60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde

Analysis

max time kernel
149s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
Size 648KB
Sample260429-tyttdahv7p
SHA256 60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde
MD5 c74eed35fb6a38576559dc9f63fedf48
SHA1 02ac0c9234836dc303fad5aab9f1fad345bc48c0
SHA512 6c2b185b32c93aab043d1f2be12f73decf59d817548d79b1d95d9fdf5919e27f2b6ba6a66696b3372a548baf33c7a66f6eafbed2d22be8b32f88c07f6598b12d
SSDEEP 12288:jQYyhKHH6MCmgWeh94xDx31qZ7gzt6KdtFT+MRmYo:sY0oH3gWca2Z0zvdtN+Od
TLSH
T1F3E42ABE9C60B326F60CD0BAE146D7538F2138411236B9A319BE93241245972DF677FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4696	chrome.exe
4376	msedge.exe
708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134219537414674907"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{22BE5B86-8D46-4658-AB2B-C7A8D89E45DB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3568	chrome.exe
3568	chrome.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
4596	msedge.exe
4596	msedge.exe
1676	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 3568	3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe	80
PID 3568 wrote to memory of 3984	3568	chrome.exe	81
PID 3088 wrote to memory of 3568	3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe	80
PID 3568 wrote to memory of 1892	3568	chrome.exe	82
PID 3568 wrote to memory of 1892	3568	chrome.exe	82
PID 3568 wrote to memory of 4696	3568	chrome.exe	83
PID 3568 wrote to memory of 2656	3568	chrome.exe	85
PID 3568 wrote to memory of 2656	3568	chrome.exe	85
PID 3568 wrote to memory of 1872	3568	chrome.exe	86
PID 3568 wrote to memory of 1872	3568	chrome.exe	86
PID 3568 wrote to memory of 2520	3568	chrome.exe	87
PID 3568 wrote to memory of 2520	3568	chrome.exe	87
PID 3568 wrote to memory of 4992	3568	chrome.exe	89
PID 3568 wrote to memory of 4992	3568	chrome.exe	89
PID 3568 wrote to memory of 2312	3568	chrome.exe	91
PID 3568 wrote to memory of 2312	3568	chrome.exe	91
PID 3088 wrote to memory of 4596	3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe	92
PID 4596 wrote to memory of 3868	4596	msedge.exe	93
PID 3088 wrote to memory of 4596	3088	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe	92
PID 4596 wrote to memory of 4376	4596	msedge.exe	94
PID 4596 wrote to memory of 2872	4596	msedge.exe	95
PID 4596 wrote to memory of 2872	4596	msedge.exe	95
PID 4596 wrote to memory of 2872	4596	msedge.exe	95
PID 4596 wrote to memory of 1724	4596	msedge.exe	97
PID 4596 wrote to memory of 1724	4596	msedge.exe	97
PID 4596 wrote to memory of 3268	4596	msedge.exe	98
PID 4596 wrote to memory of 3268	4596	msedge.exe	98
PID 4596 wrote to memory of 3268	4596	msedge.exe	98
PID 4596 wrote to memory of 3840	4596	msedge.exe	99
PID 4596 wrote to memory of 3840	4596	msedge.exe	99
PID 4596 wrote to memory of 3840	4596	msedge.exe	99
PID 4596 wrote to memory of 2624	4596	msedge.exe	100
PID 4596 wrote to memory of 4856	4596	msedge.exe	101
PID 4596 wrote to memory of 2624	4596	msedge.exe	100
PID 4596 wrote to memory of 2624	4596	msedge.exe	100
PID 4596 wrote to memory of 4856	4596	msedge.exe	101
PID 4596 wrote to memory of 4856	4596	msedge.exe	101
PID 4596 wrote to memory of 2196	4596	msedge.exe	102
PID 4596 wrote to memory of 2196	4596	msedge.exe	102
PID 4596 wrote to memory of 2196	4596	msedge.exe	102
PID 4596 wrote to memory of 2436	4596	msedge.exe	103
PID 4596 wrote to memory of 2436	4596	msedge.exe	103
PID 4596 wrote to memory of 2436	4596	msedge.exe	103
PID 4596 wrote to memory of 1668	4596	msedge.exe	104
PID 4596 wrote to memory of 1668	4596	msedge.exe	104
PID 4596 wrote to memory of 1864	4596	msedge.exe	105
PID 4596 wrote to memory of 1864	4596	msedge.exe	105
PID 4596 wrote to memory of 1964	4596	msedge.exe	107
PID 4596 wrote to memory of 1964	4596	msedge.exe	107
PID 4596 wrote to memory of 5104	4596	msedge.exe	106
PID 4596 wrote to memory of 5104	4596	msedge.exe	106
PID 4596 wrote to memory of 1672	4596	msedge.exe	109
PID 4596 wrote to memory of 4632	4596	msedge.exe	110
PID 4632 wrote to memory of 1500	4632	msedge.exe	111
PID 4596 wrote to memory of 2440	4596	msedge.exe	112
PID 2440 wrote to memory of 3120	2440	msedge.exe	118
PID 4596 wrote to memory of 5092	4596	msedge.exe	114
PID 4596 wrote to memory of 5092	4596	msedge.exe	114
PID 4596 wrote to memory of 1836	4596	msedge.exe	115
PID 4596 wrote to memory of 1836	4596	msedge.exe	115
PID 4596 wrote to memory of 2408	4596	msedge.exe	117
PID 4596 wrote to memory of 4388	4596	msedge.exe	116
PID 4596 wrote to memory of 2408	4596	msedge.exe	117
PID 4596 wrote to memory of 4388	4596	msedge.exe	116

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe

C:\Users\Admin\AppData\Local\Temp\_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe
"C:\Users\Admin\AppData\Local\Temp\_60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3bafc728,0x7ffe3bafc734,0x7ffe3bafc740
    3⤵
    PID:3984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,13936970516159486335,14758072357735780592,262144 --field-trial-handle=2012,i,7900864356530106494,2724328584775419235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:1892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1528,i,15075950096596101830,8625372278304519447,524288 --field-trial-handle=2012,i,7900864356530106494,2724328584775419235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2288 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,11577137998818550579,16626646636961375499,524288 --field-trial-handle=2012,i,7900864356530106494,2724328584775419235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2764 /prefetch:13
    3⤵
    PID:2656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,15081907508829529313,3993184529055569444,2097152 --field-trial-handle=2012,i,7900864356530106494,2724328584775419235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,5383063984902860621,9455317992150495367,2097152 --field-trial-handle=2012,i,7900864356530106494,2724328584775419235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:2520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4260,i,1029130371718559037,2506957497307954484,2097152 --field-trial-handle=2012,i,7900864356530106494,2724328584775419235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4268 /prefetch:9
    3⤵
    PID:4992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4640,i,11808233876050784768,2125742009445962376,2097152 --field-trial-handle=2012,i,7900864356530106494,2724328584775419235,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x30c,0x7ffe3badc188,0x7ffe3badc194,0x7ffe3badc1a0
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,5117657550087400168,12779108162712742145,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,1475196818908716855,16448959367014236558,262144 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,5100473809742674278,4004125070956124120,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:13
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,5664924878065595019,2663174889735090485,2097152 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,13555891555758093865,18377026502322037056,2097152 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,9084515203653115359,11608029154361679014,2097152 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:9
    3⤵
    PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,1343606148243330914,11326822992692213193,2097152 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4212,i,14676473888642976356,5637171055400632968,2097152 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4232,i,3808236026318662791,15585807252790349698,2097152 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3904,i,11520780347555012395,8348796393078534453,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,15641546435974133374,2501114183750303461,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
    3⤵
    PID:1864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,7671320514039420188,738549379384313751,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,12001140780984247880,3123165024994011075,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,16983886064965004714,11256382293672282446,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,16983886064965004714,11256382293672282446,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,12524864261692027228,10564362874625383169,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,17593921603640690437,9158978227666912427,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=592
      4⤵
      PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,2658617941406559855,12547732284972594018,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:14
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,8154488669706729609,5643794188367722966,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,5446916846432165234,4624173007993508866,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:14
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,2212314479111278213,9927926100047280245,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:14
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,17433142424003396521,18167410799296075213,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,13569532790003708700,12107415409194860207,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,8829058159632343694,13339440556494547041,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,9193036181413956042,3319463982363032510,524288 --field-trial-handle=2176,i,6401337610216300609,505090556298769959,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:14
    3⤵
    PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x304,0x7ffe3badc188,0x7ffe3badc194,0x7ffe3badc1a0
    3⤵
    PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,920573431621309587,18133272356605632804,262144 --field-trial-handle=2248,i,7474942478535166202,18437746190540444333,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,10911326733006717474,6275198894676726092,524288 --field-trial-handle=2248,i,7474942478535166202,18437746190540444333,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
    3⤵
    - System Time Discovery
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,11284643562952257269,13159394223845275013,524288 --field-trial-handle=2248,i,7474942478535166202,18437746190540444333,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:13
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,10297919107897548956,3759064728347390731,2097152 --field-trial-handle=2248,i,7474942478535166202,18437746190540444333,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,2296153233233985586,14012662754104470670,2097152 --field-trial-handle=2248,i,7474942478535166202,18437746190540444333,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:732

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9210785b-5ed1-4d89-b38e-a28d41487f98.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9210785b-5ed1-4d89-b38e-a28d41487f98.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 2d783ad45eb72838d679abcdfc1114bc755a826ef9983d5325ddb19074122e3d
MD5 155aa5abb037fd1955eac3f2c8d4c8ee
SHA1 6239c505bb914278a57ebc4b5f57d66b279720b2
SHA512 b1dd4ead2e3466c427030b2bbf4c4a7f927baff0dbaa1c8ab6eaaaea2d2d1e958290a04f595234c28d253101353f1e0347d26893203bb53d88d782f1040681f6
SSDEEP 1536:wS7P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:1++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1559312B9991E7D39236FC39AA0179CAC88D3DCDE151410BC30C76F1E14BB392A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 c3b4ae5579dc767da93de21e302ca5f036752c65e8bd147bc8c0095fe974eaf4
MD5 daa44223fb192edc68bb3dbb99547206
SHA1 bcc261632d83e2b91cbdca16ae5e7e0467be2f72
SHA512 f3de0895503cf9c3baca266c262d19edd9c47d0efe31d2ba2a877166b6582c6586d1c0805b924cb6dcad9b234d3d129b4b82d6174450b59f2624aa3f04b15870
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7O:fwUQC5VwBIiElEd2K57P7O
TLSH
T168B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe2bc29e2908e41303a90ce3aa8767b3617c8cf9d0ac38f0e499e027f0057eb8
MD5 92fae47e9634c2697baeda90e820907c
SHA1 70f5405a0763ac5fb96019ed9cf2f8328db0ec0e
SHA512 c3425fadc1f3b412439beaceb628c46cfee3fa6c5d35f8f766193d0d163aa6ee97722a9bc9c8ea9a5afac344c87728ea4de822b3abfd5c91822494423198970d
TLSH
T1F5D0A731B395F006C2E61976855281A0295E90C621CB41D5A215815D84AC59D67D6386
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 95850d63350e644f88756b3d4e73693b2474d8c94e35108c6ddb8b5e3d3a9550
MD5 ee6391a0a4a4577a6a77aa67d49d4523
SHA1 f7d6b2c89ff3d60f77fa40b040877daf1120e593
SHA512 59f53fd3449df8880d9d1e017b1bb7e51471ec937c8dac4766d6d182f1902ecb09ce1f9ad85fe59ef81a357f82849abae15ad05005d8bdf886b1896339db04fe
TLSH
T1A9D08031B399B445C3D31D77C451C2902D9F60C721CF52C25251511E945D69C76DB347
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b396bd47a8f06145f44e7adccf7ba7b61285fd283e75b2e5c6d3bb116be80b4b
MD5 770ea9e7e35591a7c63e8edc75958f1e
SHA1 8ab8ad092470af4eb00716b1fde4cda7c3dad2a6
SHA512 39e86bf172f642f14d2fb13a5f19d2079956c67c009b0754857e82c0a7e998f2fb032a69c03e55d604b35229ebf67588809dcde569191a8f3ca755722019f5fa
TLSH
T1F5D08031B799F445C3D31D77C850C2903D9F60CB21CF52C25251511E845D69C76DB347
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
MD5 35b0754e7f5b0bef0f59e6474c3c9e30
SHA1 a5dbcd61883043544b184e46e47beb3bf5d259a8
SHA512 0a14f00d3bf385bd104004e3adb021fc5b135483b30669a0f446d235f67bf00d734e76a56ac18adc3d6765163a992c78b2c6833f0e764506a9c06ff2ad8fc90e
TLSH
T1ECD0801452F17C64C2E65975484677153D1DD4E346C3537225A3267C4C461881C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 df6d1a8c99e741451718dee8d3d2839157812eabc535a19352856c2b01f21ac4
MD5 9d8f66c582550e13c78164644ede1f97
SHA1 ecc05e07b992c2a0c9ac865ec04e89a8d25c8901
SHA512 3b22a9e1f469dfe89c755349ee06270d3609084d1cf60e22cc164dc8699187e475db7902b415b918e13341053798214ee2a77807bda1f4ad2a3c6a271b662cd5
SSDEEP 192:xAgNQ0+G83uxXBBK31GkSJpgEJH7DNspUC:xNNQa83uFBBQ1GkSr17DNspUC
TLSH
T11214531F5F752312CE7C803629EA44A35DBDF07F8B52669A78641470CEE3B52606C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5cdbd82fb81c4af8e9e9f9408ffb4b5bdc26eb717a4628bd53244234cc044762
MD5 6742b3b9f1277563483b88d26efb987f
SHA1 bb7bc8df346f5fe6379fc02d28b076c6381804a4
SHA512 1eb98db5299d5be1058f7957c5fc53cacf0b29f6147b6c2b8e066031996ad444b33185c45ce7b94bc2ede76472ebf051f4c47aa396ce7fc1a0c13298cc1cd8ad
SSDEEP 192:sxZMQUnoRHyM//K1Ml8M40/f+shTW7TvNRb+rdpjI/W6+WNB1K/Y0XwwfUENIg5g:sxZynoVg0/f+shTWPaH8/ba/5hM02
TLSH
T1BB72F906AA24497BCCDBD219F9057B93E6F85163E6901E4499FCDA0C04E6BED2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3de8cce3d7f8340fd42307231dc9a27b01b4f4e650ffc27ca596b0b63f36b96a
MD5 d9c58de73b02baa1f67a2c0aabd372c1
SHA1 e99c787da160bf53f2c6f8572b1dcb0c12d3b0d5
SHA512 7a62e12d20fb759f2831d2f133a1dd2ddeb034ba2e34d5cf03c495d263bc1205d6db9dd4e9abb578f807230e35594ed81a1d49cd56e2c17d8560f67e8ccac791
SSDEEP 192:sxZMQUnoRHyM//K1Ml8M40/f+s9TW7TvNRb+rdpjI/W6+WNB1K/Y0XwwfUENIg4J:sxZynoVg0/f+s9TWPaH8/ba/5hM0c
TLSH
T1BC72F906AA24593BCCDBD219F9057B93E6F85163E6901E4499FCDA0C04E6BED2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 9395f3991a48a261484b4148843750e15209f9567049894a27e8dc05f8e51ecf
MD5 a0d6e438ce964b626576ca406caddce9
SHA1 65b853faf0ad4c605f1a569eada2ca2f728dd55c
SHA512 859db231dbb678f68f4878398f6c615153963d06f33f289c9852e687bfe10f6de82a210f9867e70c9b4bebeda6f8a137f204f5ff9b1073dcccdbdde45a66ef5e
SSDEEP 768:a9TTF8J52S47pLuLnYwWRmY4QPU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV32GtfLl/:a9TTF8J52SkEnYwWRmY4QPUu1jaK2GtF
TLSH
T10E031C3F680CCB7E4F804E9CEC26BE9A6DE8018B9698C99447FA444C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index
Size 1KB
SHA256 d2e7fb56a9c1bea06b6f57036b06df05f8a4c9994176dbdc804c04bf796e8a0d
MD5 96caa2506baff3fdfb5a98d80b167a70
SHA1 6c9c223bb2a0e17512ff669e63986e81d9b89371
SHA512 cc3cedf96de4fbfb96d2f843e344f9ea99906f56738701e6837928b0eb5610131ee691248bb513296e89398bcb081d149dd2585b093245ede2e91dcc8361e1d4
TLSH
T11B31C54E9CD94D03CC7285B000F5263C33BC99ED0F88630BA5AC463AAC9F3A66CE3108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b447.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index~RFe58b447.TMP
Size 1KB
SHA256 06e1bac86b5757a9e560ba7dffade8bbf071b884e419b6cb5a035241b477e3e2
MD5 c0b11c15305b5020940bd91ad1f474e1
SHA1 abca9a9d4794b3c8bf1583400b5d739aa3678b2b
SHA512 8e391dbe3540786ae5a69bcd4be7aff7bc1660c4fe579920a22b45f55115d3244247d331af947cc8c8bf0c92c00a4ad3e813fe3b688c4170492cccbe1f88bfe5
TLSH
T12831B49A5C940E13CC60807145CE6129337CE8D51A00AB0B75EC8A33FC9BBB92D93114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a0feea58-0528-4786-bcab-29a71cde3c37\index-dir\the-real-index
Size 72B
SHA256 3d03304d884867efb52304c3fbea892f606c355b467634fdc40e433c9e609772
MD5 ce7b7a4bb8f2aa3f6dfdde532ba78ab4
SHA1 5481ff6e63a881543a7707bf2cda6bf0a63db052
SHA512 05034f848a962f100335312fce4a71a24090f48bd1782559169522fb794b0ab5b5ac67bd8f55142589bf71bac63f740f3f114d479c5aac09628d5c28c612b08e
TLSH
T16BA0025453B55001C90292F0659602413314DF344311D30B51D40044CC527C78DC100E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a0feea58-0528-4786-bcab-29a71cde3c37\index-dir\the-real-index
Size 72B
SHA256 d837d9800ab4e8943da05ab67a50a6ed43191bac557c05ec47b9f739cdb467a0
MD5 ab47fc704dbb98fe666b17857290e813
SHA1 54a2cbeeb84cd536466ddf53388c3e2e3f5750c9
SHA512 35b6bf0b89c5c13e9b79deb9a4656c52cb683a97f806d4c10782f6191c139070b8c3cb19e47c8f0a94f675927ddb4ffea1431ca47d437c7eab32d5b2044a3464
TLSH
T1CEA0029013B28809F05211B1256302432240C91511B2D617A3A54088CC64C60765104C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 28084efd2269304e73edebdba0b21ffc715307eaa36142a7f60d0b5d8723694e
MD5 295ce00935717185e1d0cc4e9a2c9e2f
SHA1 ead2a290c4f385c83c89377edce29cd82a340410
SHA512 3c8312d266df5876cfa6f434051c9d69d49c7b07e0bc3e28afe363ab7a250391cf766d149aed46c0d243e13a9973533fad6fcc9707692ffb6ee7cb4e03230693
SSDEEP 48:F2em5HdYlRqJp6Hmgf51Oep48qmp6HmL51OipYL51OV:F1m5HlJp6Hzbp4gp6H2pj
TLSH
T1C181ACE3CA145053C9C966FB2039F6E4552DCA066BFF87A611BD8F6E92412D63328B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 3d15a2f753cf1ca4bdc15e24fd14229b89de487585fbac4f44b551b028fb1ead
MD5 27ad8a93aadc639a640bb1f0c64a614a
SHA1 99eb05aa12389b985e35f19c2c6194114b0e9e04
SHA512 b391078ff51cb9c83b77abfc9999a46d3ba91321b41fbf7bb46657f994327d1a03c8f84d71cd8bd33fc5495c1b451694062bde6bc3c7aa38198685c636b82622
TLSH
T11DE026D85DCAC1BDE11930A3033D9308C2F4740BE6C83E422F02EE4462C2984B1D36C0
MD5 SHA1 SHA512 TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 119KB
SHA256 9097d307d7b57c93b809f66cb7e4a9df7ecdca86d4af6ac59dc8cbca4271b2e5
MD5 8d45e72fab86ab9dfa39e190c95b853e
SHA1 ad48194ba3b75cd88faceecbc06e33838e3a278d
SHA512 804e2d66ea7993f269c87e48c7341f54375d6c13982ac2f28cc9f41d54cc9970297e147ecc3cbcb276cee01af39768e86fa426e6fe1c8bdb794887ded8bfe48b
SSDEEP 3072:M49K+xPCJWjtG/EezKL/oTXTmR+1eUML/0L/NL/N8L/uL/YfE9sI:M2cdKL/ozTmR+1eUML/0L/NL/N8L/uL7
TLSH
T10BC3A932359C50AB0E89BEA45166B50392BC7467B844E178F21467FC25DBFB013BBEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 207KB
SHA256 1efe539c0dba73127c2f8007d96e0ceb71e0a38cdcb7eb73afb451f1e64b7455
MD5 82af6f00c2cc85d26a5a6c092d5111ce
SHA1 0c6b96515ed4dfff9af67ecc7c6348e0c0a7ca58
SHA512 25d466f615056537f8025ba16c982ccbe4d025ad97deef37ae5ae933f30a53d556e1d1947b6b069b3f23220c0ae03984f4c6465832b27b1683ba5b7e2a141814
SSDEEP 6144:cxO7lg8HhXNkD+4epjKLfxSw182ZCGL/yMEAaPrugT5bi45zyIr7y9L/YL/DL/Ny:48dwVL/1vIr7y9L/YL/DL/NzL/OL/247
TLSH
T106240822231960AFCD1A53FE152B9E1367F44046BFC3E269854153342CAFBE35ADF926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4cb7a47a18c02b34194fc65ea9e26c02aa0178466457946ad77a0d7efcbef67e
MD5 78e497d2af1d4a6d46151b97c4a17821
SHA1 cea0cc4756b8ef37d5cf297b5a9892aff7b14d5c
SHA512 e85238ed2b05c9932ff3e68430483cd0bdb5df77ab5f73ff455e18735a2cf81cec5ba5963fa04b72f30d0c99c7eb4bdb86a834252f67e97fc9ee00089922543f
TLSH
T167A002109A4FEB99C880D67550E9D3547350489D0205573A85ECE1D88CD115153D5141
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590a47.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590a47.TMP
Size 48B
SHA256 4f7d41f210136820f3db01dfee7d6d082d015eb49bfb0735e70451c504920503
MD5 5ebba10f697d09182c10efa0ee73be21
SHA1 e0769b1bc188a7b5267da723e6e6ca4b591e4923
SHA512 550981ca6bb5f78d3258bc66df863b2266f0f00356b772bf29a6e34921074cde269c362aca94c2b1cd438704058534289613dc4b70c40af7d46d408c40c6eee5
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 5941d7610fb399353502b479d5e2094cd6b4d9df965f23fff9aaa5ddb831e50f
MD5 d0bfa7239b1dbc4ab48e9c4c55568aae
SHA1 6cd9ce6e8c6d7fbd0b170cb43db2cc5ae2a37b9d
SHA512 ced2b058e4023d9fec36e210a8281d78831abede5030e6ba75c46c5e8b965200cb8c01b8bf766d2145419e2c7084c09419ea79ab7b09696d6c3b0a7e7a7d4c51
TLSH
T161E0D8E429CEC6BAA14934D7533DE708C1B2740AEBD83EA52B09A54862465847283340
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 86c54e9d75b88ee2dee640ede1550593b37ca4ecb6ae69a6aa76e66a7cda10f2
MD5 f3ea353b2e4885594cebe4d1284eeb87
SHA1 16efb7a1493456f2639f7cc2469cb02d4952da65
SHA512 f53fd0bbfab6572056996223a10ea7f564533b4dfee4649f86ddc3b4ee6f8579211a156c60149041a0e31b95297e8d2f98e9203d5dddf3b8d689b7d664ee6ec1
TLSH
T154E086F859DECA79950860D3437DAB0CC2F0790BA7D83E9A57089441A141188B3E7780
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 8fd2726c106a5e7225cbce39375d8c32e67f224cd8fc0c789dfefbf728e0c33d
MD5 c449882e9310e685d4ffd1d4a057d179
SHA1 92aa85240c0d12313dc857b33b08cd6908286eba
SHA512 d3257c0e742f0457ac4e8a123a1d447ff2562c74403b1b8ae25c712b56a192d0782842b0f6f4d0a1143d70eaac16d76dcf8a062ef8f686e35006bfeffb1c73f8
SSDEEP 96:KwzeKc4mWH2Kc8Cqq4Kz6YuoKD6umB2KqA4:YFBFPIjdN
TLSH
T1F7E1F451727707C03A7E258A85E4B9BF52C134777018A47B7BB812668F26E50DCFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 f3b0d4fd9ff6c15fd01d30b5a6a6c5706f238d6b20990bbca2394415786e73c1
MD5 81a2fb942100b41a029b3092d7da0baa
SHA1 77d5aa4ec58f38a3516aea8f05c50e08f94ed998
SHA512 2dd7d5d53a615d3016d8fc3c88960ba11d257ed242fcc2d766a271fafa4e1f1bc49d831b1430ffbedf84e5737b91cd791810d98b36d837cf2c57ee708fb14cab
SSDEEP 3:3nzlHNllv/etXlGztR/1qvTv4RRftD0td7jdtQfQertbCxlsXtXlGztnh:XzMlGftpR0tdnd5ClGNh
TLSH
T12B424CFF3ECC81D0D871087D8A52EAB436EBD98D9985BE40502A139F1416B21F836E83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 116KB
SHA256 24a1c073880c9466c95ee02132ad47a7ae4b125406625b95ffa6c2bcf7ebb9fb
MD5 250ebbcf88386349303589b3a3cc07a6
SHA1 117758087498b5db9970db9e85448e68a4045362
SHA512 05064e1aa15cf84099a6fa7953f4202fe03e518ed4eb30ecd1e40df6646526200a01f51da4ea24620afb207d283d9e95cc91b6d0753815c1d11168008f14d7dd
SSDEEP 768:DFf8z61hKGmyhDR+4Q8T1NJ27qAifP6o/0dmqUem24Jt6I1n4bbyq5J5Aa//jDQ1:JFe7LGNAjTmdzqK7Y1w50na
TLSH
T1E1C332FB6C0981A7CACDE5B4D80BEE5441B346268A20DDE5A93C04C3777DB023DB65D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 9eae72d0c9c726d4e5fcd757fe2711690e5d228b1eff93502dacc8f8128414f4
MD5 55d28d45675febe54510a258559a393f
SHA1 8f258e00a223a2961582b65064e8115d88bfa3b5
SHA512 5ba5f22eebeb76cf3dd2264356ed956f456efc4c40a48d5d81fc135c56ca5106e40a66f2fdf149984e1b8a1c1dd8b40d16ef12389d6ef101966960f3b4cace2b
SSDEEP 6144:xmQj+mK96KRCVPM+VsCNhuFsD8vzGyTyAz2p4Yh36cNVNhrVDR2vbP2hVHlkRw/Y:rg
TLSH
T15916EEFB7D1941AECACDE074D50BEF5941B346294A24CDD2693C08C37B78B023DB59AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 0bf5edbc518bad88eec44388fbe7d2c3d8fe87f0d6b430bd267c916989317834
MD5 fabe17a3c08318048a384443ff7c32e3
SHA1 ce62447e4ceaab3ff283bad1efcf2ded44fe12b0
SHA512 3f4c6bd82ad602b18d090c5f1be0ae1f45cd2d95fc587608ff3f23bfef7673b1abde13e446cf84f063c06a72cf2f830282f8e574fabe6fb259263b9c75eb8b8f
SSDEEP 192:R1OZRAsSlrHyQ2sLQP19QvIIIebOMIMUbZYcY:uZSso12scHQvIIIebOMIMeB
TLSH
T18542926E2B885B37C24F9FB62256C6501BE98A818D30253D38612C1F8DF3B9747C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 1afe4f697a0c386b42a1f3e2adc40c378993d7b416cde94d4e9e48ddcb93cb92
MD5 f18a65a571d66a3fef8c3de7d23bff0c
SHA1 179cdc594645590e58ad4ded0431af1d757989bd
SHA512 16b1fba269fad130aef275522967cf3f95c6d6493565f62197958659c3e2202cd6d4ba5d8128423b5a5cda9556462b41d4fde1ef2ee60c9d72a596f8f9e4c405
TLSH
T15EE0DFD4A8CAC1AFA0682097033D678DC2C03813FBD83DA61B01A844A241180B6A7291
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 de3ecde0bed975f8a7a192b888d63710d1d8525a6a63bc123b38240fae6e2064
MD5 d87d7c0e84008127bf8e54d19c34786c
SHA1 f77e7ecdb68573cad5f70bec957be54609c09f5b
SHA512 cde8f1f46e9d88ad1e7624923f959429b7e4b5c77c451d2414906848fd9e1389ce7bb027a587557030edf436f0d9b04623935fa49afed760c5e33996dfb93a54
TLSH
T13A212D96F330C145D149463A643E7B291338D5468FF8EE0F447520642F73B440D4B6E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 31c4da0f7b3c30d773aebb051461cfb9e10c450e06254d9953dd72b2daa38046
MD5 8545946fc48263517b8200cf1db8746b
SHA1 525c89403dc04f2773304e04cf74ef0c571c88b3
SHA512 c18e2e6adb687fc629e84745556c3aa46d6406767245255f0efb041f10dedf6619bdaaae68b611a226f9f0e195efc5518e8700ab58a2579d2218d7a2730dd24b
TLSH
T128E04FD4B8CAC2EFD11920B3027DA788D2E13856FAD83E562F069945A581185B29B682
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 eae5023b96ee759cdd5102d12c3430cdeec1eafacd3221ae5eac7533790771bc
MD5 9f6b293cc01e306fdaebe1336b212d8c
SHA1 49ac92b29a80d473ab5339e324dc6ae8d87ee8dc
SHA512 c1886fbc5500f9d4df11e079c3973cf65496b48be592fb1d349c9d211f9f215c20a681cdc303ccb45f7f8c3fc03fc0f524a11e6378f6b9171eba1e1bab234214
SSDEEP 384:nXcXqn68N0tjTYAlFwZukc/Tvw+pxqYOlQ8WX:P65P8Xc/rwekY3X
TLSH
T1D6828D36A8785C3B9DA78646B10B36239FB46077D7942F588DDCBB1C05EE6D8230BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f16b26331ee4a4508f9176ba5b012e40e5f4acefc5b4b9103bcb42c945f5954e
MD5 b1abe9d5b30b7c1ac3e6fb28f0a5f5d7
SHA1 9bacaaf9cc019fcc9fb5ae3d582978e6b82a180c
SHA512 d17572b02c7ac5ce95832a65f8ba31781797de264998c0e33070940402d6dbcb58948c9c0cd54aaa3db38e40acbe298d91f553dfcebafd76fc7a1a922e04e90d
SSDEEP 384:nXcXqn68N3tjTYAlFWZukc/Tvw+pxnILOlQ8WL:P6GPiXc/rwexIL3L
TLSH
T1CB928D32A8685C3B8DA78646B00B36539FB46077D7D42F599DDCBB1C09EE6D8230BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c02567f47257fd63a67a4c03c9cbb4b49e766b9a0cb151772b429530f0e48f4b
MD5 58bde26e8293f8a6453b63a7e55bc44f
SHA1 6108dd34d3a998e69c09b03414657ebf2a0a02ae
SHA512 61c7986345bd964cc25cb99ea2ab78cbd2c5d201d46a29c5608041f6a1a7a71f66bc04aefbe40560eaac301d06f3a1598baa7d386827f0fd396a21faf878274a
SSDEEP 192:MGN96IMGGQmiUzQCExc/Tvw+pxmhA9S66XqWEU6:MGN96GipExc/Tvw+px2YU6
TLSH
T1E3121C327868AC7B5DE3A951F0473533AEA45127DB886FA5D9DC3B1C05EF69C230B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ed0d4b55810240a411812a6a1f09c86831b858e248d24e311c14908d97b8e755
MD5 3be08abf54c8ab0f86733c7165e38842
SHA1 b09fec1eb8007dcf2bc017254bc93cb43af1ef3f
SHA512 d510195789801feab2b98062075d95a9ddc59f9b64528960b3d83c93b53352d93dd903efc527038b4914f71093241c92d82d9df60dcf2e3f94769b7ed66c7bf7
SSDEEP 192:lGNmB6IMGEQmiUybTC6xc/Tvw+phSepWluU6:lGNmB6GUYW6xc/Tvw+pfTU6
TLSH
T11A02D9357C686CBB9EE3AE55B44737339F94206BEA941F98C9D81B1D00DB65C2307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 10cac3ac6b39ac109ad1bd8855e702345633a43cd0c5b7636e3d6bcc7ba31473
MD5 e8200a5085e403f083f0ad9feae60530
SHA1 1644e0f8dd6368f4081290a12560cbc80d0f4087
SHA512 16157405fd9a37634b5849469447cf16fbdff051d8722701ce917d7ab7d0064b3ee76e56cfc7e7402c53943eb2fae13da0d7ba5feff379f5b7b9bbfed0d88c75
SSDEEP 12:TLpOPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isOmQQtudJzQdyzcQAJf:TL85UOl0afDdWec9sJUNGDB5fc
TLSH
T1F592D262BD252023D8DE0B76F94349D00DFD126F89A7B804D9D04D5109A2AC5BA541F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

7b613c0d-314a-42e0-963a-551058a9f311.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7b613c0d-314a-42e0-963a-551058a9f311.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

11f0547e-dfe5-41ef-a2a2-41f9354b078f.tmp

Path C:\Users\Admin\AppData\Local\Temp\11f0547e-dfe5-41ef-a2a2-41f9354b078f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d396127e-e7f4-4dbc-92e2-bcc94008ba12.tmp

Path C:\Users\Admin\AppData\Local\Temp\d396127e-e7f4-4dbc-92e2-bcc94008ba12.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec219480-d922-4794-b32e-f6c4a46e9a5c.tmp

Path C:\Users\Admin\AppData\Local\Temp\ec219480-d922-4794-b32e-f6c4a46e9a5c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4596_1160733252\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zXCZrcSUHsRx

Path C:\Users\Admin\AppData\Local\Temp\zXCZrcSUHsRx
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1500-526-0x000001CEB54D0000-0x000001CEB557F000-memory.dmp

Download

memory/1672-1253-0x00000222D2A00000-0x00000222D2AAF000-memory.dmp

Download

memory/1940-1351-0x0000026344160000-0x000002634420F000-memory.dmp

Download

memory/2904-33-0x000001D5BF830000-0x000001D5BF8DF000-memory.dmp

Download

memory/3088-17-0x000001DD79A70000-0x000001DD79B1F000-memory.dmp

Download

memory/3120-535-0x000002011A2F0000-0x000002011A39F000-memory.dmp

Download

memory/3952-34-0x000001FA85F50000-0x000001FA85FFF000-memory.dmp

Download

memory/4064-1368-0x0000017721960000-0x0000017721A0F000-memory.dmp

Download

memory/4900-1292-0x000002186D860000-0x000002186D90F000-memory.dmp

Download

memory/5028-101-0x0000020984D60000-0x0000020984E0F000-memory.dmp

Download