6e6f0557309ec221d0bfd6c71c6c1c52241a091629075f2545f352641826756b

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
73514b486d4b5165cc88a613c6dd5ad9.eml
Size 115KB
Sample260604-y3ex8set4q
SHA256 6e6f0557309ec221d0bfd6c71c6c1c52241a091629075f2545f352641826756b
MD5 cfd81341ecb9a88df7183f64c4935386
SHA1 5a793e27c03636a4850cdfdc0c541a48fa228773
SHA512 49d5d7501ed0619f2a128c9901ba5447a3ea63686625f9d6ff63de944fb02c06a4af9cc854d2564be9640341d8fc949b1707ea4dc55c2e9e1f06f394c43a710d
SSDEEP 1536:pBvPJyO3cYSPBWuuAzuuLlIURVXrc/pdg9iu8f9pUomuJXYOMVsikUSHYvQg1vlU:t13cYSPBWVIpXjiuGRVUS4vQXwDlU
TLSH
T12CB3074A8DA61336D98178DD0C55BFEF66A91EFB84B32088CE7C789604039FF5259F48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4204	msedge.exe
4264	msedge.exe
1064	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250779794578298"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{77C5B51B-F89D-42AE-874C-C1481B1D6F3B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{7E708864-72EE-49A6-8227-91CD7CFE8B71}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
4560	msedge.exe
4560	msedge.exe
3632	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1892	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE
1892	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 3512	1892	OUTLOOK.EXE	81
PID 3512 wrote to memory of 4036	3512	msedge.exe	82
PID 3512 wrote to memory of 4204	3512	msedge.exe	83
PID 3512 wrote to memory of 3408	3512	msedge.exe	84
PID 3512 wrote to memory of 3408	3512	msedge.exe	84
PID 3512 wrote to memory of 3408	3512	msedge.exe	84
PID 3512 wrote to memory of 236	3512	msedge.exe	85
PID 3512 wrote to memory of 236	3512	msedge.exe	85
PID 3512 wrote to memory of 1660	3512	msedge.exe	86
PID 3512 wrote to memory of 1660	3512	msedge.exe	86
PID 3512 wrote to memory of 1660	3512	msedge.exe	86
PID 3512 wrote to memory of 4560	3512	msedge.exe	87
PID 3512 wrote to memory of 4560	3512	msedge.exe	87
PID 3512 wrote to memory of 4560	3512	msedge.exe	87
PID 3512 wrote to memory of 3068	3512	msedge.exe	89
PID 3512 wrote to memory of 2160	3512	msedge.exe	90
PID 3512 wrote to memory of 1840	3512	msedge.exe	91
PID 3512 wrote to memory of 2936	3512	msedge.exe	92
PID 3512 wrote to memory of 3068	3512	msedge.exe	89
PID 3512 wrote to memory of 3068	3512	msedge.exe	89
PID 3512 wrote to memory of 2160	3512	msedge.exe	90
PID 3512 wrote to memory of 2160	3512	msedge.exe	90
PID 3512 wrote to memory of 1840	3512	msedge.exe	91
PID 3512 wrote to memory of 1840	3512	msedge.exe	91
PID 3512 wrote to memory of 2936	3512	msedge.exe	92
PID 3512 wrote to memory of 2936	3512	msedge.exe	92
PID 3512 wrote to memory of 4592	3512	msedge.exe	93
PID 3512 wrote to memory of 4592	3512	msedge.exe	93
PID 3512 wrote to memory of 1060	3512	msedge.exe	94
PID 3512 wrote to memory of 1060	3512	msedge.exe	94
PID 3512 wrote to memory of 1308	3512	msedge.exe	96
PID 3512 wrote to memory of 1308	3512	msedge.exe	96
PID 3512 wrote to memory of 1308	3512	msedge.exe	96
PID 3512 wrote to memory of 3688	3512	msedge.exe	97
PID 3512 wrote to memory of 4588	3512	msedge.exe	98
PID 3512 wrote to memory of 3688	3512	msedge.exe	97
PID 3512 wrote to memory of 4588	3512	msedge.exe	98
PID 3512 wrote to memory of 2140	3512	msedge.exe	100
PID 3512 wrote to memory of 3656	3512	msedge.exe	101
PID 2140 wrote to memory of 2792	2140	msedge.exe	102
PID 3512 wrote to memory of 1576	3512	msedge.exe	103
PID 3512 wrote to memory of 1576	3512	msedge.exe	103
PID 3512 wrote to memory of 3280	3512	msedge.exe	104
PID 3512 wrote to memory of 3280	3512	msedge.exe	104
PID 3512 wrote to memory of 3592	3512	msedge.exe	105
PID 3512 wrote to memory of 3592	3512	msedge.exe	105
PID 3512 wrote to memory of 3944	3512	msedge.exe	106
PID 3512 wrote to memory of 3944	3512	msedge.exe	106
PID 3512 wrote to memory of 4952	3512	msedge.exe	107
PID 3512 wrote to memory of 4952	3512	msedge.exe	107
PID 3512 wrote to memory of 4820	3512	msedge.exe	108
PID 3512 wrote to memory of 4820	3512	msedge.exe	108
PID 3512 wrote to memory of 4820	3512	msedge.exe	108
PID 1892 wrote to memory of 4560	1892	OUTLOOK.EXE	109
PID 4560 wrote to memory of 2416	4560	msedge.exe	110
PID 4560 wrote to memory of 4264	4560	msedge.exe	111
PID 4560 wrote to memory of 4060	4560	msedge.exe	112
PID 4560 wrote to memory of 4060	4560	msedge.exe	112
PID 4560 wrote to memory of 4060	4560	msedge.exe	112
PID 4560 wrote to memory of 1452	4560	msedge.exe	113
PID 4560 wrote to memory of 1452	4560	msedge.exe	113
PID 4560 wrote to memory of 2232	4560	msedge.exe	115
PID 4560 wrote to memory of 1184	4560	msedge.exe	116
PID 4560 wrote to memory of 2232	4560	msedge.exe	115

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\73514b486d4b5165cc88a613c6dd5ad9.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://url7925.withme.com/ls/click?upn=u001.oeUcd4d6qrB9JyLP7Q3G-2F2tBKrHe7IYF-2FIiig-2FD4RFb0ZJIamlHO-2FbFBZ4tuBg3paW7L7LzsFnd-2B046EBOxLISXdlZwYpOFKArkwc2v18Eo2QOAfp-2Bnw7Hqfc1Zj08lStQISNJPc6sZwxY5baK4r4djGq9Sg7me70Rqnk4wllE62RC-2FYonWScGOF7ERBgQPJ6uki_kosi3356XLmNdLAYKG455-2BysrlFalKYoC5bNRt4i2-2FF-2FO0Q0JzGLBKznMk3-2Byqtcy28GQMzYXQwO-2FMfbMOtv3s2soJKV-2BkHAfRX3w44PIbVJVv77IPW1UXo5OGJpj4abfowMciG7TSy1-2B4ehP-2Fd2W965alOlircswL5XLdkr0Gk7BTUpnFYmiXHGWbV7MnbT3xxFsk2ftkeHgDTIo6bHb6W7iGyvNgkg-2FQSb1LmuJ-2Bk-3D
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffa121ac188,0x7ffa121ac194,0x7ffa121ac1a0
    3⤵
    PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,734484715231815699,5282708097059908504,524288 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,12714108772795283019,18182624521798921767,262144 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,15285448634985941201,12604508453849159089,524288 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:13
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,11594926635310195538,17208818413409926280,2097152 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,6362669566761150640,1080346623547522919,2097152 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4088,i,3844555299258059293,6341410308314953641,2097152 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4128,i,14325166357782410602,3533779542955923579,2097152 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:9
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4116,i,6695476095096233612,13174362502310999758,2097152 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4100,i,884939103601208744,15928099491749644356,2097152 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:9
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,17840225989912042238,6002188116594873472,524288 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,15858213513968096636,8392473058532716854,524288 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3612,i,17303348744138601703,8257077904280602436,2097152 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,16507912649104781936,17733006250612145666,524288 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,15581273283040658724,6796433810283920555,524288 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,18096597713954898416,16699560642830944240,524288 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,14828850358170995140,6939700489750002077,524288 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1144
      4⤵
      PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,18096597713954898416,16699560642830944240,524288 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,8491755203683256192,15506680499248393469,524288 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,14686276317366398680,14510506149087620732,524288 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,4514873834399838641,14578593364107710670,524288 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
    3⤵
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,11515710861480356660,3873019488588916736,524288 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
    3⤵
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,7911268379458761392,10202950728350701584,524288 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6600,i,5097524528896482713,11508741305936897278,2097152 --field-trial-handle=2204,i,1218297109812627338,5666780917167303840,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
    3⤵
    PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://url7925.withme.com/ls/click?upn=u001.oeUcd4d6qrB9JyLP7Q3G-2FyvlyP-2B2mBZtNVdGG1e0idY-3DFQvl_kosi3356XLmNdLAYKG455-2BysrlFalKYoC5bNRt4i2-2FF-2FO0Q0JzGLBKznMk3-2Byqtcy28GQMzYXQwO-2FMfbMOtv3ou-2FXDIubzyRQUtLZROUTyHszseuZzXka8Gi0wj65oMSJVCJUVJtopfJZ3gkAuE0LOBnTDyoe7B4QnKqWcwiEHWEjelrWOjDshI-2FEPR9KayOAX60HddtTsUbjZGg4tnU2-2BKnP9v-2FgytS7eCQhFW9GQ8-3D
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffa121ac188,0x7ffa121ac194,0x7ffa121ac1a0
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,17335802618241674182,4319585356387382247,524288 --field-trial-handle=2152,i,15266817345676516637,3298041910314195404,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,8975164234103286746,1840286496329019101,262144 --field-trial-handle=2152,i,15266817345676516637,3298041910314195404,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,15762279532823987093,17783568337088992572,524288 --field-trial-handle=2152,i,15266817345676516637,3298041910314195404,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:13
    3⤵
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,140034471651872178,10832316265449475853,2097152 --field-trial-handle=2152,i,15266817345676516637,3298041910314195404,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,1979772954764680874,11567026550834255855,2097152 --field-trial-handle=2152,i,15266817345676516637,3298041910314195404,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3404,i,7262355454527549883,9025637692380783577,2097152 --field-trial-handle=2152,i,15266817345676516637,3298041910314195404,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3532,i,12058882839910657294,12572997726215233383,2097152 --field-trial-handle=2152,i,15266817345676516637,3298041910314195404,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,2186988037752589260,17665040267295167158,524288 --field-trial-handle=2152,i,15266817345676516637,3298041910314195404,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:12
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5184,i,10126363759937244545,8870428279558231791,2097152 --field-trial-handle=2152,i,15266817345676516637,3298041910314195404,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:3632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffa121ac188,0x7ffa121ac194,0x7ffa121ac1a0
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,15404109267838114263,945876642995609616,524288 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
      4⤵
      System Time Discovery
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,8341469994037985951,7860222997940392992,262144 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,120651832436321502,7524792266310644490,524288 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:13
      4⤵
      PID:824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,16493170499905705072,2621912706051037516,524288 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
      4⤵
      PID:592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,16493170499905705072,2621912706051037516,524288 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,14684429414715444512,14187160288730470332,2097152 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4960,i,4688392191039049570,11370376456697769818,2097152 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,2289807455748694005,4103551796399057517,524288 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,1145613349260381004,17631733267498423196,524288 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5876,i,11569349543274481263,3708617011215927132,2097152 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6100,i,12199328125548669728,2768593017097776448,2097152 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,17805773233555252109,9443486238480750831,524288 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,2311395055311639735,9526982692355495357,524288 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,18041223460819394090,10854561053620524048,524288 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,1648400827739042284,5632966532958971930,524288 --field-trial-handle=2044,i,5515205601934748316,12841167432149116223,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
      4⤵
      PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://url7925.withme.com/ls/click?upn=u001.oeUcd4d6qrB9JyLP7Q3G-2F2tBKrHe7IYF-2FIiig-2FD4RFb0ZJIamlHO-2FbFBZ4tuBg3paW7L7LzsFnd-2B046EBOxLISXdlZwYpOFKArkwc2v18Eo2QOAfp-2Bnw7Hqfc1Zj08lStQISNJPc6sZwxY5baK4r4djGq9Sg7me70Rqnk4wllE62RC-2FYonWScGOF7ERBgQPJ6uki_kosi3356XLmNdLAYKG455-2BysrlFalKYoC5bNRt4i2-2FF-2FO0Q0JzGLBKznMk3-2Byqtcy28GQMzYXQwO-2FMfbMOtv3s2soJKV-2BkHAfRX3w44PIbVJVv77IPW1UXo5OGJpj4abfowMciG7TSy1-2B4ehP-2Fd2W965alOlircswL5XLdkr0Gk7BTUpnFYmiXHGWbV7MnbT3xxFsk2ftkeHgDTIo6bHb6W7iGyvNgkg-2FQSb1LmuJ-2Bk-3D
  2⤵
  PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 1b84a03b0c54ce48a394b1b07344d38a1513d284455850bb790213333f3676b0
MD5 3fd462a9162e1361ef1df613c505a9e8
SHA1 328b62e6d3e571f8f91320c9d865e5536473e368
SHA512 45a7cf76cb1f59e17faa5c199e7dc27359ba5afff0e8279931485d9ff3d85751b179434dbddba529c0c7e5346f74d89e5c6eee0cdaea9d6a37323154c39ea59b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
TLSH
T1E9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89aece557b44b7bbfbbcf4b400964122abd96af51f7000d28f68afe565894a22
MD5 ff6487a63dca3c0e7697c03c6b093dd8
SHA1 15724b0465bc412976304db8ce95ac206b29956b
SHA512 698da47d0afce9fad9775a1b8cd1e2d7e3f8cd3e1dbbb10136880bcb81743e019157dc098f2463c1188515517262b068d535220c80b67a1e5b232b0b23a5a46b
TLSH
T1B2D023B4AD220830C052F63F1442D1073FAE54400D03310D26C034116CC1ADC04DB8F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bfd11d208699e080de8aebbfc6f9489ee5377a34b9e0af589e09331dc869f2a7
MD5 913b6e7066d01e26d5b8f8fa60916c05
SHA1 64c15971f8588d24a143dedcdd4b73a0967c646c
SHA512 77230c8104f576efba52bcac6431711f1b78de01e793580cab3d622405bc5edc60f9635651b39239978f13df71bfcc57886c5d5b3f5dcd46958605a62393c0a1
TLSH
T1FCD023E09D231420E635B23D645752053BEE54010E571206D85139571F866FC05D35E4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0bada15c0e9d915f25da0b4200ba259edf1558ad608ef0d91d51706d6c018cf8
MD5 dd590cd1925cbb15fcf8a5e21e0ced71
SHA1 ad381b3e881558e004ac2af7c47fe980fbdf910b
SHA512 2d4760eaceffb0ba2c8b1c6096a970e5b33feb591dc3d3ee03ab457db45a99f041a2d07c314a315ba94482618049a563585209da278180416b74f9119d4473e4
TLSH
T191D023B4ED120830C052F63F1442D1073FAE54400D03310D25C024017CC1ADC04DB8F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bfd97ed3506eb28dff09da8164ab5253186ca7010d125d0ed84a14fd8fc39293
MD5 269550f0129b5785c1cbdf4464c2b40d
SHA1 226ae6884edc5ff3d98e43ce38978bd367d0cc72
SHA512 7c6cff86f2e4d739e2905623e972731938d671ef6fc9a7f383d88ab6e2b4f4851fb2f2ffd84837045d9cdb1919cc5fb410fddcfc25dfa4d872f351d614334457
TLSH
T1FDD023B4ED120830C052F63F5841D1073FAE54840D03310D25C424016CC1ADC04DB8F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

557618cf-85c1-47e0-897b-08cdf10dcdb6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\557618cf-85c1-47e0-897b-08cdf10dcdb6.tmp
Size 414B
SHA256 cac33552b4274a0f013ac69884eb87bf137f82d1826438b57a6d6d001efc11c3
MD5 35a19c3fc1ed11bb389a5ff7b99a828c
SHA1 ae9c0f71b8e3682a24bc5ab665d773209ac9e13e
SHA512 78b5d2a372bb079274bec7b5ffa80768129dc6b1bd6b6f5014ea799fc791f7afb0bcaf75b5451750c2bf2e597cb629cbb54e1461919baac3eaaf070858e52e83
TLSH
T1D8E02B99CA359C2F18FD1B3974504747EB54232B2F41459F3A3D91088FB0A3F418A86C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 9e2427b8f0a36f4255f79f4f4b7e3b99c4afa80fc58b7d80dcda84605b43b734
MD5 beea93cd862a04d73c8ee303927603e6
SHA1 66de82b8c64ee0abea91b03314b4f4515f221351
SHA512 edd1fd3e40aafd7eabf4f2dadc5640d759354f3b7222fd75c9b444113e1089b39c01dc05e54a60b9a20f28995c307291004233ba02410d91b97f17d652b117bc
SSDEEP 96:19xIhdbheVVt+dVugT9JQNp3chDF3oal+3L09VKL0CLXSPyaH:PSwcVucHZ2pWPj
TLSH
T1489194E47183D2AFE360463484D2471136F7B4F60B6F1D8161AC5A7D9C3A78CCA16F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b6fe02c5339427274e4e3a776c95e6982db28e9c38a0717756758bd8352e1bbe
MD5 9f8db08d2a8a5ca18c670afb9530ff66
SHA1 028769023234eceae76739e118dc0284dfcd8fab
SHA512 1ed5f371d793d0718179f37e052dbddd7dc6b4a6f073e38c29c55279de57530b54fd9f0abf97336373f4d8dbaf944ee4fecd020d9713c93207af9e697ceec39a
SSDEEP 96:Dj1paNpmc4bWO+/KT3bymDyr7UV+UQW3dJ/fJzyvU+QfzLLXI:f1e4bWx4A2x3ux
TLSH
T1A69194E47183D2AFE360423484D2471136F7B4F60B6F2D8161AC5A7D9C3A38CCA16F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 666a430f80eb4c149b4e7b1e3012048c3a97f7fe9e88ba9dc35704013474a8a1
MD5 569e3a6359257a63dc42b2c652fbbd2f
SHA1 5ab6f83adb4444e072316b3eb1b6d6fcb701ab38
SHA512 9cfa87bfa8b7bced6377178f6f3d6c679f325f962fc4664f1264100a73065ebbfd80946027dab73f1b38d2d1c02db7b65219da217de00f247d2bba9bd79b2b2d
TLSH
T145713EE8B6C3D29FE371023194D213513AF7B19A0F6F1EC2219CA8B5693A79DC119B0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590b70.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590b70.TMP
Size 3KB
SHA256 0ccf5da0898f6d96be954e04df3ff25d42959dcba5eddbe20ba91fa51c442f37
MD5 9f60540cbebbd94fd31d0d92ed848dc4
SHA1 75d020d7571231d6cdc3f9a34c8b70f58d34190a
SHA512 f4a79c5cdc3be2ac5291ed28bf1fd70491a785e01a305a70004f39a5a016cd775dc317ee4e81ba88c24f0e26d974a990d59e17e175cdaaf8dc0dfec631789606
TLSH
T12D611ED8B683E29FE371067198D213513BF7B1AA0F6F1EC1219CA8B5293675DC519B08
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 912B
SHA256 5b8b95bcfc5166dae664a63a04cce2c7181632bb2aa16ee3eceb52dbc24ab359
MD5 31f2fda68069960fc373111b3b077fe8
SHA1 261eee6c07a38136aecdf18edd8561fe6e770935
SHA512 9ba0c6d6e5bc149a052565c05fd051088a61e04012f246975055fb716b43b519f150543f1b20df171407eb43bbed922668b3d0e510348abb0f2bd93ef6ea3ab9
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 ed91f17257fab84bc9598427fe441d762afe0c136cb399fe90ab1fc572ee5bd8
MD5 fb26bcdd00b6071ca1223bd398ae4195
SHA1 f1d070abe54e3d5366f02288606d1ef3e5d464f6
SHA512 632031bd3c3ba17f1d567bd37ec3238adf66d3960e21e835df43eea13a1c9e8d9c7588624c8078fb8e83ff3e8da025fa7626aa304d2345059be7b92157993027
TLSH
T16FE0204409CDD5BAF15475E346AE574887D1354FB2843A09270D8D487203D8273C7754
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.106.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 2c1489016d8a98c73f9d0db3ad3282e3ca959839bff36ae8e75abe6ebd2c093b
MD5 3774fec642ae4687ddcd5d138fa763a8
SHA1 60cb6ef1f78a81dbd434682438c2e192248e277c
SHA512 b77773a4fce66e9eb5c0d0ab426f8a6049ed5f781e12d285ed6bc8d16e6d1da314067b7c816c562f9fe14ec2ed0b4be37ae3f4f3fa58c581db243ee1c69c6c37
SSDEEP 48:uzBmw6QU1PzNLpHWHnAHCyostNxKdkwYKfnRg7Gr9gkh0/jD1Kdr3UmEpnmHFHYV:6BCx3CgxHCdkPK52erhxr3LhNuR
TLSH
T1F892C62B6E7C3426EF261D7AE2BE31BEE57BD1243D93AC54381190414EB0500E5ED3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 0c30d037b7244fc8753d5160f0372826b8a95717e3f0d7d15f8bec06dc631c8b
MD5 d48037289818ce8e1cb133864f5d5a7b
SHA1 ac388a6d036419e766ace4970448bd98a5f0769d
SHA512 8c184a49650392b40416b1cb23eacd8d24b0d7d30e2e417a994e6b29a51ffd73af041e3c69b9ab135a0bbd9df20b9f23eec803342cf418818a1315467d70f425
SSDEEP 384:4tscana83uFBBQ1GkSrn0XPlIrWPT2DmtI97DNspUxO:jtkFBBlMPZU0
TLSH
T18814E71F2F212301DD7D40B2E5FB64DB98AFF03E4B537589A8511451CEE2B63A05CAA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 bc7b0a81c57017c85011c42bb448a0f16382da145c67a047635b584b74f63f15
MD5 ea74618dea4b72bfb0b98f67338e1ff5
SHA1 417ec4de2bda13729db2a259b7f01888bb468da2
SHA512 9fa37c566a167a6737cc3d180e1790f481ca34faaf6d6ce7b3fc6767b39bb5ddc1b18a1b59f3fb2842e729b9b9dfa924293dc52bd42662d3e4a2a083bf9d0e78
TLSH
T123E0D8A044CEE5FBB244209B463E7B08C7F0344FD68A2E059B0C9944B003104B7D13D2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 9916502f8a604d8636537e1e727d1565a496d80b03a2f4a216caf284f672f07e
MD5 11939e9ff633f2ce6cacaff7772e649d
SHA1 85115358cc21b179497719ed5f578ed81acc66cf
SHA512 7e26beffab5e5f582275cacd9c629c1b6ae07f01061b36ad049f49de4cfc31ce0be72e266c5bc22103a6b2bcb67adb6c171855238bdc246259233440c8147f1e
SSDEEP 192:DmAhuTaaABCiKIYSkm4B8s5Aea4LPOqOVA9T/RI62p8IiQXC:DmAhuTaaABCiKIYSkm4B8s5Aea4LPOqr
TLSH
T19BE1AFF7C3E9962D891296F5AB147E17CE5C0924932C3D2AC9D4AF0B67E2871E20174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2965e957b266196cde18472cef5366fc9d7ff909890701ef34d81795b7b775c0
MD5 d5de8c7f75ac61aa3935cb82b1db9108
SHA1 d5bae78221139ba0128c8f10a33e97cb7e818bdc
SHA512 670e5e72677cc20235e3c10508826d5122659845735d4e404c979c0abf945ebc13ef46f2f77e38d117ad3dd8e7dac0c743a44ff778866fb09d1cec36f65b0895
TLSH
T14261ACF7C2E9826DCA1555F4AA14BE2BCE2D0524831C3C5AC4D4AF0BA3F2871D20164F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 75d5cd69ab25318d41292f39f09815547a46ee0e4a93cbd8a44aadea7e1de213
MD5 1a58422d2271b95255e44faa80461d70
SHA1 46d504347197a11df6e2b88076eec364015d12d4
SHA512 5487d556b41b2a5e448c8dce71cbbbedd87641954e89659359db161757c5a8365dba35f32d537d0d9a4b5743832a67d5b91f52fc2c140ca669885baa95b42c18
TLSH
T1814148D7E67EF417107D9D7B1E04BD0569BEE8360653A8F4DA9AC36CB081AB30B13012
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 456196a2bd86d248e11744de02154a2fd123c25d0b3796777ad26d529f535587
MD5 a6e0e0c604a931cdb20e1484af70f8dd
SHA1 3b07f99eda2f75d688874846b43ce537ac6a317a
SHA512 8f8ed244793ca82d9c2ef8f8477ee0dba0ffc488db3da2f61b75ff27f2510298587a3e91886ec2d141ab9e0683f6e4d95a494d984fac6eabecbc2dde8728f80d
SSDEEP 192:sxZzRGyM/jK1Ml8MNG/f4sju+XgXJ3wVQIdpvxl3/nV6+WNhtXl/Y0aIq+PIg4J:sxZzY1G/f4sK+wqb/+B/54ac
TLSH
T12E52F906AA3499B7CCCBD219FA45BB53D6F51573D6900D489AFCDA0C05E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 830aafaed4d56253ba089281a7a36310cd813aa92431b986e6b85f77b7fb3ef0
MD5 527900e127a718850414ace3f1cf303d
SHA1 b86c417fea5ab2e98091d18ea679cdef2d67bbc2
SHA512 cb12ab562353643f0d8f652a912621e667dc8a5954c3a8d8d6951a063a1e2fe373f3ecb0d49afa7e403900ad868bbc73c5cb346ff880cf8195571932f309f1b0
SSDEEP 384:sxZzVfG/f4sGWvU+xn2c7/i3b/Jvcq4W21:sbNG/fSYU+xN/izZ4Wu
TLSH
T13382E946A53449BB8CDBD229F945BB17D6F54823D6904D48AAFCDA0C01E6BED3203C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5faa99d4cf9fcd2fb2e8631986a278a651b0ea98352aa0f1e423618125c16cb6
MD5 f2195e593a61ade144be34344521fdbc
SHA1 7dd2eac1979ef93388edb5ef9887c9b87858e893
SHA512 5d28c50b725244154aaceead5ddc04603cfc3c922f99cff38e85eb1dbaad498bfa91f676c488ae5bb8ef69bb298a018fd681ee1c9d18b3162e7c3198e02b9afc
SSDEEP 192:sxZzRGyM/jK1Ml8DcG/f4sYWpVPu+XgXJ3wV5oIdpvxl3/nV6+WNh+RXl/Y0efqP:sxZzYlG/f4sYWvG+wUZb/+c/57d1
TLSH
T11562EA06AA3459BBCCDBD219FA45BF53D6F91432D6901D489AFCDA0C01E6BED220385F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 fe50ad78941b14ed1847706013e8cee6442c9ed3504eaee9aee286cc97d5bbfd
MD5 0ce53710798115cd252e8c2f5c000049
SHA1 de85d34ffd19b7e79ca930f49360b405bedfb2c9
SHA512 439f844bbad96e7d217e3e5298e5cdbb8e9d51db519237d6b64bfb8b30fafdf9b46af1641d90b28e5d9681a8d4ea1ce58fd02e09af6396ccdd4e7abfc2e30088
SSDEEP 384:sxZzyfG/f4sHWvU+kn2FZ/eI7/Jvcq4f51:sbqG/fjYU+kk/eIZ4fb
TLSH
T1B182F906A53449BB8CDBD219F985BB27D6F55423A6904D48AAFCDA0C01D7BED3203C9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 fbfbb76d82610a3b25d97f7ddede7cd3c87ab360a2124d3de05759612db17654
MD5 171cac2093e94c4e3eecf8de74df4314
SHA1 2b5406fc06340303ff7457af33eda2892c4238d7
SHA512 d3bc8cdc02c6261baddd953108af95bc13fe7099516ea1384cbc9d670090f63af96df6eb5673292f5b07692d64ed4eab87ecee85374e9ffd454b5c2af1a94982
SSDEEP 768:5k/zh8dF2A17pLuLXEkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3AvJjLlX:5k/zh8dF2ADEXEkWRmEcQXwu1jaKAvJ5
TLSH
T137030C3F280CCBBE4F844E9CED2A7E9B6EE8018B5698895447FA844C03C66DF55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 32803d1fcf0d110cd242001112edae7ef74918e6bc9c56729edb22bf5ffa88fe
MD5 c9dee94ae9b1cdd7513daa45f1b1ccc8
SHA1 6b8e328f36a9dc2d22706a3dc3fe112377d3df68
SHA512 6234c9181b5d9e604641c0b266e1004dc6a3f3dff3861e8d349455097f3a3346adff6dc60d38c7fde1a6e90ee8b2753bfc2b431b1a771332f2a280d8f09404d0
SSDEEP 768:5+/nh8/F2a17pLuLXCkWRmEcQLw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3AvdjLlw:5+/nh8/F2aDEXCkWRmEcQLwu1jaKAvda
TLSH
T18BF21C3F284CCBBE4F804E9CED2A6F9B6EE802CB5698895447FA444C03C66DF55161DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 5dd661725a6dd4837bcdea5e1bd55560d9aa28f6622c06c8f6f697f6facda996
MD5 9fb1c6d8f0d021d720305bc8abe9c9a1
SHA1 e1d3d8e176a5fdd154e7e88484e04fd91d4d8071
SHA512 6d3348907f219ba779e91b5875d2a7a0dd688689a9a73b8c876b16c0b2283e55d8f4335e03041244d35298e56deb8ff419628168f10ce9ae1efa37013ef01def
TLSH
T161E0201009C5E5FEF15531C38929A708D2D8B45FD3C83E157F11CB44724394472D2AD1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e0e5f18452db9803adb042754263f4e084decf5fe650468094b22786df18efdc
MD5 5ccbc1f41ae0cde7e23970ee4f0fa7ec
SHA1 23df0813b9ac44afd4f686a073e5dc3db52aaa40
SHA512 5e3e08a9980f9bed447e6e0c23545be8c380275f8ace7df58230c5bf4793085de3c039ec6fb0d1282e40a6d23287e6c55c7d5b3d748d97831926602406283603
TLSH
T14FA0025116588040E0204170B84611C8D25168F00049163191A405B88C904544732809
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593406.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593406.TMP
Size 48B
SHA256 7cc1c5b80f53476d80e9d3ae499483d1c227d9a2575c7de0bf03f35f41159131
MD5 9e2627e00c4419724cf8c6ed6be3a63d
SHA1 9579768300dff4ea12fe6016b51ed3affb24f60c
SHA512 515a691741dd6952f71fb10d83bc2bd82d7d5bc8940a969315da8c03127aa61c467b35efa3fe2b1caa3e2fad0d6d49c0d880b1dbb3775e2107d7cca3bec50ba2
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 6eb8a5431c12e6f56be34e22e3560aa3dcf85f892b1a340fc9e13ada23b5506f
MD5 8510449b5535d78eace6940599f40fd3
SHA1 bd5212912a76cc8d314deb97d63a9065585fe2c9
SHA512 a6d1343bb32f85097b6aa6e80b544d7eb1b4911a50939af1bbd63fa1d97b6fed137135110ba59223e0f5090cab414cf8999b023484610f7d91cd96cde68d49df
TLSH
T101E0266404CBF9BA71A064E702BA6B4C82E0784FE78A2D061704C8447303A41B3C66A5
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13425077993575202

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13425077993575202
Size 5KB
SHA256 da3df70050dd0691e75f11f7855091f7e769b5d30ce277f34f35ab681caa3169
MD5 b63155856b11449564a15a034c2e4a39
SHA1 9106d0ad83e3009f6bfc72125d26f53305d643db
SHA512 716c8704db5db60b6bf7479c2f51b7755fd0973910328ed850f31c2f49063e26c4223da2641092febc56368c5185e1fee953e73a7f46c90b370400d05a9199bc
SSDEEP 96:3ozzg7MD186ufFpfctIZMDYZMDMRAXCokMBlabIZMDZKs:3oH8o1f+fcsoeoMRAXCokMBDocs
TLSH
T11CB161227BEA113EF0BE5877C0F935F6F17AB5213851AD1E404192050C63B179B75F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 9a0a2b5364dbdef1385d4ac1534c4db5f2540e500cb42802863f5004c860f2aa
MD5 859c88837e88cfcfe55b30e6f5027927
SHA1 9f4fbe35298a40b510a029d16a57eb30341b1abc
SHA512 6e057a7368a7db84a828e08abcf873e5372ae815a054337c99718ad262bc15a9f4c7705a3ecee8c259e03c1507b7596e354594590bb7ed10fcaadd76309c4ddd
TLSH
T14BB012407F90725DC0D406B115E8578C6354E00300084E13ECA49F340D859582E2499E
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 5d78182c51a6a97e1b65a2ca421853fad8804341b76a8178f87753c55fe2ef24
MD5 675ae20973ef2a68b831b7e5e2cfe056
SHA1 c308fe778830d298fe9f860359340085d6a01bd9
SHA512 3c105ee74ce14e3d0e050741fc440456e4e1ca869772f4f17e36a01400e52ec3fb18cfd56ed0c7fe4f4aa7fe52f589b8715873766293b486781425ff1187cd2d
TLSH
T148E0D82415CAFAFB718620C7422DE70C95E2B59BD6C969196B08D984720B1407383661
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 612706c714939a9e2d7b0646576a17fb4130a87c7b0aea22366b0b40f4f50b02
MD5 fdd9c38574262deb318e8cb6413218e2
SHA1 84cfd6b64b3f37bea9ab790a587c8bd37c55591a
SHA512 ff8ec7c3fb9498d53019a6497956144a94e61a4c55122350a3c1c72f19de2a95ca516418e139a867c6dc0da5b144e16f585379c3c6747fbbed2b9e1d0aa4dc8f
TLSH
T1A0E0267445CAFAFA758060C3826CAB0C96F0B99F93C93A0A97088884B102100B3E6AA1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b568863e50144c1c7d23fb611b676dcf4e8c39288522acce36f8ca6830fdd117
MD5 90a717285c781b052fd6d58e7826dea4
SHA1 c4d8f142a29d1e87b99b8d5e5af6744119cd7c22
SHA512 22fad518be6e5ec13d70c41220b60c323e74c9ba727cb78b53dc86ee7a979f87a66d0ae4daa401c30a254bc411fa5fd0d8879226f788e6663eac0c2ca39449fb
SSDEEP 48:KEWIHKvrGIvKDyYLyVxIdKqYYHyZWInKf6UI:KEWgKvrG0KDyOGxeKqYiaWoKf67
TLSH
T17DB1E15233BA16133C3D3958A39487572A4272633018B92B7BAC5DB50E2FE605DFD5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 112KB
SHA256 5dac6cbd55f9f450f94bf097509e33f628122c4388dc69f6f10b48f410907d84
MD5 bc55507bc10ec3fa263297a1f4930f57
SHA1 9acde296a7c20eda1c4a6b5073ce64ec9ac416c0
SHA512 73c29f0a19fed477ba5c02d7364486e6355d82a7375ef39e2bdd5fda44108db188c8692afc6451575ca3174048830f2a8e2ceeeef383e60cfbbac6d8b3910753
SSDEEP 768:4P2aKOVAQvVyXJ8p+QaJ9/wDWLxFC1YbTXkQF3y4ZW0GuCetHJxCTbW0/LqTIFMs:zSqo4ZPIrzeImM5p9
TLSH
T121B322F76D0A91A6CDCD91B4D51BEE4440B30A25C620D9E9BA3C08C37B7CA07BE756C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 e145ff88a0d93329971fd64796553018a3b5cd81e127610b2d8f8443b464721c
MD5 418de5b74ea0d98f42917c112eff5c8a
SHA1 a45c64875d9025e36d96dcabf0dbf91fdfe84c54
SHA512 2ac6465e4ba504497f28d4da1c55fc07061ee58c1df3e6d982bd67a2f8c90daa0e85b2140f140f7a53cd45dc0d74a7f1ff37afd38d7cc930248fb33a0a7f35f8
SSDEEP 192:lQXIIImbGMIMslYcYyzODfAs2li0BusHqia:lQXIIImbGMIMuBqDYs0os1
TLSH
T18442832E2B152B7BC19F5F7A2256C7851ADC8881497021AD31A22C4F8DF7ED793D12F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 f29787736ba6a6d6ba218dcd3fabd30eb1954f13dbfc52c7064f0518ee5d0e60
MD5 41324c36ff591f1b9bc243af493c9edf
SHA1 6c9530106a3bfe0f68ed90da21033fd4a4ee6f6c
SHA512 bb275a11460bee12966c2e798e4e07608b0d481d7d1ce7d41063a9a72d6a0c5e22581fe1846833c5937fa8a88994b6030e461fea4a803c9dce59d80e5316f86e
TLSH
T134E02610AFCAE9FFB06930DB01365B0C82C4384FEF88AA0A2F11C488B403580FFC6291
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 6da1d2f7bb4a04a9ef193e2232b8424bedbdd809e9487921d42b0d601426cf71
MD5 1d74d4ea1fde70d3807e64affc920a40
SHA1 c8450b2c04d3e70e519726d07a1fde42d4729da0
SHA512 3efb37164328349d18a9b1db11a4e307065006186ae32f3095d8cfa0cf8a71c9bea4348d02a635cbf8d351b3401a35eb82c2f6fb33cf59f5c3a68c7b6942f262
TLSH
T15D216891F330C109D149863A503E67595734E4028FFCEC1F557920643F72A584E473EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 e7643e5329348e58e33a122d1798d7860a630085f3c60160c475e1aea963e540
MD5 1c3847e838654d5fdc6ff179b13a1182
SHA1 a5b7c27aab83913e7646169a092e2c1f4645a9f7
SHA512 faad06ca8f41b4b926d899461a227cb21a834ab682f2cd0f750300bd8a7755b089b1a41f857d57cedeae63d71ba02c3974446cf02d6d94ef53ec2ba16d4926a1
TLSH
T10AE0D850AEC9D5EF705530D701669B4882D5384BEA846F092F018D887503581FB86251
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2636.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2636.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 01fa6d570c841f725e67d8e230cfa980c608bcd8e877e4bbaea91252f99289df
MD5 ddd5b0a91ff10ac0240681c32c313fc6
SHA1 a62bac948d8aa78cd5e60a738e6e2b9f66425741
SHA512 5e8202daf82afd339b7e04e0f7250314d6f26852ed82ed1e1fef1f54b425fc86c6bf9930f60f7e644ebde52002b3ad9678c5619466749a7ffebd0b6a79250cd0
SSDEEP 384:nrurQXin91fer48NMUIlxICu1Yh93nshFd/w0ju17cWMq57mvc/Hu:rurh9Qr4xICn93shFP+7cWM67rm
TLSH
T100926C76AC785C7B4A9BA505F88732136FF450E7CE951F88E6E8CF0D018B2AC274B516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 514381799c48d01e0cbf359ce2a5cd45e7f9bf127e212abd94a313d5896b1440
MD5 1a88c2e86a9f90382f88f8a20a7402e1
SHA1 45fb7231f68ee01cb40975334c36df9da3051690
SHA512 dcb542da25932d73ee99b623ed4b3c62f5d5cb944ab6f93018e734c5e53a206c9f9772ae661d172dfb94cd8c5348d6170d3d197d3a6e4fa144691f584009ad83
SSDEEP 384:nZurQXin91ferA8N+IlxICukH8M3nshFd/w0ju/sc8cWMq57mvcyF1RIzJHM:Zurh9QrAGICqM3shFP62cWM67rW
TLSH
T103926C76AC789CB74E96A105F94777136FF450A7CE851F88E6E8CF0E008B66C234B516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 020b2769609080576849144bce97d58adb9bf00a02257e47ceaf944242b87c06
MD5 63601c54a270d12a28cd5fe563bd35b3
SHA1 7dbe21278380c30b4d94f57448ccb4362c03706a
SHA512 645b0bc77eadc80e2d2439626942bc078c111604da0a566c7b680ab9a6f77528abd0372afaafa508bbd7b84e909375cddf6e7c1040d10c06e727267eb8d8eaea
SSDEEP 768:vurh9Qr4xICXl3shFP+xFfpH1KG3k3uuUcWM67rm:QLQr4xICXaoFhH1KIk3uuUTM6+
TLSH
T167C25B7EDC644D3E49AEB708A90F35231DB8407BCAB51E88E7A94B0DC27A56CF342516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 41c724ba44918417f9cb31d10d4ae77569413caec60d386b0a739e0b92405556
MD5 7c41e4d2585c93710c828bf55d17f0d7
SHA1 8632eb62227d5f85ee0831b841b81b73aa4acb97
SHA512 c72b5d2a39c46175d785de8fa4dcf4bfef839fada979489da18776164ee156ed519581e899f2879b3f11248cdca1e9d0e0fe4f29293462f202eeb3ccc2aeeef0
SSDEEP 192:BGNM6P2UOcQmiUyxIUFWqGv0h6+Fd/wsNwSIJU6:BGNM6eXsCIwWqGshFd/wi4U6
TLSH
T11202CA396C782CBB8FA2AD45B88777135FE4106BEA962F84D5E45F0C00D765C2317936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b6ec96e5d2ea3d7334bd6388f445401c205e4613d571862e8d700d394cfd1646
MD5 aafe295cb9c6b5ca892f5f10fb400308
SHA1 79e62a3ee796ff6affc2b99c8aad4dc5eb9622da
SHA512 eba188355cbbb78e18c609c216152e81329ba9b00e5832187ec8c92a6e58804f04bb751857d9b0771f923eaab0ffdb9a46895d61b8b83e8fb0e9bbb7e126e182
SSDEEP 768:wurh9Qr4WIC4W3shFPA4TUD9VFZuNb4cWM67rW:FLQr4WIC4tDTUTFZuNb4TM6u
TLSH
T1AFC26C7EAC644C7F0A9EB708AA0E36232DF810BBC9B55D88E7D44B0ED036658F743556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f3574e6b7bdd5dc4f0dad6de21eb366756c24a3f8d743f6bb68c50b00ffee1f8
MD5 a9cda442942077397f285b680b82e7e6
SHA1 528d6f768cf866a39de7303396ccb17b7666dc25
SHA512 fc365ecac39a61c1c350a2970c480ee682fa6c1b52bb9ce9cabecdb4236d3e7b9da96d86aa7b25b1de80772c48a6345a1b9f965a19b9af1cd461659a303647a2
SSDEEP 768:wurh9Qr53WIC4W3shFPA4TUD9VFZuNb4cWM67rW:FLQr53WIC4tDTUTFZuNb4TM6u
TLSH
T17BC26B7EAC644C3F099EB708AA0E36232DF8107BC9B54E88E7D48B0ED036658F747552
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 895a2450639db8df1da26a54f921983ce52783edb513fcac2bdc8d0114543d8a
MD5 d468c622f04abbea41412c3a5f72089b
SHA1 04d0b559b1b3f6c4059aa3f6fa2e502106482f0b
SHA512 54b24089203be514a6d3feeaec795b1b552ec0211b4af8e4fec3c78b5985007c8e592f1562dba45ad080e7af8259427f25e35e07906f83ea90cf90129200bb2c
SSDEEP 192:BGN26P2UZQmiUypEFWFGv0h6+Fd/wsL6YU9/0B8qzpU6:BGN26eAsgWFGshFd/w0juQ7U6
TLSH
T11B12F835AC789C770E96A405F88737539EE520B7DD8A6F88E1E44F0C00CBA9C371B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0bad44293a0d927915b337252018e73b492daf42fd9c2bef98d5e3e2c733621a
MD5 734ec1a3b93b6bc9a7d5f78563e4dcbb
SHA1 3f6a81094fbe40974b7378d95460845b6094caf1
SHA512 fb14f59d1a3d154ffc73c7b7465e73377c5c7a08c07395be0b2613aa2fd0b7bdc2043cca767a3013a685efd9f9d0b47216ffe68f150b882ada4ee1150ec55da9
SSDEEP 384:nVurQXin91ferr8N+jlxICuhH8M3nshFd/w0ju/sc8cWMq57mvcyF1RIzJHM:Vurh9QrrpIC7M3shFP62cWM67rW
TLSH
T14D926C7AAC789CB74E96A105F94776136FF450E7CE851F88E6E8CF0E008B66C234B516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8482f30964c3895e738ef73c1796a364a0c2b899c1b8a6aac1182cdc6793de1c
MD5 66020e2818c18aad3b1bbfdd1faae73b
SHA1 25bbb529d3fb4230038a5bd5ab29a0e91bed9842
SHA512 17343b2e302abae245e68c6e39476837b4dda4eed9d3f4452a08a4d2a131a2dd41c4aa0150d81e6713028bf21d04a0de72f3f877f8ad0dc9366a619bed5cc4b5
SSDEEP 768:vurh9Qr4xICel3shFP+xFfpH1KG3k3uuUcWM67rm:QLQr4xICeaoFhH1KIk3uuUTM6+
TLSH
T1D5C25B7EDC644D3E49AEB708E90F35231DB8407BCAB51E88E7A94B0DC27A56CF342516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c816b642fbfc391c993a62ef70270f1fca229f1642308bce805ee83febc45336
MD5 adf647ef1f532922e2866ea6ca55c5e6
SHA1 916f6d9d001b039d0152acb9ff1db62ba53cedf1
SHA512 5e670ea8b16c6a08a887cdaad55f6add1bdebfb77dbd849b35456c32e5901db6ce33caa1c39bef3efc240a53f6b965152507976845e1cef3245dd258c1fd6628
SSDEEP 384:nvurQXin91fer48NmIlxICu10ml3nshFd/w0ju3IcWMq57mvcyF1RIzJHM:vurh9Qr4WICSl3shFPsIcWM67rW
TLSH
T10E928E3AAC785CB74EA79905F94737137FF450EBCA851E94E6E88F0E008B26C1347522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 54a60168c677152e27a937abd895abdf9004a0b3444d58cc5807e5d4fbc6083e
MD5 9b1642b4605f6f1bbb3bf31addf0c387
SHA1 490416e127f01b319e82ae483e26637ea0d515c0
SHA512 27935ae59db0c7d861cf77bec752c20df8ef585e0084ef4f3f310322d60bcc17898c46976fa2ea084acd38a2f409a68488e3df4aade6b8007efc2070c6531591
SSDEEP 384:nVurQXin91ferA8N+jlxICukH8M3nshFd/w0ju/sc8cWMq57mvcyF1RIzJHM:Vurh9QrApICqM3shFP62cWM67rW
TLSH
T18E926C7AAC789CB74E96A105F94777136FF450E7CE851F88E6E88F0E008B66C234B516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e2070339-db0e-4cc6-b46f-0c2f512502c3.tmp

Path C:\Users\Admin\AppData\Local\Temp\e2070339-db0e-4cc6-b46f-0c2f512502c3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f16ed7df-0eb1-48c2-bee1-c704f6b492e0.tmp

Path C:\Users\Admin\AppData\Local\Temp\f16ed7df-0eb1-48c2-bee1-c704f6b492e0.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3512_1423999988\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26a1f051-0dbc-4a4c-916e-72a005fbd085.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3512_68144310\26a1f051-0dbc-4a4c-916e-72a005fbd085.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1892-8-0x00007FF9FC070000-0x00007FF9FC080000-memory.dmp

Download

memory/1892-6-0x00007FFA3E500000-0x00007FFA3E709000-memory.dmp

Download

memory/1892-4-0x00007FFA3E500000-0x00007FFA3E709000-memory.dmp

Download

memory/1892-3-0x00007FFA3E5A4000-0x00007FFA3E5A5000-memory.dmp

Download

memory/1892-1-0x00007FF9FE590000-0x00007FF9FE5A0000-memory.dmp

Download

memory/1892-5-0x00007FF9FE590000-0x00007FF9FE5A0000-memory.dmp

Download

memory/1892-7-0x00007FF9FE590000-0x00007FF9FE5A0000-memory.dmp

Download

memory/1892-0-0x00007FF9FE590000-0x00007FF9FE5A0000-memory.dmp

Download

memory/1892-9-0x00007FF9FC070000-0x00007FF9FC080000-memory.dmp

Download

memory/1892-46-0x00007FFA3E500000-0x00007FFA3E709000-memory.dmp

Download

memory/1892-2-0x00007FF9FE590000-0x00007FF9FE5A0000-memory.dmp

Download