de0a6868425b60af005d210a7123a815e6045baa2202e60ddcc64c5eb0650f26

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
phish_alert_sp2_2.0.0.0.eml
Size 57KB
Sample260605-e3qj7aaz5x
SHA256 de0a6868425b60af005d210a7123a815e6045baa2202e60ddcc64c5eb0650f26
MD5 d70d8c98389e7069f83100c1b124b3c5
SHA1 7ae7dd34d5613fef705aec39eab3aae89ac258e8
SHA512 8afe6524557c604a8a534a10239e0a66fdf30c170b1614fd25dad79171d148fb219fda148406a73a123435e693c466b02357d05dd83a1f9cb0eadc29b11c0633
SSDEEP 768:NMbknLkA1Lf/xwhbx2eIfQNz+HBc+ibij:NMwnLdRRwhw9fQNz+HBc+iba
TLSH
T12643311BE6C219D6483E8BA1611337BD7B761CCD8B224A706492373F4B8DEC257963D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\it\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5332_1508339027\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\id\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5332_1632885651\_locales\ro\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1548	msedge.exe
5144	msedge.exe
4992	msedge.exe
5976	msedge.exe
5192	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134251073273586200"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{BF9949DB-330B-466B-B158-B279DBB92C20}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{88BCC182-70D7-4D3E-B1FE-C3E18DF262D4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{36E49561-0CEE-49A5-B7D0-DE9E06909BFC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{7E870BD9-070D-4625-8799-45687047B638}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{77472FAE-730B-4788-8B9E-CA05B3E7BB5A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
6016	msedge.exe
6016	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
1304	msedge.exe
1304	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
6016	msedge.exe
6016	msedge.exe
4104	msedge.exe
4104	msedge.exe
1304	msedge.exe
1304	msedge.exe
5332	msedge.exe
5332	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1244	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE
1244	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 6016	1244	OUTLOOK.EXE	81
PID 6016 wrote to memory of 5196	6016	msedge.exe	82
PID 6016 wrote to memory of 1548	6016	msedge.exe	83
PID 6016 wrote to memory of 5072	6016	msedge.exe	84
PID 6016 wrote to memory of 2724	6016	msedge.exe	85
PID 6016 wrote to memory of 5072	6016	msedge.exe	84
PID 6016 wrote to memory of 5072	6016	msedge.exe	84
PID 6016 wrote to memory of 2724	6016	msedge.exe	85
PID 6016 wrote to memory of 1808	6016	msedge.exe	87
PID 6016 wrote to memory of 1808	6016	msedge.exe	87
PID 6016 wrote to memory of 1808	6016	msedge.exe	87
PID 6016 wrote to memory of 5188	6016	msedge.exe	88
PID 6016 wrote to memory of 5188	6016	msedge.exe	88
PID 6016 wrote to memory of 5188	6016	msedge.exe	88
PID 6016 wrote to memory of 3444	6016	msedge.exe	89
PID 6016 wrote to memory of 4628	6016	msedge.exe	90
PID 6016 wrote to memory of 3444	6016	msedge.exe	89
PID 6016 wrote to memory of 4628	6016	msedge.exe	90
PID 6016 wrote to memory of 2088	6016	msedge.exe	92
PID 6016 wrote to memory of 3296	6016	msedge.exe	93
PID 3296 wrote to memory of 4236	3296	msedge.exe	94
PID 6016 wrote to memory of 4104	6016	msedge.exe	97
PID 4104 wrote to memory of 4596	4104	msedge.exe	98
PID 4104 wrote to memory of 5144	4104	msedge.exe	99
PID 4104 wrote to memory of 5648	4104	msedge.exe	100
PID 4104 wrote to memory of 5648	4104	msedge.exe	100
PID 4104 wrote to memory of 5648	4104	msedge.exe	100
PID 4104 wrote to memory of 5512	4104	msedge.exe	102
PID 4104 wrote to memory of 5512	4104	msedge.exe	102
PID 4104 wrote to memory of 220	4104	msedge.exe	104
PID 1244 wrote to memory of 4056	1244	OUTLOOK.EXE	105
PID 4104 wrote to memory of 4896	4104	msedge.exe	106
PID 4104 wrote to memory of 4896	4104	msedge.exe	106
PID 4104 wrote to memory of 4896	4104	msedge.exe	106
PID 4104 wrote to memory of 2992	4104	msedge.exe	107
PID 4104 wrote to memory of 2992	4104	msedge.exe	107
PID 4104 wrote to memory of 2992	4104	msedge.exe	107
PID 4104 wrote to memory of 812	4104	msedge.exe	108
PID 4104 wrote to memory of 812	4104	msedge.exe	108
PID 4104 wrote to memory of 5152	4104	msedge.exe	109
PID 4104 wrote to memory of 5152	4104	msedge.exe	109
PID 4104 wrote to memory of 5580	4104	msedge.exe	110
PID 4104 wrote to memory of 5580	4104	msedge.exe	110
PID 4104 wrote to memory of 5580	4104	msedge.exe	110
PID 1244 wrote to memory of 944	1244	OUTLOOK.EXE	111
PID 4104 wrote to memory of 5416	4104	msedge.exe	112
PID 4104 wrote to memory of 5416	4104	msedge.exe	112
PID 4104 wrote to memory of 5416	4104	msedge.exe	112
PID 4104 wrote to memory of 464	4104	msedge.exe	113
PID 4104 wrote to memory of 464	4104	msedge.exe	113
PID 4104 wrote to memory of 464	4104	msedge.exe	113
PID 4104 wrote to memory of 1676	4104	msedge.exe	114
PID 4104 wrote to memory of 1676	4104	msedge.exe	114
PID 4104 wrote to memory of 1676	4104	msedge.exe	114
PID 4104 wrote to memory of 5324	4104	msedge.exe	115
PID 4104 wrote to memory of 5324	4104	msedge.exe	115
PID 4104 wrote to memory of 5324	4104	msedge.exe	115
PID 4104 wrote to memory of 1304	4104	msedge.exe	116
PID 1304 wrote to memory of 4968	1304	msedge.exe	117
PID 1304 wrote to memory of 4992	1304	msedge.exe	118
PID 1304 wrote to memory of 1972	1304	msedge.exe	119
PID 1304 wrote to memory of 1972	1304	msedge.exe	119
PID 1304 wrote to memory of 1972	1304	msedge.exe	119
PID 1304 wrote to memory of 1692	1304	msedge.exe	120

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://b88yi.r.ag.d.sendibm3.com/mk/mr/sh/7nVTPdZCTJDXPP7wvHoRlt9E4HCLYiE/y3jiJMwMxr2m
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffbfb0ac188,0x7ffbfb0ac194,0x7ffbfb0ac1a0
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,10016950624759512706,14562196430604815563,524288 --field-trial-handle=2324,i,156545248990902380,11390055418872295492,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,2722469270652421014,6011802523015353777,262144 --field-trial-handle=2324,i,156545248990902380,11390055418872295492,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,8117965052139623302,13843628825488569997,524288 --field-trial-handle=2324,i,156545248990902380,11390055418872295492,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:13
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,2013278179162911656,11459072966249967838,2097152 --field-trial-handle=2324,i,156545248990902380,11390055418872295492,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,10071138669948124484,5884602150691921134,2097152 --field-trial-handle=2324,i,156545248990902380,11390055418872295492,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,7430166791665334539,5868880287268502746,524288 --field-trial-handle=2324,i,156545248990902380,11390055418872295492,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,10764364462513473797,8472397487590375974,524288 --field-trial-handle=2324,i,156545248990902380,11390055418872295492,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,1505202778790516731,9907702418593969574,524288 --field-trial-handle=2324,i,156545248990902380,11390055418872295492,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,1505202778790516731,9907702418593969574,524288 --field-trial-handle=2324,i,156545248990902380,11390055418872295492,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,7302144992570507088,5027830134673754956,524288 --field-trial-handle=2324,i,156545248990902380,11390055418872295492,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1104
      4⤵
      PID:4236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffbfb0ac188,0x7ffbfb0ac194,0x7ffbfb0ac1a0
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,18220212932610461888,16809654335473013152,524288 --field-trial-handle=2188,i,8511367747956371142,8942402282871142601,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
      4⤵
      System Time Discovery
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,16925131346619113453,11598885607119161603,262144 --field-trial-handle=2188,i,8511367747956371142,8942402282871142601,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,13394752064840700984,11753824010537598007,524288 --field-trial-handle=2188,i,8511367747956371142,8942402282871142601,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,16030145032992259436,7456016398027247063,524288 --field-trial-handle=2188,i,8511367747956371142,8942402282871142601,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
      4⤵
      PID:340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,16030145032992259436,7456016398027247063,524288 --field-trial-handle=2188,i,8511367747956371142,8942402282871142601,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
      4⤵
      PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4980,i,10110417469582801607,7618599422643870058,2097152 --field-trial-handle=2188,i,8511367747956371142,8942402282871142601,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4984,i,9825221739301599088,13674814870040872206,2097152 --field-trial-handle=2188,i,8511367747956371142,8942402282871142601,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,7969688618071025091,11610347204568900510,524288 --field-trial-handle=2188,i,8511367747956371142,8942402282871142601,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,11684778997567943770,11560508684959729635,524288 --field-trial-handle=2188,i,8511367747956371142,8942402282871142601,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5944,i,12536049852106810434,17611479600319758114,2097152 --field-trial-handle=2188,i,8511367747956371142,8942402282871142601,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5868,i,10557843317063365719,12637426608001921214,2097152 --field-trial-handle=2188,i,8511367747956371142,8942402282871142601,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6284,i,824953402627368554,14836826413526809248,2097152 --field-trial-handle=2188,i,8511367747956371142,8942402282871142601,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6436,i,891741416884850706,3483707388148037788,2097152 --field-trial-handle=2188,i,8511367747956371142,8942402282871142601,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5100,i,4674876119156824731,10689411448905018480,2097152 --field-trial-handle=2188,i,8511367747956371142,8942402282871142601,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffbfb0ac188,0x7ffbfb0ac194,0x7ffbfb0ac1a0
        5⤵
        
        PID:4968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,1062475465046700723,12720551799882918777,524288 --field-trial-handle=2232,i,16933742130143674336,2922624142122957417,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,6407566893594918505,14121730224401062709,262144 --field-trial-handle=2232,i,16933742130143674336,2922624142122957417,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
        5⤵
        
        PID:1972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,13661103353524683075,3017853657946881048,524288 --field-trial-handle=2232,i,16933742130143674336,2922624142122957417,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:13
        5⤵
        
        PID:1692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,7493235371368757909,17751722320062505222,524288 --field-trial-handle=2232,i,16933742130143674336,2922624142122957417,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
        5⤵
        
        PID:5704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,7493235371368757909,17751722320062505222,524288 --field-trial-handle=2232,i,16933742130143674336,2922624142122957417,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
        5⤵
        
        PID:3268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5000,i,7591401655013264726,3912217190026058894,2097152 --field-trial-handle=2232,i,16933742130143674336,2922624142122957417,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
        5⤵
        
        PID:4976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4988,i,13506489633467157875,1369157700539189391,2097152 --field-trial-handle=2232,i,16933742130143674336,2922624142122957417,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
        5⤵
        
        PID:3064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,14877201393541747840,12184401443821554787,524288 --field-trial-handle=2232,i,16933742130143674336,2922624142122957417,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
        5⤵
        
        PID:4788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,5542172886699942056,14252680913068143672,524288 --field-trial-handle=2232,i,16933742130143674336,2922624142122957417,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
        5⤵
        
        PID:240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffbfb0ac188,0x7ffbfb0ac194,0x7ffbfb0ac1a0
        6⤵
        
        PID:1568
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,4043781332546312868,13588593696924994082,524288 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:5976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,3530331183257763362,7428527758349162355,262144 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
        6⤵
        
        PID:868
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,11945260690601431276,800710142621214484,524288 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:13
        6⤵
        
        PID:1540
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,15742163383062208984,9700466996521852842,524288 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
        6⤵
        
        PID:2668
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,15742163383062208984,9700466996521852842,524288 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
        6⤵
        
        PID:1764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5012,i,14573526751975723755,17575873726909514911,2097152 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
        6⤵
        
        PID:5528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5032,i,16749926963952577059,11843745539469695017,2097152 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
        6⤵
        
        PID:2076
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,6629511650505743838,7846019226595433225,524288 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
        6⤵
        
        PID:740
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,13932011635672199386,17922646060172301579,524288 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
        6⤵
        
        PID:4924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5912,i,5156896511436314177,14541696499199629061,2097152 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
        6⤵
        
        PID:2716
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,3697950674771080216,192481525248361831,524288 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
        6⤵
        
        PID:1548
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,2230282460339488493,699788193365060241,524288 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
        6⤵
        
        PID:1876
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,4414145442800454980,12917310923044110792,524288 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
        6⤵
        
        PID:1348
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,6289778033186712883,8069801037880362617,524288 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
        6⤵
        
        PID:4556
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,13174539893367092991,11550109445230598058,524288 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
        6⤵
        
        PID:3200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6632,i,7872369096539258223,1723017045859949009,2097152 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
        6⤵
        
        PID:2476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5164,i,16418024048145024993,5556470125632388871,2097152 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
        6⤵
        
        PID:1760
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5276,i,5323857889639695271,16270426425259939920,2097152 --field-trial-handle=2216,i,12060764068133535158,4809959336432361630,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
        6⤵
        
        PID:3160
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:3680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ffbfb0ac188,0x7ffbfb0ac194,0x7ffbfb0ac1a0
        7⤵
        
        PID:4592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,8599324438689925740,3846859463762982228,524288 --field-trial-handle=2144,i,10085356186020790087,10598118102607732388,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:5192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,6998346343471750291,9834651906180188384,262144 --field-trial-handle=2144,i,10085356186020790087,10598118102607732388,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
        7⤵
        
        PID:5468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,14174945314070983500,12513186726646468108,524288 --field-trial-handle=2144,i,10085356186020790087,10598118102607732388,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:13
        7⤵
        
        PID:4912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,8416341314727786454,10353536425521281782,524288 --field-trial-handle=2144,i,10085356186020790087,10598118102607732388,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
        7⤵
        
        PID:3364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,8416341314727786454,10353536425521281782,524288 --field-trial-handle=2144,i,10085356186020790087,10598118102607732388,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
        7⤵
        
        PID:1652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,1283773064327501591,174387144064453228,524288 --field-trial-handle=2144,i,10085356186020790087,10598118102607732388,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
        7⤵
        
        PID:6032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,5633077066299736596,3344460672378146618,524288 --field-trial-handle=2144,i,10085356186020790087,10598118102607732388,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
        7⤵
        
        PID:1936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,2677119399614751314,4096555370661349741,524288 --field-trial-handle=2144,i,10085356186020790087,10598118102607732388,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
        7⤵
        
        PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://b88yi.r.ag.d.sendibm3.com/mk/cl/f/sh/7nVU1aA2ng01RBzTsmSbCv8cYMrRRdW/nVO8wArmsqiF
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://b88yi.r.ag.d.sendibm3.com/mk/cl/f/sh/7nVU1aA2ng01RBzTsmSbCv8cYMrRRdW/nVO8wArmsqiF
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://b88yi.r.ag.d.sendibm3.com/mk/mr/sh/7nVTPdZCTJDXPP7wvHoRlt9E4HCLYiE/y3jiJMwMxr2m
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://b88yi.r.ag.d.sendibm3.com/mk/un/v2/sh/7nVTPdbLJ2bPbgE3zM7uCzYzIi9Q0KU/0Yb6dO7i26jA
  2⤵
  PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
TLSH
T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fd1c347bc068f8904bc46e53610973649799d96fbd7766b3bd54727d86ccd95a
MD5 460d9de35d0830eba3b6eb8c4cd180a7
SHA1 158133e97472532685ae00dd0f7d47a434197a70
SHA512 7e47dd92c5f932b0de1743e6e7e4e7f0012999602ff1063487ff180bd1dc0093d0edfb14869a956bbb3bd2a52f4a13e07361818879d4756e086960072d3c3b35
TLSH
T1C3D0236A770F8CE1F7B4E53B1B1AD2931FDF4560610B1186E745CD4D8DF544544C90C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3b4aca2d7691757d37aa2edf531137cab5cb14b3bb29e673fb828062306cebf2
MD5 150f03c8c65bf9c0a61d2e9a6735499b
SHA1 2865afaf1171ae0384a3c5cf1c918824d9a7cfda
SHA512 16484fbb7d2c10cd4294a7d143a8d62f7ce7f9662fd1dbcbef6991180713dc7b4cdda1855a0fb896b2599e2a6832d5b5f5ad3f2d20991e09f4ff6f8c86e0818e
TLSH
T191D0A769234FA4E6F7B8E57F2A278287179E885161434202D60A4D098EAA55500C10C5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 028c30b18decf86b89ca43abe4c0840d9aff3646b12f8c85c06548e176cb47cb
MD5 2194dc539cfa958946d793f40184cb59
SHA1 fa471d6872a8be07e4752ab67cb3133908258e26
SHA512 51b9aff3abc037e3369fc497d41f544d8c7c4b116b3abce029dbabbb87334bb8ae53e8fe775e8bed4306f783cc6bac6b0cb077987260562b0558adab26bf2a4c
TLSH
T104D0236D770F9CE1F7B4E53B1B16D2931FDF4560610B1186E7454D4D8DF544544C90C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 88a1bcaff068ad47369493dad384af48e6fc270306955b96305dd549adfa24fc
MD5 38237cccb2bed0fd2faa2a1a779e6ab6
SHA1 6c75661655a36ebe8aca8a233a608b420cf6edae
SHA512 e0cfa27ac429c28686ba9bad3066bb599c651417b5a79229ea4a2c094c37d750a32ac6effa21cb68171ae3c8d02201171b6d072841c990618003962638681b61
TLSH
T1A1D02329330F8CE0F3B0E53B0B16C2930FDF4020200B1186E3044C4C8CF041500C80C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aac98c493471b699f522f73aab3f9b3367dd003effb7bbe6e0b626755499871
MD5 938d7be8612f2b5e3b5b14b7eb40b90a
SHA1 f5a4b55e0fa9d6d4c6f60243393ff591f6fd52f4
SHA512 f8fc97643f49cb8af7eab615b0799af8136c3dada9e2418886f739b0db99a2fcfcf629ea5cb59bae2114530a53a842eea424480aa9a06a650f43119798b26590
TLSH
T1BCD0236A770F8CE1F7B4E53B1F26D2A31FDF4560610B1186E7454D4D8DF544544C90CA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

3d6b9320-6286-4c92-9da6-f3d6f31f078b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d6b9320-6286-4c92-9da6-f3d6f31f078b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 3c7d03ace0375879a35addaf885056f1e269c8de97393efda02ab5889d69e134
MD5 600c406f7306243247a910a4163c3a58
SHA1 c7e6c4144a9bab8ef546f0a3743e911a2d78b5a7
SHA512 32817441a23ca0f86f35bbcd08de98a6381082e72efd3d668efddbc7127c6d4554b20e9e4d542d1b6069f3c554cde5e1c1a61966436840d74a3a3596078b53de
TLSH
T175F0F9B6CD21AC3718FD2B2960645746E75513672B814D4F3B3C920D8FB163B4595C6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 76c23c614ee364c9b3d2f9aa3ec80e52d10e4fd1c58abc5b143aab304e8ec44c
MD5 452e976750b9bb971821df4c94e9fe2c
SHA1 53a183ec1a435348a8e204efa8e19b88fc3fe958
SHA512 5027878fa9b2148eab49c620499ed2fc7567f63cd7ef40ffa76d013669483c1e7bd899392a8e79ba601c3227e26fc84130a7531d693c9bf782b3fcabf8a0e7c5
SSDEEP 768:U4bteSVlFubxZZQcutsLwT+ZFxUJ++fHa:UX9ZZQcutsWsfR+fH
TLSH
T18F13C47C76519E9AFAD6C7FC594B1A72273CF4A9C6C05B233BB174A1273239A184F060
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 e529a2d61be27056ea7d129a02019f5a84849412a2429d64d66ff05f2ca05168
MD5 0747ac1fc0206d5a4d70950a4483ee6a
SHA1 49b7fd306fd7539dd7b682ac00dd6a8b175c6395
SHA512 4c94bc3e80ea675d97b062872d8ad39a0fb2f4c8f8964c43a4259fc0379acffcd67a8dacf40b04298b65174e7e7c7afebb638fb0bcfc9796a8e09cb0b3f6d8ce
SSDEEP 3072:VpJKCbGVIDJP5L/pL/L4iwL/dL/D/cbKtfpNsHP:VpJKCbGVIDJP5L/pL/L4tL/dL/D/5SP
TLSH
T180446FF70951A01BCBA842F5E2033E3DD17B055D2DE1E9E9E67C0CD52835B22B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 0dcd856036835340152c8ed6b1a19b0492188686f7798744aa1ca84704156886
MD5 6fa8d3877a6ec8bded2cd225d60d9be7
SHA1 a2690d2700e809dacc4b1c44e86c66444dc0c853
SHA512 3282d4868e425c01caf0dbd141f1450af20b42f5ec89a4b57cb6ab86171f2d1e29cebb8e76e376883c210361fce71d6bd61b1e4e815c6349fd5d7af7e1e4071c
SSDEEP 3072:3/fCU5mR3uRH+Hp8ybs5hnTNbRnc4KlPdWrZj:33x5LRH68XnTbc4KOZ
TLSH
T1D02529EECB681C82CB6B8770B0E0D9077E712183B68DD0D39944C5D897E6B8575E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 acddde196460e3307d9fe1b10feda0ce3870f0302cb0b2d6fe17f8a29ec467b3
MD5 e8c854d8de2a583b75a8e174e2718d3a
SHA1 fff730db151ab310db90bccbabdf5083f025af38
SHA512 fe3e8e19b50b8b725e036ae946af21275840b211015b11f899ac2be277fe2a9f74e320a810dc3d359534aeb8d9e3a33d8567dc312832df0e2a002aa8800f2fb9
SSDEEP 24576:/2eOpE8ol4YdCuxII+zaSLANUfs8KJZxoOKiKCCiJ9+ygzWVi:/leYdCu9mFAifsDZxoOKi7CiylWE
TLSH
T140867DEDCA6898C3CD639A70B0F0ED477C7413C3F595C1D68898C584026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 734d6db3f01a948f0b6027e1fd79400894f1a002e73c8e47d76f1df41ae3a6e1
MD5 7cd9d8d23ce70fa1364adbfef7173e55
SHA1 63025b189f0ddddd4dd133adf79e67562f238596
SHA512 03efc1bc09a3a1ecb59bf0b07f20b550f135daaa9d3db72c6fe24e8380140fb79a85e1e4951cd77a0b81b94a5d3c3ea86c8bc9f622cc3cdc264bae06e2cfe415
TLSH
T17E716066DF9209A1F3DB533FD8F10512397CB4EA998F4E0191C8583B680AFE5432F848
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4490ea0826e389756a31394431e7fc5cbc5bafa49baf30826be74154997ba9db
MD5 af6deb25bf0851bd5535a4acd95efe85
SHA1 a9127f4ae8d3319000f96de4745395c7dbf5baa9
SHA512 faf2aea5c20f931e6b40ad7a5111b547ee061e342a374c4f0bc22dda7272ae73956909c65f5981e34b746bf1b7127b0c90c0b60cdd966dc2cc4232d2bc3db134
SSDEEP 96:pjEIRIkQcaG3k+QwdwlVYJoYhHDEMUMoc4XwU9P:poIRIXcaG3kf0mYJoAHAjMocpU9P
TLSH
T10EA17191CBD11861FBCFA77B9CF10C02383C72D5A98F8F56428B95379406BE9462F508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c768546127708e70ef375b109de4f6d1d6980bf7df42a9ff4e2aadcf03423557
MD5 5e31ecfd965e8921ca7cba9c54a9d970
SHA1 772b9902286a2a892f7587d705307cb039826634
SHA512 cba5354fe3398587a4fbff465ac860a508fa351864da3817f6189389ecc52bc63d839e865dd1f882492f65581ea984a7216ba28cdcfe1492c31a6d172c272bdb
TLSH
T13C616022DF9209A1F3C7137FD8F10522397CB49A998F4E0291D8683B580AFF1432F848
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 ba319fbb80c35c700536bf78bbd145b5c77ca0886519103494a7db1f5928900e
MD5 46e541818e262c901b82204c14573b7c
SHA1 138dd3be3f867e1382957f56dec241c23deae917
SHA512 537a0c92ebf3395ab84a497c637274586bb841089b449e507adf25b1eec4f887f469a02de79495921e121f6e4cf8994c0969c00b5dc6d9d5461fac5038fb14e3
TLSH
T123E0D8E494D7C15E751038C64238AB49C2C0344AD6DA7E872B008CC8B606001F346D76
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 c1351459ff39fcb90a22817f71a8d17e19faf3368d6360081a521df81da9b04e
MD5 15d799e8a4738bad0cd953099cb9bfbb
SHA1 c1f073b4df015324332becaedbe30d38b72272d0
SHA512 2f3c6c24fe84d1681eb4110008b2ed01fd7d8df90d9394b5c90fffa59971f933b0cd092a327dad752217127d0dc2dea93fc3bad392990db6884e67a41162477a
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jLvpW5LBIK5fKFtInjAEGqYpnT:Tyi+7f+UZD4jJ/BfpWxBICKFOjAEGTpT
TLSH
T16DE2E08C3B11F511C8ED733DA1C2C6F05EFC692C464D71B1A17858768D52AA2F49E60E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 79e5c7b52653be3e80d351fbe6619f215e54e1f742a3cc64f53f332416d94a2c
MD5 3de28a7d503169820939902f0a14f4df
SHA1 d4ca814d813595663495c434984bb2bb7bdf7571
SHA512 691d6c82b974c132a8be57244f75e48fc8ec2763d9c294b6aabd1e755d0950e7e8df93e94238daa89246ef6486859bfdadb4d84c8b89771eaddc47749a89378c
TLSH
T116E0262415EBE17DA11868D3936CA30C82D8350EB28E3AC6670C8848B249B41A38BAA0
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 7b4351f0763f0c5a3ea7fae536460fb3bc3ca281318388bcb30f730983202bff
MD5 0099953b7d93ca7640c06abc252cf8da
SHA1 8749543d310f3fdf7edb15c8f24491cf61e61431
SHA512 85d57effb97578a9aeb0dfb12dcb3ae893c743e21e5628e3d516691c594fa46a0192e9e3af10ba2896441eeb98c38a5898ccda4b3613a01d158fb95175173e78
SSDEEP 192:x58bLH0+G83uxXBBK31GkSJtB2OEJH7DNspUe:xaXa83uFBBQ1GkS567DNspUe
TLSH
T16614655F5F743212CD6C803669E784A75DBDF43F8B5276CA78601460CEE3A52A06C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.freightexchange.com.au_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 33168de270dd62cee75de1639198851408672ddfa3d7cfa5756dee9c702fe74a
MD5 91dea1461117b8a57a80a7d267a77198
SHA1 60e93b47c46a226e557544c0ec1123a0f5ccee01
SHA512 11e95a48edfcac009230055b0307809209c81234a1eb61f2cc98b774ff86c21a5491f001dcd60f1e7cb65b6c95bb8411548de6a1ddc97bb6d5248d7f0b04bdf6
TLSH
T1D6E0207248EFC25D76447087536DB70CC3F1350AD68EBFC51B049858F405808A387DE1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 d598e3c0bce066135a84ebeaf39ecdc8b1ca4194155e23573fe187fd2695b255
MD5 813b25e8f550b656d6da9568a8c4fb39
SHA1 8e7c3c55d4afb378087a46721f3bb3ed30e8e402
SHA512 7684d11759f4964fbb8a900f03763d3c81a6558c0796889c5dcdcb4820b1441e603c90a9299aad911266d9438b5ca2a1d5b4b733f6880834e81b059f3d9ca2b7
SSDEEP 48:T2SLopFMatSaw/auUOt8BMovw9gV+B5kDTPCjduAwH:iSeMatUaAKhsgV+BiP6jIAA
TLSH
T1AC923D4E2F346120D0F58B36ECD5856A2F7C201CD3633A89DE5420F38DA25ABF1021AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 54d8daded4ad9e8dc7feb1527d66a98f425e96a1abde666172c16fc7659df7b3
MD5 286c1d57717e54dd5a161c114426afec
SHA1 858dbc5da3cebcd095f99368d9919dbb0c497acb
SHA512 d597ba52607adf3cc1f878e643c22d207ca2a8b8618f00c75cb0aefd08fcc46e18565555f73c2e200406dbe9ef9fa3058357a84533120d4d3f0f977e2d2c321a
TLSH
T16651ABF7C3E4856D8A1196F0AA156E2FCE1D0924932C3C9A88E4AF5B93E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2419bc7b882aaf4d8913e544d3ef844a9e445ea51b4b6ef5b8736f521e4bd1cd
MD5 b10e0c10f93d37839a0bf2e00613c4a1
SHA1 7f58c1c929f07f14d25af92327c870fd0b553d0a
SHA512 766259b78523dca7d0567f9ad15ece9438f9f42a0a43011e9b93264d82e8c8d87a9a05a86146a6d7fc4c9b53e135eb9eb73179d6f91c502b6aebb3e4b62dc983
TLSH
T1D471DCF787F4A57DCE2191F0AA156E1FCE5D0420532C3CAA89E4AF1793E2471E102A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 e45b0f2b86b729adec3a5a0f91986de0baf0b3f6792b66eff76ec1c328342a68
MD5 eafd976d9942d1d85394bca7fdc91230
SHA1 891bc1aba2a773367602245def6e57fa4182668c
SHA512 ea0534bd399b6a037de91759da936a8495ab22e0e9ec34dc95b8663fe8cc1742b60a126f04bf2785fd0429a892999e5b9ab3280d91b16060a5889d2e80d9787f
SSDEEP 192:D1sjyOOnaij6/1zm/J9hE+omGItcpxpatPm/SzOxTH7/8nHZR3Gf3tmcxS3GwNQ5:D1sjyOSaiG/1zm/J9hE+omGItcpxpatk
TLSH
T1D522DEF383F4E93E892185F4EA14BE2BCE1D0524436D3C6685D4AE07A7E1876E150B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 45c32392b8ff6bad63759716efba81abc1838b3f81b16f6a06c7ce80c9057eed
MD5 fd18a6d5a049488ad618ca5eaa1bc557
SHA1 03981226ed8f3717f9e5149af5c231d3aaac28b9
SHA512 c8451c103c7688e5e608d45c0665635d5edba7b8f991c8573f2a6d94fefe22f1fee9d9d234e2dce7cea720bf39843eeff5c95ee7d7d9a043da0e69c4cb18183f
TLSH
T14A71DCF787F0A57DCE2191F0AA156E1FCE5D0421532C3CAA89E4AF1793E2471E101A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 198d14e3fb412567e642ce58743b13596c06c6e12d6fcc664f8def2e3b166c01
MD5 ea99fde550c5c7b83b1083b4ee1a170e
SHA1 2001c288d67328aedbbfe32740a523871fa1c20f
SHA512 d555bfab39fade9af21f51aba221096af62c857a820b870eca984954ed943c9b469a0fcd2cd2a3ff835ab88afc440fdf84f3c5a771fd5f871064fa757fc118c5
SSDEEP 96:uIEumQv8m1ccnvSgQusno4NgC49vjVfqOtnFq/+73w1Y2y8e4g:uIEumQv8m1ccnvSgQRoaR/DG73GYFl
TLSH
T176F2EDFA07276105D99444B0A0005F8EAF17401B47B6B7EC76D447E3F7A20E2B6B979A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 772789af7cae312ed127a9316d086ac787aaee1499c8254ff1b46177b5e32426
MD5 2ae0e00fadd1cd853e411b981fb401c7
SHA1 f671b094e3719aca074dd7a7c0ce904914570d90
SHA512 6f60f0a0b8e8ed410965b558c7be647df31b012f33addb5ddf67e1987f2e0adfe375ccae4942bb0c2f8ce9bedeeccc57b8a2245c1f8bcdfb997f9860d1755559
TLSH
T117E020DB80BFF0372129997E1E44BC811739A431346258F5DD99827C74C15F75E93435
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 fe750860b384bced90b775ef2c2ab209aa5b6808a523b0fde97d62b067247d47
MD5 5d19b04407cd2c6f703a8bd75f4bccfd
SHA1 57bacc11752544312a32a0d9bf8d0f4f24fae073
SHA512 27cda3225b310f43416a5e04db332690a0ef9e85364f607bcd9e2ba30da8c70a3599ca229aa48cc2c8f1c4ac749a94dee5b281bc06b60a286d7cb90d3aed4a9a
TLSH
T1E83169A7D1BEB95720294C6B2D467C4519FAF8320643ACF5DF96826CB080DF35B060A6
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4929d06742da6f8fc6f7b8bc96155fdf5559142e44e1a6c085e94b5331559270
MD5 eb802fbe2bfb91b7a7dfe5965c2aade6
SHA1 01f32811b7ec1b2e6871537347af48bd3248296c
SHA512 64921a39ae17b329400200b24fab23b07f75be78929d15df40772c48cbf77cad0383a27fba7db1aff2a44863149ef2f543788974945c2ef0705da85f7d27a030
SSDEEP 192:sxZDRDyMqZjK1Ml8YcV/fksRWpVypNKTG5GN2QwDzodpiH/W6+WNihzQ/Y0FMcDx:sxZDwaV/fksRWvypNUei2E8/bf/5rZ+a
TLSH
T1AD72F916A674597B8CD7D219FA55BF63D2F9156292904E489AFCCE0C00E6BEC2213C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 91c21ccbcecf5b36990f98b02e0bd78515afeeeca786daa455617fc8f2279dfb
MD5 94c2ddd07308802786405f8d07d0befe
SHA1 356c7102f8477103e56b3aed9edeb35c5d75c075
SHA512 b2e96dfe73c76ea7cc5e35d21b823298692a283d4a917f43fda68006a14294f5a8237849a174dc684898775d2950b2199b5fd9d0057090a205c47d5c17e85877
SSDEEP 384:sxZDKPV/fksHWvyuUei2/Pd/bYG+ZZeOyZ+a:sLmV/ffYyuUI/bvYeN
TLSH
T19F82F916A67458BB9CDBD219FA55BF63D6F9553392804E485AFC8E0C00D6BED220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 3bce7a821ef3d5a48cf162dcdbfd04aae29b1bfec6381a746e2d9830fd7283d5
MD5 79df77e1ebb739a130eef4fa47d110de
SHA1 6e6891a0ddc24bf8a2fe21b4c91629dc6d90fa09
SHA512 f07698332fb097f470ff6752c7315cf308ad81d7c388104bba1feeb2dfa505043ecea8e46af7ff13e2f0cdf94f3034946bcc9b55f22c140076d0b3125b8c1efa
SSDEEP 384:sxZDNPV/fksDWvyHUei2Ep/bYG4ZeJZ+a:sL1V/fbYyHU3/bvger
TLSH
T15A820916A674597B8CDBD219FA55BF63D2F9153292904E489AFCCE0C00D6BED220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 6c9a03d04b10de08c55a171bf75317d756b63a3fc5291f99a00ad251053dd738
MD5 6c374d394d7960f04d73ce85ba9d10a7
SHA1 2db2d1a68e1a24a2744d8e6c4707e0325f9d997d
SHA512 7cf30649ee70e24783089366d4fabdd94c6467ebc11f5688442b2cdd514f5bb543cd22dff1a78a36cbe7ef9e7d6308b723985ecdcd3fdc15606e4164f21d22fb
SSDEEP 384:sxZDzAV/fks8WvyQUei29v/b2/k2EVV0nyoW9:sLEV/f0YyQU4/bcWV2w
TLSH
T10892E757A57459BB8CDBD629F555BB77D2F8142292804E88AAFCCE0C00D7AFC7102C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3d54438b2bb6bfc49454e46fe0ee9f4f8928f600bdf8ca2d32ff02f85d896d58
MD5 d5d9eaece027d8f3f451952d1517fda0
SHA1 617edcd1c70fd357ea0eb48e573d72573ee2b1c2
SHA512 c6f6d94705d639004419b2094a9655f268ccc6cc8043eef63f5e9dfb86b8a3eb66c13b383a6284bf4536a6cf4be5a7db80ec113be22a964543ad8e3acf3ff43b
SSDEEP 384:sxZDNaV/fksDWvyHUei2Ep/bYGAZeCZ+a:sLoV/fbYyHU3/bvYeo
TLSH
T18372F916A574597B9CD7D219FA56BF63D2F9153292904E489AFCCE0C00E6AED2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 286fa45f8cbacb3015ccf4031bf688a1e82eb566cdf10473b3eceed47ecc8618
MD5 d1f004237e858b8f5bb8a22f05573959
SHA1 47482c351897202b01a427c2e646bef477442487
SHA512 0f43129f4ad11bd23c7a796b830dced679903f3584adbdc7348db37f89263eaeeac77307b820bbc6c1eb2f45a9188af908caa80f99e6f3d4cca739eff906c8b5
SSDEEP 384:sxZDK+V/fksHWvyuUei2LxPd/bLZZeF6Z+a:sLnV/ffYyuU2/bTem
TLSH
T13A820A16A57458BB9CDBD219FA55BF63D6F9553392804E486AFC8E0C00D67ED220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 165aca182c8fc504a47e0bb3f51cd36c830aef62e56f7437ddcf812d62b156c4
MD5 adb9d00073f957440e5c516b38b86b58
SHA1 16a38678c1829cffe68b68f0d7e9e26df5dc3bdf
SHA512 e72349480024a78f325796772e801bbe6023ee38655ed34cec16b1fa4e66688b9fe133513153cfa32abd9334afda4ba8b037eec1192155fd2a6bfa07dc609b9f
SSDEEP 384:sxZDz+V/fks8WvyQUei2LxR/bErbeuhoW9:sL6V/f0YyQUO/bKe8
TLSH
T1FC820916A57458BB8CDBD619FA55BF63D6F8543391804E489AFC8E0C00E6BED220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 4585fd2262cc468dbad8f5b17018ce206008fae872da51ac210d980e2995d6c9
MD5 a6684a3bd61d741a7fba2341da014dc2
SHA1 93f08d6e50506655a18086580c3206d1e8d2f3d7
SHA512 2220a6a7dd65cd96a798c7a4aaa7d826f3b24f9107d9ddc578a4cb1a6135fcb5c230694697241fe1a3d5b3d22e7ded3c08119179c3eb1e9ef93adc4fade6f690
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3nzx4Lls:wQAKq8y02yqEnjbWRmj1QWTu1jaKnzxn
TLSH
T18603FA3B680CCB7E4F804E9CED277E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 96e1260027b04686aa16a4ffdff98b895755853aaf7e55e29b61f5b76068bf1d
MD5 dcc6416911f2041b91bbd93786dd318d
SHA1 aa8151fe2d0b056becf705342a920e902ec835bf
SHA512 ba686fb4525cedafe72d3f10ef24a8326b6803816c5d1ba72d3f281670c0ff1b813dae11563bbbfda00900b4a2ea5d661cf332c23162525b4f6ffd65118a64cc
TLSH
T199E0867046EBD9BD705921830368D30CD3ECB41BD6CEBE962F44C9A4A156D48B2979E1
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13425107329403619

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13425107329403619
Size 1KB
SHA256 cde672ca648af186bc5cabd76e042de4b95aaaac410a32fc91906d1ff2da4283
MD5 7a6c099464f6f8938ce9c6ff9b0ae6e9
SHA1 ac015d297b11ccfa8bde6b975962955fd2d7f7f4
SHA512 753a189ef5d8582b69821c6f0bbc20c3a05d1467691bf0513b54d4283b0fa582c64562adce691aa75fcbd96c24e6c357d80c3d5672dcd5132ca8aafe609f089e
TLSH
T1E921DC3A1AE8007AE77FB5BE54BA06F0D522B51561E18B4E02B242802813742EF21F2A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 249ec01b7a3d0d0c1965be6a3edb2f7eb135eb455b9480b89a79a4843cc6c232
MD5 ced3230deca71ff0e27ed4e4cf5483c3
SHA1 60e66154117e6f54f0a4032cc9ab246d55b41bd0
SHA512 7b711a635590fbb086629ac8c90041d92188ddb8f2bcebc0400860239c476375c6b6c0aab71c2a187ac2f12a6a52eabde782b27c9b27fce2c04568e118111b70
TLSH
T1FFB012487B80E12EC8D90831A5A08B46E750F10322408A23CC6B6F720F192A43F419D8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 19f05b26b4430b76e1d15afb511a6e6f7e1fc21cba36c52ef3be6ea667fffbef
MD5 d4a92e131b3c5ee7ca4b82b02a3d4b39
SHA1 d1d3c6d4217af65090295ecdf173f18faea2da6d
SHA512 73d57f4f6a501ed766100f5afb9742d743d8d792b2fe1bce0b19911577dfe2230696c37cc48f3d265385246f75f71bacb54b2d71c03e23ec54b25f3cf0d9dd6e
TLSH
T11FE0D87455DBC2AE718524C7533CE34883F2F40ADACD7A953B08A448A20A5407347961
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 ecb38b775801e4a4955ad1f276417f0559a9af9ed7e4662f326659c4d1f56bc1
MD5 2b9011147d3ee25a71b4900f9e3e655a
SHA1 a881791a125fcaac06854a7c3907b2645747eb32
SHA512 48b9fe2a417076b0798874bcb9f3b8d3d96616d3d883f2f1c6d55fb8b898888211abafdc61f9ff774ac60234181af2f7c2201b814de1ff23efab9fc0caa80581
TLSH
T1FFE04FB455EAD27D704460C2437CE759D3F0B84B9B897E8A57085498A105545B3AA9A0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 9cae95f543fb1a24ca59a615bfc3d890c91f656a23f1cb54124d458c1072a009
MD5 cea1cb17f2e552f78410503f438738f5
SHA1 01b5714d422080032b2c60bdd86c5d09be493f8d
SHA512 7654965c5fe48c3f5fbb8aa16999dd4d024a5bd9a1af78789f5e9a2ada689f1641e13ce1a58651154b318682feb072c08dc00cd9c2055db34ede1fabbb177684
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5h:GZLVDJjEDPV0/Zdm/Y
TLSH
T17CA2581232BA42023C7E390C93969B674A42F1633459ED7F7BA900B54E67E125EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 d5e6cf018d9d4629574c6b0fe82cf710151c68bb80cb9f5df6dcf4c89d5e53ea
MD5 ddc13748d120ecba187f7a4afd2cfd17
SHA1 a80f000d41c10c93acd84126a4d96dac8f8076df
SHA512 2ef3d2998bb2575e7a472f45a2d4b8d94a0a4b13ce0913ced95e1b0eeecf8ab05c84e28a727b37feae45099b5275cb078d300e092661fbe94a7fa05590e0d87c
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5l:GZLVDJjEDPV0/Zdm/Xhk
TLSH
T15BB2571232BB52023C7E290C93969B674A42F1633419ED7B7BB900B55E27E125EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 10dcc37755b18f13a40123cf29571112e2167d19a2cadd2986ebf2344c5e0f99
MD5 5af3504ce4c1680f6debcaf4316bf880
SHA1 3dbee8bfd64cd5138ea97f4087732b84531ed64d
SHA512 c41e96e85f55a3f945f6031c4b0545d00164386b08e46bac05feccc312e0de9ca74d16e91ce36a22d79ad104977328a9866e776337798ea25ed9f2b345e0f2d0
SSDEEP 192:FvoWjRNQfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aeRufQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T11724630A7B747001DDE7D9725CB080771A3CB16ECF22A6916DB264694DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 2b19a8040f9d56cba18316718ee0a77d3d091da5f846743b928bccfffde94013
MD5 29c16a528837cb9cbebc7d4d459996eb
SHA1 b14f5bc4a3cb4ffe70d54286322ef39d974b72a1
SHA512 5bd7f1d75379e7466c642de54c893eb486f0d8cf690be4c8889a859213a6b77acbb5872fc292f1f011d3abe3d4a2f4dfc74cc98068b1020c2d81f4a43380e5ee
SSDEEP 48:TEK3tjkSI5IUltGhp22iSBg5H0AMMsbViE89RYH0AMMRW:TEtSyGhp22iSmX8bViE84XU
TLSH
T1245232AFEE742223DCE583728AD105D47E3A503D8FC2E78321F501211FF0A02971A6AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 7a82ca8b2e415fb07b07b09b22084b55fec3271be1ed8b0605dbcbde7eae3d7b
MD5 7197eab2badd69a91ed383090a62c2c1
SHA1 fff5dc3fd85e36e5e8bf7807ef644a4337942835
SHA512 3ace4e6fdd9ede15da142ec152cec2d684d8a5ade6b79913d2d50450105b6993f76dc7de67cc5a9a43e7ec10ad32cc9395c1fdf430dda37cfbf30b46cee8c674
TLSH
T11851A7C0A3EA71897F89B941D31A5503A4E17E67260F6CF2232E44F49F48C264F6FE25
MD5 SHA1 SHA512 TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 116KB
SHA256 142296912ee677f32b05bc8b95f3a77d494de70567e3c6e0c14cc872f10c2aab
MD5 831fd0604f8f20ea7d2d8bd22ae6aa4b
SHA1 854e7d2b6b425d64c7c14b4b26e5ab2f5ee799e1
SHA512 78ba492920ec73bcb4fda8555a1ebcafe46f4db5a815c26096d7cf72c360e5b59266e273c71a53d7c6b966badde9ebc2dac0444d0497120166f31310f88488ae
SSDEEP 768:uAy92uuNDK5Wj8QslVltBaAPs7JfpyjWCf3uHAVPPW6hTTz65XwbyLPSszpnH7CG:WGYRPgo4M5ELb
TLSH
T150C341F36D0A90E6CDCD95B4D49BEE44807306298624D8E5AE3D08C37B79A03FE765C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 299ea5e7a33baa721f7478691546ad9805d86317d3d3795d979bd10a20bbe5f5
MD5 6d434dfa9962b06b162524e4f4002b90
SHA1 684a9a0880419eb66737c1f940cb9e98862c0a01
SHA512 b4f3566af0de8ebe0bc1d9e7bba5edf40e3d45c439411738776ce753910b229174a4f3addd73dc1dfc9dce28d0e2ddf9257caa7cef0fb4507996008f4de67146
SSDEEP 192:6+y5Oq5AsylrQEus0tL0BsQLKIIIVb6KMIMD7uYcYgL8:62qasIgs0VQGIIIVbFMIMD6BD8
TLSH
T18252922936051B3BE94E1FB7132A4BD52FD8984102772A6D71221C4F9CF3A9787C52FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 737b1f5f4e115504e3174eae22932544f0178f1f4706a7ec65525005b087bf28
MD5 239761cd2c806316c83ddfc8a009077e
SHA1 718ee1bed22c0166acd8c0425769573d42f7b01f
SHA512 c757631f671e72a436a327455831cd450081f71e077f15b65b72bd5e3e9788929fad919a8ed8a4c32fdea94b455488b017efc502895374e233a2e87298ee4ef0
TLSH
T17DE0206055D7C1BE722520C7222C930C82C4341FEA8D3AC95F04C44CF445600734F9E1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 fc77cd497c54626abab83b4e1670efe36747a6d91ca49b7ef0a49838f3d72115
MD5 7f2c5d6fd33093edf249ca59ef788651
SHA1 ab3c68e6db2cf37e3127fc543ac8ced447302c8e
SHA512 a427247439ccbaaa83e5077267bcd1855d0a9b8a0acabec0d7f2d57885f78545dcf97e7d2c52de4cace801f84d8d35a2b3d3fb70ba7102a44bd4992fb9935b2a
TLSH
T127216056F320C148E59E863D642B9B661338E8429FBCEC4F507970256E71E001E8B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 ff5ccc05894a4518046e3e725bd2cffdced302d8b879412c027697543297199a
MD5 2a358bd7aea3b8cdd78c65d150196b9c
SHA1 a1ea7692dd18f8a034fae0787e70446501836e58
SHA512 95d428724b939918f6d025ab04805dd256c5e99b50865d46bcba24087bc5c68106edca7523312984d159f19baed2b795f6ead053e1dab94bd6c28323b6a82fb3
TLSH
T1DCE02020A4EBC1DF751064C3027CD78882E5784FEA8C3F856F04CC4CD105545734F962
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 e65199fcf9f1df74bd5a2c2c325bb98c783de70d16c03f99e1071852a8e1de73
MD5 04439cb256415ebac6fcdc31e7584ec1
SHA1 bd1585c763a2a028f6980c2590c93bbe8ffd5be0
SHA512 6a00a8d650af059e9bf92d10a52954cbfe73c16746d580954a762ba6779040ee223a86865964485abd8b50aaccc955628a2a558944b22e52d525ead50b985393
SSDEEP 3:MsEllllkEthXllkl2zEflw5e:/M/xT02ze
TLSH
T1F04404047FC00407C50010704051C3503370F4100D5177477CF10473DCCF5D44C03000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 9390d7f936f29adf601f4084ca6cd8502cfde851921800acd13f0373bff6937b
MD5 535424e1e8ebdd4043e1cfdddb9c2179
SHA1 013feec5d219e862a24f1ef536a262d82b908592
SHA512 42722e86b84ba83fe378c9d6d4b5660fe969d1d0f4c1588f70294323a2abdf4d3951731cf97484bb36a47b0a7831ce09d197b8c803e3c389c13a1a5d5faac02f
SSDEEP 768:WFIjZbePwgOKekmXbGdyKp7o6d9+qhZ3ZIE:HqEk/yK6xqhZJIE
TLSH
T1CEF22939DC20DE7F98EE6F89A30E765699E40237C8A859D8E7D80F4D807209DF747816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9d472b64393c891de98654e4f1377ab3463525ebffb5affbf872132252b2ccc4
MD5 bc513a16c86c1466ceae90a1770c8a92
SHA1 aa5434c0739cca885a9d24834a5127620b41810e
SHA512 57289828a2d72c27fd9e8d78914c4b26ee96d30a2c93371de13d016420445ed8bbc254757631eb4f8bcdef7739b61062933d07a2700392259f15c87ff5dc6733
SSDEEP 384:n7iF1tNnNnb9E38N08TUNTUlIREPm3ek32nn9tYdSSfC8GdyKmCgAJzFiDF0zhuV:WF1jZbi3PwgOKekmYbGdyKp7ihZ3ZIE
TLSH
T114D25B31D864DEA7ADE74EC9F34A7647EEE05163898C5ED8EADC5E1D00831DE130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ad83b03d7053ffb9f52be9560a2f1543025a1736e4486a88796259bb3a1ebde0
MD5 52903808e7c45d9b1cca06ab58b83c6e
SHA1 d792302ab6022b165f777f2026fc33598156349e
SHA512 88b6e58a7c5d08cbd279e8324597ba448d4a935038b1a01f87fe52e7935a66ff010b5b0c74ed04c33669aad4488b0e5541aa134fb40bb393f91f34a799f31f3e
SSDEEP 384:nJiF9CcmyWCs38N28TUNTUlIxBPm3ek32nn9BOQt9sSSfC8GdyKmCgAhGe4KV8pK:gFccps35wgPKekmWC90GdyKphGI8p0J
TLSH
T1C2B25B31ECA8CABBEDE64F89FB4A6A17DEE01163858C59E4DADC1D1D00971DD134B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 8d2cf86d5c7dc79535d899ef36d1775f9cc91bd944b25cd0090e729c18432e66
MD5 9697dc844a23945fce23df2a83d6baa4
SHA1 05d4c6efb9a6b59bae1652cf324d3d4b8886c372
SHA512 7140479272ce803131646f893f3e92a9c9226824aae02f0d7e0bf756bcd0f57754d389de3041368e8b3e6dfd79dec6b27cde5583695ead5d8dab0f87200d293b
SSDEEP 768:PFAjZbVtwgQKekmtG6GdyKpfk3d9+fhZ3Zsy:Gx0kJyKO2fhZJsy
TLSH
T1AEF23939DC60DE7FA8EE6F89A30E351699E44237C5B858D8E7D80F4D80B609DF346816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8ca55f9434b8033f3feadf9214da8314578cef71a1745323691c1bee9f056fda
MD5 94f1076bba675f6b703a172dfd3ede94
SHA1 9d92841e44eb6ec87096d6904557dbab5ae2492e
SHA512 b0a0620f539449af410bb67fa605bf4873b4b6fff38114e7e3cf72deef6d1a0ee039d5501eda9fdbd7dc3e80d23fa62a43efa43a0530334ed828f1b66b8819ae
SSDEEP 768:IFSjZbGzwgeKekmmG6GdyKpBnOTh4tfBhZ3Zsy:Hack2yK3cmpBhZJsy
TLSH
T1DFF22879DC60DD7F98EE7B88A25E761699E01137C5B849D8EBC80F0D807319DF34A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7922f6f6ad6bf471a50954f81ae5830fb1cce4e0eba96149da8981e200299b6a
MD5 bd19f50df1ef025e9423f4ad7561938f
SHA1 84f61a5f36e559c9e0e7c031cc8e0feabd01420f
SHA512 f5692bb01faadeb7f224a8ff8783077626e7c1cc2d7e572bf415b2f129c4888456b9a0ed8c9f640a1cb4ca201dc4a4cee06948bf3d387ea2e1f5488906ff693d
SSDEEP 384:n0iFItNnNnb9j8Nm8TUNTUlIREPm3ek32nn9j/dSSfC8GdyKmCgAJz11DF0zhu/v:PFIjZb1twgOKekmBbGdyKpn1hZ3Zsy
TLSH
T195D24B31D864DEB7ADE74E85B31A7647EEF05163898C5ED8EADC5E4D00831DE130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 86a0ed3faef5e03c82804b0b2800d6ace266cfc9ac1da918b931387392bdf9b0
MD5 68a01df575586f98444cfb2245da2f26
SHA1 8562971005d0dcc783af3f6432c3025df2ab025e
SHA512 f6956b9c5ad021efe500e6ac0c2bdc8467d1609754dc7bcd4d1b543b62951f4b53556becb2c63b4519dbfbe46309e255b2fce3b39eda0b1c511797358c842dc4
SSDEEP 768:PFmjZb0uwgJKekm3G6GdyKpSwvZd9+hhZ3Zsy:QIMkfyKDv8hhZJsy
TLSH
T128F23939DC20CE7FA8EE6F89A30E751699E44237C5B858D8E7D80F4D80B609DF346816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1ad6ae1c62bd72fad9e6775a8eeb4ba2f78515c879f78542ea94fdcd5c2afc86
MD5 4dc96c87a6688d691f9f6cc1d213dbcd
SHA1 ad475ea870b6e05e744b77c22224d295beb756ab
SHA512 115a9bd4912cc6b7f80d0375c454ed429725686696c99ec8c132448b725fc07d23df1ba9a6cf88d3f3539900a055b417c9ba3e25a13761c7238ebc4e078e73cd
SSDEEP 768:WFIjZbePwgOKekmMbGdyKp7o6d9+qhZ3ZIE:HqEkgyK6xqhZJIE
TLSH
T1FCF22939DC20DE7F98EE6F89A30E765699E40237C8A859D8E7D80F4D807209DF747816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f4951ebd952e492c2691ffeb538d239253cd1fdc15a0a1f3e638d20bff357251
MD5 1526d628f53f0f6c9d00e943ee71550c
SHA1 4fe45e445388b770b1798a7f51ce1a4f9729cec9
SHA512 d9af875ff584f3e43d4275b74ac3fdea026373e075ca8ac509aa5b82200825005fbe970fbbbe77e5f9e313b3a58e95d29ad1f68b93ee96440cb343c0139976ad
SSDEEP 384:nhiFKtNnNnb928No8TUNTUlIRQPm3ek32nn9v5G2SSfC8GdyKmCgAJzvwDDF0zh8:IFKjZb0zwgeKekmnG6GdyKpB+hZ3Zsy
TLSH
T1E8D24A71D864DEA7ADE74E89B30A7647EEF0516389CC5ED8EADC5E1D00831DE130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 92e6b2f628bbd8266b623bdf981b913d72df06f59b7b182b76caff96b2fedde5
MD5 f4e8d24ef7a07e6605eb035a24805326
SHA1 e7bf38bc1149367ee2be79b0057ca3d97f792b54
SHA512 89f1c0c81492f1c73d5ef0db67ad9e7d7d9a43c070cfa2e627754ce7bcf50b2dbad3b30d632c9702706b7b803d0585c881b45f0d461310e840c123fcf22dafbe
SSDEEP 3:MsEllllkEthXllkl2zEflWA:/M/xT02zRA
TLSH
T1A544041C7FC00407C541107454D1C3503370F4300D5557433CD104337DC75400D10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 33c9c727f743b3fbad6ece10178271f466054abf1915fe0ed8cdb1c5eb69e59d
MD5 6f566c44d39e1f9501b4e72a690c5215
SHA1 2fe5df239ef6b1325e85b3aa3b6f005039a4dd22
SHA512 6a1078a436982b794ffbf6b117444fe156595387ee75ec6c1ac0aecdb990f2fbbdea69b8b8fb201ee1658942cc02be84aa7eb41ae7d9efa2987db2d3e0af57ea
SSDEEP 24:O4KC5f2qLo4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uwp:dp2qp/IHRH34kWqB1kQnjhHmr6ITmU6
TLSH
T15142876EDA2CAAA2FEE00B3ED7D1D0127B36A60EC2E8D9F1095B505747C540405DB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 6d3f174782f806d8dfaa1258256c152d21e55cf285536008dfbb660d8c2aaf5e
MD5 f3bdeeb14a91307bc1f983a05bb8c4cf
SHA1 4110b80042d21362401354e9296a7079a6d6785b
SHA512 e767541e87162036b4b4438a70960a451c153f855033e39f963e257036a7750af0842b8b41d27d0883b857be6aceb25fbcdc8bda0cea7507b72cb867bffcb161
TLSH
T14C51E7E13A65A23F7BC747C460764C849560F180032E5B5CAE5B8474BE6CEA1972EBC5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1244-78-0x00007FFC273E0000-0x00007FFC275E9000-memory.dmp

Download

memory/1244-7-0x00007FFC273E0000-0x00007FFC275E9000-memory.dmp

Download

memory/1244-8-0x00007FFBE4A90000-0x00007FFBE4AA0000-memory.dmp

Download

memory/1244-3-0x00007FFBE7470000-0x00007FFBE7480000-memory.dmp

Download

memory/1244-9-0x00007FFBE4A90000-0x00007FFBE4AA0000-memory.dmp

Download

memory/1244-4-0x00007FFBE7470000-0x00007FFBE7480000-memory.dmp

Download

memory/1244-6-0x00007FFC273E0000-0x00007FFC275E9000-memory.dmp

Download

memory/1244-0-0x00007FFBE7470000-0x00007FFBE7480000-memory.dmp

Download

memory/1244-5-0x00007FFC27484000-0x00007FFC27485000-memory.dmp

Download

memory/1244-1-0x00007FFBE7470000-0x00007FFBE7480000-memory.dmp

Download

memory/1244-2-0x00007FFBE7470000-0x00007FFBE7480000-memory.dmp

Download