hxxps://sites[.]google[.]com/view/identity-services

Resubmissions

22/05/2026, 12:57

260522-p7e95abx2k6

22/05/2026, 12:16

260522-pftnfads2v6

21/05/2026, 16:40

260521-t6md9sa14l6

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sites.google.com/view/identity-services
Sample260522-pftnfads2v

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 14 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
308	sites.google.com
321	drive.google.com
325	drive.google.com
65	sites.google.com
66	drive.google.com
118	sites.google.com
307	sites.google.com
309	sites.google.com
320	drive.google.com
5	sites.google.com
6	sites.google.com
25	sites.google.com
67	drive.google.com
71	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\eventvwr.msc	mmc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
660	msedge.exe
1052	msedge.exe
436	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239258118605509"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{4E78DE55-0A38-46E5-BD8D-D6565F93529A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{157935B4-8A04-4B37-9BE6-99B18EDF3809}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{9B435597-968D-477D-BC2A-FC67628E8619}	msedge.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
5244	msedge.exe
5244	msedge.exe
5244	msedge.exe
5244	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: 33	5340	mmc.exe
Token: SeIncBasePriorityPrivilege	5340	mmc.exe
Token: SeSecurityPrivilege	5340	mmc.exe
Token: SeDebugPrivilege	5232	Taskmgr.exe
Token: SeSystemProfilePrivilege	5232	Taskmgr.exe
Token: SeCreateGlobalPrivilege	5232	Taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
5244	msedge.exe
5244	msedge.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe
5232	Taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5340	mmc.exe
5340	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 3752	3844	msedge.exe	89
PID 3844 wrote to memory of 660	3844	msedge.exe	90
PID 3844 wrote to memory of 2440	3844	msedge.exe	91
PID 3844 wrote to memory of 2440	3844	msedge.exe	91
PID 3844 wrote to memory of 2440	3844	msedge.exe	91
PID 3844 wrote to memory of 3180	3844	msedge.exe	93
PID 3844 wrote to memory of 3180	3844	msedge.exe	93
PID 3844 wrote to memory of 4352	3844	msedge.exe	94
PID 3844 wrote to memory of 4772	3844	msedge.exe	95
PID 3844 wrote to memory of 4352	3844	msedge.exe	94
PID 3844 wrote to memory of 4352	3844	msedge.exe	94
PID 3844 wrote to memory of 4772	3844	msedge.exe	95
PID 3844 wrote to memory of 4772	3844	msedge.exe	95
PID 3844 wrote to memory of 4908	3844	msedge.exe	97
PID 3844 wrote to memory of 4908	3844	msedge.exe	97
PID 3844 wrote to memory of 4908	3844	msedge.exe	97
PID 3844 wrote to memory of 1832	3844	msedge.exe	96
PID 3844 wrote to memory of 1832	3844	msedge.exe	96
PID 3844 wrote to memory of 1832	3844	msedge.exe	96
PID 3844 wrote to memory of 2528	3844	msedge.exe	109
PID 3844 wrote to memory of 2528	3844	msedge.exe	109
PID 3844 wrote to memory of 5008	3844	msedge.exe	100
PID 3844 wrote to memory of 5008	3844	msedge.exe	100
PID 3844 wrote to memory of 3668	3844	msedge.exe	102
PID 3844 wrote to memory of 3668	3844	msedge.exe	102
PID 3844 wrote to memory of 3668	3844	msedge.exe	102
PID 3844 wrote to memory of 4336	3844	msedge.exe	103
PID 3844 wrote to memory of 1360	3844	msedge.exe	104
PID 3844 wrote to memory of 4336	3844	msedge.exe	103
PID 3844 wrote to memory of 1360	3844	msedge.exe	104
PID 3844 wrote to memory of 4808	3844	msedge.exe	106
PID 3844 wrote to memory of 2116	3844	msedge.exe	107
PID 3844 wrote to memory of 2116	3844	msedge.exe	107
PID 3844 wrote to memory of 2116	3844	msedge.exe	107
PID 3844 wrote to memory of 1692	3844	msedge.exe	108
PID 3844 wrote to memory of 1692	3844	msedge.exe	108
PID 3844 wrote to memory of 2528	3844	msedge.exe	109
PID 3844 wrote to memory of 2528	3844	msedge.exe	109
PID 3844 wrote to memory of 2724	3844	msedge.exe	110
PID 3844 wrote to memory of 2724	3844	msedge.exe	110
PID 3844 wrote to memory of 3124	3844	msedge.exe	111
PID 3844 wrote to memory of 3124	3844	msedge.exe	111
PID 3844 wrote to memory of 5076	3844	msedge.exe	113
PID 3844 wrote to memory of 5076	3844	msedge.exe	113
PID 3844 wrote to memory of 5504	3844	msedge.exe	129
PID 3844 wrote to memory of 5512	3844	msedge.exe	130
PID 3844 wrote to memory of 5520	3844	msedge.exe	131
PID 3844 wrote to memory of 5220	3844	msedge.exe	135
PID 3844 wrote to memory of 5220	3844	msedge.exe	135
PID 3844 wrote to memory of 5244	3844	msedge.exe	136
PID 5244 wrote to memory of 5036	5244	msedge.exe	137
PID 5244 wrote to memory of 3052	5244	msedge.exe	139
PID 5244 wrote to memory of 1052	5244	msedge.exe	140
PID 5244 wrote to memory of 3052	5244	msedge.exe	139
PID 5244 wrote to memory of 3052	5244	msedge.exe	139
PID 5244 wrote to memory of 3520	5244	msedge.exe	141
PID 5244 wrote to memory of 3520	5244	msedge.exe	141
PID 5244 wrote to memory of 5324	5244	msedge.exe	143
PID 5268 wrote to memory of 5340	5268	eventvwr.exe	145
PID 5244 wrote to memory of 5776	5244	msedge.exe	151
PID 5244 wrote to memory of 5468	5244	msedge.exe	152
PID 5244 wrote to memory of 5744	5244	msedge.exe	153
PID 4916 wrote to memory of 5336	4916	msedge.exe	161
PID 5244 wrote to memory of 4156	5244	msedge.exe	162

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sites.google.com/view/identity-services
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffbe327c188,0x7ffbe327c194,0x7ffbe327c1a0
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,9989417925855320315,10676160885942135232,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,6741248496500875057,12842068094514413538,262144 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,13334596721670849290,2995022500788180525,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,4600430198485098503,11735612307883823334,2097152 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,17598462452489873335,7737678714670515525,2097152 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,15113256803559752536,10457707325681894651,2097152 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,2885214620611575209,4944961055578443730,2097152 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3328,i,17984378786231746592,4248115670249678498,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,6280603035178718495,5219935778140620259,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5068,i,12358270978428978019,13503818043983403663,2097152 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,9833303034826289704,16397690542552285727,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,918105483955376896,13161503535786694827,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,15155213259816631169,11150937318762843784,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,15155213259816631169,11150937318762843784,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5292,i,17084683228122932239,2529186250522073436,2097152 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,5841736479371937591,2551629739579467299,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,7942551366400932345,6168074498304301364,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,16398125120412370461,16849054346718028068,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,9321260815312907468,7429946692197298620,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,17349565479574708464,11625487844236479834,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,7815514070027668910,4186385779336842105,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,14367451735750691564,10019864863978381355,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,4930082532492461221,11469833109996812614,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,1920084774093633774,12020850873317953584,524288 --field-trial-handle=2216,i,18022166724914724892,13763296607770285013,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffbe327c188,0x7ffbe327c194,0x7ffbe327c1a0
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,9382695173225961896,11358652586337431828,262144 --field-trial-handle=2404,i,7176698344066511850,15886944818236035963,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,14581707501841493552,7773719620760456794,524288 --field-trial-handle=2404,i,7176698344066511850,15886944818236035963,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,9761168586998450486,15994327892773930639,524288 --field-trial-handle=2404,i,7176698344066511850,15886944818236035963,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,16780255361562825580,1317049364982752844,524288 --field-trial-handle=2404,i,7176698344066511850,15886944818236035963,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,16780255361562825580,1317049364982752844,524288 --field-trial-handle=2404,i,7176698344066511850,15886944818236035963,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,18205334177869898878,7912365656551285588,524288 --field-trial-handle=2404,i,7176698344066511850,15886944818236035963,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,8048786976693946122,8215654776880344616,524288 --field-trial-handle=2404,i,7176698344066511850,15886944818236035963,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,14172772683706084008,6259914209270665523,524288 --field-trial-handle=2404,i,7176698344066511850,15886944818236035963,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4820,i,9077038958214637814,17996900448736564694,2097152 --field-trial-handle=2404,i,7176698344066511850,15886944818236035963,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4560,i,17693480487773862067,2209834875879353534,2097152 --field-trial-handle=2404,i,7176698344066511850,15886944818236035963,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,8097683023992022048,6328440650903461213,524288 --field-trial-handle=2404,i,7176698344066511850,15886944818236035963,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,9693886377668082114,11578879904758639616,524288 --field-trial-handle=2404,i,7176698344066511850,15886944818236035963,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5504,i,13900390758420513656,8658732148464538464,2097152 --field-trial-handle=2404,i,7176698344066511850,15886944818236035963,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4964,i,16063105354350077601,17071255615626023094,2097152 --field-trial-handle=2404,i,7176698344066511850,15886944818236035963,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffbe327c188,0x7ffbe327c194,0x7ffbe327c1a0
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,7033524204281691857,2300348260037113903,262144 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,10794998098420768745,16912042220220189733,524288 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
      4⤵
      System Time Discovery
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,7830462352546501029,14830217377795585278,524288 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,12798801366454361780,8976983663449976074,524288 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,12798801366454361780,8976983663449976074,524288 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4900,i,17626138632158872886,10796167764761513816,2097152 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4904,i,15140652577715315366,1217168494871026661,2097152 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,6424937211521576403,4169632744864696123,524288 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,10769030335488316609,13235424655970683103,524288 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,10333936535147914960,4982343108185280369,524288 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6112,i,9958620159424467361,4162616638943064504,2097152 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6656,i,4461731877567962039,1297965430906659509,2097152 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6652,i,4077016005015779378,1976400177457900951,2097152 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5096,i,16316668678061872269,5262873821878219113,2097152 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6632,i,66858095462079268,14188865162041343012,2097152 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,14264584314638936522,4115838231323738776,524288 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
      4⤵
      PID:6164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,12282547659131115604,5703202121364857987,524288 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
      4⤵
      PID:6172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,10322522191727724326,17310374669882852305,524288 --field-trial-handle=2244,i,9186807997043288205,13157683375764873014,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
      4⤵
      PID:6180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2176

C:\Windows\system32\eventvwr.exe
"C:\Windows\system32\eventvwr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5268
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://taskmngr.exe/
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://taskmngr.exe/
  2⤵
  PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2116

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:5920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b9b2e787bff8ef07aaf8dc41b35307c7c27a735e7d7ceb08a7a415a3e0bf278d
MD5 6b1b71135b132fc9820aba7909379913
SHA1 203a3bbcdcbfad5b9fcc3b862338d849bc46335c
SHA512 ee8ea33ab55fc59728e89ee58318e93e1e10697a037488e782e474fdd2fcdbd8c32e1d9bb596e518f23ae71ef00bc569552d7a2f5359f8d6ad520cdac9122bde
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
TLSH
T170B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b72679b2d6ac78af2fe064c581c67c31bf753afc2f4852f7933463f57d751261
MD5 e30c9ef1e34b19f7fef514c7ba009589
SHA1 498acfada6b4db9e3c01de800632d0fec5c8f6e6
SHA512 72f20f223eed735c9a7b083e261d4a235091cef8edbf9716dfadb6d01a1be647097e5e1a482e128c38d0d8109a59208a917f1877b4810baa9bcc6bd44cffb159
TLSH
T1FED0237527D14481D065763F3C2D53477F8D8134120515370EDD64149DB5C8584CC4C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c84b0b96ac63768d057645348446be68c55adab73245de7400c7252788c5dfd
MD5 fbb22b05056938451028373f9ceac730
SHA1 2100181bf2ca147788018c0fc0d8176277267d56
SHA512 442697f514aafad71c10367ec3739b9ccede8ede2df732f17e276001281f5e3b6c20a630f00f705ef192d793575ba29f973ecdd308fa577707145ace09368f31
TLSH
T1B8D022B6AFA29AE1E039353F292543423F9C45320346223B1E6D5C14DCF58CB88D8DCB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 256c9caf6cc1c3524611c0d9bfd029328231744c006391282790034e7938b586
MD5 b831afeb8786e74a23ee401fdfb46ee3
SHA1 ddf6ce5712bd071957fa37bf9d9d074b050c3581
SHA512 c78ba551f374ca32e3a896ccabc473a3b097157a13a6589e7b0d16548027c608ab40069c0adf33356c41e06caa2dc43973e735795f8e64be4fbd4a5a465277cb
TLSH
T1FDD0237567C14481D065763F3C2D53477F8D8134120515370DDD5414ADB5C8584CC4C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f55ce9efae50a4fc1ef746b4152728c13077e5d28f492734a0857d9014aac7d0
MD5 d76f2ac8c472bf4f3d20155cca1f39ef
SHA1 7027fa8092d379402bb50034bfac764470cd35b6
SHA512 a6afad5fe503f6a3145198980302c030c212691cf9a667dbd2e676a474336c612c1ecc3844ad6fc38bd93a8feb607d69bcfd4d7a3aeb093e3ff3defe4f632724
TLSH
T12AD0237567C18481D065763F7C3D53477F8D8174120515370DDD54149DB5C8584CC4C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 95e1122c466e28446cc6b82daa1f94e2ab35aa6a6536d1b02ef5f7160d382cd8
MD5 48e76f21a4d7697b2943167b51494d17
SHA1 7314723f2b2200dc50a010e3e6c0690031e7f108
SHA512 dc0515bfbb6c2e62057b3860acaf82c917dc1ce67c3cb1f2ebb13d26a4e12326ed7088691a67b681edb58648efdf81da786fdb02b8c279ed8a3d5a67fc07791a
SSDEEP 384:p9g97c2jqiu/EuauguLpZ1cA6jgfYVegw0+Zf:ng97c/ZcA6jgAVeD
TLSH
T1C513B57C32221DEBD6D2567C051F0A35A36EE479E3EE93573270F04E57673AA0A8E804
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b99389b6bd40a509967b6280967b50f82cb69ac2a448404b98d9e2c331016ce9
MD5 b39286fc293683cc7426c89b9360ba71
SHA1 1d71a6f69d2bf264701a68fdb541fe06c86b9142
SHA512 9a7b269e4056044816905bcda7fb8a55e1351c8247bec05f50a76a46f5215c32121861c97fdca91a0f1fd46a5268402bc194417bc76da9c580c94c31c4727f96
SSDEEP 1536:gFkRsI0+zPL/fJNL/ZgzB7Y59uUxctxgEVWVOTpL/YLxQRL/1vV8AGhwzE:gSPL/DL/ej5pL/vRL/3zJ
TLSH
T136444EF70951A01BCFA842F5E2033A3DD17B051D7DE5E9E9E2384CD52825B22B6FDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 8b0d2ef1805f5a70b7a9d6c6dd10978c7460b987dc20cc19e87be09a70b90e1e
MD5 ba7801431fd34c3e9f7bf0589d747a12
SHA1 96879b7695597b375307775520e78ed8f0e10363
SHA512 c8c11f391c505f96ec644db6ecc1313681785bc17c035d4f928ae6c2d3ffec94b1a56182d74a4fc520ead6065fed389d55afe8d1f2bdd1064869070218a0aa2c
SSDEEP 3072:QX5mtiiHWIEut5IPWlrdHScLE8Uzr6TkvxDi:QX5Miu5EP+LE8y6gvx
TLSH
T1C72508EECB682C82CE6B8774B0E0D9077E712183B68DC0D39944C5D897D6B8575E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 ca15e89b63cb80c358aed5a6bf81b44223c307b07a1924512fc43f72a59fff3b
MD5 6824988fec45efcef237909a9f358541
SHA1 605ab863ce26b7189d795408aa7c3578646c55d4
SHA512 6ed03ea81494bcd1b025738ae5a0896a2ca209253b7dab5c451e0ff33a9ea73c32bc509ecd66b86afc623a6e346b15a618698a3765b89493aa6af86c9b73bc3b
SSDEEP 49152:x3YELm+A0GKF7KcPrTy/2W+hjBrw1f7oOyC:x3hC+FbPreeW+htC
TLSH
T114868DEDCA6898C3CD639930B1E0ED477C7413C3F995C1D68858C58802AB7C5BBAB769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 18KB
SHA256 68f6ef88ba434954488867eb97245d36897076869a2bf15cfd14a8f4835f881f
MD5 b13b5655b434d1fe2087f3fd649542a0
SHA1 99f2917138d5906d1bba6e672d7fed3b6203471b
SHA512 e5fb0ece914f7db7184028fac20a16873ad99b39d8914e94dca25abd508e4b3b029967920a98e0aafdb33c1bf0e0a17532e389851bee3948392aa34c1826f453
SSDEEP 384:VIGSduZbIls3uiVOOHT9RrYAyZ0lj3MketmO9dowZQiyqFW29Fpg+w9jDcygOQ:VImuiPT0hYM9TowPyqvgdNDcyk
TLSH
T1CF82D0759B4D291EF0DA3963410617CDB79BCD01ABA848D1188B9F21E09848BF9B25D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e807e771980b2675cdbf3f5cd504ce2fb862be1cc64ac0612b23df037530376e
MD5 83a5a29aadb07e8fc7f7f0424fe48e35
SHA1 12ca17794ea53174c11553b87fd226dad27c2867
SHA512 ce52300c47d78e1957bc31a8b460f0fb4610aedf14377e2769d4a86dd889b0bdb87bdc7d21355ecd9391eef70e72c7128756b970aae282e455472e2b13e83342
TLSH
T11771841482B5C981F7967071F2E2B10434FD589835AF2F4E584059BFFA1EB15B065E74
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b198.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b198.TMP
Size 3KB
SHA256 8bcfac607698855b11657631ce0945d4d350923261418c33a39881616d2f9f3b
MD5 2c1732a2288b5558c1ae83317c59857f
SHA1 d8b320d1ebc73fcf886b256377ad51f506d1e624
SHA512 6f2eabab26bd8118acecf0b2b71136abe404501f827d273cf628469098e4d983e4b147be81897c394a069829179e05aceba69ecbddc70c658ae0b9103e586630
TLSH
T1A061C42886B1C985F7967431F2E1B20474FD88993A5F3F4E584059BFFA0EB147025E38
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 65e2aede8607a0b5e6ef91a5d126edb1e6af6dec5f264eceb4e91f9db85a9787
MD5 a590b4328f72c5ebd5252701c7b9d1ca
SHA1 2533fcd6d45563fbd0f04038231c0659e0abb71e
SHA512 784a1c628671407f53ccf00ffd0be6963a7e5d13e27013f231efa372ca692f288207a3c22909029bec5c1ea195aa2d089e574197d85c221bc067636ffdf99296
SSDEEP 3:MsEllllkEthXllkl2zEkl4n/ll:/M/xT02zn4nX
TLSH
T1E34404047FC00505D5401570C031D3531370D41015135753345305335DC55440C50001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 aeff7f478b2cbc0abeabf2b3c68ea93712409939c6edf33ca0680ab5a8545777
MD5 7a206b52d15c53762243da01cfe23806
SHA1 2b63340bca616ebd346b1f9c6e2076c2623f8a8b
SHA512 1879ed6cd6ba418ca3fa1214320cf64950746b0c19d3f639b8c5eab93aaa6e0ee13c0bfb8b23849c2c1cf67e5fb972ac8a32ff1c8ff2f2c0f06812e2f8d983c4
TLSH
T1A3E0865808D9C139949978DFC36CB708C3D53686BAD83D06574DC888B141E8AE7EE3C1
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.106.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 b2685183ac6bd6d03b73ff2d8a4a52877f4e0b3611b5f54545ca255e219a6791
MD5 3a8e71efc38b6f043d205438dc035331
SHA1 1c9db115eb74f9d7e574a29c2968be452188c619
SHA512 21b43917fedb62aff48a5650dbca87e8a3c744dd5c9ef8ad88b586b61771e47409b7aa5f4f712cc42afb155592eb92b8c764fa83f97243c1215f545914ba97cd
SSDEEP 96:UBCxOvTjFH1g4TjFH1StlKhCHEODOJapHmN/zrF0EPHxh6AK5m:GaOwfakRNw5B0EPHj7
TLSH
T131B209A76FB43A13C7056E7A2A29B435C93EA7742F9BAC843D1518224DF8500D1361FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 1c17da88a20e76e1e6482caf71c55b0440fdb4ef2aac85d2ac90543a5e569ab5
MD5 9826c644543d6594d9e2b6fbf5832ea8
SHA1 c2719cca177fb8e603410322866cabca6994cc5f
SHA512 e3d3f2245771c485ebe752a1c93725ae3ae53ee560674f42b19a7e7b7c969d7229e9376dca402dcf2ca8c7643640e1853308d53a9afbcf817a64ef36e3295ba7
SSDEEP 96:djIU+bGz83uy3+u4tgp4DLjGQLBze9z3ajBHMsDEuspU0wbtqrOQpPfR4J+MCXkW:djf+G83uy3Ct7XBBKiH7DXspU3iV
TLSH
T16314000E4F243721CDBD917669E744B35D7CF03BCB5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 a25946d1680ff2d99d20b8154bf3d3c6e57446ea5d2194afa62cf589dd0e9ed3
MD5 6377fd768927c8e7725b7353cc68c9b4
SHA1 afcfbf7f7f81aaa8682c4ade9f98500b768bc54f
SHA512 3c43f3765ef5b7effe540f3f1db0e79d59272cbd2a5116a5f33aaf86df381aefd944e7e69326e906b2326ea13afe3696e10bb90ba93e70200749fc0babafcf55
TLSH
T1F8E0DFA44ADDC12EA68828DFC32DB708C3F03846E7D83A061B04D885F081008B3DA2C2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 e133e50f19ac498cff290ee4c94bc17b03c0f9b89b7a3e05eb7bd3d73667fd90
MD5 a54e543eaaf6232606df58801ce0734f
SHA1 0096209ca438845bf9c3ff9590e7d86a24afeca0
SHA512 6254b96833b98635a3855f243eca5578cb9e2be791a8117a117a3db87d5cf15e13100f453040f37489474ee4a129075d33816559e31e1f66537794cd66227f14
SSDEEP 192:DfUrDybolTrK1p/NOitdcw0JAE2GXKtHR:DfUrDybolTrK1p/NOitdcw0JAE2GXKtx
TLSH
T11DE18BF7C3D8C63DC94156F8A725AF1ACE1D0A14432C3C6B88D8AF5B93E2871E11565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 e755c94c971f27d38924fd627c35efee481e85bb9c2259cec2678aacd07a9b27
MD5 36f3bcd27f014a83d4d45a8bdea40d3a
SHA1 d95774cb49f44c74fa31fa5de281856c55ef1247
SHA512 becaa0887b6df0bd2a4901f355a9401026667f49dcd2cc616e6351fb4eecc8a4f9976b9daf6ae66f043077ba5e211183bfd5fc6bf8bdae4a97541e15d0d7cb97
SSDEEP 192:DfUrDybolTDZK1p/NOitdo0JAE2GhtHtGk/:DfUrDybolTDZK1p/NOitdo0JAE2GhtHP
TLSH
T197F17AF7C3E8C62DC90156F8A725AF1ACE1D0A14432C3C6B88D8AF5B93E2871E11565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 37d5e69275b13a7565378d5226b0b927826e5ff56c9b5f00ee3b43fe5ef57032
MD5 f2050a75deafa3712a36598b98f24978
SHA1 9516ac9f11afe17037e4d2a3f8943d7444d243a6
SHA512 6832dcfbfa5af03126998f74a449d28aeae4442a34119c87fa1f73211fe7f7a6f3149833b9201a4da185c744dded2da79fd2188aacde073313660cd74ae205cf
SSDEEP 192:sxZ1ROyM/jK1Ml8Mk7/fPsq+sbxlEKIdp7FHW6+WNKjj/Y425hIg4J:sxZ1sM7/fPsq+sbjEDxHbO/Oc
TLSH
T1B552D816AA389D77CCCBD209B951BF53D6F51572A2941D44AAFCCA0C04E6EED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 550a52073fcdb8035912718a230de9937866cf01388cc9defe5ed8ba0655a7fc
MD5 8b71d4ecc4b9f2bc18be8c5375a8ae7e
SHA1 0c9b57917d3fc5ad0cdd6dc0ea405103192e8877
SHA512 37f8bdec819572c342c0d1637de3d985a964cd79c34ef0131ba1e46c14356f157ea747164138cf205c64748ba693d48367bb363612e18da1d1a800651f5e6d91
SSDEEP 384:sxZ8nBlH7/fPsDWvj+UKEG77z8FHbFN+pXmL4:s+Bd7/fIYj+UKXeHb0T
TLSH
T1FC92E806A5344D7B8DD7D219F9167F63D7F8206396944E44AAFC8E0C04EABED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 aa8c85f9bcf764aac34d94bd488599cd1eb031e7a1764e44134b4d3eee785de5
MD5 4382037260ba2f2b7f8557a8631fd397
SHA1 0f1403276fcb410f6694893f1c30d040d48a268c
SHA512 ea4930c35678f93e5a39d2cc552bd144f23743f9fe17e09ab15a3da19bc4d71d43fb5494344eacf3ee015885ab947c1e6532ca56071033d9dbff7e5e3d26547e
SSDEEP 384:sxZ8nK2A7/fPsDWvv+UKEG7Ez71Hb6N+pXNLQ:s+Kf7/fIYv+UKXYHbFG
TLSH
T1BE82E906A5344D7B8DD7D219F9567F63D7F8206396944E44AAFC8E0C04EABED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1e36df5536e6874ff01ef65db5888207e6f92d5053da702c077a1b08aed1433c
MD5 c896afdc335743eba3868644bd0b03ac
SHA1 792324de5842709f8e2e9d4f2ac562695639a24e
SHA512 f1d7ca63302c300415cc50ca8759460fe7fcd4514d34667ccb6175403834b1ae767b179f90e091aab6f42a38607069e87532a2d033d7306c7cb37f14fe52ef05
SSDEEP 384:sxZ1Bg7/fPstWvv+5KEG7HSHbm+pXADLQ:sNK7/fiYv+5KXyHbxp
TLSH
T17E72D816A9349D778CDBD609FA557F63D7F8147292901E449AFC8A0C00EABED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 861c939a362c3b059d2188c81593d62821aa6207ab155cf523ff3b72a0851fe0
MD5 26c78b328d1119a98bed718259bc878c
SHA1 f72b0f13a50d6f4a1853a9f1c310a5ebc0407869
SHA512 a21bc012b22afe17b824a24039e32387847204bcb1be7660f50cb613eaf0b319987bba78dfbda372e97b5286806b39d318b68c877c26e4a313cdcce4c4dbb543
SSDEEP 192:sxZ1ROyM/jK1Ml8yM7/fPsvWpVp+smxlE3IdppFHW6+WNnu1W5pXYQ5eLrIgbiJ:sxZ1sg7/fPsvWvp+smjEY3Hbm+pX/Ey
TLSH
T14F62B716AA345D77CCDBD60DFA55BF63D6F8146292941E449AFC8A0C00EABED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c9b3643b5d37699a7b86d6af07c4b847d5c02e399201975eb38604886bea11a3
MD5 c0f78d69f1a3dec6e6c21d675d7df8e3
SHA1 911aa87ca3739993274b792030742cfa3d3dd39e
SHA512 c39f6913c6c4b7a1a8f863a5a582f175af497971fd201644edcfe76d149ce9d79468edfba18f0e4eb767214dd8671924fa58affb455250b9fbdb52cfe2678be1
SSDEEP 192:sxZ1ROyM/jK1Ml8MM7/fPs4+smxlEKIdp7FHW6+WNK1W5pXY4T15hIg5iJ:sxZ1sE7/fPs4+smjEDxHbC+pXl5s
TLSH
T11352C716AA345D77CCDBD209B951BF53D6F41572A2941D44AAFCCA0C04EAEED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ed13aa58577a348809662a56a684c77d3cabe7198440d58e08a5ddff57ac216c
MD5 fa45585896359eb1f02fb2d635b82af0
SHA1 47ebcb4078187ecc5edfc620cbabc033081f5381
SHA512 0fd34c0b1d2f2d9d233f7bada71067eb276529143305d3c74fbc170931ff3a584c10a747fef75a8afeb2fa7dc4edb98414c8bc9a93e76ce9afa6a5a5844415fc
SSDEEP 384:sxZ1B27/fPstWvv+5KEG7HSHbm+pX/zLQ:sNo7/fiYv+5KXyHbxQ
TLSH
T18672C816A9349D778CDBD609FA557F63D7F8146392941E446AFC8A0C00EABED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 11e1ef4691a4e5b1bd751c60b39e1100432b69978d809288162b4cf5e843bbfb
MD5 8cec0391407578d7222a982c2f010572
SHA1 7708e8d1a2a2a751b1a8da24b40ed2ab664ed021
SHA512 039a562d62018caa2b1d41f1ffbf7b696c4f4e8d5c430e9b2fbf1e1388d6b6e7c5e67515e74d29a42e88a71bcacbee7b6301c406846dff889000f9eaaefe6c28
SSDEEP 768:cG8iJRU7pLuLXxNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxqhALl6opdDroz:cG8iJRYEXxNWvx76ru1ja0qhALocdwek
TLSH
T182F2FC3B6C0CCB7E4F804E9CEC2A6E9A6DE801CF5698895447FA881C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 f3daaf13f580b4111201e1d72641203ef1a29d0cfed98f0e230e8a97b2c17883
MD5 a73613b23acc15c71d03e796700a78d7
SHA1 a4b1e9d93f5c16d9d04e517c112709a9bed974f2
SHA512 482653b0e91195531516d7fc344dba0fe29b72da08ec1ca95ae840f85464d174e1f840419b9b5ffbba626e97e0ca1e49e987041cc9d461acf82153603997f642
TLSH
T105A0021402D20143C30262F179D6457166529920A211130583A10244CC60775855300C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 37a824ce8b5b130fc597ace2cdca3a6b26bddcd03bdee8261b294ea46a973de0
MD5 708ac8ad7f046e0dc35b7a900430183f
SHA1 6f447a3fe99d59f8c6dc4f5b6dec73a76d584216
SHA512 3a2c15781cebb577fbabbaec4d001439fbbeaac72e126a779b118f932000158286112d916462e062a32c09e670b65975ca688db56d2687fa3923cfa639247935
TLSH
T159A002208BC2405BC01291F19D5B07421300D8D11550131750914448CC914444D4214C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 1KB
SHA256 3970472de93b8f070098fd1ea3b4f114854dc748a9aa086d5265f9d0fc12c755
MD5 48022e12f9284720b70f4ef0704ea684
SHA1 7255b8c0cd8ee047e1c993f4af4b92adfeff1663
SHA512 8ec288eaf2a259c9d8aa3069a81faafdbab0a1d1aec11406fd26a5c6aab4c6b9e3d42e424c938b8aa0d13d1b60109cf28b3cb8b795854a3345d178539ffada59
TLSH
T13A3163484EA18EAFE8B44572127268E4737185DC2221A713583C31312E2775A2A479EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1704.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe5a1704.TMP
Size 1KB
SHA256 ee91f8b09f0b81c7b0978a1a6edf1139cfc2e3272480ddac741a21632876512e
MD5 89e6b5b2c4184f521c0a1f022e202380
SHA1 6da5af90fdc958a5518d614574609244d399d9b4
SHA512 4fa63cce35f5cb48a009f755d726be37afeedeeb75828449d6bca538a1b8882180d87c0aa662d2cfb34646d249d461a4cd1e7efdc6fe3881d9e22cdcbce03deb
TLSH
T17531124A4A91491FE494507B1A66A4B8733588404311B793A97C62399D25B8E2A5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 3a509e19c7fa652134162a96c1b0063f9f004833a398988c47b4f4e488df505f
MD5 01c498991c391c1bdddd7c42d9bafbec
SHA1 74bdbd418df71f65a7a5883ec4c6560cf5e73768
SHA512 c93440f93ba8b4d2b35f41d3d5e921677220b7c9d37bc164821a99395145f38399544aba357cda87b2881fc288eaeb6f61d10c3eb6260cdad6723d44798ffeed
TLSH
T168E0265805D8C17E609661CF832DD70CC3E47547E2EC3D072F80C884B182505F3E7281
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c8ad5ffd12a1e500675c322db33a6d2c3de1635a35d1379e8382991cf0bcb38a
MD5 519ae9eea02cd33ade7b2ac9e606b3f7
SHA1 4aaf41b0783596f118ff3ad27171641f34b90bd6
SHA512 f73eb63606ae5dfcc079993a1e310778311a623082d3fa1358fc5a9ad38077f9ae856761dbe0fb2d26a1d3f453ba35037f1ea47267c1524fc458abe302419611
TLSH
T150A00263825C01C9D80443B8B4454688A357C8200E15621384E4D1D4A8955454172055
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6ad1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a6ad1.TMP
Size 48B
SHA256 4f81eb104d934dfad0cd53a13e378644d9c254d71b8dbcd1c6dac5e4a6769b06
MD5 2bcbe26fb14a15bb37d846891d92a363
SHA1 28504e529cc2748d00dcd5cd5f8ee190178faecc
SHA512 c36a28268d629b90185035b6a68ad35a8d361c995acb5056bd68ca85391901c3cbff33af327f34729fd15524eb10b6d0dd05b82a1e1404cbf550cd048ccd243d
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 d133c15bfea270b91ca76b35f10760b7817a38a2c9835f5a91bfcfb1adafeb74
MD5 29190510ac870347c615be7c463caf8c
SHA1 5c89d394b6d1390025d473713d4ef339bde24961
SHA512 604e50d6437eee947a751c00c78bfa1959a7747942d675351c54b2a73af7f7d9a1f4f2b5930ff3bcd918948bc92c241bff02ec079472b94d9bc864ce3b7b0a19
TLSH
T131B012D07B05E852D009093286F0EFD63E80E01101019123CE49CF212C871E93C334D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 a973a8f6c19ce3c5d7816c88339732d6c49a3023548554650b247f8c96ba532d
MD5 484f0e8022c498f1405db664ca8ca1be
SHA1 1e7c34f26d8f3a5a14d4e039d0be8126d9149f94
SHA512 0bd729e0ed7c56b04092ab5bdb2cf145839d0ea63ee6f89ad26e2028df59ca9b2f0a3c155e241f79cf483f32d6192df110e2a94bcdc73cecde1c79cd1c7c6cb4
TLSH
T190E09A681ACDC22F628520CE932AE30CC2F27442E6E869163F0CD584B246580B3A6280
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 f0f32cdd08f3c90babde3eae85724b3574de9abe6547460f5673fc47565fdaa4
MD5 cf48a1d0afcb8c48651882d486041030
SHA1 36f48491627e86089432f9e1fde9885c51eacc2e
SHA512 8d23df24c8714ee0154c69b68e1e6abfa53c04aaabbc6870adbb9b1537d28e7e9b38b19cf089af3f255bfbe09ae2def7ac8ef88fc6ab2c2d6193f71b910d9c34
TLSH
T108E04FB849D9C23A548560CEC369FB1CC3F47856E7E93A4A6B088484B141945B7BE680
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 0172294697d50f464bf2cc91f5007bcaf5e123f785df30dcf8f193458fd2898e
MD5 3bd60cbed9f2796e3dbfe7c3262c602e
SHA1 c2e066f232654b6ed93a22823d3ed7e9cb738a60
SHA512 d1c38c51691fdcba04e872485da02407b90f1a5353edca8493705c5b44f920620b07588540e815d476ad0f49d0ac294375559827f57cac51fe0e6d481888251c
SSDEEP 48:KYBIJKCEkTypEIbKxqU1nIZKoosnyl9IJKm8co:KYBeKCEi6EQKxqyn+KooO29yKm83
TLSH
T15AB1590670B716463DFF264C92D0961A4E4270A37178E42B3FD841A64E3AD255EFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d21afe45-f385-435d-b3cc-e3c66007cc18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d21afe45-f385-435d-b3cc-e3c66007cc18.tmp
Size 414B
SHA256 3bc0a1f96b3559e8c2253a8aa05c7636bc63132c4a78c14e0af4c8bbe1e43827
MD5 2917095fba90068f07321c653c2f1817
SHA1 57319d7f5b1ea5a43bb933038e23a01bc0420aa5
SHA512 f74ee9322e569c872e75c30de0c05f8ecb8a3c57ac472e6f82483b69e589c7dd29ff84f2d84417da8ebfee974e393c174a85015f0937320f9822aad8193e3296
TLSH
T1F8E02BA6C821DC3708FD276960108759EB5013572750940B3A3CD20C8FB562A0586C1C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 b39a8459e233a35c571153e73ba663bb8964111d8b757645297aa93af6106e70
MD5 627035711386626c2d6736181def5537
SHA1 fe55ae8ab700a7b76c7ac2d41714f96ddacc6476
SHA512 680c6dee2dba52616aa407fde14b56950d049f58a2fe19c2b0c0bd04ed851f0fd71a1885162523e4b5b52f65f23b07955517cc0ab84b42d9a681264be4e2d122
SSDEEP 192:WQ/IIIub+MIMEdYcYvCXOU2As5l9uFQ2s5X:WQ/IIIub+MIMeBgU/sbL2s
TLSH
T1C142833E16056B73C95E9F36136AC7845AD9988159B0252DB1922C1F8EF3E97C3C22F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 1869a41f13a53649104cd4b9264806d1313b170911928bfc7d89d1968342c189
MD5 4a7bd97fc1fc287ef8e8375d75f15392
SHA1 28d926f5797c310021814c2e49f91e2f544bc7b8
SHA512 60311ea306c5ff75c2294e8cd2ba2bf51892283cb308cab18eff5b162ca9e70c32986ed52b3dab7c110b119f4cf8a1bdc9e3c3f079b3dff7728cdab4656fd2df
TLSH
T14EE0DF94A8C8C16EB45520CB8229A788C3E43863FAD8390A1B00C488B041509B7EE281
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 6c7c5362f1bb6d8a208bb4b6d6bcc93be63adbfc913d94e28ca3136a3225f858
MD5 c3e30a89cb483e4f9dace49ba765877d
SHA1 2074320880df0ec650dffe29a889f30d511954ac
SHA512 55bc47687aad3c4c7c4b5734525d6417f21fc2f57d938b5c9b017a85bda45f5fd381c7155000e98deef8f37913c42aacdf932df51c1c12fe50e1aef7b7453fdd
TLSH
T1C4216852F330C009D14A837A183E6B666334D8029FF8FC0F60B620602FB2E050E872E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 62a51551eae0c5d4aefbf8887b945a76322952e9adf9f5f76a1c120341d36c75
MD5 a8ec048989b2bdc6c7a176c0b1bf11ec
SHA1 5b6b17d027ccee2a3b734609ab97fb75ad777e53
SHA512 f6f39bb9eaf145098b22dfc6ccff35f63070e4dd829e0e831fefe38d01d6ee9794d9e4c871c46b981da87e71534c789c38278996ed595c27f2e9a37ea3a94fdd
TLSH
T108E0D85468C8C16FA05120CB8269E788C3E53862FAD43E061F00C988A141546B7EE241
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 e55dcaed1e8ec6da6604263c4ecb7a07a9984df8aadf19fd4430ae846c3ec217
MD5 e56d7269b6c924a54c5bcd648ef5d1ad
SHA1 7863ac0730aab890011055d941f3d833efd403ff
SHA512 03fb162915ec0661b0f3f8fecc55ac248897542e52d517ea7e5f2cb7627c9650d408f051f809a3f264725ca9b48148a28b72dfa46e9d3a51a48f56b323cba9f0
SSDEEP 3:MsEllllkEthXllkl2zEklIFKl/ll:/M/xT02znIFK1
TLSH
T18A4404047FC00455D7405070C033C3731770D43005115743745114135CC75410C30000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5fbdc72892a093606d08e6e549fb143a00472b7bf4b1837297a301d0913d315d
MD5 f3265a62f686cd917165b1bdf89508d8
SHA1 23b33b086156e1c411155dc83f7d8f8895390309
SHA512 6e8ae03a4a7585737ce71f8458426f8c2f56371094b4965b0b8a3dc36ce1b1dae6fc9567cbfdea887f56eba8774ce24ecd92ad40d028e82274aea23a48e89945
SSDEEP 384:nqtNnNnb9ZsNQ/pOxBkqdhdqYKzASrx/k1qxKeahMLhg2GlP7Vz2:qjZbbQDdqYzSC1OKeamL2lPJz2
TLSH
T152C25AB0D4A65DE744A2E8C5B602F2133E785177C9881E4DE6F9BB3A309F5BC2706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 06b0ae600c7cbd37c1cb3b87cba37d9ec44ce1e0d655ff47f6aac2a22195f3c8
MD5 9fb18156bf0bf048633524322dd2a0de
SHA1 fa33d75d8a390ee8897496f730bdf4e4851fd89b
SHA512 e63a6428ac1049fd65a6f9af989f3a74555529ea42e319cca5809c9c4cb14f8418dbbcdbc2640897f1cac502258992ae5bf665f86ef1c375982f837741080d61
SSDEEP 384:nqtNnNnb9ZsNQ/pOeBkqdhdqYKzASrx/k1qxKeahMLhg2GlP7Vz2:qjZbbHDdqYzSC1OKeamL2lPJz2
TLSH
T168C25AB0D4A65DE744A2E4C5B602F2133E785177C9881E4DE6F9BB3A309F5FC2706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f100ca20ab4921045fff4f42af7fcd73811efba851ac2dd76db4dc5039b66c8b
MD5 2df85c463f18b9ba2a24faf67dd4ec43
SHA1 3dd64262deb5b70ce0604e672fda2429489baa01
SHA512 8a6f774eb3c36390953f1aa257763626a1bb0b91b11439dffbce7528e44df4af0149862925b40ad3653d461db9030f169cae87b8e40eb77b6f4f75f02433c6e5
SSDEEP 96:ZqONk6QsjpfmUTmDK5ih/cIPURHl8h4otop5d5D5BhPwivh50xy0SFYKIAxteYkt:gONO6kDfQmiUy/fZ903vZQimxqU6
TLSH
T1EC02F83968786C7B8EA3AE0AF58637275FA5213BEAD42FC4D9E41B1C00D764C1306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e64c948458b667b85b49741b9961583b1183064aecd2e148779370722c83f5b6
MD5 8dca8e18e3f4732394ee3c2ef55aa6b1
SHA1 a06dc1f29ddcd2112143d3bdc912b0784a97bab2
SHA512 6aedf76a5825fce611f60f4fe50dbb66e59cdc55019d57e263722d41d9e406187fd4645172256b2cad62d1972729d178998d6e04ee98356b49d8e24a92d56ed7
SSDEEP 384:n1tNnNnb9GsNtuppLBkqdhdjm5hg2GlP7Vz2:1jZbsTDdjm52lPJz2
TLSH
T1B6926C3568386CB78AB39D52F41B36136F7561B7D6C42F81EED99B1E00CB68C130792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 bf08e578f37a3787bc0046d2a104fbca43803f318e453a0276be38d1498191b7
MD5 c043b4efc7f9f891c7fef27378ce88c3
SHA1 280d2c67da6e01d120a49c89d54b035ba130d55e
SHA512 702322aa930e35ca4eb37d458be633f2fa66bacbc53c29b219af46a366708dc93434e1a6654bb341a6e3651c15bc6f926309134347ebbc2581adec6a9e80cc2b
SSDEEP 384:nRtNnNnb9ZsNt/p7LBkqdhd4m5hg2GlP7Vz2:RjZbbODd4m52lPJz2
TLSH
T1B5926C3568396CB78AA39D52F41B36136F7461B7D6C42F81DED89B1E00CB68C130792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 ae46c7d230da8a202d15c7a5386e1b4b77b92b4b8d222aa2052abd22b60218a5
MD5 e39bf3d7e1fa156045f0e03c62e450e6
SHA1 018212a78c1d7a7f77485d8e460cec8939df34b1
SHA512 8727a29a419894a679ff288fc5b4df3f2f77bf6533f8519eb2da2ddf363221143709185f709416a1ee56d252588a54e83a3df8867186f5b8d7c6aee3e613732f
SSDEEP 384:nltNnNnb9wsNW+Td6DUdBkqdhdoZThg2GlP7Vat1/7Izl2:ljZbe14DdoZT2lPJJ2
TLSH
T108A27D746839ACB78DA7D546F22A37037FB45177D9C42F81EAD89F1E00C669C270B829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 634eee2ece5bb9697d5b840f8690d836e9aaef747d286ebd5a02df1ea9f48146
MD5 9cd9779bbe0e68b0db7f3a6458bf368d
SHA1 afe3e8fb8633e2627320ef28f15db81f2e964737
SHA512 7d40d56b697576d42b5ea29f02fe531041628adb9213f351debe6a7e1f919b6735c3098eb793aef2909d4bad0a887e5aeaa7b0eed26076c04ca745d6ab8ab80c
SSDEEP 384:nytNnNnb9bXsNt/p7LBkqdhd4m5hg2GlP7Vz2:yjZbRXODd4m52lPJz2
TLSH
T1D9926C3568396CB78AB39D52F41B36136F7461B7D6C42F81DED89B1E00CB68C230792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1af598a2874f31d6d6e59c5426380ac8b129550648efaf4a3e03b67e802aed71
MD5 e3a9a4943af52afbb2003075ca3eec38
SHA1 6c1247e276d27eda44d559eb8134c839afaf8624
SHA512 89e9116e27d5b22d5e770bb5d8db2118e7bbe4aebee1fab5e3a451624f4f34bf6cf1e4b2c26c18020dec48cf84db80480b47ab078ccacc3f279cea087b797e60
SSDEEP 96:ZqONk8QsjpfmUT+K5ih/cIPURHl8h4otop5dYD5BDPwivh50xy0SFYKIAxteYkML:gONA6k3QmiUyQfz903vdhdKcRmR/XU6
TLSH
T1E512F734A8786CBB8FA3AE56F48737175FA4217BEA851F81DAE45A1C04C76881707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0b0fca201d18b0133f8078b7b9bbb8f7a651346ac9832e82658c2123c36e73d9
MD5 db16b310b3cde381c8ffe85453355171
SHA1 bd6a0ad61d749ee5fbcaf6785ca1183f23bdc3fa
SHA512 67915dca1e6555a4a414d70de14c29145ddb36124b01e10c7f8350659b6a9f1073548332b04f87f9548f8275b45329098211c0f7430e1b98cc3fc54991aea0f9
SSDEEP 384:nitNnNnb9U3sNsApqZBkqdhdMdqA8wNo1qxKeahMhShg2GlP7Vat1/7Izl2:ijZbq3xDdM38T1OKeam42lPJJ2
TLSH
T16AC25BB094A55DE748E2D8CAA616F6133EB41137C5C81E4CDBF9BA3B308F5B95703426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 7d26c7b7f0424708e8a6b1f63b1e55ac54afbc13e788ea5dddff6d3bfd320f7b
MD5 7b234fef93db6610c75b3576a04f98b2
SHA1 fe8b9b6bdefbeace8b383d87415e3c9481e59dcc
SHA512 d709bf204fbf87de919cf41f33ca28aa5b8b9d1ee82fd9b7b76703f8bfad62202240683d077b29f1a324cc0eec9d70bbca558992654d4c32bfadb410eedbb508
SSDEEP 12:TLyeSjPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isZQQtydyfqzQdyP7W:TLyT5UOl0afDdWec9sJFXZB5fc
TLSH
T14C92AC376D352033E8DB8B3ABD8349D10EBC125EC9A7B844DDD449620DA1BC2A2991FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 d2bdd2385e63a617b306dbc9d3a50ba2b3076bc5c7773d4c5a31ae9b3f92fe7b
MD5 4a224320e8d0d7f7256232b507d25e7e
SHA1 757a8a21bd33db45a39dad5a6a42b9f44974a11c
SHA512 1e4e02faf4d705f5ac72dd69c551566e51c8796ef7ed9fbcd6d8c6da6c0c32eff8fbc4f6f3f4e766cab535de906f3ae66c3e299bbc5793758da051fea8a8a6d1
SSDEEP 3:MsEllllkEthXllkl2zE/li4+llll:/M/xT02zn4at
TLSH
T14B440404FFC00C17DD401530C473C3553370D411071F5743345104735CC57400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0eef740c3b7fb87061bf5c2f2688bbe2183e69602c525c4bcce387c14f90abd0
MD5 0542669a1b2484f24cf968f36e658e43
SHA1 d33c0971479d79c8a64e119fe62fdbfec713dc0f
SHA512 666465a9b7e1ecdd10859bf3813b49bca63ec828c828e8d419c1c6f4a508228fe4d924905e5a6d4d41aba8448c5e60f791dd63719ee17afb68d8430a914e823a
TLSH
T120410688B6ED1148B3B36F569BF6A86D487F78772E47945D00010E8F0A27B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

56d10a79-d6d4-4f46-a914-175676673752.tmp

Path C:\Users\Admin\AppData\Local\Temp\56d10a79-d6d4-4f46-a914-175676673752.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9b153561-890f-4a0a-8367-989c7eac10c7.tmp

Path C:\Users\Admin\AppData\Local\Temp\9b153561-890f-4a0a-8367-989c7eac10c7.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd75747e-5a92-4374-96da-f9dd1ee2e915.tmp

Path C:\Users\Admin\AppData\Local\Temp\cd75747e-5a92-4374-96da-f9dd1ee2e915.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_680712061\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5232-1084-0x000001E6C0AE0000-0x000001E6C0AE1000-memory.dmp

Download

memory/5232-1077-0x000001E6C0AE0000-0x000001E6C0AE1000-memory.dmp

Download

memory/5232-1079-0x000001E6C0AE0000-0x000001E6C0AE1000-memory.dmp

Download

memory/5232-1089-0x000001E6C0AE0000-0x000001E6C0AE1000-memory.dmp

Download

memory/5232-1078-0x000001E6C0AE0000-0x000001E6C0AE1000-memory.dmp

Download

memory/5232-1083-0x000001E6C0AE0000-0x000001E6C0AE1000-memory.dmp

Download

memory/5232-1088-0x000001E6C0AE0000-0x000001E6C0AE1000-memory.dmp

Download

memory/5232-1085-0x000001E6C0AE0000-0x000001E6C0AE1000-memory.dmp

Download

memory/5232-1086-0x000001E6C0AE0000-0x000001E6C0AE1000-memory.dmp

Download

memory/5232-1087-0x000001E6C0AE0000-0x000001E6C0AE1000-memory.dmp

Download