3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

Analysis

user interaction
yes
max time kernel
146s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/07/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MEMZ.exe
Size 12KB
Sample260712-c8vpzset61
SHA256 3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
MD5 a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1 761168201520c199dba68add3a607922d8d4a86e
SHA512 89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
SSDEEP 192:HMDLTxWDf/pl3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL
TLSH
T195426EDBB8200823E0F142B334257434EFBE852E0BDADEC98DF62E519BC79032517165
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2968	msedge.exe
4508	msedge.exe
5408	msedge.exe
5560	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282980065206667"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{81207BCE-235D-4F02-826F-37BCD0C24659}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{4F51C786-4FFE-4E34-BAD9-D0BD399A196B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{A9C09FEC-8127-46EA-8C49-79D93FB5C1D1}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{62D9E41B-EC30-40EC-9931-1BC98C2A2D13}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5000	MEMZ.exe
5000	MEMZ.exe
5004	MEMZ.exe
5004	MEMZ.exe
5000	MEMZ.exe
5000	MEMZ.exe
5004	MEMZ.exe
5004	MEMZ.exe
5000	MEMZ.exe
5000	MEMZ.exe
5004	MEMZ.exe
5004	MEMZ.exe
5000	MEMZ.exe
5004	MEMZ.exe
5000	MEMZ.exe
5004	MEMZ.exe
5236	MEMZ.exe
5236	MEMZ.exe
5016	MEMZ.exe
5016	MEMZ.exe
4832	MEMZ.exe
4832	MEMZ.exe
5000	MEMZ.exe
5000	MEMZ.exe
4832	MEMZ.exe
4832	MEMZ.exe
5016	MEMZ.exe
5016	MEMZ.exe
5236	MEMZ.exe
5004	MEMZ.exe
5236	MEMZ.exe
5004	MEMZ.exe
5000	MEMZ.exe
5000	MEMZ.exe
5000	MEMZ.exe
5000	MEMZ.exe
5004	MEMZ.exe
5004	MEMZ.exe
5236	MEMZ.exe
5236	MEMZ.exe
5016	MEMZ.exe
5016	MEMZ.exe
4832	MEMZ.exe
4832	MEMZ.exe
5000	MEMZ.exe
5000	MEMZ.exe
5016	MEMZ.exe
5016	MEMZ.exe
5236	MEMZ.exe
5236	MEMZ.exe
5004	MEMZ.exe
5004	MEMZ.exe
5000	MEMZ.exe
5000	MEMZ.exe
5016	MEMZ.exe
5016	MEMZ.exe
4832	MEMZ.exe
4832	MEMZ.exe
5004	MEMZ.exe
5004	MEMZ.exe
5236	MEMZ.exe
5236	MEMZ.exe
5000	MEMZ.exe
5000	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5400	msedge.exe
5400	msedge.exe
5268	msedge.exe
5268	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5096	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5096	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
5632	msedge.exe
5632	msedge.exe
5400	msedge.exe
5400	msedge.exe
5268	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 5004	2664	MEMZ.exe	79
PID 2664 wrote to memory of 5000	2664	MEMZ.exe	80
PID 2664 wrote to memory of 4832	2664	MEMZ.exe	81
PID 2664 wrote to memory of 5016	2664	MEMZ.exe	82
PID 2664 wrote to memory of 5236	2664	MEMZ.exe	83
PID 2664 wrote to memory of 1264	2664	MEMZ.exe	84
PID 1264 wrote to memory of 1112	1264	MEMZ.exe	85
PID 1264 wrote to memory of 5616	1264	MEMZ.exe	86
PID 1264 wrote to memory of 2592	1264	MEMZ.exe	87
PID 2592 wrote to memory of 5900	2592	msedge.exe	88
PID 2592 wrote to memory of 2968	2592	msedge.exe	90
PID 2592 wrote to memory of 6008	2592	msedge.exe	91
PID 2592 wrote to memory of 6008	2592	msedge.exe	91
PID 2592 wrote to memory of 6008	2592	msedge.exe	91
PID 2592 wrote to memory of 2580	2592	msedge.exe	92
PID 2592 wrote to memory of 2580	2592	msedge.exe	92
PID 2592 wrote to memory of 4444	2592	msedge.exe	93
PID 2592 wrote to memory of 4444	2592	msedge.exe	93
PID 2592 wrote to memory of 5352	2592	msedge.exe	94
PID 2592 wrote to memory of 4444	2592	msedge.exe	93
PID 2592 wrote to memory of 5352	2592	msedge.exe	94
PID 2592 wrote to memory of 5352	2592	msedge.exe	94
PID 2592 wrote to memory of 3796	2592	msedge.exe	97
PID 2592 wrote to memory of 4240	2592	msedge.exe	96
PID 2592 wrote to memory of 3796	2592	msedge.exe	97
PID 2592 wrote to memory of 4240	2592	msedge.exe	96
PID 2592 wrote to memory of 1212	2592	msedge.exe	99
PID 2592 wrote to memory of 5820	2592	msedge.exe	100
PID 5820 wrote to memory of 5428	5820	msedge.exe	101
PID 2592 wrote to memory of 5632	2592	msedge.exe	104
PID 5632 wrote to memory of 3900	5632	msedge.exe	105
PID 5632 wrote to memory of 4508	5632	msedge.exe	106
PID 5632 wrote to memory of 2360	5632	msedge.exe	107
PID 5632 wrote to memory of 2360	5632	msedge.exe	107
PID 5632 wrote to memory of 4616	5632	msedge.exe	108
PID 5632 wrote to memory of 4616	5632	msedge.exe	108
PID 5632 wrote to memory of 4616	5632	msedge.exe	108
PID 5632 wrote to memory of 5092	5632	msedge.exe	111
PID 1264 wrote to memory of 5896	1264	MEMZ.exe	112
PID 5632 wrote to memory of 3428	5632	msedge.exe	113
PID 5632 wrote to memory of 1940	5632	msedge.exe	114
PID 5632 wrote to memory of 3428	5632	msedge.exe	113
PID 5632 wrote to memory of 3428	5632	msedge.exe	113
PID 5632 wrote to memory of 1940	5632	msedge.exe	114
PID 5632 wrote to memory of 1940	5632	msedge.exe	114
PID 5632 wrote to memory of 2172	5632	msedge.exe	115
PID 5632 wrote to memory of 1540	5632	msedge.exe	116
PID 5632 wrote to memory of 2172	5632	msedge.exe	115
PID 5632 wrote to memory of 1540	5632	msedge.exe	116
PID 5632 wrote to memory of 5640	5632	msedge.exe	117
PID 5632 wrote to memory of 5640	5632	msedge.exe	117
PID 5632 wrote to memory of 5640	5632	msedge.exe	117
PID 5632 wrote to memory of 892	5632	msedge.exe	118
PID 5632 wrote to memory of 892	5632	msedge.exe	118
PID 5632 wrote to memory of 892	5632	msedge.exe	118
PID 5632 wrote to memory of 3892	5632	msedge.exe	119
PID 5632 wrote to memory of 1728	5632	msedge.exe	120
PID 5632 wrote to memory of 5180	5632	msedge.exe	121
PID 5632 wrote to memory of 332	5632	msedge.exe	122
PID 5632 wrote to memory of 332	5632	msedge.exe	122
PID 5632 wrote to memory of 332	5632	msedge.exe	122
PID 5632 wrote to memory of 5400	5632	msedge.exe	123
PID 5400 wrote to memory of 836	5400	msedge.exe	124
PID 5400 wrote to memory of 4120	5400	msedge.exe	125

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5236
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1112
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=g3t+r3kt
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc8753c188,0x7ffc8753c194,0x7ffc8753c1a0
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,2187410721028919664,3349806715500549616,524288 --field-trial-handle=2672,i,5337596705165675392,1699457774996947448,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:11
      4⤵
      System Time Discovery
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,5199869329044552062,9983201588986855695,262144 --field-trial-handle=2672,i,5337596705165675392,1699457774996947448,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:2
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,9378574292188701470,11380196386004584026,524288 --field-trial-handle=2672,i,5337596705165675392,1699457774996947448,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:13
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2464,i,9008009266111316771,15911305703152256718,2097152 --field-trial-handle=2672,i,5337596705165675392,1699457774996947448,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,6206073067979687935,17715290818663577551,2097152 --field-trial-handle=2672,i,5337596705165675392,1699457774996947448,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,861879449006637067,3051079836140209693,524288 --field-trial-handle=2672,i,5337596705165675392,1699457774996947448,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,2389672411672868954,14202224521106427020,524288 --field-trial-handle=2672,i,5337596705165675392,1699457774996947448,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,255267362946498948,8751075921619930231,524288 --field-trial-handle=2672,i,5337596705165675392,1699457774996947448,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,255267362946498948,8751075921619930231,524288 --field-trial-handle=2672,i,5337596705165675392,1699457774996947448,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:1212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,6194094012879382662,6637703885947393515,524288 --field-trial-handle=2672,i,5337596705165675392,1699457774996947448,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1136
        5⤵
        
        PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffc8753c188,0x7ffc8753c194,0x7ffc8753c1a0
        5⤵
        
        PID:3900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,5430041961881697151,9359559163906717972,524288 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,12305637338430786106,15309543590792648051,524288 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
        5⤵
        
        PID:2360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,750681913216453897,16072753788695660310,262144 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
        5⤵
        
        PID:4616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,2779865493855587479,8393323931923646199,524288 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
        5⤵
        
        PID:5380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,2779865493855587479,8393323931923646199,524288 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
        5⤵
        
        PID:5092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4908,i,10463246614564326136,4519709714304334656,2097152 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
        5⤵
        
        PID:3428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4916,i,8836669844653286126,6742471549096532930,2097152 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
        5⤵
        
        PID:1940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,15517810934814320233,4480481238383603974,524288 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
        5⤵
        
        PID:2172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,17328906091592622902,9013936517051366318,524288 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
        5⤵
        
        PID:1540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6136,i,11771776348544260868,14746120878372467624,2097152 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
        5⤵
        
        PID:5640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5000,i,12425887843720145343,12681496032282974983,2097152 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
        5⤵
        
        PID:892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,8895168344032468057,266580013682795137,524288 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
        5⤵
        
        PID:3892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,14057244843590856162,8989495655004886965,524288 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
        5⤵
        
        PID:1728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,290915360004975146,15535514684854220877,524288 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
        5⤵
        
        PID:5180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6216,i,12136241596768169796,17758393115010597406,2097152 --field-trial-handle=2176,i,12569911759289423555,16479158399496772103,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
        5⤵
        
        PID:332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5400
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffc8753c188,0x7ffc8753c194,0x7ffc8753c1a0
        6⤵
        
        PID:836
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,17407533231421376152,3223970703452075736,262144 --field-trial-handle=2124,i,16492395209465902895,5863238816125378499,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
        6⤵
        
        PID:4120
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,9279883834198405425,6119587869911182237,524288 --field-trial-handle=2124,i,16492395209465902895,5863238816125378499,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:5408
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,16408248472720157304,11902010051029249894,524288 --field-trial-handle=2124,i,16492395209465902895,5863238816125378499,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:13
        6⤵
        
        PID:1588
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,10304305011545357963,2025229525946736737,524288 --field-trial-handle=2124,i,16492395209465902895,5863238816125378499,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
        6⤵
        
        PID:988
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,10304305011545357963,2025229525946736737,524288 --field-trial-handle=2124,i,16492395209465902895,5863238816125378499,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
        6⤵
        
        PID:2416
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5004,i,13617738169102033833,5186120817582287594,2097152 --field-trial-handle=2124,i,16492395209465902895,5863238816125378499,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
        6⤵
        
        PID:1160
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5020,i,10076942983677532017,17025290024445493732,2097152 --field-trial-handle=2124,i,16492395209465902895,5863238816125378499,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
        6⤵
        
        PID:3004
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,7683293434660545307,11438955025969563873,524288 --field-trial-handle=2124,i,16492395209465902895,5863238816125378499,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
        6⤵
        
        PID:1712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,6456800409527355047,2205554579911161121,524288 --field-trial-handle=2124,i,16492395209465902895,5863238816125378499,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
        6⤵
        
        PID:5332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffc8753c188,0x7ffc8753c194,0x7ffc8753c1a0
        7⤵
        
        PID:1672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,18208579711754080709,7289440484643563783,524288 --field-trial-handle=2040,i,11366513720581362339,1192664018146913321,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:5560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1496,i,18173003539896298510,14714815227596738357,262144 --field-trial-handle=2040,i,11366513720581362339,1192664018146913321,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
        7⤵
        
        PID:5564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,9759945955655943550,523493358013746308,524288 --field-trial-handle=2040,i,11366513720581362339,1192664018146913321,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
        7⤵
        
        PID:3736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,5497475754717344719,16901515374329855665,524288 --field-trial-handle=2040,i,11366513720581362339,1192664018146913321,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
        7⤵
        
        PID:5336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,5497475754717344719,16901515374329855665,524288 --field-trial-handle=2040,i,11366513720581362339,1192664018146913321,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
        7⤵
        
        PID:892
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4964,i,9260856739397071374,6579923096013148845,2097152 --field-trial-handle=2040,i,11366513720581362339,1192664018146913321,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
        7⤵
        
        PID:5736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4968,i,12795087533684916218,14355156915265037517,2097152 --field-trial-handle=2040,i,11366513720581362339,1192664018146913321,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
        7⤵
        
        PID:3832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,6499942878214521204,11139401500073996333,524288 --field-trial-handle=2040,i,11366513720581362339,1192664018146913321,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
        7⤵
        
        PID:5252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,9663167834235137204,475518465161162010,524288 --field-trial-handle=2040,i,11366513720581362339,1192664018146913321,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
        7⤵
        
        PID:3612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,6017694801823186620,9494872576784378290,524288 --field-trial-handle=2040,i,11366513720581362339,1192664018146913321,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
        7⤵
        
        PID:5108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,6616944740354448387,965144371770966381,524288 --field-trial-handle=2040,i,11366513720581362339,1192664018146913321,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
        7⤵
        
        PID:488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,5648148436585070703,2447897895521663658,524288 --field-trial-handle=2040,i,11366513720581362339,1192664018146913321,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
        7⤵
        
        PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+buy+weed
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=g3t+r3kt
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus.exe
    3⤵
    PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4152

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 1c02e2feba3b2af3c045d1ed01f8a67e0923f7e357b32c434e567eef6aac4138
MD5 f05b0294ae4949feed0706bc80fa6418
SHA1 346bb7d2d99251c193652ad4ae7ef2964565b98d
SHA512 348366e162f3a037e74d0e9ff422ba7ca3e14c2b170f50bab2a4b88b29a572028e56965c332bc63cbe89de1a3467c215893ecf3cac514d786ec7ea30c08bcc05
SSDEEP 12:bHiUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:blRqxosfxWMk8xVZ4YWI30otWn
TLSH
T139257D85B34494FFC8C35A7189BD17903774F6DE5F42835B6A377A0E2E671D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92e71b18cc218fa24ad8435c60697e7c57264ec817aaf8090b0bca9ad3f8a047
MD5 835ff967c81c15a11558c1a16400fbcd
SHA1 e5f0b8ac3a5597c069467d7a91d51dce8c99c272
SHA512 397a165e13e51438c9b769a8b470df8fab625e008a92beacced95814d3fea839dbac6712589e7b7835dce92b2a1f1ba4cc38e4ff6c3b3cc02b585a6be2706853
TLSH
T117D01266374AB001E7698230E4C2C311266650E138864A01B214C81DA9A41E86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0a9b4cb216fa964221ef65cf80fae56894711f4ab9586163756f972d29f96517
MD5 c584641db98656737d881a668e4d4d25
SHA1 d7b621aa4c91156cbabc3b29170524107d9021d5
SHA512 cd754e71d0b5677eea1c282e49389b4262b00884f3cb3ad4e88df8465de7a8fb2640e6956f4262fd2701851d34e9b4f52e51068022d26fcd6d7b38adf609d7c7
TLSH
T115D01266374AB001EB698230E8D2C321266650E438864A01B214C81D99E41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c73ab19f92b0e80c015f7ae429eedd93ac6afb04ec0ded00d1d7ff36ff0beae9
MD5 554ecabc2e71f1c4e1e9308f71109904
SHA1 7619af9c3a84d92bbb4698eb8557d819454f6306
SHA512 d5d5b4ab48826fdd9b97876a05915c55ec62d3513cc8966f48ffd942c0cb02af82d070f0b7ed9196174486d885276b498d320182b61bd6592f89df50d650e48c
TLSH
T125D01266374AB001E7698270E4C2C311266650E038864A01B214D81D99A41D8A293186
MD5 SHA1 SHA512 TLSH

Submit Download

37c9bfdd-c152-4427-9f30-ce6d825666d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\37c9bfdd-c152-4427-9f30-ce6d825666d3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7e271233ef8da6c93a9972a1d4c9b8c3272249fb9c62b13985c095b4c2ac351c
MD5 c6d14ef23cd27ad90c4f04901cc34d95
SHA1 b895958586ba6b9cac50b7223a0bedcefd1f3dd7
SHA512 7708559569a1f760cede21cf4697833d6bc94dab077e13b9f68f4e4650dc18833df30846c55d2b08c508c08225590405c8929edf533b19f99b930765230a8ed1
TLSH
T188E02BA6CC229C2B18FE0B1974544745E74523273E41894F3B3D820C8FF463A069A92C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 6f98599f1670670793b9ecf08f704a627a67d9767d092d7a573f150d9afb1e33
MD5 c090648752febe5d71fc0b1ea6a13f45
SHA1 7dc5ca5b7190ec98b80c6e61cf4bfde06b0b4cc4
SHA512 d65c5c3ac6f7b8b449a1a8292cf115decea4cd8e3e1b2401a532dea5b5430eaeacc458c9f8edcb509426957d559beec2d94bd599e8c9a67858b44c68cd46c887
SSDEEP 384:lUAF0e0PfYEvjrEKPFbozYxkFtJ5IuHQ86YnyV:F+5PfzvjrxPF0sxOauHQS
TLSH
T1E213823E72494D5EEAC37D3C0A1B1A7427F9F861D6C2430733F1B2A9432AF46995EA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 6970a57fbcc24308c9d364bcbabeb50e31e514ee34b121a8fb676e779c0558c9
MD5 992e1e1cf3965c1fd6d861c079ea3cef
SHA1 b89d140083606c70ff2a7bc43faddbca52a37c54
SHA512 b638a45a04ce6fda458fec778fc67249d33b2f0f70704de3d69a6001e217289b267743bd58fb58fcc6da593d797f5a3be54efcf21668e29f5cd58e0059e49644
SSDEEP 1536:X6nkLeCJL/GyL/xzStZfZNND9xTYU71CL/rL/iA7hT/PdC3F8UfBuaIoIjXb/N:qcL/zL/piXqU70L/rL/xbC18UfMZ5Xh
TLSH
T1DB4470FB1851A01BCFA812F5E2033E3DD17B455D2CE1E9E9E67C0C952825F22B6BDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 ddc671ef976d0068fe2e773296bd396d49240eb55a9e3cf858378563d5f6298a
MD5 5976d0c541ee7eb9860c78c3874e8183
SHA1 201f312cacdfb84b5c695b6fd8ce09e6b7431f68
SHA512 fc717ca40cb81f4f2cce9314d6525e8f80ef3848982a435373da79aae7880a9bd148d3c15dcf0d7adc3a81b75bf1921d29c27a25f59631a6d671777e88413e61
SSDEEP 24576:Qwb6olBm8YHLJycM/mewHJEB7b6WzkBGSMAoOqq1k1Y+u4OpYGuIZnuprbF2:Qwe8YHLZTpEsW2GS9oOZe1BnTAu9
TLSH
T12D867DEDCA6898C3CD639930B1F0ED477C7413C3F595C1D68898C684026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ede137ca069db5989b9ec3c8a26bdcd6671cebd68b3ab3d8e6fc72cc72f734b3
MD5 39949e9cf85ea0ca12277fe6e152e068
SHA1 aec72a8aa0f36d858379634fd686eb7564552c99
SHA512 cbfc5ab568fcc79ae4d25763d129d7449cb697dcc079262c06b2b90e10bb120acdf165d4c6653bbe2d943c095deddbc01de489216bd0d7644ba17c63b479a7c7
TLSH
T1C8515D7576BC44AEF3933E70A98392937DE0708F79535D832ED0E8F1971AA221D51304
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 d7fe897eb5799230076ba17a232d9d85f354f449c1354a21af96d7ffa02bc6d8
MD5 9222bf5717f4cf34c5307388d364edc9
SHA1 6a117f598da9b789403e48f8364ba5a3936738a0
SHA512 3ec64bd96a939caf37c86247d652f52aa240871da5d6efc7a370295cdd4c95c1e456705f4eb34147bf67cae55bb5c296f4634371893353f064991594d683214d
TLSH
T135E0D8ADB5C6C55D7650758691249B4CC2C17493D6C5AE0317488CD4B683502F341E4B
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 e35049928e4f72669a36baec0df1b6b370f3f76a312c7b3aaa48a62d67e58c69
MD5 2ad4aea79ffb2d937806d367f0979462
SHA1 ae58b466f0e2ea563048ca9684a749e47767e9ab
SHA512 34aacaeb2c3de1457dfb5ecdf9627a8a9da0d4e8bae1ac5ff89e4196580e3371d11ae6ce6e1b89ceba3aa4c00861e43297d2d0b42c95ee67ebc7f16d6b43f372
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jUiW5LXK5fKFtIyqYpy:Tyi+7f+UZD4jJ/B7WxXCKFOyTpy
TLSH
T152E2CE8D3B12F912C8ED733DB0C2C6E15EBC6D2C4A4D7071523898768DA3A66F49E11A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 ed590615fa9064af6065a28e66c2127ca782b9995540a472b479e3a1f4407c97
MD5 ea175d2723413a5b4fafc0942ccded40
SHA1 5587875eb5fd07fdddeb3cbc7a0f014175b5e4b2
SHA512 e7a010b796316afee8d7a9e13ef43c9df65cf15ce979676dc17daeff22b75447711a0d0db130d026588a9c5fb07c56695e5011eda0422eb08d2f7a113fada806
TLSH
T137E0262C55C8C929D1946DDB8279630C86D33493A2C83F03278C8C48B281A4AE786B84
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 eb665e4aba93cd921a032907b9e075b8d41113e72fceef435934f3c591f814fb
MD5 42e9ab125ab761905fc147d5c7ca2f57
SHA1 d635975e5734916d79fbfc00832d0185377595bc
SHA512 8bedc1b32b15d2d6ddf02806be7fe5da10137ab0103b54c0b49196ef157d041f935d014bddad2b08173ca6258e3f4a795fd48070cf3735cff1f3eb25d1e971de
SSDEEP 96:xiHU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2juEbjBHMsDETbiIqOR:xi0+G83uxXBBK31GkSJHEJH7DNspUk
TLSH
T1D314E00E5F343722CDBD817669E644A35D6CF03FCB5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 0ce66b209fcc9d84c6292cb96c790a55c801c8a96623275c378ce92fd6d3fe12
MD5 0ddc81708de50a7176a6ba8e6bf0e39a
SHA1 b536189f9a7dd1ed48eb8d09de40f86ce73017a8
SHA512 9f7c55cd21e30e2a00d3c58581fc3ae21f9bac8369133ca2d4192ee652ae8596fa57eecae2836168b828be679f9a38e90face4b544dde5b82056842aaf0508ad
TLSH
T1F9E0D87896CDC5595244258B4225670CC7F2389BD6C82B016B489854F541514F7917C9
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 7f219023e96e23bd91f0b9ef7d87b62ec8f5ab4e330a1780e15efd39ca1eb39e
MD5 0bde2f6c444cba92b85a50ee7e2c28ee
SHA1 081d5ada3fddf195cd83f51dd68305b48c0cfe91
SHA512 fe41efab2e0a56bce14741bc76db94eab98b27f5f61608cd726886634ed870e75ddcf16681bac0a2eaa0380c635a0501c91c5d37da3ba20a29adb96ea4493208
SSDEEP 24:TL68LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T2SLopFMatSaw/auUOt8B
TLSH
T10E928C4E5F346220C0F04B36EDD189672F7C211CD3A72A99DE5410F3DE9259BF1055AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 87b5b58d1edd3c8ca6acec7e50b91a9afef0d082b59890bd0914a6318f76d486
MD5 2eb38a79ae2ecab146eac1810beb82ff
SHA1 27de3583729b4a97cd806b197900cc2f36686a86
SHA512 bedfbc209303e29f16ff168c503abd091032d5e10dc0a89ff89a6753c0dae338b137cf0b3618eb740e9fdd5c4c7c0a110d3b72c4105538be3b63afa0f64ce8fc
TLSH
T1B0218BF743B4856E9B11D6F0AA18AE2FDE6D0111432C7DA985E0AE27D3E3461E042B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 366b53175af5e23d49cd7d65eb32aa92f32d6a23d4ec4e746ce7f63bfdfae7e3
MD5 afe67e9be6f8464d1cd7bf54a51bc506
SHA1 ecb2659a26095e30503ec09fb0a5bbbe3ed38fc5
SHA512 0d9a4cd90d774c2e7a5c49aa9d318a9f534938e09cd3cc393e84ad14d1d510dda3cebc5a0e0614373cb5f2da6b6236ad191c67983a27120c8134478601dbfb14
TLSH
T1CA218BF743B4856E9B11D6F0AA18AE2FDE6D0111432C7DA985E0AE27D3E3461E042B5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 db9b0aabed4ed3e4ceb31087dcc7ca8542555c6e873d7faf9493a77a9fc8eedc
MD5 3cea0eed20fd337107f70deba884c9bb
SHA1 8601cda3b4baf6b453a761968f15251eb83b6078
SHA512 420c6e8e97960decab40ef86ed44d3da28da7c81df642b6c46dc6450f2345d6582fd52c6f9715059d15bf4691f212beea7660cf19e815c4ff380ad6a14c69fa1
SSDEEP 384:sxZMHYl/f0s7WvPQV7orc0sM/bM/5HWjTJm:sE4l/fTYPQ87/bu52c
TLSH
T11072F916A974597B9CCBD218FA457B93DBF8252391814E44AAFC8E1C01E77ED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2df21c42741b62fa8dd3c8b0ebb446a1b5a4f416d440d735e42d9e54eda6e4fd
MD5 3dc4ffa3bf1ba9ebd4aa65184b16d8c2
SHA1 85087f4413424b89d54ef49ac6ccd19295d3027c
SHA512 ab947c2643f10061762b5a88ac6102871d1e39e92d08f117f88b51d65919eda118acb05167b85525aa782f5982207a8e71d456f5c89ca34cd182ed1fafc4abd5
SSDEEP 384:sxZMsEl/f0s7IWvPpV7ord0sW/bG5EZJm:sEXl/fjIYPpZ3/bG5J
TLSH
T1C072F8166A3499379CCBD308FA557F93D6F9152392904E04AAFC8B0C00E7AED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 682733e3b904b259098bdc45e9da47590c2934e6f23086e25d607c561220e1b9
MD5 ca2fabd6b84a36246971111ae7185229
SHA1 34ec4f388f36786790b24feea399c34337278e18
SHA512 ff73f513a1d0287e72745791ac3bce7c3ce1fcf2b23ad9617044de5cc6a644f09e5d3a6caee0d07174da11e59b06dd6e9bf44bf92ec55bb6a6f47d1139592bd6
SSDEEP 384:sxZMB5l/f0sXfWvPQV7orc0sM/bM/5uTJm:sEXl/fPfYPQ87/bu57
TLSH
T13A72F816AA74597B9CCBD218FA457F93D6F8152392814E44AAFC8E1C01E77ED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 71af13b2744b10c9a92fc1aa77aad22f5ff6f167f4472b287a9173dbcc7715cf
MD5 ff1afa75b6516796ea6f5c360f4d3af7
SHA1 90baa89afeace101adf4b849d85a1a56c0d43366
SHA512 e435edb04ace8a91b992814a7de04055f0acd581ae85578e3ee64832f8faf436ff6645c3bac8ff870734db662b6c1dd5c93764a01461231fec0686530a144d03
SSDEEP 192:sxZDwRzyMqZjK1Ml8McYw/f4TsRpKQ7PgYsd05tzodpW/W6+WNGY0ZEu7fIgjJqJ:sxZMs0l/f0sRpV7ord0sW/bG5jjJm
TLSH
T17962F7166A3859779CCBD309FA457B93D6F9152392804E44AAFC8B0C04E6AED2217C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 04b723197f48e77fac4381fbb2210431a32172b87fb499246a46c937d4482f5a
MD5 411c6752f3a40646db5c18a82cc01f87
SHA1 df1b0414ee9c8f821811869962216b6e710f8cc2
SHA512 3c4bb141270622b734112c34729a495e4a2faf9781f38cfc0c4f21009da60eb842ed67d3bb69d58fb61795f300e34ef2856bc4a720fc67ded5669f7780966cb5
SSDEEP 384:sxZMBEl/f0sXfWvPpV7ord0sW/bG5KZJm:sEWl/fPfYPpZ3/bG5j
TLSH
T1B07209166A749977DCCBD209FA557F93D6F8152392904E44AAFC8B0C01E7AED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f1eeda05646007dfe9085d759ce0e3df58685261ca761a80bc5081a227201f57
MD5 ece0ad653820531e4f69e0dbad1d889b
SHA1 dd9bff3833537d3b6e264467f4d75daaa180f583
SHA512 c384321d7aeb516a5da785c6e04611a84b39d56c3d1a2eba2ae320ec60248ddeb1b5f5b1a514d2acbd178432636347dff939698d480b29e8f72ff3bc9120df00
SSDEEP 384:sxZM2Yl/f0sBcWvPQV7orc0sM/bM/5HW4TJm:sEZl/fpcYPQ87/bu529
TLSH
T19E72F916A974597B9CCBD218FA457B93DAF8152391814E44AAFC8F1C01E77ED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1fec3d325326953be547a691840d102421f60d83bbe92c74008c1bec89816ca6
MD5 bfb2781da198ea6a55469ef810a219cd
SHA1 a163f6740d807e0bf76b83dba5c4586c48bd0989
SHA512 22fe083df8d64ab24aabebeb40f020d7a53a6b9db316e8fd41efa0b6d99fab027492f667bfa30158bebe133dd658d658fff4ea6d4a7ca9a0c7f00923fddf79d1
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EGq9Lla:XwZh38Dv2SkEnZFWRm6GQFmu1jaKEGq6
TLSH
T13B030A3B280CCB7E4F844E9CED267F8AADE8028B56988D5447FA494C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 8c1cb6f3e245f88277ccb05d51d5a8619ba09c1ef9fce4274a6bc0015311bd47
MD5 e7f5222e75009e55d1f99617103c026f
SHA1 4d873a69b8e2dd43d3481511dff66e69aa551dfc
SHA512 125010e48cf0f5f39d6e9bfbc2f986e54a653fefc92cdcc1485a8a9bb8daaed1af70b29da0f946e10fa8e4b5c17d077fcd8e33d595431c8db3d98a7dd78ad3da
TLSH
T1FFE0D86C66C8C57D625B714B0124830CD2D6756BD2C83F022FC48859B683906B352640
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 716B
SHA256 113719010a464344b901f29f241f390f8fc4f023c488c56174f0725d5c61db69
MD5 9ffd547cd219c1ef336466afe938fbcd
SHA1 4c4f1aa4024761b44fdfc41ab546ae319f2dcc74
SHA512 980ff208e614d1b121e91241d52f24e80e5a2184487f01a5ded20d74372eec10805c4593d3bb9651aab3b59c9a8f7894bc8d3fd3243a1b6bb81e6e515ac3414d
TLSH
T11B0149E74A0964EBEC5EC3F41CA637B4A7B381CD068D8BC28E8C674324162323806C87
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 ac3681817bbec8c57be0d45849f4532d3bb3303fb5803a7505de9f9f10e839c0
MD5 90072cb0bcab828ab36384b512a37df8
SHA1 a5e1a8b7c7530f292dc60e0e0e4a01a21e1174ad
SHA512 c729f077fd6484f788dabd603e550b6305b6de5391944a478b51a34864c98349a90c625eb6db9f41c0b186f81e55db6ae9d305983b09f2431c3135cbedc36d0e
TLSH
T14CE0267C15C8C92D629065970234630CC3F2389BE3C82E421748C864E207906F3A6785
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 2c250330a791bd90d5bc18c7e6539bbe17f354470101508ceecc04123ae40273
MD5 13bceb8915f036d08af9a97de32a65cf
SHA1 e6b088926d6142a46d1038c25057ff424b6d8f09
SHA512 d6502fe650df967ae31dcec89cbe8fc9ddca56d21f9e29054e37bf63958d444337e75a15d37b736be8ab11bb28a59b15ee1289913d7077fd744ffa389cc459a6
TLSH
T162E0D87C76C9CA2A628A618F4224D70C81E3B653D6C82A123B4C945CA306541B383650
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 f665cc527e2c756502a08476e3eb10a1c00668bcef527adda6eb27de14de866d
MD5 07d7cc5b5596ec2190826c33e6be9f4c
SHA1 8bd5b72dbd8bab1b4f42e46c9a0ae5635d9348fe
SHA512 67f5383d4242e298299ced71e16cdca6e7fee81ad148d80577d73aafe49487e492b43096117d0e70028b2abcf52d2239aed02d889669c7b6198b74253f67d1cd
TLSH
T1FFE0207CA6C4CA396244A5CB42B4970C92F2799793C43F03674C4858FB02602F365E80
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 d0b3b075b8419388c69b3464df442e493b44203eb09129a06151bbbea31294f0
MD5 a57798e344d68e456582299cdd9b2ce3
SHA1 6770eb08ca6e64973fba60b5f5741d27041bf5ea
SHA512 25ea2d2019a88ad905bcdc57f516624782a0771c4529ec2dcb76dcba8ba690bf2bf8d7fac5f1fd749a90e6a457dafc9e75148d8e21d296e264ff9567704eeaf3
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjl1Ihv+jMy:ctGj+BCNC5qFVpKx1UvAl
TLSH
T1C7C2761632BA02023C3D791D87959B375A82B1733028E93B7BE954B64E6BE114DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5d92003e58ff531fb9a07220744801a0a108e927206411ee80c742c152cfcc19
MD5 a519295db149934bd15fd4d78dd90db2
SHA1 906c09e9bc3fc0a5c7489dd02fc5ee42e18aec78
SHA512 1cf459e2405392848b16da6668942d4c505d773e3ca325c8b8d8abf217858698284079c23ec494a1b0a323a4eca28651196c1c963cb6baa99534fdba639875c0
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjl1Ihv:ctGj+BCNC5qFVpKx1Uv
TLSH
T1C4B2791632BA02033C3DB91D87959B371A82B1633418E93B7BE954B64E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 37abba087623bb97b04ae81c4ea56d1db3acff479a60f6909ee212c5968303fb
MD5 65db0cc65391b9e0468938f1894ce890
SHA1 68c2a058a76c0596935610fc4cbc53532f42cc3b
SHA512 f55dbb80a9e3028acc3018ab443ec8360ca522af87087c465478ea0fcd37bcf3b35a419ec6c5069998ada53bdb57f9c6492f36b0aafafe556446ce5003f4b323
SSDEEP 192:FvoWPXoqGv4fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aSZGv4fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T17324640A7B747001EDE7D9725CB080771A3CB16ECF22A6915DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 bfd0a08d82afeac5dda10ca5686daa602ab6758fbfd812e14e6baa7c93c490a0
MD5 e5a84f6ab57a04b4567dadf3bcb14e0c
SHA1 343b79e6116ca75644cd4b573b8268ded03c3f79
SHA512 993a05762baf97c82edebc3d465b265c188dc9d135a4cd5a2b0d024843b22d2ccba1edf8d9f49b268d5c1dbd210807b9985d0e37c795ad3fe65fe7b07b186f91
TLSH
T1C35149C5A3E558456F89B941C31DA613F8E27E67250E6872335E44F44F88C2A4F2FD29
MD5 SHA1 SHA512 TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 112KB
SHA256 6c6e6af433b4099f66e28c1e67c95dec51d729b4bec1a8bae736c7eb7f66a082
MD5 177a4e135f80598012a1c7f0b20feb60
SHA1 1995302eda6eda72785101d2263ebc6ee8aea291
SHA512 5e1817d08eb021abff3558b4115ff89059e3fec080ef2540969461c993a1daa4a3c69976b0250586e00baec738afae960db41daee7f7fd82c2bcacdb25b1fa2d
SSDEEP 768:c40/tEUFRThP+IjWAqNerec98JQAqCk2zC23nFw0H0OvCrwbnXbWAvF1UBFqY05V:a0oSw0XjeD8LmYjLj
TLSH
T189B30FF76C0AD1A6DDCD92B4D41BEE8444730621C624E8E5AE3D08C37B79A02BF765C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 776fe406e8c246abe86243f4d055435df4dfff7bbc64acfdebcc89c18f2336b8
MD5 e6d1db32ca8e7ff7de30432666aab682
SHA1 2f481742f315d481ca1765b0daf53967d18a070b
SHA512 f294c8ac28992d4ef37c93b6f1a3677c1be4bd76cd58ecb0bb5c1f3f85bb2f7e9c7184037df60c2edb9c3155c1371bba74138d46ac7f024f0e2bca274ffb918d
SSDEEP 192:HeOQjAsvlrqxrsj5RLhFCA1BootQwsIIIgbgMIM3q7YcYfb:FQ8sNis/OotQwsIIIgbgMIM3qB2b
TLSH
T1455294692A061B3BD05F5FB703A947941BD989C2017732AD30662C8F8DF3A5786C91F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 2c9beb57a234af409445311902e2b5420aefb4c245fa825ffe9ae20db0dd94a1
MD5 baf29965b6c47836fb41b171275149b4
SHA1 75f232e5d74314b06adb47f14a57c77870654f59
SHA512 9fb2f4de8bf30eb19dd3e340b5a1c2b983bc1b86d150c19d8e9aaed10b5506593d7f051c5edefdc5a903d2c63aa11ead24ef13f4ff2b469d060ad15bac820609
TLSH
T1EAE02628FAC8C9AFA19525EBC138830CC2C33C53EAC82E063F4CC448E641549F7876C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 f0133e103c624453a6732ca95b9e4ca2f7f15b16699444b7a52ac89a1f8d39a6
MD5 e5d24f0158b3a0d449a3fa8ebf05718c
SHA1 21d8bc6c2ed1347dbd571b7c844a38efc30448d8
SHA512 cbc932deef35ae9882f8f437098ac3547b115db9f046a19c7f5c0310bee4ae384b8123d1b4ded81cb4d73483133c0c7ea549f39f1a467681b860fc53a0e38625
TLSH
T1C1216056F321C149E14E8A7EA12AAB361328E8029FFCED0F447920256D76F015E8F6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 560d43225651f5e8611ab975e06669bccd3e7f73e947f13d44610f2902dd1413
MD5 886f5aaa2bf29f0a20b9f8ef7c92c856
SHA1 9928db43c35a42688a401183a72c580a4fe5f6ec
SHA512 276dfe6b707f135e8ef9aba0bb8a65d26edccf742da244d1e20cb44e7ac868177fa6bd5a0b78794f7dab519c5644e3c7abbbaef39b06f5e4e11ee1441d3fdc7c
TLSH
T103E0D879B5C4C55F615029D74174974C82D33857EED43F022F488C4CA641546B746A41
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 9511df4a5126abdd1e0c45502838518be750e1aa9f0fd8e2be87c5c1dac99edd
MD5 57211637577cf2bd534f03b4e4a99235
SHA1 d8ab106643552a3befda7352ad6aef10ecf48bbe
SHA512 0c49818a0a0ccc28010010320f88fe2e6164410e9d90ca930a8d72bfecc14d8f6bcb8d68365a24f37cacee9f0d3bf3e85c988756a3109c4efefcf3b74c75c782
SSDEEP 3:MsEllllkEthXllkl2zEfl0k/:/M/xT02zQ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 33202e5d0b31cbed56479aed60260601684332be3cb344ec13fb3d4d55434df5
MD5 9d43c0ac3eec73531b404428388896bd
SHA1 10b5a7915cf85ffad9ccafc9dcc8a142b4aeb7bb
SHA512 ba331b49d3f736068ee80611ca6acb89f0ad636ccddf526cbaa1b21f37f498e079210be817a5736aee6e00b6b0de90ec7263edbd1d34ecafd1a614472441ddd1
SSDEEP 384:nEFiF0CcmyWCk8Nr8TUNTUlIRSrk6zqE1ifbAoC+qrVSPd2zYze4KV8p0Uxty/7o:3F/cpkAwgfB0oLAIP4zYzI8p0+
TLSH
T171C24A32EC99CAB7ECE74B98F64A3607DDE05263C68C9AD8D6DC1D4C009719D530BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d89280209fb8168d61008677fa35ab5afe80dc3f46f5badb9940a782261b66ed
MD5 55cb674fbff300bf03a98d79a3a4d7e5
SHA1 3a9c9c13c524ab886e5345d14d1314344b3fb401
SHA512 e0a04d06462248933b5797c7cb258325753dbecc8c1e6f03e31354c2208b87de845b23cbdf10419b280cb41339a05ddcdc12d310ab7f358d374bdbd48cbcfa68
SSDEEP 384:nCiF9CcmyWCs38NA8TUNTUlIxBrk6ovoF1ifbAoC+qrVSdS8e4KV8p0Uxty/7IgS:JFccps3Hwg4bo7oLAIdS8I8p0W
TLSH
T151B25C32EC99CABBECE70F99E74A7607DDE06267858C89D8DAD81D4D008719D134B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 43d5f89262dd01294c1c44b5d259bcdb78bc5946acdce572eae24a4d0960b31c
MD5 f7a4635276c825243fb6bdd36dbed61d
SHA1 1564bfb914bdfe214223078fdc1099ba137ed662
SHA512 9e54f65b6983df0fcab331003d3f2f34ad217a83f0fc0649a15c2864e56e0f5e878e6adc67671963f7a31b1a2e61e40620a1dbdb052292719866f0d66bcc1fd2
SSDEEP 384:nBiF9CcmyWCs38N58TUNTUlIxBrk6/C+x1ifbAoC+qrVSPd2zRhe4KV8p0Uxty/M:oFccps3ywg4z+XoLAIP4zRhI8p0W
TLSH
T1AEC25C32EC99CAB7ECE74F99EB4A7607DDE02267859889D8DAD81D4D008719D130BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4a6e9e5d038377088d506bb34a32880cf158b6c247c0c3e781d257f98b603c1c
MD5 710dff75c0dedb5c4cc3698d47da3d2e
SHA1 813b7c414e399ad323a7574cdd1f02c61fe8425c
SHA512 d16f4fd6d3353d888c3d5b6e48d599b713f36f4cd8a7543968d922f3b0549ab312629365bacf30f4e0cee87357be27bfa8c417afeece1d914cf3092e184522ec
SSDEEP 384:nkiF0CcmyWCg8NJ8TUNTUlIRDrk6V5E1ifbAoC+qrVSPd2za6We4KV8p0Uxty/73:/F/cpguwg2M0oLAIP4za6WI8p0N
TLSH
T1B0C24B32EC99CAB7ECE74B98F64A7607DDE05263C68C9AD8D6DC1D4C009719D530BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1264a4124b6226c7bb024b33dea8bd5fa79597f1aa87a656dda7be6bc05ab7dd
MD5 a512987d7d5e9167512211863cff2798
SHA1 6c413523f9fc2e9f456d6f397b99083d4c7b14a7
SHA512 6dc9c6427b9902b2f2557c52d3e955e334758c951bdb2c2a4f4e0985800125180c8ddbb61f1ba647e0d2ad983e1bc6224fdd57971246dc31fa1eae608a23baf6
SSDEEP 384:nkiF9CcmyWCF38Nd8TUNTUlIRwrk6XVE1ifbAoC+qrVSPd2zche4KV8p0Uxty/7x:/FccpF3iwgRs0oLAIP4zchI8p07
TLSH
T15CC24B32ECA9CAB7ECE74F99F74A7607DDE06163858889D8DAD81D4D008719D130BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 9664017cfd73dd747ad209f9978119362d0d7cdffe25e69d38845cb931c27f0f
MD5 e74f80430439cfd2280a586f888d5ec5
SHA1 5456f765f1935ed99577d258e1c2cffaaeaf1bce
SHA512 d42603f0884d48589605a74c919a5c4de1635e5ff8a32786ddb3d208ae4e2a738f2993b8be6a138656a8aa0930c5085f8fa88a5be9791fc06119441ce8ed50a6
SSDEEP 384:nEFiFBCcmyWCt8NJ8TUNTUlIRPrk6GoE1ifbAoC+qrVSPd2zSbWPQRAKRpHpne4V:3FIcptuwg2k0oLAIP4zS4hKRpJnI8p0a
TLSH
T1A9E23B79DC698A7FDCEE6F48A70E25129CE41237C5B88998D7D90F4D807718DF30A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 b4722496b3eb91c22abbdea44a2cc328c9ba388885c1bf7fc61ae3a043974df2
MD5 01da41662e64f80b3ec3d452f1995620
SHA1 181f5e33f587ef1a5054a18011d54209c33e928f
SHA512 78f548707a833590d102b9cd424e7d5661fd5ce7b87b363b466cd88447901532c4b0271866eb8abb9a2dad50e0ccabb3d90fd1c016f27afd0dc6d71ada7d8151
SSDEEP 768:3Fncpk/wg2z0oLAIP4zuPumTb4tGkI8p0/:YksJAzzy5M4kI8p0/
TLSH
T113E23939DC59CD7F98DE6B48A74E29129CE02137C5A889D8E7D80F0C907359CF74B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 32fbcbb06170dd46385c48fbd2ad22aa25ef19ae683a15c2a625d4716c6fa2c4
MD5 05a2f829f21a53fd22d447effdbe2a4a
SHA1 8b66f89f8d0872fee0298787b82a6bea79aaa308
SHA512 5d9f634e798e4d5745927533bf884cd3db7e259be4c129130532950d21f09bbf56585962b9b0e4b8797d2c10265b5f84035d23bb03ddf3d213d4d772b0576b44
SSDEEP 768:/FfcpgiwgRJ0oLAIP4zc5K8yuKRpJ3I8p07:ogOjAzzGWuKvJ3I8p07
TLSH
T1C2E23B71D895CEE7ACD28EC8AB06F5029CE45133C58C899CD6F97D7D209F1BD530A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 02e488c7957880ab7e759ed4026b7dc7b5bf404a6f124b20397ae9417bca13af
MD5 2227a3466bb52dd882df867035931adc
SHA1 51123625c684825d77bfffea462e0849a27d2193
SHA512 f4bf69715b7098ff63bbad65bb58dfa595e32b85a9de5c9fec520dd580f7de20bf7eaf7b789c5b5781a431c1516e636f030d7751a0b945da34aa9d75d8424816
SSDEEP 768:/FfcpgiwgRI0oLAIP4zc5K8yuKRpJ3I8p07:ogOIAzzGWuKvJ3I8p07
TLSH
T1ECE23B71D895CEE7ACD28EC8AB06F5029CE45233C58C899CD6F97D7D209F1BD530A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 89d09e300d8a6444040832d888ad40e1c2332e7bcabd08776658c861f31f96b5
MD5 5a517ab6c7972cd5e6031dbfab6d171b
SHA1 b951e01606d7638086731ac31b70274090169db7
SHA512 4e7806e836f07bb24429f19c45115ddb575fe5c9bdd9d1c76faddf4879de3fda3b0f41c52dde871132a3938164a810bd039102de493c3c166fcc9517eca28d3f
SSDEEP 3:MsEllllkEthXllkl2zEflpVK/l/:/M/xT02zBt/
TLSH
T1D1440404FFC00C0FC50510314055C3D03371FC100515575374D104335CDF7700C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 87B
SHA256 c7209c3eb51763e3139fa0a5e5a1d18b610932294b507ba5d043658e45953727
MD5 8e0265073c65dc7491c8b6eda0b62e0d
SHA1 b75642618bae1886d9c426b5183a13da6c21acd3
SHA512 45b190ca41357baa1dbdeff2b123d27428be4c2dd69cb88cb6070f5d6abe9a7728f47fa2844592b192c17961580225348aeb1ec270e161a7422c1a8b71a239d8
TLSH
T168B02447C473C00FF41440D1C45C03C114F4C047411DD0015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 1fddfac23ed8a0173985e07ad084ac59b34f5724826594b5de51be5e35f25651
MD5 fa3c66f2d231a26522634a792ba5cbfe
SHA1 d4ea101f4ed47ed921ab0da1ea43e540a8d91170
SHA512 5eec660fa922e97dfc2307f29f72ec2648399d043823224e18a9a8d0b911062f3b0a5c8b42fe30308006be8a828b715a84dea74908bed525143a8262cfa24130
SSDEEP 24:h4vC5fhqLo4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uw11n:5phqp/IHRH34kWqB1kQnjhHmr6ITmUA
TLSH
T1D342896EDA2CAAA2FEE00B3ED7D1D0127B36AA0EC2E4D5F1095B505747C540405DB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/892-782-0x0000015E6D060000-0x0000015E6E060000-memory.dmp

Download

memory/1212-224-0x0000020E62D50000-0x0000020E63D50000-memory.dmp

Download

memory/2416-666-0x000001CD97560000-0x000001CD98560000-memory.dmp

Download

memory/5092-380-0x000001B9D0390000-0x000001B9D1390000-memory.dmp

Download