ffef9842912ac5bc351c545fab23073dd2e5529150b2333fd245a61838ee3075

Analysis

user interaction
yes
max time kernel
108s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/06/2026, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cypebat.dll
Size 1.6MB
Sample260621-vwpmbafs2w
SHA256 ffef9842912ac5bc351c545fab23073dd2e5529150b2333fd245a61838ee3075
MD5 77181c5af104d160a15f1885a7bfc300
SHA1 923d62ed2f2dfc5bc02462160be9342606229ec6
SHA512 02fcdfa058ca1aecae405b8d2bb2d82715ee97578e1c7dd5995f964c941b5a4372813c55212d0612f5041fcab1df0a5c372fe8a8d3929fd207ba5a5b32897ba1
SSDEEP 24576:D/MpOqco+K3GEkeexuAAkjdl9MUjqCJ0MhM1Sk+GPmY:DaOfo+K3GEkfAg4MhM1Sk+GPm
TLSH
T1AD754A32CAE86295F8FB1A77DCBAA5760D247F15563580CF1A4269C80B32FD1D820F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5748	1372	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2212	msedge.exe
5820	msedge.exe
5504	msedge.exe
3636	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134265360900809487"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{D041BC8E-38DE-4E04-846E-4A090EB9B22A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{D92B6016-EF67-4F6A-BD22-37CCA9CEAD4E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{EB9999D3-B546-447D-8ED5-D4ACC851FABD}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{0BCE764A-1111-49BF-9A36-D408DCF90074}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1456	EXCEL.EXE
1908	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1176	mspaint.exe
1176	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
1456	msedge.exe
1456	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1692	unregmp2.exe
Token: SeCreatePagefilePrivilege	1692	unregmp2.exe
Token: SeShutdownPrivilege	2376	wmplayer.exe
Token: SeCreatePagefilePrivilege	2376	wmplayer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
1456	EXCEL.EXE
1456	EXCEL.EXE
1456	EXCEL.EXE
1456	EXCEL.EXE
1456	EXCEL.EXE
1456	EXCEL.EXE
1456	EXCEL.EXE
1456	EXCEL.EXE
1456	EXCEL.EXE
1456	EXCEL.EXE
1456	EXCEL.EXE
1456	EXCEL.EXE
1176	mspaint.exe
1176	mspaint.exe
1176	mspaint.exe
1176	mspaint.exe
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 1372	3128	rundll32.exe	88
PID 3376 wrote to memory of 1912	3376	msedge.exe	97
PID 3376 wrote to memory of 5504	3376	msedge.exe	98
PID 3376 wrote to memory of 5240	3376	msedge.exe	99
PID 3376 wrote to memory of 5240	3376	msedge.exe	99
PID 3376 wrote to memory of 5240	3376	msedge.exe	99
PID 3376 wrote to memory of 1528	3376	msedge.exe	100
PID 3376 wrote to memory of 1528	3376	msedge.exe	100
PID 3376 wrote to memory of 2304	3376	msedge.exe	102
PID 3376 wrote to memory of 5252	3376	msedge.exe	103
PID 3376 wrote to memory of 2304	3376	msedge.exe	102
PID 3376 wrote to memory of 2304	3376	msedge.exe	102
PID 3376 wrote to memory of 5252	3376	msedge.exe	103
PID 3376 wrote to memory of 5252	3376	msedge.exe	103
PID 3376 wrote to memory of 3344	3376	msedge.exe	104
PID 3376 wrote to memory of 1536	3376	msedge.exe	105
PID 3376 wrote to memory of 3344	3376	msedge.exe	104
PID 3376 wrote to memory of 3344	3376	msedge.exe	104
PID 3376 wrote to memory of 1536	3376	msedge.exe	105
PID 3376 wrote to memory of 1536	3376	msedge.exe	105
PID 3376 wrote to memory of 5592	3376	msedge.exe	107
PID 3376 wrote to memory of 5592	3376	msedge.exe	107
PID 3376 wrote to memory of 3524	3376	msedge.exe	108
PID 3376 wrote to memory of 3308	3376	msedge.exe	109
PID 3376 wrote to memory of 3524	3376	msedge.exe	108
PID 3376 wrote to memory of 3308	3376	msedge.exe	109
PID 3376 wrote to memory of 4776	3376	msedge.exe	111
PID 3376 wrote to memory of 4836	3376	msedge.exe	114
PID 3376 wrote to memory of 4836	3376	msedge.exe	114
PID 3376 wrote to memory of 2776	3376	msedge.exe	115
PID 3376 wrote to memory of 2776	3376	msedge.exe	115
PID 3376 wrote to memory of 1456	3376	msedge.exe	118
PID 1456 wrote to memory of 2776	1456	msedge.exe	119
PID 1456 wrote to memory of 5412	1456	msedge.exe	120
PID 1456 wrote to memory of 3636	1456	msedge.exe	122
PID 1456 wrote to memory of 5412	1456	msedge.exe	120
PID 1456 wrote to memory of 5412	1456	msedge.exe	120
PID 1456 wrote to memory of 2820	1456	msedge.exe	123
PID 1456 wrote to memory of 2820	1456	msedge.exe	123
PID 1456 wrote to memory of 4728	1456	msedge.exe	125
PID 1456 wrote to memory of 2452	1456	msedge.exe	135
PID 1456 wrote to memory of 2452	1456	msedge.exe	135
PID 1456 wrote to memory of 2452	1456	msedge.exe	135
PID 1456 wrote to memory of 4636	1456	msedge.exe	136
PID 1456 wrote to memory of 4636	1456	msedge.exe	136
PID 1456 wrote to memory of 4636	1456	msedge.exe	136
PID 1456 wrote to memory of 2332	1456	msedge.exe	137
PID 1456 wrote to memory of 2332	1456	msedge.exe	137
PID 1456 wrote to memory of 6072	1456	msedge.exe	138
PID 1456 wrote to memory of 6072	1456	msedge.exe	138
PID 1456 wrote to memory of 4860	1456	msedge.exe	140
PID 4860 wrote to memory of 5388	4860	msedge.exe	141
PID 4860 wrote to memory of 4480	4860	msedge.exe	143
PID 4860 wrote to memory of 2212	4860	msedge.exe	144
PID 4860 wrote to memory of 4480	4860	msedge.exe	143
PID 4860 wrote to memory of 4480	4860	msedge.exe	143
PID 4860 wrote to memory of 3056	4860	msedge.exe	145
PID 4860 wrote to memory of 3056	4860	msedge.exe	145
PID 4860 wrote to memory of 5972	4860	msedge.exe	147
PID 4860 wrote to memory of 3184	4860	msedge.exe	149
PID 4860 wrote to memory of 3184	4860	msedge.exe	149
PID 4860 wrote to memory of 3184	4860	msedge.exe	149
PID 4860 wrote to memory of 5312	4860	msedge.exe	150
PID 4860 wrote to memory of 5312	4860	msedge.exe	150

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cypebat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cypebat.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 500
    3⤵
    - Program crash
    PID:5748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1372 -ip 1372
1⤵
PID:2112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\SetWrite.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffecee1c188,0x7ffecee1c194,0x7ffecee1c1a0
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,5784927419019224822,12684382089742167533,524288 --field-trial-handle=2672,i,4854244693213433134,13028810413773014662,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1996,i,12932758708904260720,9517610003952577327,262144 --field-trial-handle=2672,i,4854244693213433134,13028810413773014662,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:2
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2708,i,3367555373201543265,3783817822579963419,524288 --field-trial-handle=2672,i,4854244693213433134,13028810413773014662,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:13
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,13944746481312165980,11660613176344715760,2097152 --field-trial-handle=2672,i,4854244693213433134,13028810413773014662,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,12690839272986787400,9144343643919275008,2097152 --field-trial-handle=2672,i,4854244693213433134,13028810413773014662,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4368,i,8382381597177543222,8451355482361734280,2097152 --field-trial-handle=2672,i,4854244693213433134,13028810413773014662,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,4367566943776617074,5859464312957326040,2097152 --field-trial-handle=2672,i,4854244693213433134,13028810413773014662,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:9
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,3648462466533967356,15924295248132974178,524288 --field-trial-handle=2672,i,4854244693213433134,13028810413773014662,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,11367791582471790308,1361749149050234380,524288 --field-trial-handle=2672,i,4854244693213433134,13028810413773014662,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,11242787159002024034,176929929337258671,524288 --field-trial-handle=2672,i,4854244693213433134,13028810413773014662,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,1789944308782034917,14065074104137549551,524288 --field-trial-handle=2672,i,4854244693213433134,13028810413773014662,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,1789944308782034917,14065074104137549551,524288 --field-trial-handle=2672,i,4854244693213433134,13028810413773014662,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,6374127003979782647,17113929723965701890,524288 --field-trial-handle=2672,i,4854244693213433134,13028810413773014662,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,928001342419897875,16553540290281703136,524288 --field-trial-handle=2672,i,4854244693213433134,13028810413773014662,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffecee1c188,0x7ffecee1c194,0x7ffecee1c1a0
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,18226442927649155747,9602312885481715826,262144 --field-trial-handle=2276,i,14990570461361729853,6036756290130481280,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,13850420162222812592,5272605584465629740,524288 --field-trial-handle=2276,i,14990570461361729853,6036756290130481280,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,6035302554251492029,9424785090326464621,524288 --field-trial-handle=2276,i,14990570461361729853,6036756290130481280,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:13
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,1961267906200961497,17998423381120275545,524288 --field-trial-handle=2276,i,14990570461361729853,6036756290130481280,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
    3⤵
    PID:704
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,1961267906200961497,17998423381120275545,524288 --field-trial-handle=2276,i,14990570461361729853,6036756290130481280,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5100,i,8909818519799171617,13511261050873786897,2097152 --field-trial-handle=2276,i,14990570461361729853,6036756290130481280,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5108,i,5987961569999130873,17912512836282086150,2097152 --field-trial-handle=2276,i,14990570461361729853,6036756290130481280,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,10893465066880998555,13943386858824380454,524288 --field-trial-handle=2276,i,14990570461361729853,6036756290130481280,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,5971292719152250316,12748123014478412519,524288 --field-trial-handle=2276,i,14990570461361729853,6036756290130481280,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2ec,0x7ffecee1c188,0x7ffecee1c194,0x7ffecee1c1a0
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1800,i,7469003764487124644,6651511090647336809,262144 --field-trial-handle=2540,i,15586966533018498917,2038701600243832565,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,1119776595734642677,2327779641358269937,524288 --field-trial-handle=2540,i,15586966533018498917,2038701600243832565,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:11
      4⤵
      System Time Discovery
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,2413042612212679988,6067019197948697120,524288 --field-trial-handle=2540,i,15586966533018498917,2038701600243832565,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:13
      4⤵
      PID:3056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,12852531696954507390,15122066707976246648,524288 --field-trial-handle=2540,i,15586966533018498917,2038701600243832565,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,12852531696954507390,15122066707976246648,524288 --field-trial-handle=2540,i,15586966533018498917,2038701600243832565,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5028,i,625367354328535608,4240645676690923933,2097152 --field-trial-handle=2540,i,15586966533018498917,2038701600243832565,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5032,i,1496209780620478386,17675465444739871783,2097152 --field-trial-handle=2540,i,15586966533018498917,2038701600243832565,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,1123551757026681988,11845977292395781625,524288 --field-trial-handle=2540,i,15586966533018498917,2038701600243832565,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,12832502062305148174,6419037198705340811,524288 --field-trial-handle=2540,i,15586966533018498917,2038701600243832565,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5684,i,9158861447174994229,6823918851116287024,2097152 --field-trial-handle=2540,i,15586966533018498917,2038701600243832565,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      PID:1676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffecee1c188,0x7ffecee1c194,0x7ffecee1c1a0
        5⤵
        
        PID:2068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2012,i,3911529688574320002,3022364771065457703,262144 --field-trial-handle=2476,i,4128214261449988981,5648799297622678541,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
        5⤵
        
        PID:3884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,7219161371048837523,4435052035214116221,524288 --field-trial-handle=2476,i,4128214261449988981,5648799297622678541,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,14030950455256152519,13906954962007560376,524288 --field-trial-handle=2476,i,4128214261449988981,5648799297622678541,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:13
        5⤵
        
        PID:1948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,4846282637312320618,146682707759651346,524288 --field-trial-handle=2476,i,4128214261449988981,5648799297622678541,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
        5⤵
        
        PID:4228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,4846282637312320618,146682707759651346,524288 --field-trial-handle=2476,i,4128214261449988981,5648799297622678541,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
        5⤵
        
        PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4264

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\UnprotectPop.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5792

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\RenameFind.dib"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5352

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\Desktop\StopTest.xltx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ReadUnblock.xht
1⤵
PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\InitializeExpand.mht
1⤵
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2260

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2376
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3056
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4484

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\90d0fe832648436f8317424169e6585b /t 952 /p 2376
1⤵
PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b471d5790d1e8ac94438a5662d0ed854761db5162e9ed715d3f950974387da2
MD5 f3139b9e55fe18feb36cb00db002d273
SHA1 755162342b8e0f46c67a7ca7edf74a3293cdaeb7
SHA512 d229aade54d55576064d540cb4f4250cd3d32106eb04bcac5449501aba91bfbfe3857ca0457eab714fad16945c3e3a00e1b408afe8edd04cdf8574cf34450a48
TLSH
T17CD0C02437457610C40D05704410CE02C133C803B0C3DA003032C50CC5158C0FBCD0EB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f567aa281ff3c62d73fa235b6615f782a1ce9b5d33cbc22828be4b096dcbb704
MD5 a286a0ea156674cb89016284d640c0ea
SHA1 b01f9ff43be31bc9c1a4041053d544d534dd38f6
SHA512 355bcfa5f49fdf21a5279186f9d74a1c5a602a00f9f0a3ba5f6ac8d7336234290f7ea54253c707f2940d64bf322751bcf1830d14be672ba4c86754a48132c463
TLSH
T1CDD0A715741979D1D129117145214E10911A4647F79296167511980DC966880BAD6DDB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d2cb4d06a9f0251634b6275158e2101377075b6a43388c16a6045d16d57d18ed
MD5 7d019079fd6aded3dae85cc03023f8ed
SHA1 8bf9ee54089b0d72bedce38859c4a350113f471a
SHA512 ed4bff45219f9190c599f30e1b5c5b14026cc004042877cf511408cf5fad770966646aabe1858ea20a0635ee2743cc49a310b3cee8d5eb6b51d8187e25033690
TLSH
T198D0231675087D00CD1571715D114E10D116CA0FF696D56A7971D80DD90BCC0FADD4C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9faee199881a6dd753d80d68192f2a92ea4a05996983d0a2b22b74674a7f1ecc
MD5 ddc04ad0c4d9f12c169a8225daa79278
SHA1 99d3d6c457e5f2adad1d061a7f4671edd9f4d888
SHA512 7e19864289ff23aaee548d85c5ce1ae794871371573e52a9263e9c7f2551c4d5677a6f06dde05212806b4f1bf68268fff3681d3b4d413ef6f4734d4cdd2f991e
TLSH
T110D0231675087D00CD1571715D114E10D116CA0FF296D56A7971D80DD90BCC0FBDD4C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b842906cea16d7b3aa3205573cacb7d4d1d2364d11253f46244aaa1a7745db30
MD5 aff0d41e14c14a0f33ef71eb300b3517
SHA1 1b323ae2f9d64108caaa43e8fc26a953c57942d4
SHA512 7d91f5d419c8dab3b5c13b763160d5c782dae9d50314591afda7d0f4db293ab075d234d6ab8602002e921be583a3c7b2c7977545c7522af94ab7cfae1e8bd620
TLSH
T1FAD0C02037457510C40D05704410CE02C133C80370C3DA003032C50CC5158C0FBCC0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0a4cf642758dd51a858352ffc1f3575fb1ff140c903130e3796ef9738f289150
MD5 fc067e5330d079238a9adf5af51156b7
SHA1 298e56ea9943122cf06d105c719b124f30e12f28
SHA512 772ba8d1d7a0af03d3f100f32c80c8698d0400801937b6d29d4b19b8fa215f9b42085dd82b9514873eed11453fd15c735d58890fa420e19322e8840a0bd97c76
TLSH
T1E3D0231675087D10CD1571715D114E10D216CA0FF296D66A7971D80DDD0BCC0FADD5C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d115328e18a351b5298d28d383052bf6d6d1c867770982ecad1be645ddd0ad35
MD5 5e06a364cf911792d5a215f0314b6733
SHA1 bd4a8e41cb5462fa9d672a5327ab6fadb6f7718f
SHA512 cf195132daaaa42ccf2601358dc9586c8f8b73540754f4d4db9744c3c61b3b7f1fa9ba4c40e83cf2c0c5ce37f10e991ea1f22fea1f6083e6d173f4a71b67e0b1
TLSH
T141E02B6BCC25EC2B19FD071960554789EA4023173751855F363C410E8F75A3B159991C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 9ed049b10e896aa2efcca070939deffac969e5e233983267be2367102e65733c
MD5 3787789758e865f4f6fd791f119ba1e9
SHA1 b5fb38ea431a7cf6e4a57c9c7bd6b2916d7810d1
SHA512 500a5afbc4722d528d73dfd7b59c47ea57931e6ecc0ce9d16ce5f32efdada7ffeee00cd44a24210bd04d076fc435e4ae19618323108c695d7c6befd585e21426
SSDEEP 384:XQ4s89bt8PA7jzUiq2wywmjwZ8zzHXRGrm:XpsOR7jJnf3RGr
TLSH
T1CF13087E6A808C92CBD3653C48573F75AB789FA2F0C8C213A636B138F345B691C5E558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 7a864aac1091d1cba5f7f840e37966c717a9d8b18eb771c122e47cad87154b63
MD5 234cd28c2474a05b0ce5232444458a4a
SHA1 b91f0ef130661fa06af69367cdaf9c029382ac5e
SHA512 40264bd118e134f871d7703867d507aaa75bc7d658311a6c77774bcd430e1f4d8bbd47a851b8b5e26ea07a5ce27289b6f802c7e379a5acb03be2aba6b42fb345
SSDEEP 1536:ihHk3L/8FL/49CigJRkQsEr+X4iqr66VlP57qL/:iZk3L/0L/LbD1xtqL/
TLSH
T16C444EF71951A00BCBA852F5E2033E3DD17B464E7CD1F8E9E6784C916825F21B6BCA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 cc9d13e755bc8ef2312829a862c748e978d44af7c8df42a89c65f62b8de74fa6
MD5 941529595431fb1a59c307336e5afc5e
SHA1 1827d951d7a242d8d206a361936f784befe39fea
SHA512 b62ca2d99634b17d3aa4108b270d54f5cf600dc5d033b9377850e9c4e69556178efbb0ac49e87a47d7bf5eff241b69f677d792d77802a69edcd539b813ce2dcc
SSDEEP 3072:sv9G+6hNwGAKHQSOM8UL4Dk9EIS0WjL55:sQlOGAHSct5IOjV5
TLSH
T1E82538EECB682C83CE6B867470E0D9077E712183B64CD0D39944C9E997D6B8175E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 025ba3810d64e6893d04df20ae7fcabaddf38637f03b987e7b7ac7f4b48b74a9
MD5 60985854cc073ae6f58896dfbcb23f62
SHA1 da32c6c18821d9eb6d27f73589929636a1f55468
SHA512 ae4c9dbbb1cc41724c331339c1816d9e7b7714e2ea9493467afcc9c46d5d80abb437d13f644de415f25d191ae218f33eccf622df8d884d0899babc43f79527cb
SSDEEP 12288:2hL5mQ86/1zDHB/9VyC7KTMw+zFoILyBgIxKn4kx6qhd45gLpM2uhcWJ1dDUa7yF:ueeNc2EkKyHNnWZPYBjZbGu3nUOoRW3
TLSH
T13E166DEDCA6858C3CD63AA70B4F0E9477C7413C3F994C1D6C858C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9eae1fb558790be927d10fc47c7a298321bdb575a0f390cbacea5bff3a52cc0b
MD5 a0432316bf1a1e19eacbd6644bc1f669
SHA1 52049f40b89d4c778481b56081fd2eae721eb1b3
SHA512 912f1adc13708fe5985e7572682acdb280a1710bac279eaa6f7fdf14bcd9672e801125265aca257f054c33e53576f16f22226fb9a142d3dfe812cf99898bf446
TLSH
T161711B5DCC6239B2DB2541B900D134B57BB42C429A07EE26185950FCFF8E78C63FA568
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bf20.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bf20.TMP
Size 3KB
SHA256 b4a508c02377bb0a657434465bb7b81b74fa08bca9cdc04279d44f1cb18dfa44
MD5 9fe08c445b1b592aec676abfd870a615
SHA1 b11c5ba82414406df36ce11b8ca97c27491a8258
SHA512 df471fe9c60b181065c1cacfff26befffc2db225375c47e43661df8b83f1794bb8cf72cd4daac5a4a9d9d6198fce79f5603f7ff7c2e5bc2227dd0b6f2c84993b
TLSH
T194711B5DCC6239B1DB2141B900E534B57BB42C429A07EE16185950FCFF8E78C63FA578
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 854c3070bdadd518722d0e2ab69ce326c78aa7019cf87f1bfe9efe974ea8f316
MD5 70b0191c430bdb6a663a2dd24daf5771
SHA1 26ce69679920a5865ee01221acb68432d87401ae
SHA512 e0e8e1d291d95a01e837893dc00455b35888fc6808f61eeb7ab7309e4a5c9b5236e11cd72e6eb57be0d7a55cdaafc472af00281736395f257073cd3db89ac7a1
TLSH
T194E020E9E5CED23D5A103CC38378771885D4345ED6866D871710CCC47E43552B659946
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 8bef0e9006bbe5f62b7c7d904c6112d9717b110a0f27243321cfe01124c9b719
MD5 c79f16eba6cc562dd1dc7c29a5596337
SHA1 0951e1177b805b0d6b940a895b9e2e575dd6f5cb
SHA512 a8033cdd7d7a17b960515e70ac73dc96e2187525d4b9a17e1d4f7211eecf1a93ef8a4f522a029ae6818636932e1337f67ed8a5338fd39b2275c900bed1d750e0
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfjvcpRW5LjpiFtIcNVqYp/:TtD4jJ/0UC+lf5LOWx9iFO8VTp/
TLSH
T1ADE2E08D3B21F511C8ED733DA0C2C6E09EBCA93C464DB5B042385CB68D22AA5F49E11A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 3f0d82ed1339ada615182c7aadeb6187b59c3ac9df03ba8204e8ac3996f24dfe
MD5 7b094c39503f17f0562aa3deb0d70fe2
SHA1 bd39b62b007cc48d56664f314a794f862be107bb
SHA512 3659809f7219135718cd57bcb7de1671c39a356d13c53ae00c2920af4e4e6269a01a3a71a1f459fcdcc5d4dd410c6c25ef55017d12f8c952085c00e6728d70c2
TLSH
T1A3E026B844ECC23A965868D383EC6308C3E8340EA28B3D8717189DC87141342B2A7A80
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 6d00169849a2b12f838349e41dd28e27940a7f783df787381aec0ed9863c67ae
MD5 da8a4a9b9ddf42fdfe59922140c5ca72
SHA1 c85f3962afc06c11dd03c3ea2089f81131d17cc0
SHA512 91b2f4bae29795fff1da1598a5d5e74ce21f53868b3180bb5f5512e216ca41e087e87b40aab6096c5032685e76248ea0dd970631d793f62e24e9f56013072208
SSDEEP 96:rr+WmItejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/fibbEOVpZf24JkMfXSFR+Cw:rr+WGH+bF+UI3iWGVoWN3qL/UVVV63
TLSH
T1F0240E0E5F342722CDBD913669E744A35C7DF03F8B5326DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 31832ea92cabcd60234e45a8291b4b74c1042780f324aac2a98ef7c2784be4fe
MD5 c44a58851c021ef1e6309776285faa01
SHA1 86de1ccf649a9260488d30b67c9736f59890a24b
SHA512 339f7dae525c6eda3215b7cd92e5f471fa98d9459a5e6b5f17cbf9297ad821c32f0b008ffd4ab7bdf08885e1844a34d083315b3fb828862e2dd064aa74cab54f
TLSH
T178E0D8B489CEC31D6704208B436C7F0CE3B4344EE6992A465B189845F505108F2A25C1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 ca289675847fc734f4826ef5185a3b4e815b32dcdb9373a0724d5e335982b9a4
MD5 b39f3abe20a656cd44621f0a9630df97
SHA1 45cac81ae25646abebfdbf767e009b707777ff6e
SHA512 a71b5440cbac9189ce95b281e0ed02638dfab324275556271d5cff060af53a52991a20d540a152a9d6cb5b3efbc01108730c95270d0bc3dc722eab6be4604123
SSDEEP 24:TL00k/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ6H+Aw7oFwO39MA/+:Txk/LopFMaty423w/a9NUuTjAw7oFwT
TLSH
T1C0B23F8E1F346211C0F45B76EDC085672F7C110C8BA33695DE1860F2DEA36ABF50A5AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0c8af062519db9d39facb8b9fd1526c44e7daa9a64520301764b77e34cffeb5d
MD5 4e040ddd218feffda2bef44060d00e09
SHA1 2967957654108bd8bfe573895416d11d4e6c6015
SHA512 ab0c019980d29612f5f472f6c3bd6e66a0651c76cb54cd5a397de07a6f1c5d569617144691ab1c87f28efe1da81c94d425f43d7a3570e8e337740e325023c678
TLSH
T14E51BDF7C3E8866DCA0156F0BA187E2BCE1D0914832C3D5A89E4EF5B93E2471E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5c07e2f1fb7be85f13ccc1880859c3e907a2c3b5334062850068e88dd8b835e5
MD5 37e08ea4a2bc60db8b1627b779e7622d
SHA1 6bd19366cf24276a522b30c9592827cda1da8cff
SHA512 ed5e990e872520e6e38f0cd07c899db7a84534686fafc4ea1185bbfd941bd6607ab0fbb935eb1ca36c61ca3e07c2dd60b7a997005a46a3d052edc4d2a9d6e5a9
TLSH
T15B41ADF3C6E8866DDA0156F0BA187E2BCE1D0914832C3D5AC9E4AF5B93E2471E14194E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c9959c4f69512121a2037be59cb014ec7a9ef449f653bb2a39af845e5396f30e
MD5 ba0450982cd765c4670240779ee2101b
SHA1 0f97a1e2149c830bfe1908f9c36d44f97e07d371
SHA512 f40ae4a30ea123ca417d1a7dcac74643eafd188639131953c080c3fbf0422143cb28670efd5f1732cd62a656a5b993ef410cbd9985cae3e67043c4ebca70d3cd
TLSH
T1A151BCF7C3E8866DCA0156F0BA187E2BDE2D0914832C3D5A89E4EF5B93E2471E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 8852b7f96788fdf38689c7d744ce23875284214405246e2a57edc347e249b02a
MD5 50a08c800160ac32e57d5565573362fb
SHA1 5c2825772356d03d1d804d2ef24d0c4cabfa0f66
SHA512 cf6f6abaedb78b66bc21e37c65b8481991d2775565a9f876f90506a7114cb06f88a15574edc4aaebf721add1830eb5c10c49793e2e8eb39ac16ad4babcb012f4
TLSH
T1F4C0229A84F9E4FB0028443919C0A880AA35C834008080A4DAA4B3BCA0A00FB5F12229
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2a2b80f107c284d3205572a3d04f4a0fda53b1688c81ce981d1fb8aa422993f1
MD5 59ef1c4cf84c5379a5bbd6d9ecc04234
SHA1 b0e5890135fea8a5ace0d113c6f8106359301db8
SHA512 f8b707bd2c749178f06ab9aee0683a0d94210172211e7f309ac838e53b92940b3e7b84b08d85779722fd4b5b405bba1ff23d1ffe2361b609d16e8f184415d919
SSDEEP 192:sxRQR+yM/jK1Ml8w2U/fSsLPfaOZ1m5zPOLzoA8p4W/g6+WNIYJzfGUIgtJ:sxRQMYU/fSsLPfao1m5z2q//5IO3
TLSH
T1FA52C806AA34597BCCDBD209FA557F53D6F81573B2911E44EAFC9A1C00E6AEC121382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ef53f6f5dbbee356bb8ab817217cc2ef77c098aadbd50241c9fea33fde111051
MD5 37cb1c73b2296856a6a8db6e9174fa40
SHA1 01dcc83dfa453d91865378d288694f7d1fd4917b
SHA512 0089abe85c4b2026f4f0fe3bb92710d41988a3974f881cd78f7f4c721212de6523b85ec5934417c8fd21af7d375e7022f7629a86e254f0c0d65d9103f32903f9
SSDEEP 384:sxRTMcU/fSsKWvuPfao1m5z2q//5IIBcC:svBU/fgYuPf9k2u/5IIr
TLSH
T18062D905AA24997BCDDBD21DFA557F53D6F80473B2915E44AAFC8A1C00E6AEC121382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8067f81da4318761fe089668a6d28088ade66235ee27c573fb1c32b5d266a645
MD5 5486a167657944da71f1867e31d68e30
SHA1 f7faafb1bdeea8ec99ab228318e354fb461259c5
SHA512 64399b9302ab3989778f479d15d5ffcf8099c83db040b697c296439eb2f2d73ab7bb98248d53718a70a12a4ecde8710fa1fdb5fa3c471848ea2fbf80584373c6
SSDEEP 384:sxRThSU/fSs3WvuU+ao1m5zD6VcqV/5In9cC:svUU/fFYuU+9kNE/5InH
TLSH
T18572D805A628597B8DDBD20CFA567F53D6F81473B2955E44A9FC8A1C00E6AEC231382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 79ba2eb598bd3f2aa7b1004bb0b109fab4e6ae21db86e4cadcb6071b795be44c
MD5 93bf03f1541210f535ab35241f587809
SHA1 426b99f7c85a0f371d1a65368a2e55974c7f4ed4
SHA512 92472be1d747d1c7ce47a2e27d48a7996e10784c8f99ca1b80504dfa9593c45cdcf92604b3d3b59db6350f57d97c916895fd00467387db68a4f8767e69bf4e33
SSDEEP 192:sxRTR+yM/jK1Ml8wFU/fSs+PfaOZ1m5zPOLzoA8p4W/g6+WNIYJzfGUIgDo2J:sxRTMbU/fSs+Pfao1m5z2q//5IOcC
TLSH
T1D662D906AA34597BCCDBD20DFA517F53D6F81473B2951E44AAFC9A1C00E6AEC121382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 20a8ec45e39bbb82bdd6672add96d9aa5c4909136b5abf3386e15b176ed38b46
MD5 c1983c076eb2a029784fd96420dbd813
SHA1 c2ad68436fd9984e0d2c955eff158f441620557e
SHA512 db97e9652f28d085da0974103495e82a527adb6a4ef9925160ee6b4ace61468c82c73a34b31d7ae52d1d2bba7977282b501c6aadad48901c68ed8ceedf7ce078
SSDEEP 384:sxRTWKU/fSsiWvuMao1m5zD6Vcq6/5I90BcC:sv5U/fAYuM9kNH/5I90r
TLSH
T1D072D815A628597B8DDBD20CFA567F53D6F81473A2954E44A9FC8A1C00E7AEC231382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4a5859f7a8456918a433968a6ab525fd5c80db0365bbb5af0ef0e5176fb6ee60
MD5 ce561e580c37842a702a2d635c056ff3
SHA1 6e6f696e73801916115f6c9b3708b83eb5af5c3c
SHA512 1c7b5e9121456ab3f987b133a2214df570059e6c5cde0f5cec3b7aefbf3d3c93b60613ea5eecc569f147a23999e65fd75c121a10386f8776ea6215be86704e8f
SSDEEP 768:v1D8Pw7pLuL7e7WgeEftq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvRHDZhdrol2ZFf:v1D8P8E7e7WgeEftqu1jacRHNhW2
TLSH
T1E6E2FD3B680CCB7E4F844A9CEC29BD9A6DE401CB96D8CD5447EE880C03C6AFB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 c68e062e48776e91e2b651b2930e0c6e8388f47e7b5e048e8103cb8f897a27f8
MD5 a96e2bba9d7bc3af53d143572a29d5a6
SHA1 2432575a31082e08939ee5c8faad4a6ab605831e
SHA512 23d95f84dc336701db18a453acb3c71b8f0dd6a436caee4baa42f660b2410e83f31a0a81a516b16758c7e4bf4412eefc0324ffd6af016f34c54bd940540aedc8
TLSH
T116E026E445CCD27D611524C743FCA30C83F8B40FD2C83D472FA0D884754260AB193980
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 26269528dee660ea87038520659792001168c61b2fe9480491fa5d995589840d
MD5 d12b2b5a0e14b03f3c9af1bc3ef08a6d
SHA1 fcd294845ecf95e01c5e00ec9be79b53d186e078
SHA512 3d27dc21ccd351cb26c9911949ca920e5b0707e0fd1344fde9a43214b762ac5f077e73d355c4dae2d1c76ca49b82d662c15680c9e71d0f29aece3e5bcf7d915b
TLSH
T1F4E0D87856CDC72A624524CB83A8F30881F2740ED6DAA9562F18E5C476062407243D40
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 ea64c12e776ce1211c935ff389bd0acc754187ef281b5d8233297f85e661e6df
MD5 7fc728481004fa7c4004c001e994b764
SHA1 1fc3295132edb01ce04c0012151925f4a91be61f
SHA512 bb35d370d6edb214294d66d43f946364b31f881e1a82ae4641d29cc86ad338c8862de038bb8e6fbc8e3961ada6db54c24fedb126b1c86f3609053932399848e4
TLSH
T176E086B885DDD33D9A04A5CB43ACA70C83F4B80ED7C93B9B6B185444AA01295B2A6980
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2e6eda1e4b6874244a92f3816bf71827cccef44dda8547384e06a9ab007190af
MD5 95575e0118ca6c8ac15e35bcfced853a
SHA1 15d7e5043cd4402704f622a5cee62978a1a8ac61
SHA512 4d48b5c96d0b88ed4465b0a3605a847feb72c196676881f4f78688f9964a2e4f490a3d8f5bcddc1fe823e26d180272a6309d957fd96c4aa7b38144e01257346d
SSDEEP 48:Kg/IJKsgULyeXAbXxRhCT5qxI4nCK9n1NCpHSuC1XryDybo8aMbcTPAHI4hcK9JQ:Kg/qKsgqPYQK5meK2UKXKRl
TLSH
T18791229575772300287E790D8264991B7642307B305EA47B7FB820E25E26E14BEFEECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 67a47ddea4234de541612b8360df5b9203d07c35bb686bbd1b5d6d10e5032e1e
MD5 bc502ebcbe0972f086698d1efb0559c3
SHA1 66ee052350d0c5d8e8474bc2e847dd5e3800a556
SHA512 381cb13e0f4c3d712b6869e8660b2854255e4439a8d20cf56ec089429377354d1025714bc06b6146cc453675f00e97da253cbb09a7014424de90e8ba5e0eba50
SSDEEP 48:Kg/IJKsgULyeXAbXxRhCT5qxI4nCK9n1NCpHSuC1XryDybo8aMbcTPAHI4hcK9Jb:Kg/qKsgqPYQK5meK2UKXKRD5yKk
TLSH
T1D7B14295717B2300387E790D8164992F6641307A315EA47B7FB820E65E26E04BEFEECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 ad5793ee5809959f2a303d6e390549c7278d908d310334f6887523a072cf6bc6
MD5 c954f9aa9d4126f2318e5aa883ce4cb1
SHA1 dc13e021f2d57449813775ab2d797dd8e564ea43
SHA512 083136f4f3399aaf78b3c8ec37596ce8eb70d6391305de76d94280cb8527015b6e60f99917747552ac074bc12a5ef477a2865f1d5fc381b7dd8712219f45aff4
SSDEEP 384:DNrRZyCSDnxTICJMEhIKyll7svbFKfk7:xFZJSDniPyI1l7svbF9
TLSH
T14344850A7B747001EDE6D9721CB080771E3CB16ECF22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b63dbf89-da87-4d82-ba0e-2a48f5953bd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b63dbf89-da87-4d82-ba0e-2a48f5953bd0.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6011fe9-87ee-47de-9cbb-753c31b59075.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6011fe9-87ee-47de-9cbb-753c31b59075.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 488B
SHA256 e95266a98c0ef4a6e8e6743fc0c289ddc5eee0fb6c7c468ac59f04c890e7e249
MD5 e81cf594f77cbb777ee3dfeb4bece6de
SHA1 707d61696f2a34ccd37643cd0db987c438818265
SHA512 5d4fb331d9d6cccd71a9cce2e5df1e7258d78facc6f7d189e476d6495d29a7875ceac69eabeae656370740c5b363bf50892774235ad00889287e23ffd1b40d2d
TLSH
T192F05BC0537B75956E8DB541C219250774843D69168F54B1372D64E45B44C0C6B6FF36
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 272a2de2303ff2ce37f588dbca0ee8fe04507c702f1b0e1ea42f44324f9c4da1
MD5 f488425a98621f76f10db2f0a9daa12f
SHA1 3c6ec9d9c0146728be67ec2d488b59940dbac186
SHA512 706ccd0db73be967e9dcf9c4b9936c9748825ce9d7823454eeabddccbabc2b89fbd5412f0450ed57d81e1cad759bb3aeab1f93bf69fe40243252c5d7ab79a82f
SSDEEP 192:s8QT6IIIFbVMIMX+YcYetO/tAsTl8TFQ2sY2xs:s8QT6IIIFbVMIMuBU/+s5N2sYB
TLSH
T12742845E76055B77C05EAF3613A287449BD848C18076752E32666C0F8EF3FA786C92F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 a2c0b7c0055c0ec0e92add46b0dfdd54f71cbcad0f6a3ff421083b9defec5023
MD5 d46d0a154060482614939243ba78d976
SHA1 4ade978eb5b1dda6d5f95f80b8638f1121034a8d
SHA512 0621ea5a06630580dc27fccf9e221009f57d4321498f75b5eef2fb207e8c631764c43352a4f42191edd2915c9ea15177ca6ec37868d10fdc2033311aacf32798
TLSH
T1E1E07DB4E9DCD37FB51464C703B9638883A8380FFAC8298B1F10C84CE641311B786981
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 e4eca4cf3221513117163bf310fd01fe55f3f6ddbc89fdb6c860715fd32176b6
MD5 78466ae55d6b0791fa54d2124e427873
SHA1 618f60cc56dc40cfc2272c476beea22b85b90e1c
SHA512 c024ed85aed9909d1b6cf23adff2569c561870ac3a7d4eea0fd08fc3ffe33765eb492b264619ce75ca7042499eb24ae0d61eedc6d8244baee39474ae8ed5f1be
TLSH
T1C2210455F330C149E14A827AA43FAB291738E8168FB8EC0F587920746EB1B141D4B6E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 a5a39335ab3e12fb7305780973ae356534c183435ea492ca51fc714f4a208b40
MD5 76be87c9e9aadd7e7c2e3cbaf699357d
SHA1 735861efcfaa7deddb9083edd1e5ba9def1d693e
SHA512 2073092392a8271bb15758dd9371276709a272250bad0b30eebe72798ccf6040cb81f19245c94c980781a80ac655f8054ee0b5af798f33bcec3be37a3922e80e
TLSH
T12CE080B4E4DDD27F551420D703B9A38893E5384FEA852E471F14DC4C56412567656941
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 e700a0cf102faf46a8a31cfa3109ced4685a4f29b666284803a9ffb373f49242
MD5 f7fbe80627958a12c6a0c5a0aec8afd9
SHA1 7f2efc54bcde3dbd194a39add71248f5c63ab5fa
SHA512 520fdbe21c4374857de27a93a60592ca001e95d0a65bd205b26d66997f9354dec406ebe121d751a76d56d71fc85d8b265bacce6ed656422467aa504c7504f5ba
SSDEEP 3:MsEllllkEthXllkl2zEflI:/M/xT02zH
TLSH
T1B1440404FFC40405C7001030C055C3501774D5500513574334F104335DD75C00C00040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 aecc75c0fa29609ada769a3fa3965c65dc94bd4555b14b615a4d79a8cb3cf5df
MD5 06cee7e2335dc06056414325a24acf92
SHA1 27ee3d80e752c577a48ca54f58d4cda288d0cb2b
SHA512 38fd039d74966dd47f3e01b0e3763edb622479ac2f158d900aa9c6e08274cd64b2ce6e449c1f8290b966365a131da60775876ca2fc49cd2e9608493050cd986c
SSDEEP 3:MsEllllkEthXllkl2zEflh:/M/xT02z
TLSH
T19644040C7FC00505C71010704051C3501374D5504511574334D155375DC75C01C04050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8da1037ea1e0699b4c05c185369a9ed35d55f79f723542c62d506a2acea24dc5
MD5 b7f793d40e86b3ecccb963c8b8ba774f
SHA1 cb128554aec78ca45885b1820fedd5dd29dd705e
SHA512 031c9d68334703c758a954a3a8c10868d9e03169e0e8231dad03f1a6a7b72f59fac05eb2e316290e54fae5992ac104079567f23b6ee58f7c0cd22e676b22b743
SSDEEP 768:bjaeqD4MlshiLdMmu3Lf5GUuVCgZSVCKPFECrBhpjcxq4+ApX32TB:bqcjhIdMB3Y8gs0KPF1HRcI4+KXk
TLSH
T1EA03CF7AA8A45E738CB7D645B207B2466EB842D7D2C92F8CD8DD6A0D41D73DD130382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 05b8e19b06cad2b06684883d29a4bd164dd040134ae98e45741866ba9dc0f908
MD5 837ce9134803044eaa8f53f126dcf5a7
SHA1 76344e59fdc42da7a4b0179482da2bffad86e3aa
SHA512 2e88a6308e4c2e5bb384bd44ed86e09dc36615bfee307651882b0decd59deaecc946d105a2ba908411ea4ae30cce080b3ba27cef8628aadeb4cbd6a4e4242563
SSDEEP 768:ijaeqD4MlshiLdMmY3Ykt5GUtoJVCgZSVCKPFECrBhpjcNFOBXTm:iqcjhIdMf3FQ8gs0KPF1HRcbOBi
TLSH
T1A003BF75B8B46D734CBBE145B20772866EB402EB86CA1E5CE9D96B0D05833DE1707C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 4e4f6b369de02941cb2354bd98f6c4ec5508452958aad7f4ec897ca0889fde03
MD5 276a31a388508ae37d040b15355ad854
SHA1 44d62edebecc8a7db1b6b891d37f40cace6dbf6e
SHA512 ebeba5c39a25188e66df93e67b806c9e164d63bf1ee261f5cb9f7ccaf9cfcaa7fda9739fa0262103d2d07707ae9bd3393d8b055531d23931f6874ca9ac8a898b
SSDEEP 768:7j+9O7dt5GUtcVCgZSVCKPFECrBhpjcuY+9qm/+0gvr:u9OXc8gs0KPF1HRc5vm/Evr
TLSH
T138138C79AC605D3F48AEB388720E25592DB80277D2BA495CD7DC1B0DC4BA29CF743C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 2a08f97cfa77c4b61d2cd1c684f515b0cccbec8d2190f56e1eb27c74960c3491
MD5 f259fa6caddd0a737adb924ff34c2661
SHA1 22ee653b4ecf4a3089bbfb91784bee6717d0716e
SHA512 7cc5c3cc6b0aba2c2854d00b07e74530df70e1dc5e7366fcc4fc60755baff58f8d120c5e9f0f32114814ebf7ee6541a131b813c3d6a6807524f3d5512c1ad921
SSDEEP 768:ej+9sBct5GUtoVCgZSVCKPFECrBhpjcPmc9qg/+0gvr:d9sAo8gs0KPF1HRceZg/Evr
TLSH
T185138C79AC605E3F48AEB349620E25592DB80377D2BA495CD7DC1B0DC4BA29CF743C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fb354e517035996cae674f2625eb1f5be777742f60552bfd05400c690ede2897
MD5 ce3e44c8a0fb042bd0c49063cd896a46
SHA1 d97ddba260ee1fa3858eb86d30b1f28aabd5ed3e
SHA512 186b5212ad0d7fa9e893faee054077cc6b47a0ebcec7cb64fa332b989bef6e6d1a1b1382ce2893210e144fba6da6b5d576406a1661313b7425375aa7032bd9ca
SSDEEP 768:ij+9S3Y7t5GUtyVCgZSVCKPFECrBhpjcNF/+05vC:R9S38y8gs0KPF1HRcb/FvC
TLSH
T167F2BF71B8A5AE634CE6D295B20B728A6EF402E791CA1E48D9DC6B0D48C73DD1707C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 14785ffd80f35ab56d7659ae3e1c5f2c4c0891228d775941e35c4d6c546ffee3
MD5 2bbe7de6acb64930ec8b003fe6f025ec
SHA1 f5ddd3103a93193ce05632a2218db13e1e2902f8
SHA512 856da0b78bc1f88d580854aa35e8f96ca1a7396a57fffb7484db59ed1430e738f41fd152b07f18caea75627a0519f5ade21fc311f5b8c6ecb8596feab1c924e8
SSDEEP 768:Ij+9S3Y8t5GUtyVCgZSVCKPFECrBhpjcN9v9qK/+05vC:X9S3hy8gs0KPF1HRcHQK/FvC
TLSH
T1DC139D78AC605E3F48EEB748720E22992DB80277D5B6495CE7D85B0DC47629CFB43C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 2aa574e7f834642261fce4506e8f3b595070163d7f904dade7baea895ae4787d
MD5 8a6bbaad3fcc662ab0b791bff3c474e8
SHA1 01d7bf6d0846e6b244e4640c074e2d3d2d0d9e2e
SHA512 825482f7e0fc4daf449714e73fe78931f1f95ef5908de263d6a702b4c07315a2118982815c2b969d990c30b05a4ed7528df0026c796f1088301a01ebbf431a83
SSDEEP 3:MsEllllkEthXllkl2zEflfE:/M/xT02zOE
TLSH
T18C440404FFC00405CF003070F051C3501374F7500511774335D11433DCC75C00C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

c06738e7-e522-4627-b143-4c03d29a77f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c06738e7-e522-4627-b143-4c03d29a77f3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 576KB
SHA256 bf4eeec31285831c911db3585cf4cf19102c1858b76af9ac246253b5f528a4a9
MD5 8d109f5c3c504efe0eaab2b00b867c4e
SHA1 f942c4e519c6044a4986c44b0c354323f87089ab
SHA512 c653ca20e28a9bd58198ac59db0ac4a9c2af165846136fff72b7d1d3db19a2ef703a7339608deb13bdf27c316643d992dd25e42b3cc1ca70e26328453ece799c
SSDEEP 768:af0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3r:a69tQeoVYocxYCutFCJGAKt
TLSH
T1D4C4FE37A470A098DF3C35B1E2AC6B8CBD72641A12E006421F74B57F7A337D99A0B5E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3376_174482196\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 304B
SHA256 7629b59c77c79b40c966b5f47459e988cfaf72e01743dc50382789c7ebfeffc0
MD5 9a6d9e3b07261e92f69726df4623787b
SHA1 918e705c600a61301ab88c19826ccc0cc8bb39fc
SHA512 c4c0c96a97c70378b42f7eee163b9ed1cb63fc80e55b711ed0a2437595913b9bf77a488c70ac59071fc7b83c973b00570d620d6f2ee5e103b08c1ec2f59403b3
TLSH
T17DE0EC877B64E7F6877C11683C7A9CF14FF188A4D38C615621ED6C5A0D74987504750D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1456-178-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1456-233-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1456-231-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1456-232-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1456-234-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1456-181-0x00007FFEB1A90000-0x00007FFEB1AA0000-memory.dmp

Download

memory/1456-180-0x00007FFEB1A90000-0x00007FFEB1AA0000-memory.dmp

Download

memory/1456-175-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1456-176-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1456-177-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1456-179-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1908-544-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1908-545-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1908-543-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1908-542-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1908-529-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1908-525-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1908-528-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1908-526-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/1908-527-0x00007FFEB47C0000-0x00007FFEB47D0000-memory.dmp

Download

memory/2376-951-0x0000000008CB0000-0x0000000008CC0000-memory.dmp

Download

memory/2376-953-0x0000000007630000-0x0000000007640000-memory.dmp

Download

memory/2376-952-0x0000000007630000-0x0000000007640000-memory.dmp

Download