ceee3122bdaab7d019bf185654a892f6ee8bfec65397f14d47035360f8b23edc399f4ac8ba8bdf5f0934b8f475b17b0ca2e20
TLSH
T13D31CEF3C3E8992D8A1185F0A6186F2B8E690955932C3D9EC4E49E0F93E28B4E14085B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 9f1b14ab588ce7892cb9b19436822fbe190e490930887fcd60dac67e00948d1d
MD5 fe0e3490bb89efcbc9e5c54f6a096cd5
SHA1 9553b05a45bd12389a379ab89d03fe0842fba088
SHA512 72de4113208ad93531592e79fd25b784b2532d2f16a1095618a7961ec4c9ffd639a468390c5a347b02c46d86916f21e53c8b3ff68cd63386075ce79297ecc370
SSDEEP 192:DNs+HzteXhX8k+M3nGs4uxGdORzRtWxdVR2PB8QJwi9aj6jW:DNs+HzteXhX8XM3nGs4uxGdORzRtWxdJ
TLSH
T1BAF18CE7C3E8857DCD5152F4AB182A2BCE5D0D19531C3C6AC8E5AF0B63E6870E205A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 ef0bd991e07c71e909698acfc1fc7800f2a2117500168074909e711ccada89c0
MD5 cd3f00c37e37c38fa4726d6cfb9f7b2c
SHA1 16a024aae482d33cf4777cf496094b6986f64229
SHA512 3be9b255f96bc7a73046447f4568259132848113003cb1fdc8e82494d915b1291c85aed77c18990feedc7c184918fd882e2ee49abe9dbfa6e3141c5b694af4d3
SSDEEP 384:sxZoEqxX/f7ss53Mc8fT5KHbL/OQKVBlbYVloG/:sgTxX/fH58tbkHbzdKzxYVlr
TLSH
T1AB82D75A6634897BCCD7D226F985BB66E2F50463D2904E48AAFCDE0C00D7AED311781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 48295b5766c2f5ae662d0325c45daad403510eb1059066ac8fdc955abf6256e2
MD5 b26b7f7bd9bfeed45d398044689b72f9
SHA1 52d15cfd336ea961615d8e202f9d47cfc71b0acd
SHA512 41106cd294f8c47fcf8a8a535e91b9340b48045a0a677455c41a7a23e7400b4b4c3ce87ef8d3ef5fc8ec02744ee46f157b02c3f8d959384e6b5499ff06399102
SSDEEP 384:sxZoEMX/f7s/53PRT5KHbL/OQKVBFYVloj7:sghX/fs5/BkHbzdKzFYVlI
TLSH
T13772E75A6638997B8DD7D216F685BB63E2F50523D2904E48AEFCCE0C00D7AED211681F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 f8fddc8081e5f67264cb81bca6b0d27f51ff963b09adb1d9be21c5e25550e9b1
MD5 cc071d16fbcee842edb8da99de0b6ca3
SHA1 dc49b3ae655c403415914e2dd4ba30393a22d3f1
SHA512 1b5fe713660d216972fca24cc3dc49fa2e4ab898e99e01acab6f4c91317a8ffe3ec0e0180f3ae8987768dac2a43ac5231ee63e9cef71d60979ee6f7897d4eb27
SSDEEP 768:QyMj2O97pLuL/OmWvOKvC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjj+xLlh7WxLroL:QyMj2OrE/OmWvOKvCu1jauj+xLLqx4E+
TLSH
T169F2FA3B2C4CCB7E4F844E9CDC2A7E8A6DE801CB96D8895447FA884C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 5abf6fd03e320f0abdb5c78424052576bc7f986c6236684ffb391f31510dc522
MD5 d84e593d85316303fc4ee1520bfb8c75
SHA1 153d5f6dcbc385f7d6ad424feb101d2bacab3584
SHA512 63979d789e01b4c4d00ae36821680203f96ac97be8cb0ae996c7dbaf9f609545d55cb2609e53b0c9fde9164ee47d6aabeeff743538d742139c4b28bc8a162c01
SSDEEP 768:Q1Mj2wc7pLuLndmWvOKvC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9j+xLlh7WxLroJ:Q1Mj2wAEndmWvOKvCu1jaIj+xLLqx4EQ
TLSH
T1A1F2FB3B680CCB7E4F804EACDC2A7E9A7DE801CB56D8895447FA884C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 5d643ca0e96f02b1f705dcff93eb17ede899a5230527cae2f49ec8d759d6c516
MD5 dfe523eed4d5d7fe11713aff8bf7b743
SHA1 859e8304141425126b9d9cf376496c3e96613b10
SHA512 cd8fb4afb10a059b383f2f6306d278ea336452d634d4f40e02b4b100df0c56b8b3c651e733d662b7f1ef3ff7114042e1e917cbba2c94fcc1636ac0a6e65d117a
SSDEEP 192:sh1WlDub/kDnmtTYB19srn97bQHSr/54UdaVtq/5bfsRLObvIpg:sHWJujkjmxYpYTslODIa
TLSH
T1D6B21511713A06803A7EB9CE81A4B95E46C330737158B42B7BB914A65F6BE20DDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 94cbd926fedbb0dda82287e0d1bdbff808f6a3ae619fdb3b771743983d15bf03
MD5 196cbc7933b5f610d00e1d9cc4cabdb9
SHA1 70b1614d94247f9c48992242ce74fb326e6a5519
SHA512 88aef5cc8233ef234c6bfa8d145890482174b6c695f2fd835cd717b01a30be6715e5147038e69f87aa53057786ab7c6fed9efad244e7e8ba12b86827c4fce1d1
SSDEEP 384:nTCiFavqMg3sNH8TUNTUlImkrOgU+TySIzz4fbYbePOGoCcRYV/Vw1mRiCe02err:TJFayv32wg2veYyP/o/RYk1mc/0Xr
TLSH
T10FC24B35E854DEBBEDE69FD9E7097A06EEE001A7C58C49D8D9D81E0D00D71AE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6be6bd9b204697ebd177919d729157ae1fdcff5ce8e79533d11f195da92e1d95
MD5 57258b1d6c7f70b2a57179b108aa36d0
SHA1 919d59cb5e24f96aff75575f60bcabf3ca8e2edc
SHA512 691ab7ca784b0c3ee0ab046f1bc0858c412a94c453f8fe139a43b662fa3179097ecdedb3242769d556b71b64830c16f1bb476a16e4c25626776de4880784d0ba
SSDEEP 384:n8CiFavqMg3sNJ8TUNTUlImkrOgU+gy2XFz4fbYbePOGoXrrwCRRYV/Vw1mRiCeM:8JFayv3Qwg2JwYyP/IXw+RYk1mc/0Xr
TLSH
T136C25C75E854DEABEDE69FD6E70A7602EFE011A7C58C49D8C9D81E0D00D71AE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 591c1e4a5fe74f103bd096946d5466027150688dc9f5f69193f7c9ffe2d91fd6
MD5 5213505f2a67bede2ce9ee6e25be13ee
SHA1 0ed1ca8cfe290c38c7119f863707cd830752fdb6
SHA512 b73d2b8627310e1ac6bee3c50e2b2a2dddec0d85a635ecb487754d1fa1b7e8d6080fc1da91ac8c2474067f648bf817a8ec81ce242b385321b70cece7295a94bf
SSDEEP 384:n7CiF4SxmoW43sNt8TUNTUlI4kFOgU+Fy96Iz4fbYbePOGoXrrECRQNvUG3rN1kI:7JF9x043AwgCmnYyP/IXE++TP3
TLSH
T177C24B35E864CE67EEEA9FD6F74A7603EEE00197C18C5AD8D9D51E0E008729D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1c3ee54bb459c1ec99346047f973d4053ab5eff2ec5dbc9e3fac76fd5c6a0666
MD5 2bc42b066126c6dd3e01bb8f444d17a2
SHA1 3e5b8229229d9a2a3a25925f93daabc3e537fdbd
SHA512 7208081a88a3b9db1338a4f8dd4c3954482ca940a712f0dd6bb8846b84caa82a3d4017f2547bbf36c258db904874999fb096c164bd1a3e0cf7fe8f6bee833c2a
SSDEEP 384:nICiF4SxmoW43sNt8TUNTUlI4kFOgU+Dy96Iz4fbYbePOGoXrrECRQNvUG3rN1kI:IJF9x043AwgCAnYyP/IXE++TP3
TLSH
T16BC24B35E864CE67EEEA9FD6F74A7603EEE01197C18C5AD8D9D51D0E008729D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6c2f7399ca25de32a05157b165d4836e87925f54ddf10519b1e5cbdc4f03539f
MD5 9cfb11ff806ec8ee096b86b6af32c28e
SHA1 0b713994f1912affc4a8fdf485dce8816757e0f6
SHA512 5c2a2417ffb329aa8fb083187cb6faa5ba56819c1be5d317407d5b1ce582a3654375da74c7cc46edebc6afdcb33faefbf8b08efdca2bda87ea7eb22f58c70906
SSDEEP 384:n7miF4SxmoWx93sNt8TUNTUlI4kFOgU+Fyn6Iz4fbYbePOGoXrrXCRQNvUG3rN1P:7NF9x0T3AwgCgnYyP/IXX++TP3
TLSH
T106E2B2F598D78977D9AD9B87A37D2D02AABCC053B1885984FBC41D0DCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf83bef7-efd8-44b6-a9e5-ad44c97b981f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\bf83bef7-efd8-44b6-a9e5-ad44c97b981f.tmp
Size 2KB
SHA256 1fcbb7797cb6f21e02b06ee8af1e9d98c4684870d0696f9f1495cfc1c66ec4df
MD5 e07859ecfaf1dd35e8a98e560eb13185
SHA1 df84a7cd5f17aa9c1a30054aa9118480a98b5cd0
SHA512 23fbf67e4257060dec3053f14fa07174927c7ca8e9e743547ecdb56b5bc8f6aaddc076985e906d9e8b2e033c7d587505bfd4c49ccc91800867d6f7280eee9dc0
TLSH
T1724172D14C3D66D2D8BD1A3EB08B78FCD5DCC62AF1A4357E2864EA88063A51D648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3c6fb452e338674944358ceb65974369517cd36566429cc352c01aac9a2b326a
MD5 4626f9542e17630d934d7c3b3452160a
SHA1 3489c27f7b528ef314ac493ce22a08a929ef1277
SHA512 3c2e711a9ff60369d78590151d6b5ab2d7fc0f540fbcd17919fe5cd51ab18b284c04a7f0505ba35e88cee0954255457fb8d12be87443f081943e745da701b8b3
TLSH
T1F34172D04C7D1AD1D4BD1A7EB48B38FCD5DCC62AF5A4347E2854EE84063A51D248943F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 114047c4faea085ee446480f15e663461dba69d1736e473ff94996d55da924b6
MD5 b68345c67bf7ac6c9ac303d12150ee03
SHA1 93cc25aab2a0f6f44bcbd23fdfa3eb95dc7843e5
SHA512 2fb16b8f68c6c0db773c98e62355a9fc2d86757bc12d31d090f46fe5875b4dc52f6089c3b8577b35db5ae7af0730cadd9743036c8561e259984e453a45e6c267
TLSH
T1564160E04C3D6AD1D4BD1A7EB08B38FCD5DCC626F5A4353E2864EA88463A61D248843F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 25c512f91e34ab137f5f48ffa3dc2dd95668d9bbf0c435b3dac72bdcda15a200
MD5 420387476871041350b2e1b610f6d996
SHA1 1a19d6d4e802e3233b5ad68dc3856fa907089e54
SHA512 a41f99015f08773bd8b1cd2959e66060cce039f10725f0d7bd2a639560b725d30aadca354b9ec4e98cde441daaaef0b4f45085a77a74237a02e304c933080841
TLSH
T1AB41E958AAEE114873B77F59ABF6986D887BBC772A47D05D00110D4F0663B40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5712-276-0x000001A1C8630000-0x000001A1C869B000-memory.dmp

Download