53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2

Resubmissions

24/07/2026, 12:53

260724-p4sfaagc325

03/09/2024, 01:42

240903-b4rl4avdlc5

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
Size 896KB
Sample260724-p4sfaagc32
SHA256 53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2
MD5 ab347bcdf487791492fafe865eed030d
SHA1 367c691778cf2cb590581986c3fea87504455782
SHA512 9dde5f9126df93fef41fa9174a2d0ba01facac1746697282422c73f32a5d1fad6f8769d647d69403802069a0fe901baa5eecd5c0847c3191e8f4d545035b87b5
SSDEEP 12288:pqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTt:pqDEvCTbMWu7rQYlBQcBiT6rprG8ast
TLSH
T1E7159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_1108086301\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_289397326\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_289397326\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_1892604346\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_2120856817\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_1108086301\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_1892604346\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_1892604346\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3284_1892604346\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5800	msedge.exe
6152	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293712134970343"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{D19293F5-6F28-4AAF-9E69-B9A8718A8221}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{E3A94A7F-AB6B-43E1-A635-B459C7B3A6CB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
6504	msedge.exe
6504	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
1720	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
3284	msedge.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
3284	msedge.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3284	4484	53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe	88
PID 3284 wrote to memory of 1620	3284	msedge.exe	89
PID 3284 wrote to memory of 6004	3284	msedge.exe	90
PID 3284 wrote to memory of 5800	3284	msedge.exe	91
PID 3284 wrote to memory of 6004	3284	msedge.exe	90
PID 3284 wrote to memory of 6004	3284	msedge.exe	90
PID 3284 wrote to memory of 4524	3284	msedge.exe	92
PID 3284 wrote to memory of 4524	3284	msedge.exe	92
PID 3284 wrote to memory of 1308	3284	msedge.exe	114
PID 3284 wrote to memory of 1308	3284	msedge.exe	114
PID 3284 wrote to memory of 1308	3284	msedge.exe	114
PID 3284 wrote to memory of 2268	3284	msedge.exe	94
PID 3284 wrote to memory of 2268	3284	msedge.exe	94
PID 3284 wrote to memory of 2268	3284	msedge.exe	94
PID 3284 wrote to memory of 1092	3284	msedge.exe	95
PID 3284 wrote to memory of 1656	3284	msedge.exe	97
PID 3284 wrote to memory of 1160	3284	msedge.exe	99
PID 3284 wrote to memory of 5960	3284	msedge.exe	100
PID 3284 wrote to memory of 5752	3284	msedge.exe	98
PID 3284 wrote to memory of 5144	3284	msedge.exe	96
PID 3284 wrote to memory of 1092	3284	msedge.exe	95
PID 3284 wrote to memory of 1092	3284	msedge.exe	95
PID 3284 wrote to memory of 1656	3284	msedge.exe	97
PID 3284 wrote to memory of 1656	3284	msedge.exe	97
PID 3284 wrote to memory of 1160	3284	msedge.exe	99
PID 3284 wrote to memory of 1160	3284	msedge.exe	99
PID 3284 wrote to memory of 5960	3284	msedge.exe	100
PID 3284 wrote to memory of 5960	3284	msedge.exe	100
PID 3284 wrote to memory of 5752	3284	msedge.exe	98
PID 3284 wrote to memory of 5752	3284	msedge.exe	98
PID 3284 wrote to memory of 5144	3284	msedge.exe	96
PID 3284 wrote to memory of 5144	3284	msedge.exe	96
PID 3284 wrote to memory of 1480	3284	msedge.exe	101
PID 3284 wrote to memory of 4772	3284	msedge.exe	102
PID 3284 wrote to memory of 5600	3284	msedge.exe	103
PID 3284 wrote to memory of 2584	3284	msedge.exe	104
PID 3284 wrote to memory of 1480	3284	msedge.exe	101
PID 3284 wrote to memory of 1480	3284	msedge.exe	101
PID 3284 wrote to memory of 1120	3284	msedge.exe	105
PID 3284 wrote to memory of 4764	3284	msedge.exe	106
PID 3284 wrote to memory of 4772	3284	msedge.exe	102
PID 3284 wrote to memory of 4772	3284	msedge.exe	102
PID 3284 wrote to memory of 5600	3284	msedge.exe	103
PID 3284 wrote to memory of 5600	3284	msedge.exe	103
PID 3284 wrote to memory of 2584	3284	msedge.exe	104
PID 3284 wrote to memory of 2584	3284	msedge.exe	104
PID 3284 wrote to memory of 1120	3284	msedge.exe	105
PID 3284 wrote to memory of 1120	3284	msedge.exe	105
PID 3284 wrote to memory of 4764	3284	msedge.exe	106
PID 3284 wrote to memory of 2660	3284	msedge.exe	107
PID 3284 wrote to memory of 4764	3284	msedge.exe	106
PID 3284 wrote to memory of 2660	3284	msedge.exe	107
PID 3284 wrote to memory of 2660	3284	msedge.exe	107
PID 3284 wrote to memory of 1856	3284	msedge.exe	108
PID 3284 wrote to memory of 1856	3284	msedge.exe	108
PID 3284 wrote to memory of 1856	3284	msedge.exe	108
PID 3284 wrote to memory of 1696	3284	msedge.exe	109
PID 3284 wrote to memory of 1696	3284	msedge.exe	109
PID 3284 wrote to memory of 1696	3284	msedge.exe	109
PID 3284 wrote to memory of 1248	3284	msedge.exe	110
PID 3284 wrote to memory of 1248	3284	msedge.exe	110
PID 3284 wrote to memory of 1248	3284	msedge.exe	110
PID 3284 wrote to memory of 5200	3284	msedge.exe	113
PID 3284 wrote to memory of 1308	3284	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe
"C:\Users\Admin\AppData\Local\Temp\53aeb2fd2ee3a30d29afce4d852e4b33e96b0c473240691d6d63796caa3016f2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x2c4,0x7fffa13ac188,0x7fffa13ac194,0x7fffa13ac1a0
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,7741403798493267704,11680081146252472715,262144 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,14305990069865023392,3905256704979678706,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,3571879550157342217,7576105060937179273,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:13
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,2445535906080022167,18445554085368637434,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,6059159240137661250,15604283981872389168,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3932,i,10572788320668423888,16060779401532622295,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:9
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3920,i,15727944460760610493,12619807915347553418,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3952,i,12130566549179754703,10505452452105391242,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3996,i,9201224211749763156,2198246085202014507,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:9
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4036,i,12231730432341457376,6655473736149878365,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4048,i,5660113554777698294,13030204908165057231,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:9
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3992,i,1618959195285236324,14696762010207024634,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4100,i,18037606131004055787,9680141469911886248,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:9
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4416,i,6503494762320325376,17244723356057634359,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:9
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4816,i,222916865765656478,15021292513428798352,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:9
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4836,i,13305970838680954433,5863710156092933276,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:9
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=1648,i,15670514422177671508,14521317285780741135,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:9
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4796,i,7236797979005284738,1953776353549860208,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:9
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4184,i,7312091803682927970,3777412036205301506,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6324,i,874402720208719110,6610649076802758546,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5376,i,17669362476044237504,748453814736141399,2097152 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,8686569550014301285,10697518747534498173,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14
    3⤵
    - Modifies registry class
    PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3360,i,13705991143889652447,9660069070351261934,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:12
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,6908701063183748575,6139016554342292056,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:14
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,13103072075751752406,4072686130478143887,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:14
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7888,i,3350899990265945981,5857264276603326086,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:14
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7888,i,3350899990265945981,5857264276603326086,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:14
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,4169027942320379619,6366875876278479741,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
    3⤵
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,3037749103821400045,8121902750013138580,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
    3⤵
    PID:6444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,10995396760755482873,4755408813621550863,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:14
    3⤵
    PID:6404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7300,i,16427060046707979827,14466036364375502093,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,3124420221390380587,7443878855125129553,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8136,i,11235189382989265911,13741470575411194506,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
    3⤵
    PID:6484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5640,i,10294816708649122705,284538744971909357,262144 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7532,i,17078864777591314777,6262507150722725862,524288 --field-trial-handle=2228,i,368670314412800516,11815960201278639669,262144 --disable-features=TranslateUI --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:14
    3⤵
    PID:6652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x32c,0x7fffa13ac188,0x7fffa13ac194,0x7fffa13ac1a0
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,10879182581666342451,2641735723886860867,524288 --field-trial-handle=3104,i,10458351984132404197,10424290880398616152,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,14512508285284249519,3237734246407786282,262144 --field-trial-handle=3104,i,10458351984132404197,10424290880398616152,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:2
  2⤵
  PID:6164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,16652516440773771465,11067145196842062445,524288 --field-trial-handle=3104,i,10458351984132404197,10424290880398616152,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:13
  2⤵
  PID:6172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2908,i,12364275011357262123,202454287842715229,2097152 --field-trial-handle=3104,i,10458351984132404197,10424290880398616152,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:9
  2⤵
  PID:6180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 280B
SHA256 5be9218c6d87b4cb6e4b0badf0f2761d6fc88181243d1d43c20aeb0b59cbae43
MD5 e66a20e679aa56a91bd4c22646f21ca4
SHA1 5f7a566d93643d239b8bb72edf4332c0ba9bc3db
SHA512 8fa1bf43dc09ed240ed5f0a55d3de3d112c393cf22121362856b260c123583da0a9175d2810deaaf4f785c4c8c8bdb893142729b4933ad7940304a22b3d34a01
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 280B
SHA256 0084dc4efdd7e442ee024f496c7ddd778abfd1af98cc9c2061afd1f933e35d43
MD5 5f93a8256d0110f552ac0ff1a321b9ac
SHA1 cea13876aa34b84db2ce214d3c756736a8bddf67
SHA512 799b24baa9cc28b10032d1bc5c7934618d1f159be6aa9e08c691d4ff87293396fee9c0f524631c403f7b851cb2990c002a744ed3207c612f633bab5ef079f61d
TLSH
T161D02223B2CCC3A0C82F203B023002B280FCA83F280C000C2A3B00008FC282A28F328C
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

70931727-b685-483a-8b37-02bcfa6ef254.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\70931727-b685-483a-8b37-02bcfa6ef254.tmp
Size 24KB
SHA256 d5f2a531143930f5585a7ee0e16e338d06d9bb45014f020327580a4b02145929
MD5 d7f40bf42ed2497508a79b48cab3f028
SHA1 bb2e116ad61e6154f5b138dc3a70701718b1079e
SHA512 4f3631823e6d852c69b5c3c6cc811e086ca1876f874fc7e7303c9efbc589968293fcb53064d264f995412ff817b6b0e640cc4f3d07088dc4fe218d441071b7a0
SSDEEP 768:VcS6vCWDe2f828F1+UoAYDCx9Tuqh0VfUC9xbog/OVyGq80roDf5k2:VcS6vCWDe2f82u1jar/8fDxT
TLSH
T1F2B2EA2F604CCB7E8F804ADDEC16AF966D6C01CB9A548D444BFAD94C03C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 46e641228d8728f7519d749d65cadb305ca1d5cb1b166b168ad375c6c39f69f8
MD5 ddbf3e02b2aa7be5774dce012b6af3fb
SHA1 3964f03a102100b9be8f0fd668520391c9884f2b
SHA512 eb62be70e437536a46683a395fea63fb96757e0e490ad4e861774bd77bd19383b1f8d2c02db7318281fd950cbca38a943b14d3bb008a7cfcac0ebe471a587803
TLSH
T117E05E5F51C125D7FF2124B0DCA4BD8CFFC88671774433AF9165A49E44D31E66540C46
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f6ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index~RFe59f6ca.TMP
Size 48B
SHA256 8c2c3d22f7c87c283e8a5f06ec643ce8729c59f62ac9baab2e64008b60a4da4c
MD5 d7a93b71821e8791ae3ac74baac39aec
SHA1 bd9d18305fadc716f853f91056a29a76b778d27e
SHA512 d5e78800031c6b1d5252ad88274d5a8f54ca7f333391ed15d27d199081950919022d9fae22345a8eb28ffef7fdc1e84c54359537d2e859abc7961fff8e1918ad
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

77c46c14-914f-4503-9646-285d0d11071d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\77c46c14-914f-4503-9646-285d0d11071d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State
Size 1KB
SHA256 7114eb00dbb97484c125c604a081c3f1d4045d28283c8f2e437844853eb5c5f4
MD5 fe4200ef49278940926b25ad4a67859b
SHA1 4fe5a3f50be0cc9612fe9ba9f2eb383bd2765b79
SHA512 38a408b55a7224660641e11c840b96b9aca2a41ec7d3bfdfaa246cdf115cbf72a9a6c8ccff482d4025d9bf6f0240dee5fc1e476a82e0ef3b28afbd1baa01468f
TLSH
T146116AF7C3E585AE8D0156F06A14AE1BCE2C0512832C7C5989E4EF2B97E3475E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 8KB
SHA256 550fed40b63e08df808d508f3b486841374f981ef3779d58b5ea659cddffc9a1
MD5 ff7246d7756a60c851bcaadd10918af3
SHA1 d9219cd8ec3a4bbf5820ecd712b9a67d4e714666
SHA512 4868c439493be7af859e819c175f5fd286a5d5109d08e7d3c993a754359b4ecb445099206f51b6e0de2942787e299d585ddb9345d55bb8b39b8409ab8e88988f
SSDEEP 192:sxR/Rlv0/fgsMB8SzWuI0pY/gb+WNVdYOqhg7J:sxR/7v0/fgsMB8SzWAY/cVnN
TLSH
T1090295576E24A97B8CC7E15D7B257E03E2F55062A5C51E589BFCD60C08E7ACC230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 8KB
SHA256 7811891d4100d29917a34c8ee53c23b3ea314f28ea9d1cc86be9ad4d9ed5c994
MD5 c5ba0a7fe8ae62c3ba43d94b246a23a4
SHA1 3654bbe86aa0c6606cf58abe0a53a4103924b54f
SHA512 f02644d317bb52bcc525769f232ca915f4c51609a7c3c1ad3bb59799d6b0ec096429cc06a62339b50bca7b48159e3a36ed50ad4309c213c99e6b1579f0eae3ad
SSDEEP 192:sxR/Rlv0/fgsMB8SzWuI0pq/gb+WNVdY4qhg7J:sxR/7v0/fgsMB8SzWAq/cV5N
TLSH
T15002B6576E28A9378CC7E15DBB25BE03E2F55062A5C51E589BFCD60C08E79CC230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 8KB
SHA256 07184918093741b810f2a988e739ab0b4af358619d7def306fe4c5fb5297b3cb
MD5 bff8800fd052239c86fb1a60ab176c7c
SHA1 2dc0944bbaafd4024f6532123cdf54757836f1af
SHA512 d00a6588e79c2a6c065d3830f55c78e6ea3d8d777741cf94d2710e73e3fc775804bfd82b58a8c78ae5f96124a32ef51cb727dee64958ae388b3a2d83f3e386ce
SSDEEP 192:sxR/Rlv0/fgsMB8SWWuI0pY/gb+WNVdY+qhgJJ:sxR/7v0/fgsMB8SWWAY/cVZz
TLSH
T13002A6576E24A93B8CC7E15DBB25BE43E2F51062A5C51E589BFCD60C08DB6DC230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59f0fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe59f0fd.TMP
Size 8KB
SHA256 cd4d8f616134d26db5652d5d29912ca47b49b6db0bb63df5e9c1bd4375e9d56e
MD5 d9ad0eca813dd16d64c40217bcf20f7f
SHA1 dd55809d83fee1e56c9ff2e9b0ac395e11df98d4
SHA512 e72a44f3f3731d7807cd365ece8f640f21c7b887ec1de552bd0591dbd130081c21e817914c3aef719cb87fefed423bf244d5dfb2a3ba4661098d24d0b74cc5a1
SSDEEP 192:sxR/Rlv0/fgsjB8SWWuI0pY/gb+WNVdY+qhgJJ:sxR/7v0/fgsjB8SWWAY/cVZz
TLSH
T1B20295576E24A93B8CC7E15DBB25BE43E1F51062A5C51E589BFCD60C08DB5DC230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 38b44f21766b2bac390435cfbe468b2943e8116d3a7373c6493f1f55473cf5eb
MD5 8928aaf95afcca7bcfc75e89a2d3ac15
SHA1 7e4ec4c950d7fccead503f4d11cdf5194f54d677
SHA512 74473d64907ce7d417350d7a0a55f8fa5493e8c8e7e337ec0952111334fa6215bb7e3a27b8876716c380d6a2e2f3ecbba2203336e16f0f130f0635f4a93c3eb5
TLSH
T15BA0022755C89412EE1112B1D5823652379948259587571741A6809CD8D7DE85265802
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f766.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index~RFe59f766.TMP
Size 48B
SHA256 6368eee02d9ecb96502e0d97a6016974ab7c23e4b77d591dde5bf69aa979fc5d
MD5 ca14cd08d40c25fd1e200f304b09af6b
SHA1 3c4e7413c8884c005fc2609f003614d81fbb8094
SHA512 9d5be5e5b1885cdec79cc04d6f06dc2edd0a5868f057f534737978307ace4de91d895b0c4a888d8f95c14ddc6d755d53f439192efbe52b87fa2bce276752b321
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

e1983701-e71e-4651-a7e6-c2e78d52c792.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Edge Cloud Config\e1983701-e71e-4651-a7e6-c2e78d52c792.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 15KB
SHA256 f6a6a26b494351277d705f3c2706062d42ccae587121ce737f1877df1ec87538
MD5 dc215df3cc2894b436af3f278caccda1
SHA1 ea07f97fc9a9ebd3d2c32c5e42ef17e3a2cdbeed
SHA512 460d4230a18684037d8fbad3ec97e3c212009a3f545d7e122139559d28f91cd8f4621a41f33bbbec628fd8baf9dddaef06166c79d6d19f0920baecfcee2afa48
SSDEEP 192:uu6m+xasuheOwQxMd8NsexoWIASocDUucaxyDiIsXSH4+UU83s4Z2IqqBqM+Gpl5:n5ZcIq8NseJI7VxeP6+wvDm4vG3e
TLSH
T101628D721C312867A9F6DE81F6452A135FF8A07BE5E06E94DEECDB0D04A72991307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 60KB
SHA256 6498195aa0190844f89bac6efdcce0bc24159a1d35de02fa531387ce4b9a3d85
MD5 64bde142819062f4fbdbd0b54992d7fb
SHA1 8c2a83cc001e3d0fd9f4e984b64aa1ae29b7d5d3
SHA512 f8ab7a4e407adfffb95c5b6f6621f1f57b93c5b4214fe934afb0619e33f10e59099ca5aea685fec50a69b2dc98b4dd1f262fd30974cc0c984aed4e3702e9623b
SSDEEP 768:yFQM6wg/xrgwR1aLW63sYTnIftD7nxaGv/aab+WrGFI7WXPpjbJIQxA/i96L+wr:JMeEWk3dEDAG7iWrGFICxhIWQ1L+wr
TLSH
T13053BE7ADC51DA7E58FEAB94A60EA52749B44073C5B849D8CFE46F0D80B328CB346C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 15KB
SHA256 fcb08725b59ec2eb25eb3c1f44787350f577b3bea7f35722210cdca8deff24ad
MD5 d3838b26a5b41c5f199f663b0ae79a95
SHA1 49a2e86bd5b4ce5b18955261de3740c8d15a39b5
SHA512 78ed59c2dfadb38bc3bf27874069cc3970cae5cb77edd213b9b4b873283001fe2a00a8b8861b3df3d792b64bd56fda9fe7f28793c5a73cf390e4bf499ce0ef82
SSDEEP 192:uu6m+xasuheOwQxM88NsexoWIANocDUucaxyDiIsXSH4+UU83s4Z2IqqBqM+Gpl5:n5ZcID8NseJIMVxeP6+wvDm4vG3e
TLSH
T17B629E721C312867A9F6DE81F6452A135FF8A07BE5E07E94DEECDB0D04A72991307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 15KB
SHA256 b2b251a6c7291a10cdcecc8c3f9150c53ef4598406ec8fbb7b0d1112e277acb1
MD5 47776ff03b64ab3aa90576327853f7c2
SHA1 d7e251d214d739b9b7378835628ce0fc12f76dc3
SHA512 e15bf0c77dcdf978a09daa2c9fefb4e32eff4d525422dbd77c60a209a91eb250b45f08b12d449a51ef0c39e687ee8dda2ea7e1dcb62dd9ad9a504e9c8c0a9e6f
SSDEEP 192:uujm+xasuheOwQxMN8Ns1xoWIAuocDUucaxyDiIsXSH4+UU83s4Z2IqqBqM+Gpl5:nAZcIW8Ns1JI/VxeP6+wvDm4vG3e
TLSH
T138628E721C312C6799F6EE81F6452A135FF8A07BE5D06E94DEECDB0D04A72991307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 4KB
SHA256 6c2495f8da9f3122aceb2aae02c595607f785232a7f5c12a3f0e6b33e01e6f71
MD5 960d842b921a27ffb9d9599e156a8cc9
SHA1 76de04de9fae1c1c249535078ef4649cab8aabdc
SHA512 10af7aa50795235d3df0beb4df8d63e330b1b9db7beb2553d52e765ccd9ef33dac939c9d7b93f80771e5d91482bc1c1c559b2bdabdfd9ec973198f923ea9a4dc
SSDEEP 96:RqGNkwsIMff6UxcODkb1XlqDDNBZ+vt95s0x4UOwEmpq4a:YGNfH+oWKaTY5sXSK
TLSH
T12281A67368247CB7EBF25F81B5063A139F78316BD9626F94EED8221C08D75581306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 5KB
SHA256 7ceaa9ba3f552f93d65e0c18382cd752060c25f8457326d4751ed48c5e376fa3
MD5 2003c1344bd962f71ba6bb05ef306466
SHA1 73ad268bf274130b45e095d5af9737a01b68a041
SHA512 9efe839cbae4bb30838f784566da168486d1aaed8565bbab1dcc698a8840d79b38b5c2e988e35bff48d04efe96db466c38ee4c0210750e32dfdc1a88b9f9361d
SSDEEP 96:RqGNkjQsjpff6UxcODkb58Frh/cInURcDotovK2SDDOBZ+vt95s0x4UOwEmpq4a:YGNb6xoWHocDUwkuY5sXSK
TLSH
T112B1A7366874AC779FF29E81B5463713AFB4213BD5957F98DED81A0C08D72481346833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 19KB
SHA256 2f39820f73f5a4eb88585379867d9fe56f13957fa7810a90813b2f3b1760a7d0
MD5 197b14ada3137e74153b59294a932fa0
SHA1 3a5e40386c59e1668d6c5db9c8a5fc02fca15e37
SHA512 395a7f608eb95261d3142bc07d377bed43299cae4650468e736f4b39e19b3bb356e97ea5812d72b73a055e6a6da37356ee51dcfd0337f6d8e9ecf0d1364d8111
SSDEEP 384:nIZcI98ND1JIuVxec3PIzF96++wvDm4vG3e:29YxZ/i96++wr
TLSH
T16D924A7D5C219D3E44FEB744B68D2A261DB8907BD9B0AE6CDBD89B0CC072658F306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59a32c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RFe59a32c.TMP
Size 1KB
SHA256 d5c0f6840831aa9b4000ff1e71a95a5b4830da6f51222876bc332211d7773a3d
MD5 6fa91fee23f1e5ba31106928c879b8f0
SHA1 ea8489e340c4f996e01b727ff8ffb6ec55e1ca7c
SHA512 7ef374749f94826d4224b1836eb108d7644432e079f71872546ecab8f091e9b4ecf82944932f6338ca58a0ad214f368d97a6859ec830b679ce9c89e89494bd01
TLSH
T12731A87768982C73FC625282B2457B572E343176D5529BCC69EC560C05D758C232FC37
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f07d470b-e650-4167-a164-73f61ee4afe4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\f07d470b-e650-4167-a164-73f61ee4afe4.tmp
Size 15KB
SHA256 15a6d68f9ffe9f16a824779236f954bfa664c4e108adb524237437a0d9060c9d
MD5 14378d803197e6877b64c69a13b6af8c
SHA1 aaa36b8ee8e82734c445f182dfb69b9f762b56b7
SHA512 f1270971b3f0d6c421d5f401f0b50463d1a5c5193f6e6da54d2b1e9df16ba942fc7f1982e5afd97404292b3a1dbd7812108afc91f5c79cc2fadb62678109a49a
SSDEEP 192:uujm+xasuheOwQxM48Ns1xoWIAEocDUucaxyDiIsXSH4+UU83s4Z2IqqBqM+Gpl5:nAZcID8Ns1JI9VxeP6+wvDm4vG3e
TLSH
T1DC628E721C312C67A9F6EE81F6452A135FF8A07BE5D06E94DEECDB0D04A72991307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87dc969e-bd7e-4ace-9f99-f7bebbdc4566.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\87dc969e-bd7e-4ace-9f99-f7bebbdc4566.tmp
Size 38KB
SHA256 cd6ff85ac1c435b2e317adfdfee1c6043e70b7f7ca87832b1446e7d879436450
MD5 4d7591f051ee2aedbdb72e58de41b3a2
SHA1 8fdca63e625935873b94e81fdcc3ca7f2c76a0e3
SHA512 470f37ba2b352a23868b38fe19f2b71f4f2669c9bc79d62e1ae1cbe34f1323e9f6853126f064bd30d80625280f63fb19748dde27e1621ef4532ebe3cebd411e2
SSDEEP 768:6rv+4UNbds32jDZIO0khnNzc4ReyIsXZeVH1S5D:6bsbS3ENtc44bsJEH1Y
TLSH
T1A303CF33AC688977ACF69685B14B76133EF89127C2981E94C9DE5F0C4A4B5ED130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

6e08d29a-1900-4cbf-a451-9ac9993979ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6e08d29a-1900-4cbf-a451-9ac9993979ea.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5d388ecc1fde115980ec2fe760c97dd709cbd174ba7a6b17a3c6ec2a21a98e4f
MD5 c550c50c11ffc2d8439e941536a6a5de
SHA1 1cc477b1099c7e54cae4532fc5848d3a99947f1f
SHA512 563344c005542b55b67c0ba83bd13cf6bb93a55849965e510fbd2b1dfc1f3165038f71131b2572a4325d717f563543290b731954ba436980f09e243b374d6db0
SSDEEP 192:sxREr5gsdprQ5c3oVg/g6+WNIYnnwbqPIgEJ:sxRElgsdH/5IMwwI
TLSH
T1CE2296166D28A83B5CCBD25DFB55BF53D6F9603261D46A48AAFC8B0C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 06b010fd80ac7204dde47e66d607dfb87b7492fc6ed546acdbffbd251af1d602
MD5 3904cd63041516d6b145cd68c8981272
SHA1 06ae7a2fd6b82c03427f1cf72391f5a040b5b0f1
SHA512 313f4a4e06844b7ea528eb97c5e4c37770ca46f6cc9628833059e33eadf10ce1d19ff1100e2dd1b3daafb3db9c94307578ee04bd7e5e8345bfa9879584fcee4a
SSDEEP 768:wb8dpg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUu4Owroh1kh5D:wb8dpsE7r6Wgouf6Mu1jatVObQ5
TLSH
T1CFC2DA7B740CCB7E4F800ADDE819BE9F6DA802CB5AD8CD4447FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f513283b531c2254de97ce3065e426bd6b2eb1e6a43acc0e710ec8ffc1f810bd
MD5 968842c5fc9964e908dceaed4f113017
SHA1 474575b0ff9a77815b8aedec26a96a04935d9d28
SHA512 3a0cffae67946b315a75698191a793a75c03f1a5331d708738f34c5c0c8b2a190a4c3f1e6a6cfad71507e43d652a406b932c50a87988d52b7620a89a85939d8b
SSDEEP 768:Grv+4UNbds30eDZIO0khDrNzc4ReyIs2aeVH1S5s:GbsbS3dtrtc44bsREH1b
TLSH
T1E803CF32A8688973ECF69B86F1477A533FF8615B82D41E94C9D95F4C4A471DD031B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 f09c31c0de40b42bb1a0546afdc97b14a5a44bd2e26e95aa3c135eee339479bf
MD5 46d3d8fd94beb7858837b6d4de591608
SHA1 f162eee5142fb9f3407e5b4400923047c9af4f6c
SHA512 d4e537018c83801ce8bb38647a038f0d5175607a7ae4dda2ba3d12d35105b519d717cea5546293fcc9bcc94aea135dcca3b6c7e91dd17da8219a23790934a64b
TLSH
T12481DE009FD21E1BF2F7EE7256727720BF37B9499D048A4D048952091C72B4499ADFE3
MD5 SHA1 SHA512 TLSH

Submit Download