vidar | 86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/05/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
Size 2.8MB
Sample260501-2fvxqaew8v
SHA256 86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624
MD5 c7d9ae5644d25ac79df9f7464eb66cd9
SHA1 4795df3aa81ac11c64deb8e2e6d307a9ac3e0007
SHA512 3b9332d473056c389f65f83a34a3325072cbd2cbec13d1250ab58fee04d5ba4315ae587cd558f3cd8234b2556e9b42b6961f6011f260c0621c1e600ce0ef3f5d
SSDEEP 24576:Bq7sDotPqIB61kK+5k/pG1wHk5Us4S77gXBFDasx5zNlL6Fhele5n92jcZucYMXG:Bq7sMhqB1kKD/pGeE54SADBCOddd
TLSH
T18FD57C07789104F8C09AF33194F67A95FB35B80847393BE72B525EB42E7A3C09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery vidar spyware stealer

Malware Config

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/3212-1-0x0000000140000000-0x0000000140104000-memory.dmp	family_vidar_v15
behavioral2/memory/3212-13-0x0000000140000000-0x0000000140104000-memory.dmp	family_vidar_v15

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4404	msedge.exe
3140	msedge.exe
1248	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134221484069476294"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{99C52EA9-01EC-49FA-8717-FC5CF5434E38}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3624	chrome.exe
3624	chrome.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe
Token: SeShutdownPrivilege	3624	chrome.exe
Token: SeCreatePagefilePrivilege	3624	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
3624	chrome.exe
4720	msedge.exe
4720	msedge.exe
2328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3624	3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe	79
PID 3624 wrote to memory of 612	3624	chrome.exe	80
PID 3212 wrote to memory of 3624	3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe	79
PID 3624 wrote to memory of 352	3624	chrome.exe	81
PID 3624 wrote to memory of 352	3624	chrome.exe	81
PID 3624 wrote to memory of 1248	3624	chrome.exe	82
PID 3624 wrote to memory of 1960	3624	chrome.exe	83
PID 3624 wrote to memory of 1960	3624	chrome.exe	83
PID 3624 wrote to memory of 2276	3624	chrome.exe	84
PID 3624 wrote to memory of 4504	3624	chrome.exe	85
PID 3624 wrote to memory of 2276	3624	chrome.exe	84
PID 3624 wrote to memory of 4504	3624	chrome.exe	85
PID 3624 wrote to memory of 2540	3624	chrome.exe	86
PID 3624 wrote to memory of 2540	3624	chrome.exe	86
PID 3624 wrote to memory of 3360	3624	chrome.exe	89
PID 3624 wrote to memory of 3360	3624	chrome.exe	89
PID 3624 wrote to memory of 1376	3624	chrome.exe	91
PID 3212 wrote to memory of 4720	3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe	93
PID 4720 wrote to memory of 4688	4720	msedge.exe	94
PID 3212 wrote to memory of 4720	3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe	93
PID 4720 wrote to memory of 4404	4720	msedge.exe	95
PID 4720 wrote to memory of 3584	4720	msedge.exe	96
PID 4720 wrote to memory of 3584	4720	msedge.exe	96
PID 4720 wrote to memory of 3584	4720	msedge.exe	96
PID 4720 wrote to memory of 2836	4720	msedge.exe	97
PID 4720 wrote to memory of 2836	4720	msedge.exe	97
PID 4720 wrote to memory of 840	4720	msedge.exe	98
PID 4720 wrote to memory of 840	4720	msedge.exe	98
PID 4720 wrote to memory of 2964	4720	msedge.exe	99
PID 4720 wrote to memory of 840	4720	msedge.exe	98
PID 4720 wrote to memory of 2964	4720	msedge.exe	99
PID 4720 wrote to memory of 2964	4720	msedge.exe	99
PID 4720 wrote to memory of 5060	4720	msedge.exe	101
PID 4720 wrote to memory of 1644	4720	msedge.exe	102
PID 4720 wrote to memory of 756	4720	msedge.exe	103
PID 4720 wrote to memory of 3716	4720	msedge.exe	104
PID 4720 wrote to memory of 5060	4720	msedge.exe	101
PID 4720 wrote to memory of 5060	4720	msedge.exe	101
PID 4720 wrote to memory of 1644	4720	msedge.exe	102
PID 4720 wrote to memory of 1644	4720	msedge.exe	102
PID 4720 wrote to memory of 756	4720	msedge.exe	103
PID 4720 wrote to memory of 756	4720	msedge.exe	103
PID 4720 wrote to memory of 3716	4720	msedge.exe	104
PID 4720 wrote to memory of 3716	4720	msedge.exe	104
PID 4720 wrote to memory of 3996	4720	msedge.exe	105
PID 4720 wrote to memory of 3996	4720	msedge.exe	105
PID 4720 wrote to memory of 4084	4720	msedge.exe	106
PID 4720 wrote to memory of 4084	4720	msedge.exe	106
PID 4720 wrote to memory of 736	4720	msedge.exe	107
PID 4720 wrote to memory of 3308	4720	msedge.exe	108
PID 4720 wrote to memory of 736	4720	msedge.exe	107
PID 4720 wrote to memory of 3308	4720	msedge.exe	108
PID 4720 wrote to memory of 4772	4720	msedge.exe	110
PID 4720 wrote to memory of 3628	4720	msedge.exe	111
PID 4720 wrote to memory of 3420	4720	msedge.exe	112
PID 4720 wrote to memory of 3420	4720	msedge.exe	112
PID 4720 wrote to memory of 2496	4720	msedge.exe	113
PID 4720 wrote to memory of 2404	4720	msedge.exe	114
PID 4720 wrote to memory of 1532	4720	msedge.exe	115
PID 3212 wrote to memory of 2328	3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe	116
PID 2328 wrote to memory of 4412	2328	msedge.exe	117
PID 3212 wrote to memory of 2328	3212	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe	116
PID 2328 wrote to memory of 3140	2328	msedge.exe	118
PID 2328 wrote to memory of 2220	2328	msedge.exe	119

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe

C:\Users\Admin\AppData\Local\Temp\_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
"C:\Users\Admin\AppData\Local\Temp\_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc467c728,0x7ffbc467c734,0x7ffbc467c740
    3⤵
    PID:612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,12827486125305160115,17523966828029941821,262144 --field-trial-handle=1892,i,2987438613868047391,4551376670123576733,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1880 /prefetch:2
    3⤵
    PID:352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,10661378895296815242,17051551811483094468,524288 --field-trial-handle=1892,i,2987438613868047391,4551376670123576733,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2236 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,3380226145530890693,4920905035701394384,524288 --field-trial-handle=1892,i,2987438613868047391,4551376670123576733,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2396 /prefetch:13
    3⤵
    PID:1960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,17646051733977768305,859569005912168368,2097152 --field-trial-handle=1892,i,2987438613868047391,4551376670123576733,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:2276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,9233961408943071364,9669245577872241736,2097152 --field-trial-handle=1892,i,2987438613868047391,4551376670123576733,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:4504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4224,i,13776182095157503394,9539773044798124440,2097152 --field-trial-handle=1892,i,2987438613868047391,4551376670123576733,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4236 /prefetch:9
    3⤵
    PID:2540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4616,i,5690426857483931606,11513600313123059667,2097152 --field-trial-handle=1892,i,2987438613868047391,4551376670123576733,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4632 /prefetch:1
    3⤵
    PID:3360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,5989124107889346801,2204262301934651852,524288 --field-trial-handle=1892,i,2987438613868047391,4551376670123576733,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffbb5fbc188,0x7ffbb5fbc194,0x7ffbb5fbc1a0
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,1143267359374471432,18210417271445963731,524288 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,7276796208070225596,11878488836074541510,262144 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,12242646593498426819,8593000915781563724,524288 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:13
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,13967466879633948578,5137794080057212568,2097152 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,4839472129371299846,11470792144631284894,2097152 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,3519466643603586872,9931231062870121040,2097152 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,15550049043540609082,16276115213712958950,2097152 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4196,i,15928026473054906966,11103687340215683104,2097152 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4212,i,10641802687588210214,10787925067376370331,2097152 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,1589386545238420204,11231858690186502957,524288 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,17490516521264547202,16819056540046708302,524288 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,16571472048659543376,12159006611398409651,524288 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,13254957685111485468,8983450690113856088,524288 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,13493746134085576899,3554991501781308456,524288 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,13493746134085576899,3554991501781308456,524288 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,16986694262067598829,14006201895752966339,524288 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
    3⤵
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,16304385055373226544,6275151794110804226,524288 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,15849539112203414981,175612949539315081,524288 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,11026370812358161833,15106757685447980662,524288 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,8403432615700298920,11065425223124931328,524288 --field-trial-handle=2128,i,17262322555320922328,1400068952826469173,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:14
    3⤵
    PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffbb5fbc188,0x7ffbb5fbc194,0x7ffbb5fbc1a0
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,5361166515136412363,4718987003722329865,524288 --field-trial-handle=2208,i,15037605609255014190,5642823533129530489,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,1918742745222054648,10925512113364966230,262144 --field-trial-handle=2208,i,15037605609255014190,5642823533129530489,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,3770617453728912412,3481867815428122290,524288 --field-trial-handle=2208,i,15037605609255014190,5642823533129530489,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:13
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,12460753463106853619,9255025900149106829,2097152 --field-trial-handle=2208,i,15037605609255014190,5642823533129530489,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,8761463535635553269,9762365545339938429,2097152 --field-trial-handle=2208,i,15037605609255014190,5642823533129530489,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,3896761442776556475,3753775324618659636,524288 --field-trial-handle=2208,i,15037605609255014190,5642823533129530489,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,10605119025875059658,15304967987963191696,524288 --field-trial-handle=2208,i,15037605609255014190,5642823533129530489,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
    3⤵
    PID:4280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2d6d9750c322f1f95e3f249d59b7f6138cca8ea5de7211fd6ac11c02b99de51f
MD5 74744a6e90719ef9b4b17df77db30242
SHA1 f8fab99c797795cc987bf8fba7369c606e1ca667
SHA512 65a74bfeb37c823a9bb9dee327400831fb9d677a320933e995bd797a01c794570cd0a81b4670a16406c17468b83ba8bb80bf6821a7d23985712d02e4a428b100
TLSH
T139E02BD9D921D8271CFD1769A0554B57F720136B2740984F3B3C810C4FB062B05C986C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0f14e26d944d07138e298dfa53c9a7395cc013359af1973ed3df45fa95c5c5b5
MD5 7c8565bf1b95c70cb386c6685ee4cd57
SHA1 5a889e05d4b639cf27ae7612aa07e0fdd2d4c6ff
SHA512 2ab7dc765c5cac5a844909b189c37bcef93223bf53d97b411d263e9f6b6188bba14955cf1846007bb2eaef25210551aa67b6aa2997287ecedda17a144bca09cc
SSDEEP 192:SRW3la8W7wHv7ApAPRp2w9qHsb+WNnTR02GQeA/rIMQTa8VyIsnAUgtaJ:SRW3/tPsUXz4w90K/kbaY8
TLSH
T11142D82EB91875375CC7D219F965B753E7F5103221942E88EBF88A1C05E76CC622B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 02fa3748cc960b0ed806669146286ae61d8f8c37c72e1c20fff625c9b568d7c5
MD5 e1d791f76039330e35fa0e1827d639ea
SHA1 a37e7b6749565fdef84e626eb8e8ab5cfd1eaf09
SHA512 4cd2d4ec371de591ed8fc49a3c9c69bf2d80c0d8879044f55af268ee4a35e216538e529304db502c0dc2822c3e20cfadd9949c623d30489800bbc0cdffa3ddcc
SSDEEP 384:2Mjqt7KxkXqKf/pUZNCgVLH2Hfgslo67pLuLcifklXODqt+ErU3sjHG9TDWxSal2:2Aqt7KxkXqKf/pUZNCgVLH2Hfgsq67pU
TLSH
T1B672E8676C0C9D7B0F94C58CD8267E4FADB9024B65ED886483FA582A03D5BDF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0fe7d936d3136e0acbeb8901110f551bcd5090d7f4a4961d37dfe43744229d70
MD5 8d19965b2f8fd3a715a11ff2f2dae0b0
SHA1 149fd8cb33b36b7788b9d14be6f2d702fc480816
SHA512 b8348cf8460a5b537da8d64a86dabee5f8419e52127c57f5140c663ef6ab576979a13f271b717ff3963f3d59a1aedd2abf3e65ae75f43421fdd62f9ab998ef49
TLSH
T151B0125484025531C00302F826CA44DC31549F519705270153E0ADF5F8261D080241A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598275.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe598275.TMP
Size 96B
SHA256 8b694ed49e38942a837161a64f846703921b14aec5b6d0070484f957e290da77
MD5 caf111417ab5145d95150649f1b4be2d
SHA1 7fcae719f6da5e0d09119b1d3098bbe14bb942ce
SHA512 e09395d55983a01ef0a7baa05eb1ca385c5536e74630edf9b813c7cf7d090587e6cf312e6f988e876e69be6b2a5284242fb1455b78b4fda1fa9fbbd9ef4168fa
TLSH
T115B00255D102A326C44203B03DDA95DD71A4DF2BD6231316A2E05BAADC25B604526570
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 d8afb17340747f374652dc9508ffd74352d01cbac7a190f858c5367604def0b9
MD5 4270a9a082a17cba7f318f7aee0b36fb
SHA1 2851826cdce7f4e6395e954ee135943637a79c6f
SHA512 c54caf83b6ba61b286133a5539c3d6d06d73795baec78aa899a08007e969953e92f8e016b834005db5cd6569233550fe6ebfe4ed7e904f9b83b657db5ab09f58
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2O7pX6Jpq4VumjPBwkLl:jeuvBnhJsueMEGvIW1DcP2O1gbVumdn5
TLSH
T143D3864B3A747002EDE59A722CE0547B5E3CB16D8F55E5D428B620588EF2923A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 db12d26164eb2909ba2c1f91598ffbecb5b99ab238aa32f1e73af12a1d91630a
MD5 1fcd56010c4f1cbff7f05666db0d515f
SHA1 7ed91dc208790476c10ec52142186ef5d3fa0922
SHA512 eb33c1036be04a268cd495431fd40f9bba89b03ee58b78637119b31ee3d83c2fa2dbfcaf8611fe5d5518bb962273f13aa5d2e81eb9cf2a4444414005d645eeff
SSDEEP 3072:mZb0yjqIU3g6dKpWpNnswhJRspz7HbtRJITxs++J3qUQm08KMWF0bFTcVHr6z0:igyjqId6YpW7Bw7Gs++JjcMW2VcVL/
TLSH
T181141255AD1DED3F731992E560178E370DF098EA0865A0BC30CB3B4B09AA3C6426B5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 43ef78afa82a45e202ca83c98de54be821ed85b169c7e3b227bb9051a4a7f36d
MD5 69e958580ad63ebe24f37419ce51df64
SHA1 c92cbec84e6b59693cb09eabd6a7191dcc55e9b7
SHA512 33097b670b29af9eaf2171fea9ab7087068b0504a944d0bdef16dea46d34661f49b7faa7e0ee422cffd019a98cb45f0e4a0b7c40129a43a1221257c7faf88c22
SSDEEP 1536:hZHP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:n++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T13C9312BA591E7D79636AC296D007DCAC8CE3CCCE1514557C30C7AB1E18BA393A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 292255856bfb4d1886ef5501a74f9a8f32029861d1ec4415f70cfee9fe6efca5
MD5 e607610a4576cc6d7957ba4993ac3118
SHA1 7072dc052ee6208420c72cace8189b8aef169e5a
SHA512 94cdb6d49ba2428b808140936d8c07ff43e30d48c4af03ee922d5ed91516bc181f4cf93763c397823772887983622c818368a44f058fcdf4c124540c8a8513d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7f:fwUQC5VwBIiElEd2K57P7f
TLSH
T1BBB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 31a139f100a2534a6bea2e79c671ee2ad96bed8aea6f9a46e54d67492dfd9fbc
MD5 93162e4c9a58670155630040e3ff71bf
SHA1 72d1992a7d76ad8c4bbbc352f9f533b5491097b9
SHA512 9dcec067bb46a6f4d085d610bae5cc04e985dc45940f271a1852179c8fc5aee8ca5467818d5678eb12e21b5e582261ee16cc1da8b58885767f776b0d8d655ca8
TLSH
T1C1D0C0347A54D403C0C10DB2B840C3813BF220CA308F9BC01172840D468035AA3EF196
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 717eb4940c7fbe87ab8f0b600d1104c8a67cd4b09b0beada521544a45bbe175d
MD5 e9e994edd7a4b5a78b7b4a8f74bbf493
SHA1 df0475a3ce64d76335fb0863982edfd1a11e70b3
SHA512 d35a1536d171822e132b7f0c00b30e123c9a419e2c6192fd28ef0dd75cdabb6e20eeb4fa7c6c6085b4ad1cdf846fedf1ff5eb9437a48a09c77a49de91da73af5
TLSH
T10CD0C02C00F15C25C4C489702840FB063F34D023140B9F3128F32C6C0D42382445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72b205beb453f50e17a365601deeef9544c1fb0a6c7471fff4fe6b93111db2cf
MD5 4545a4b7e84bcd1f6c7395a6930d3c6b
SHA1 26e12977a65c318160cfc591f3cc6ac9c106ebef
SHA512 789954b86c2f406bc6b7f62fd9619c8e956d66ddac2ac5afb6d58654154278baf2404cd620e207faa1dc05510f158069b79ca441afa4f99edcf4da9fa519cfd6
TLSH
T10DD0C02C00B15C25C0C489702841FB063F34D023140B5F3028F32C6C0D41342445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef90c39630cd07297e313bdc2fffa140cb5c63f86b4a79b5cd3e9ee6887a6bc6
MD5 a1a8af2d775c15850afe2068d7aa9cfc
SHA1 8ba936e51146ebce1229c44cfe8aa5eea50b7ee5
SHA512 5b97d5235fb6a599a6aa4b0913291305196d7d66e8387da82a611e19cfe8441e570d356c78398cab537ac841cd48436ac6224ff9df1210cd0e170649db3e3ec1
TLSH
T109D023347255D407D09504B27551C2913FB6514630CF9BD0E226944D56D835FA3EB1D6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e39cd162fe9d2866669faf9470cf2ced7bb102a61d36e89edb984ccb3ef7ea30
MD5 2f9d781ed0340c9fdb6082df0fe6a85b
SHA1 8a4d0d7d04d5b126376c2c746488c9c7ce4ab9b7
SHA512 86e19b827c80e217195efe2652ff97336e2b56c6dfb8047ccde2c5b00c75c05bbcd2a4bc621e1748263709d07973ec4cc69ba36360e81f3750e82cd694024c26
TLSH
T19AD0803476559447C1C50DB27440C7816BF66186309F9BC15172940D569475AA3EF196
MD5 SHA1 SHA512 TLSH

Submit Download

2c2ee8d7-e8d9-48c0-80f0-40c4ca101da5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c2ee8d7-e8d9-48c0-80f0-40c4ca101da5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 65dc284b0abc6576d207439276cb1bb8a8b9b8f288f6c64fa08184ca472865b5
MD5 c621da2bc051ec9c54a99c9b69e1d9c7
SHA1 3463c4b149e3f31d49373bae9ae5edc20f9e8c31
SHA512 a2ea404e5765309314c956c5daf723c1f170f907143a2f47a9bef2dedb5529e7567548af000fa308ee61c415c7a164384e4b73e132e2de6ae39069b48467764a
SSDEEP 384:JBnB3tY5ZobsAZd/jnKmp8NjdF7vEXlVz1vXYKMOOtx1Gg09e1:JxB3tYTQsAXjKmp8xHEXlVyJR1Z09
TLSH
T154132C3DBA289C27CAC385FC1C5F5A7C2770CA25DBC851BB367274D21B1A35E2A1E116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 811b35895ddcb0f32070f378c91834fe553673d037ed9fe8500ae48091b5beeb
MD5 8fd035410b496d5cedda4b660a03178c
SHA1 d60b681cfeeb157fa64b7184c224e6fb95454c3c
SHA512 bfb32d35d2e677b6c29124edc40dd5aaa898b40bec77117c94fa149c11ad75a1d2d27d5deaaff54fd55d3f78b08a01246c01d7a301f794313694be02c95f2338
SSDEEP 3072:sBpGowHtEJBc0Ug2DRUL/mL/kzML/6nL/sL/:UpGHHs2D6L/mL/kzML/6nL/sL/
TLSH
T1B1B45DF74951A01BCFA852F5E2133E2DD177050D2DE1E8E9E63C0CD52829B32B6BDA94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 279c72e986572a729b85514d89f46dbed7359ed21ebfafdeea9629fe0a6edf78
MD5 8c4f8f1d6e136f701a49ef1363bd454c
SHA1 c3cd12c193062446690e7a6275e25ca33101b054
SHA512 5d602b89d027881cffcc8843b08556ebf201e7e392d3539ac07777fcf6f7412f3fa0c3b45b426e0a3a34a9868c9276a8e51f9ff97104290942c759dfba597404
SSDEEP 6144:I5JGl8EaVrIqUHZGjX5yfuCcxeoWJPFvI63z:I5SDaVrIqUHZQX5CcQoWJ9Q6j
TLSH
T130254BEECB282C83DE6B8A70B4E0EC177D702183B659D0D39844C5D497967C176EA2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 ac47a053b85051e5283a808e15858d7726d07b2efb4d1806de744606064fff9c
MD5 6f95683f26d36cceca4e58af54a17608
SHA1 4f6ee9b3ecf348ca666f6064443be4860ab529e7
SHA512 f4cc6c3da6aa33509d32b2cfde05a22453a3d2b1f2d41bcc937cca82d4c2e143bbf089e63478789c81e96eaf65c49de0cc49d7c787acfdadb2fda7f9ce097499
SSDEEP 49152:c6jiu4aIiz+kMNk5kb5Sid0LiMqmUrAa57A5eY2:XlDhz3ATIiQrOA5eT
TLSH
T145868EEDCA6858C3CE639970B4F0ED477C7413C3B955C1D2889CC68402AB7C5BBAA66D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 d400f01292ff03daa016cda786fb6a93225493b961fda83ee1c0ddfc2e1b0bad
MD5 b482777b9d51a89dd88b3be3276ba34f
SHA1 bd9b79b306405745146b31bebe5e3b71f6820f40
SHA512 224a003e657be9bb1eafff671bc9e6c3a6030079676e71dc66af5206044d30e7eb3d4493a15b139d1d0021ba1407e86f1c83ce19c3ec86d5ee6b1de5899510d1
SSDEEP 96:O+2jxDcwa0XXsGksovM31EdUOSfrIdszY7bbZrk:O+2dDcwa0HsFM31EdUPfrICzyfZw
TLSH
T1C0C154B4E0826233DFD24AF885FF3ADD7927C949A9371B7731A406EC571229493726C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a0725.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0725.TMP
Size 3KB
SHA256 1c1c667bf99d679c25036010476aca7bcfb457bd77e68464decf3223972e5717
MD5 cd35d30025cb9a482cc008a243291a9f
SHA1 f1c4f7dd4d317bd662d19447f9fea919584c99e8
SHA512 5ca9a1ff141201be1413824f98e42cbc2d864dcfa474c98569cdfba9677c4f1fd9a4f3ae5ef74d4a329e766b5e64549c044f198de15a0446adf28ae7e565c232
TLSH
T1F971B3C47280A03AEFE751BC12FF12D67A674949A97B0F7735944A3C9B02B15A3B3A04
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 912B
SHA256 5b8b95bcfc5166dae664a63a04cce2c7181632bb2aa16ee3eceb52dbc24ab359
MD5 31f2fda68069960fc373111b3b077fe8
SHA1 261eee6c07a38136aecdf18edd8561fe6e770935
SHA512 9ba0c6d6e5bc149a052565c05fd051088a61e04012f246975055fb716b43b519f150543f1b20df171407eb43bbed922668b3d0e510348abb0f2bd93ef6ea3ab9
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 1dd3b3fa8974e25e3f6d96cba910a6a770a94f0075b6f56695d9b6091ccd5e21
MD5 73bc2818720ae08fdadae1c7ab025d1b
SHA1 cce0ead8caf15269686873b899dc2ec63db9ae59
SHA512 3e1977567da0c3f25380c2e90b50fdbbf27eee0c2c94263a485b5ddad764214f022ab7406a0e8cb3f6a33e84d3b09d993feca8cdba1a9f45e698f59869f8fcf7
TLSH
T162E0200414C8C339E419BCE747BB5708C2D53853A2843E421F0CCC447242D8563FE261
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 3KB
SHA256 afcadee104d399f7fd9ba5ffe50a1e8e3106260f26f5e363373e7a6239241a9f
MD5 495191825d9c4b59cb4cc9ff5e43b253
SHA1 b605e6465fa3220750c3bad3d9b51d0284a1a48f
SHA512 a509e53f3d9dd6de15280755af9b83dd5532e6cc9ae7ddab81118f4d76cf53c5f8636cad85898a8f9ff315d407a93c06f93fe7144fb746ec3762b25d4b74c4ca
TLSH
T1518162FB281C9866C7CA40D84943BDE6C61724BC9FDCEECCE0BC68E766611787528095
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 8fb5882663ceba04314357176f6e63b238ce00d712a5044eb495e2c051cc3256
MD5 c78aac05d7326b3de3b7a101d74ea0fd
SHA1 e5df66da727c1b317ae5320312b31f08b32a66c3
SHA512 84b629543b6bba4393c1377262756f300fce87dc8a1a2b4b177d054b52ddbbfe4775e585ecdffadc3abdccb17fe081155c9bbaca075a283d3557ae38b001d6c0
TLSH
T13FE0D86045EDC319A10668CB53697B08C3E5385BEB88AF816F05D840B191458E7EA5E7
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bef75f1e21ec3c46b670d00af9315a9b151ec999779f03f557ce37e1e488db28
MD5 f709d114b89dd7b9211534b9127669f6
SHA1 17f28992ff37b0b46db712647188b5c4134de334
SHA512 d0500fa4f014f4f318169ac18abfb5ca2f264ec62d26131b80f6c4c7aa4ed98703fca3e797ad250a0e2d1358ec2d6f88c440003623452163e0becfecfae9f8bb
SSDEEP 192:sxZ2QUnJRpyM//K1Ml8M4L/fvshAxHBDbDOqcdpjc/W6+WNBSY/Y0Fss4IJIg5AJ:sxZInJDgL/fvshAxJMQ/bT/59K
TLSH
T12062E8026A689977CCD7C618F906BB93D5F81563E6944E4899FCCE0C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f4c51bb2340f1f60b4bdecc110de978ed7ffe48137149818bd209d32346508a9
MD5 40d4261050572b3bcab52e4a5e5e55b2
SHA1 852152109281bdea1428cdad8100bf5d4df2a9f0
SHA512 6a49accd671dd719a8e11aa85ec7d729a645c7d113bd669473bcc4028d0ffff3b4ff46c7fe308dba58ea504ed00c56181bc5c0005232d63e385db866f8605899
SSDEEP 192:sxZ2QUnJRpyM//K1Ml8M4L/fvsoAxHBDbDOqcdpjc/W6+WNBSY/Y0Fss4IJIg4J:sxZInJDgL/fvsoAxJMQ/bT/59c
TLSH
T11F62E8026A68997BCCD7C618F906BB93D5F81563E6944E48D9FCCE0C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8e029c4ac98f954154ebda996578bcf922cd7e2f56bfab49314d3c530ae402b5
MD5 63adcad53c3860d87a847dae89cc132b
SHA1 9c6672368c63a81001ab4f9f18f92ac6a2e69bf0
SHA512 553f838fa1c2fa61a304e8fc6f12aa6919e9c825902a0b73fa69b9404db8375d5abfe0b350a841e2fa21ab081dab83bd0c54d9e937539020e4d30e79312838d5
SSDEEP 768:G2P7x8t12K0WRmoMQ3A8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KzLl/cK0FNVrom8:G2P7x8t12K0WRmoMQ3Au1jaKKzLpcTFQ
TLSH
T1D6E22A3B284CC77E4F844EACDC26AF966DD801CBA6684D5447FA884C03C77EF551A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5afae500-fe9b-42d0-a795-36bba5dce15d\index-dir\the-real-index
Size 72B
SHA256 6897972332163de67e822ae9f11646b49886a1b27f7ff292219bf4b4217f157b
MD5 d3f9bd091fe995916c50faef94a50ad6
SHA1 dac211887a4204deb711f79a9fcdea06f4b294c7
SHA512 e933a873c7e73effd0ccfaaf0dd657b3ca42499eff68e981878e0845a0ac204656f15474813a01675ad6426cde778435f660c35fa8eeb73176ef77cf99fd7fe4
TLSH
T1D2A0025816A10522C0225AF4659E85853718CD3647851327D3D115ADCC505C54D4705C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ef77.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5afae500-fe9b-42d0-a795-36bba5dce15d\index-dir\the-real-index~RFe59ef77.TMP
Size 72B
SHA256 e993fe634518af95eb30f5394dfba3c81e65f838f8a29c359ec6e11f3fe2e0e1
MD5 4a2586bc180c1a5a8dd712682ee59c13
SHA1 88ccd674bcd4cd4ac59ef4d9b122c557ddede0dc
SHA512 1d68fdcb208c27c17733b932833d08d18bc8e9216855d507ab22e157fc66dbb0919859e390602a4b199b631023b7062f8ad58ac7d83eefe029f27875c97cd9e3
TLSH
T16DA0029043E60C05E45256B1569702511750C8212133DA2756910544CD60C44A54110C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b3dc032b-db74-4f99-95f8-e190726495b6\index-dir\the-real-index
Size 3KB
SHA256 82b7a2ca3f973c5cce49944e0fa06f79e0c4a1753e2139f5ad3e0b59b56fb1a2
MD5 a3ec103ca89690ac0a937feb31954578
SHA1 d5cfbf53bbbb502daf9e234dcf6213d5e7f0167d
SHA512 e24294cd3dc3edfe021c8860d24b1a7f7b5bce5538362284c7e247315b16bde0ca7ff8a76ce55342590c762cf85dd5a09acc63574bd2c9951a8178eba48563d1
TLSH
T15851C58C5C4B5BA6C9AC85B216F20499337809DC67B09A075C7C623CB4DB73A0E9A759
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fe2c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b3dc032b-db74-4f99-95f8-e190726495b6\index-dir\the-real-index~RFe59fe2c.TMP
Size 2KB
SHA256 d6bb7d3f0a5e8845aec47d6fcec3f59168d82c462ae6f5cc42ead1c93654f921
MD5 b20f85606eeae4398cda5091a00859f8
SHA1 02122eb503d2067343a7159df687a20529f647bd
SHA512 59142f5add09af46347dc8027d61c5eade2e251b20a9f7285209e041b93fd4a031edb414ac0f927fa0c720c072aed452c715a0d6a32b71ea8e1a561db21b9745
TLSH
T1A251B75E9C430A32C9A095B399CA5469333D68554949AF0B35FCCA33ACC37AD3D56384
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 c3dc31c66822db4d124c1b6d06c56e7139e6b6dd6a34dc4f78141ec17d82c3ed
MD5 e97134f5830e884a8c7666ef3f7eb22b
SHA1 5af7605bcda6cccd958bb3bafcbd418529f686d3
SHA512 0f77917168e3fa35ce93f58afae7ad698fdee31b64e653a6293aad4d870275ca576bb917120e1ccd752de88c4709578b37272a1b86dc81ddf19583be1fcf58dd
TLSH
T173F05CBB2EFB1824FCBFC3EA2472406004427814C540FC8F116AA19764F63183095C63
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 20KB
SHA256 436c0f9959758195e0c3cf729952c6da72c33d8faab69f5bf3c8164ba4c84fc7
MD5 bac7479a7e639e3eaa4bf56f0b128dc3
SHA1 bc6956d0d05dae94134da8ac713606df5404d56a
SHA512 290f6669a6eac02fbdb82b63caf7b1d28a348627962e2320e2bc2e3d80ee4361b7a1f7aa535f2063940f0e744cba867061d8b72e9839e17ac74f4bc9edcc3cfe
SSDEEP 192:F1YHoWM5Z4/4XW95Z4/JWe5Z4/QHiXBbI9IYfE:F1QXM56/4G956/8e56/QHiXBbI9IYfE
TLSH
T1579210A69B11E08384C4B7EB1036F5D9991EDA437AFF8BA142ED8F6D91413D36324B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 bddd7114768ce6b1613ac00fce5e72df17d07c31a60b0359913f0bd4290565e6
MD5 70bac35f20106a6126117a25386c7391
SHA1 d5da711fca095c97b2b083809517239288bcef71
SHA512 5a2c8f06f81412cd60bb0b6876ed335cf063575cd8fc4eeff83dee2184db670ce34148025f5d0f71514dd519959b4b6838cfaf740da0a2f085613532c77f7785
TLSH
T1CCE0D86005C4C279B01768D306AAD30CC2DEB867E3C93F815F00D844534794872FA260
MD5 SHA1 SHA512 TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 119KB
SHA256 455cfd184853e59d287c96afb5f99c251d052c67b44ddbdc6fa942e49c59ca57
MD5 afc209210d984923f4ee8cb5d4db869a
SHA1 14fd6c9d8659136af2c539c015a0ffeb9e6a0186
SHA512 2ffbc83d06dc3ad94bd842bca671105353a31b150ea45cc77a7cdfdb34ccd2717104bd3991167c01732bba28f0f069cac19f5a8f6bc2dadca82e2343ce3300f2
SSDEEP 3072:T49K+xPCJWjtG/EezKL/oTXTmlZekewL/NL/6hL/TL/dL/FXBkr0vj:T2cdKL/ozTmlZekewL/NL/6hL/TL/dLb
TLSH
T1F8C3AA32769C50AB0E89BEA45116B50352BC7467B844E178F214A7FC25DBFB013BBEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 207KB
SHA256 aaec0c1c086b9beb0ceb6b4dcbd941dbda498f1e512b3296b5943cae5c559d5a
MD5 8e016903e7d9113c68bade9ba0cf6d9a
SHA1 a545402304e124df429f09867e5d31f6a0db72bb
SHA512 7f8c7f287c5931bef58b2bf06a21e91e088bcf2109ce4589e3d70dd550da994347195ab58f27b1c8899a8516c0aed1475305e215c3e7b081dbc1e5af22c4eda1
SSDEEP 6144:XyGXuI8vZa5/OywOJUloGVHcBVmSBNL/yCEJr1VYgz571x5K/DQG0TL/vL/6SL/F:J8aLjL/HvDQG0TL/vL/zL/JL/UL/Km0V
TLSH
T184240822235560AFCD1A93FE11679E1327F44046BFC3E269854193342CAFBE35ADF926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 aa886ea1947e14d375502549e21a0f48ea042dfdbad210b23173e86ea86b83cf
MD5 85bb39fd655cf5ca3de2bbfad76beb04
SHA1 85932f92175830926ba4b8c1e381780832c525cb
SHA512 541c4cb6d3bac4cffe172cd06f892691c8a5b725fea6618c43c9d4b55bea4f5a664aea1761973b1815bbb354c49af4e75744d1604cccf8a92824bef2a07cb578
TLSH
T103A002A39F75D041C25612F8B17511892231C9A857052A6150AC40E9896595142D3146
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f9e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f9e7.TMP
Size 72B
SHA256 b4aa2f4650d9866d0853e36479db1405d2aa889b266ae66dfddbe6c56e0c3c73
MD5 36adfc47e6aef4aebf65add8d7928d9c
SHA1 072bb63a964e355e31f0e56960c397bbdfec10cb
SHA512 c7e70c2921df8b5743e38e70dcd71989f7bb3e24511bb15e6ebe9b0801e36bbf9b6a6e8b1b5876d065f9e753c961c811b20113a7f8d46893edbc674b2e7ecc5d
TLSH
T122A00250826B6851C43907BD1006224913A5885915005222649494DCED911C05DC2103
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 7KB
SHA256 a78be92707f5ced2c3608867895d8d6e8d5f66fc830b2fb0edc91b4fbf45c6cc
MD5 390df39ba0b9a2c14bd76ce0723e3e52
SHA1 00ea59ec186fec0d76897484e969ee1c79674217
SHA512 098e0182562410baadd3439b9fa1d42686321baaec303a224a0379ef7d7e3ecb2466c399593d80c882340f006c10457d3c535af34056c4a441d5b52cc2c954f9
SSDEEP 192:5F/+1b3HX3K+PQ0DzMTjOOxzyIdmT9MPseRrL:Sb3HK+ZMfOOzyIdC9MPseRrL
TLSH
T17EF1695AFBEB515DFBBF8E6118312099497EFC421C5CEC99019441CD0D3AE88E8B1E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 beef68fec8692ab57e5da3fe095a8482abe698c04077923784eadcb7dada5e7d
MD5 df251749a3e3c75e1f9a40c317b85d99
SHA1 77f7515099122bd85c80f34bc6af2705cdaffa2c
SHA512 81363867f41031af50c4b95b5c4a197f7cc03b0c5afbf044c3844afd5925fdcf3979842f47ea4215616897437e98d6dbc25d5385ae5ce43bd2d0e80bb8e67a72
TLSH
T154E0806404D5C729A515B8D717767B0DC2E6785BE7886E812B05C8406301955F3F91B6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 2e3e774c03e121a25d29b45ab19ee63c1549ca2ed73cc65cfd8e993f1500bcde
MD5 6a8aad599d09d3087f4d482bb7b4442e
SHA1 a4cdecea10eafa2d01b3bb1b1b709d393421c7c8
SHA512 7adf37d8bd94caebd937b398b685aa4b432069198404c58fe2d62406ec199d4a159a00a40383b147b934b31802e8dc5df99981f3103a2145072f1626e5a58e3f
TLSH
T1F4E0616005C9C32A700B68DB176AE70CC2E77507E7C89F423F04D48463436D473EB150
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 a00bb9cb4254eeeacdbbaa8515586db2bfe88a708242b02ddb36fa0999908900
MD5 194d20d617cf5df941750e0ad9c1546a
SHA1 44c36107c6cd3796e0b0dc3170dde591e7692325
SHA512 b877636632fde2e9d7f99b3ee68a3706d09f0b9b090467bb75c52b72b571767914446ea74cee1b064a90fe1581596182061f4ce81ddda47fbefc3737087828b2
TLSH
T1F8E0D8B055C4C339A802A8D743B9A70DC3E5FD57A3843E81DF088448634256473FE1A1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 4a729e367a55e656bfac19a41da75589e3780bbd6c15a7ed30720e3f0b5ab64a
MD5 a77e1a82f5549f6e7c88ec9be7015760
SHA1 48e4d40c3c57c452b892797838ea95482697b200
SHA512 60717debf784a93efd3e99d9c74e485f938132bcc3d689f5b39c96f126b79d17adf89c5912d1b6146f748c1d6c1478690943d3cd088c064928bcdeb2f69a1f58
SSDEEP 96:K84YKhq+awoKh2uWDaKAwHJiKiQCqcQKxa9:y7rflph36
TLSH
T118E1F051B03A03D13A7D298A82D1B87E92C131633415F93B7BB945A61B67E21DCFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 44220a609ca2fa9101bc84322b5692f42e121fc76f728e96d93db08ba8100fc5
MD5 77103fc36dd634cf174aa129393a003c
SHA1 456dbdade583e9518e70ff7e4aec918aa9859433
SHA512 22328cbafa694af2c03ea8aadcf1900779885e50e4619ff78c60938d18c84e045db65dbbfdde183209950aef1196e7331e628d4f7a262e9404339cf45bd0de2d
SSDEEP 192:1LoWpDfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:WWfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10224630A7B747001EDE7D9725CB080771A3CB16ECF22A6915DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal
Size 6KB
SHA256 605873cc40ff9f51097a15515c8301b95c95848c1001745dbd1d3b441daf215c
MD5 451bd11538daf2a619c9fce6503f7ba9
SHA1 d7b6986e4fe9d2da39faa13a9149c228e35aa638
SHA512 e7990bfa94c43efeddab107e119d532392fa462c01c0d5d0355a82f978dd5ce7d73ad84ef79e97e5d485da2626306baf3422f9a4e5865036a483880a6198eae9
SSDEEP 12:7+tBQUHiN8aPhe7eNIenVxbL15h1xw1dz5wyBt/R4KhutJfl:7+tBQUHgLheazVxVRxw1dzeyLVO
TLSH
T1DBD15047875519F3DD37533EA9B0433B77B7B70F6901401D41FA45AD0B8158C061C038
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 001e168fa877c862517bc96a58bc424c69852a395a1fd286cca302bc5c22151b
MD5 1a95a1b1b25cc45110dd2cd219131c52
SHA1 537c0f607a0f46ddb8a56e69f423afbb2069745e
SHA512 97acfc324d2618ae4438cb8c6a7cbf5b715899fbf94e5a5a14c54df70f4b0e30a3b5a040882df490149e33f80f42d2944bd9177dc13d9f816fa43a80c53b76fd
SSDEEP 3:tl9llNllv/etXlGCs+ll1qvTv4RRftD0td7jdtQfQNHTfsOWXtXlGQ9:tSlGC3rpR0tdndTHTfUlGQ9
TLSH
T1184202973AC4C2B1D473047FC2578BA91766445D56C57F45E03903961416A357874D50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 124KB
SHA256 8dac498dd26d9dd49964e696121488a3c8839935b60b1c795caf94f4e84db681
MD5 5f291dd9fc2690602b3f766ed9ec03f1
SHA1 3affa4fededa4bf8ad52d8950855ab243b9dfa68
SHA512 5a8fb27275e3969f9b5b525133064d56f9c0143949470f3409badd5d85167e692205938a9fe3e748bd7c14649192aaaeeff85e9a8a5bd017fdc7f548f042eecc
SSDEEP 768:2WIjn3YpD9n+NHQJTWBfo8jj5E7HZ1tvGvyB4LhPmKLiUfx0367QUng+jWHHFTxy:MmP4xNFxYgU72BW5Sp
TLSH
T141C321FB6C09D0E6C9CD96B4D50BEE4480B786268A20D9E5AD7C04C37B7DB023EB55C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 a643b870485f01b78c4b4518b2aa8f93fd12c492f3d3aa2022a565011843604f
MD5 7e5905743c1d4c86c30528dfbefa9d67
SHA1 5e7456d06aefa30e8a5b953d87ce8b125b815f41
SHA512 b2968fe40235cf485ad61eefc6bc2e4ea96d3ac905453e90f6a924477fdfca200dac3f3b4796d4e878bd4ed49177271a756afd3ea98b95e4a8e49508ff71af0c
SSDEEP 49152:jYdn0Ss5HTGT8XdPjWUC4gEChbFT5pnYv0lsZAiu012u7Xt1eMYLGcEKOjV8HtRV:4
TLSH
T16B16AAF73D1990AEC9CD9174D60BEE8884F786295960C9E1A97C04C3777CB023EB69C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 db5385f8088e80d9169daf1458e50c67976c0dafdfc8aac40af36b211894c609
MD5 9ff88a7505104d9f7a1d5fc0d8ba038f
SHA1 f46f1de9577e66cae0c6b0eb96ee070e62c54718
SHA512 3a8deb40536657067727d695fa6a8ac13397ccbcae7ed27a4a4f613fd83b7ae475612e91fd63e08ab1a72b4672cc0e8ec2c08eb14b3ee7812089880ed6e19e78
SSDEEP 192:HQvIIIebOMIMUbZYcYNZODcAsOl8+wQ2sQ8z:HQvIIIebOMIMeB5DFsMn2s
TLSH
T19E426E2E27A91F37C29F5F761256CE912BED88814C61252D30212C1F8DF3A978BC52F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 ed78dc7b5993e5dfacdb8424d398a01e5e97d2301d4c11eb55b637711f3a2456
MD5 05ab55e25a2f207a583b3c9108e247eb
SHA1 2d36a98eb1ddfe4e8a47552eba05dcbcadd1645e
SHA512 fabd850fb86cf27a90bd736b08810dc5cd378787156655b9003d5e5b275cc34099a2e2079562ae8cb77103c0f950db787f5a99ac80ddad2a2abd607eb993869d
TLSH
T162E0D81054D4C35EB01974CB13765709C2C93873EB843E451F00D8487501A8477EE271
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 43d386423a45d33b7ca61e924f72a9fa37e730587ec1ebb11bb298588a66e338
MD5 092c19b2333257d74311d7f8401389e4
SHA1 1382a9aef494fa88afffa866d6c7b82e0afd7a72
SHA512 4f8043bb1292639a43948b16ff37d3ad69a8013df45cf1b9314fb046bb3dd3690a6793a8f6bfb6160cf80820f3d787a228627bc356acb7a74952631624a38509
TLSH
T14021F192F330C145D289863B643FA7290378C9429FBCEC0F457564643E72A081D4B2EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 fb43c7bcf643961c010b3f5249e96ed2fb63c5d67cb029c85f48acc405dc9f58
MD5 cee68e4fb4be32c17f063544fe6aa60b
SHA1 ac3e3b3f05af804b4b8d2a27f30830731a833fbe
SHA512 0f332407125235ab06f131f42e3be6c9b612d2b6884bfc263a5b82fcca3041bc99c8847ca5b5896be94f2037f6cc12a6ce8aecaa152c7b820e09ea16b1fe6fe1
TLSH
T126E0D81074C4C39FB05164C303B5A349C2DA3C63EA842F461F04EC84620168577DF271
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4b7ccd56701745469f7a2500c579919d336c62e7968559ba7f43d1350f96956f
MD5 084e6a88017cc6702e69bbfd3cb342f1
SHA1 dda440fba63a28b338e78bda440c8ff5fc6fa055
SHA512 0713587a3b1dc8e125128217a1a0ffbbd589fa959cccdfe11e40f48b5e556da0685bf1e51ff76b1925be1d9014f4a6c8dada4f9499bb1d173352608ddf3f4171
SSDEEP 384:nTcXqn68NXqTo/o7QPFM8Y/F6kv3+x53as:r6c+B/F7+r5
TLSH
T161827C3678B9AC3B5EE74648F00BB7131FB4A0A7D7882F9495DDAB0D02DE69C5307819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 09d5418728bb5e28f609bc63fb1513e9243cd83211fb5c029165ea1653eece68
MD5 d08fba6d0c5095f4e019919db426b778
SHA1 572695598ccbf28754e0eeb165e88a5c44c9db96
SHA512 7e76e40809f71efe1bd4e0bdad534861577709c7bf35cc7d9cfd7ec15b6160d084efe279618d50d0b11da0ab414cea5943c606f19ab3332df61049a2f255e9c3
SSDEEP 192:ZGNI6Pt3QmiUyncvqB/Fl8JkG7rx7CCU6:ZGNI6FZMAqB/F6ksRZU6
TLSH
T13B02F93978786C779EA3AD45B487B7235FA4206BDAA46F94DAE41B1D00C768C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 10dc09e03283dfb1666089f6712f3d7fed38540b2e5cb64020989cfd1498a92f
MD5 78a0770862c5f43d669d25eec844c42b
SHA1 711875ca14b8fa1eb24bbe8ebf9da24a293ed7be
SHA512 5ee8e3ee3cdbbbf56e29699fa35e82e5bb9a8ebf90b82887e1785de6f845446629977476876cb53433fe17f16da49c567d73edac3d32f7396dce80849b8c81a4
SSDEEP 192:UGNi6PtiQmiUzVwnvsB/Fl8JkvRYln4dqjU6:UGNi6Fe+vsB/F6kvv+U6
TLSH
T15E12283568B8AC3B5ED3A9A5B44773135E60406BEB88AF90D5DD2B1D01DF69C630B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c249d1f0ddcf53d2f320fe748c6dcb096d6faabaab5f01151fabfd7cd2a79869
MD5 298b94ba167a2d6254d0933d710dfe60
SHA1 8cc81fa7218533ab841d05823cedd189f5c749e2
SHA512 745ebf5ed058b9b710ebbba4a4925b2d38d45a539e8a0dfd943b98a3d9ee9c27c6f2fe90489c3b636c8979c0b4fbacc21c4a529a210a583ea687265f141adf20
SSDEEP 384:nTcXqn68N/qTo/o7QPrM8Y/F6kvzHtSx53aU:r6sIB/FHHgrl
TLSH
T199927C3578B96C3B5EE38649F00BB7431FB0A0B7D7882F9495DDAB0D02DA59C6307829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 9aebcd7c94310ad4bdfcd403ad5c36f6342df6cdf609780db41527f6e796daef
MD5 45b03f29e18596e9d18d534c41707e8f
SHA1 7094fc847451c5683d94203a3f2730e4afa5d6bf
SHA512 cce467c1882d694a399070e79e558af72375cba7d65cd7196677c50c63fd4eba1db40acc29a7742951ca797fcf70ddb3be66e4bbb77ecbbbbe584aa61be9c1d9
SSDEEP 12:TLpOPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isOmQQtudsCU9zQdsCnz:TL85UOl0afDdWec9sJfjn2c/GDB5fc
TLSH
T12C92F422B9352523E8DF0F76F94749D00DFC126FC9A7B804D9D04D5209B2BC1A6940FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

7126eeca-8a1c-4756-b991-bcf0512f3d62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7126eeca-8a1c-4756-b991-bcf0512f3d62.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2d131e50-430b-45ca-a3fc-960f1d9e949f.tmp

Path C:\Users\Admin\AppData\Local\Temp\2d131e50-430b-45ca-a3fc-960f1d9e949f.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JRRaMDWK5Xnd

Path C:\Users\Admin\AppData\Local\Temp\JRRaMDWK5Xnd
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3212-0-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/3212-14-0x000002237F2E0000-0x000002237F2EC000-memory.dmp

Download

memory/3212-13-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/3212-1-0x0000000140000000-0x0000000140104000-memory.dmp

Download