hxxps://alphacephei[.]com/vosk/models/

Analysis

user interaction
yes
max time kernel
598s
max time network
466s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://alphacephei.com/vosk/models/
Sample260728-krm8kseq3t

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7140	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297022349870527"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{6EA5375E-1619-44CC-AEC1-3774B73F95B7}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe
120	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4208	OpenWith.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 120 wrote to memory of 5408	120	msedge.exe	90
PID 120 wrote to memory of 3336	120	msedge.exe	92
PID 120 wrote to memory of 7140	120	msedge.exe	93
PID 120 wrote to memory of 3336	120	msedge.exe	92
PID 120 wrote to memory of 3336	120	msedge.exe	92
PID 120 wrote to memory of 5056	120	msedge.exe	94
PID 120 wrote to memory of 5056	120	msedge.exe	94
PID 120 wrote to memory of 3708	120	msedge.exe	96
PID 120 wrote to memory of 6780	120	msedge.exe	95
PID 120 wrote to memory of 3708	120	msedge.exe	96
PID 120 wrote to memory of 3708	120	msedge.exe	96
PID 120 wrote to memory of 6780	120	msedge.exe	95
PID 120 wrote to memory of 6780	120	msedge.exe	95
PID 120 wrote to memory of 1368	120	msedge.exe	97
PID 120 wrote to memory of 4140	120	msedge.exe	98
PID 120 wrote to memory of 1368	120	msedge.exe	97
PID 120 wrote to memory of 4140	120	msedge.exe	98
PID 120 wrote to memory of 4608	120	msedge.exe	100
PID 120 wrote to memory of 2248	120	msedge.exe	104
PID 120 wrote to memory of 5936	120	msedge.exe	105
PID 120 wrote to memory of 2292	120	msedge.exe	106
PID 120 wrote to memory of 3840	120	msedge.exe	107
PID 120 wrote to memory of 3840	120	msedge.exe	107
PID 120 wrote to memory of 4384	120	msedge.exe	108
PID 120 wrote to memory of 4384	120	msedge.exe	108
PID 120 wrote to memory of 4384	120	msedge.exe	108
PID 120 wrote to memory of 2016	120	msedge.exe	109
PID 120 wrote to memory of 3476	120	msedge.exe	112
PID 120 wrote to memory of 3476	120	msedge.exe	112
PID 120 wrote to memory of 5756	120	msedge.exe	115
PID 120 wrote to memory of 5756	120	msedge.exe	115
PID 120 wrote to memory of 2988	120	msedge.exe	116
PID 120 wrote to memory of 1828	120	msedge.exe	117
PID 120 wrote to memory of 1828	120	msedge.exe	117
PID 120 wrote to memory of 5844	120	msedge.exe	118
PID 120 wrote to memory of 5844	120	msedge.exe	118
PID 120 wrote to memory of 5400	120	msedge.exe	126
PID 120 wrote to memory of 5400	120	msedge.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://alphacephei.com/vosk/models/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff987b6c188,0x7ff987b6c194,0x7ff987b6c1a0
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,8993039017197841615,13430069754571554419,262144 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,967495159732677058,2574217737696574122,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:7140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,4785953253692364350,8575841565306671766,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,17178842312123277526,15491426839216959287,2097152 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:6780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,11671945446012827575,7493858310949554435,2097152 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,17912757377516516856,2885095266875575110,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,1008382547287269208,159289710351013043,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,17100479843745003087,669261058057022981,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,17100479843745003087,669261058057022981,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,11914587831274793719,10104681228756537906,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,10448254792906178049,3953344138781812172,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,11468053978730310921,7073958619061053655,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,1130159854143252227,14567162054929767554,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6504,i,8657562411338875690,13580446207392381357,2097152 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,14174404756607915605,9234571987504097210,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7236,i,12966411438284134625,3408839758278437585,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:14
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,15281821364092984702,2534495327475056462,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6300,i,2312122103914819839,5589074713326120077,262144 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,1622466417833624571,4707138983603512597,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:14
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3128,i,7674592943080888356,14452313959602360788,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,17444585527980643044,14805733214722383559,524288 --field-trial-handle=2584,i,5713442257269233085,15057501062274016043,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:5400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5048

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8e547cdf-5f35-4306-b3de-2773aa91666b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8e547cdf-5f35-4306-b3de-2773aa91666b.tmp
Size 392B
SHA256 272338d2e9875f1acf00f818eed684ac1acdb83f79da3f000e78188c891c7f3a
MD5 25af3ac17925c4429e0ca656e297ef49
SHA1 ee9191cfeedbebd66acc7b742c1272cbf775a218
SHA512 98b6e3c8c01820a0ce417c238be50dbf0ccf511be079b2c8bd2de5b2456d15598c0419925534c334f9732d35b5006823beab4e02065db214fd542df3818d3da8
TLSH
T194E00203970410D3C015033040D32F403BB39431129643458E2005685D713006C20500
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 fc2e093630c4e75637467d0735c5f0cb8afdba4786acab9a2cff142396147fe2
MD5 79b1796437213333d5f2efeb0a2569b1
SHA1 ec2953138f1bdf3af68f9ca6504ff5c82465ca39
SHA512 89af33c8a8edffd8a8360b69ed986eec2c6d0e453354f8878ff9d95ad89b620e62bf01c6dc2c90b3be5346e3e938954c380ec74fbc55f91e1bf59d9da3892beb
TLSH
T165E026CA6293C3A4020396C78448DB9DC192FF47E38CAF99324CF0AC288300253711E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 187faee1554393c8dd659cc00804e256eac09ec183cfc6c1768505b8eb64808f
MD5 a9a88762b4a6627e814f7d05aa80cb26
SHA1 808cc140f1f8ca6c1f497f1199fc64213cf3049d
SHA512 ebc3a69252ab21c832e18bed4bf6b507384380f26ae7e90938a2f33f7042e54b9aa976d96b1f50a4a06a12cd8790b5f778af2f76d35e8d5c5792ba25852e6a9d
TLSH
T103E026C918CCC2EE931065C74178434CD2823B0B97CC6D6A2708889C7042988BBA2698
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 ed9213056ae74bab1723509a60f5bff2d26eb586bac34d2fd71f1ce6e2853860
MD5 a743c3d6de41ca00ccb2cafd2fb5884f
SHA1 f457b825e75a96a9d306a3be49238c0b20ec0e44
SHA512 7edb56dd603f7d38bf5dc4235910af5ad8db833164905db50591542be6a6f2b5ddc6d59e79a0b535a1ab59473a1802e677bd8870886ae79d59bdbf14a68a774d
TLSH
T1B7D0C2A8A8ECA94ED6E409BE97A5F0100F6402820416DA120160F9C136A52E41BAA020
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 0c5b609dad4bd4b560eba3e90d47b36301d272bce6cdac13a8cd3c41d0eaad49
MD5 703602a2a7a634ddabbcf0d7917680c0
SHA1 47df62f8ddceb79bcae3a66150b3be494428c759
SHA512 b84d71ab70cbf53491e9341d5b3d6cba86bd86f33ebf34c28695b5236097910f88b83f78014fd70ec385c3173914eaf6b278a321508b6f691564e3b710767bda
TLSH
T1EBF0F9A6D921EC3719FC1B1860640B47E750132B3B41989F7B3C921C4FB163B474A81C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 16a7ef5ea4b7ba0c68170aa1294a2783c78b80112a3fc37eac7e170154ea5ffd
MD5 25bc143642c238ab2858ffc9697ac060
SHA1 0899442e09d0869928a0cfd522970a4f0fb30b2e
SHA512 97899fc7da4b1544a69a3641a0bbb2cb07b7087a1a90166cddf01873a5499077433b2c79a80a1c9ffa8dca953dc8b1b1db4965b0d5221c426c9657b342bfd1ac
TLSH
T1A16181A0036B6EF2D36046F23DFDAE6872308E68134F1EE6D290D17655EE36A12F1D10
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a36ff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a36ff.TMP
Size 3KB
SHA256 d05fd5a07e22413408b9f352e15266e76552219c44bae9c227fc097a3eaa43dc
MD5 a8373ea7dbc16d56b47f91b80c9fa236
SHA1 8651c55d4d4a1edd47cb618d07ed1547b332ea0e
SHA512 3c8e837e5a74b2a178f11acb8ebe2f2995f4f6e1d31d8b3e8a484d05fd7c9e685f78db993f83334558ea7e6c6beb131a30b6ca364db33c28b79ce62ad7ca5e45
TLSH
T1D4615EA003AB6EF1D36086B23DFDAE6832348C69174F2EE6D150D17695EE72862F1D11
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

7cac3c0f-83c5-4ec8-afa2-d225d73a18f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7cac3c0f-83c5-4ec8-afa2-d225d73a18f4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6ed9d469c9b08239d618622cfe528b929aa15ca9c2088958be90bc066bb9765c
MD5 c06d4cc2ad1fb3fcd82d8176b5d0478e
SHA1 1780ad7d9f8a0597229573ae527b806db97c8147
SHA512 912d8b8f79b90e262bae4e6dd5a1b1e85e10538e5130720ef91636692227e5284c5054adc28ed798ef105f56a20a50982c6a152ee49b358a24601120ddecdd8e
SSDEEP 96:D1CO3K+SKaVcaij6yzBWBxKFlwASCxwNGj4/3:D1B37SKaVcaij6y1uxK3wASskGj4v
TLSH
T1F7817DF787F4896EC91291F1E614BE2FCF2D0514532C3D6A89E49F57A3E2071E141A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 65bd14940fa1dd2acb39978f2646114de8c36235f3c22fe447b1358d32e63b3a
MD5 597d5cd623346b39b0f12ed2c0aef4ca
SHA1 3b2082963ebea7f185a0173013dc294ac63fb59d
SHA512 9142a203b47e9072c4024a5592e925c90aebc2d66eec9720cc69c3e0d6d614d73af0a9ac71f59f8dd823bfc2a3aad89df9ecf9a83773390365752aa222cbf20c
SSDEEP 96:D1COKb+KaVcaij6yz7GWBxKFlwdL1A+CA:D1BKCKaVcaij6yPGuxK3UL1A+r
TLSH
T165918EF783E4C96EC91291F5EA14BE2FCF2D0914532C3D5A89E49F4BA3E2471E141A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 88b2fbf5d93e494644467c41f335f6fb1afb1928aaaab3d9090be6c07bd48b85
MD5 d78c925e6302a1def84136629966e65f
SHA1 b261f128bbebae946010fb98d72b3ae144b3ff58
SHA512 ec63a0d78d9ef31740596b5e8e5b2cfea3b684e815dbbd388388262f50d93c2e4bc3698d279c7ff9adc5d2c97795b6b301c90e714417da8bee92db197b1784fe
SSDEEP 192:sxRmRYyMqZjK1Ml8wbw/flsDANRZ5yzoD8pZ5/g6+WNfAJ/YcCsC9sGQSGrrIgjF:sxRmZlw/flsDAN/5uj/5s/Ws2sGQVjjF
TLSH
T13E62D8166A789D7B8CDBD209FA557F93D2F81533A1945E04AAFCCA0C04E67EC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 97907dfbb9c35a398d345a2759350f6d13c39bd8e5210bb6f3287ad4eae3c5e2
MD5 832fc0f048b50985bbb9f51434993401
SHA1 45298653dee7ea8ac685cc6f02ce9d8b0ca05cf7
SHA512 11c10d5695cf02d1ab934cd747f42f46c91c3fa122f6170416d92756cd2f1629fc172e644a19d26b7fab4d07d905b1446fdc3789310716854bfd15e525f31e2a
SSDEEP 384:sxRmZqaw/flsZ+N/8ul/5fdWh3sGQVjOF:saAaw/fKM3/5FWh3sGQVO
TLSH
T10072D816A978997B8CDBD209FA957F93D2F81563A1945E44A6FCCB0C04E67EC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d2affee3d19654fa8e8cc4c7a7e61e368b7a901f389c32f39efef175a71bf6f4
MD5 ab69a8a0687b08d3302d11e080c3197d
SHA1 424dfc1b193f9041b21090e3ba348441df11209e
SHA512 f4ad496dc27f43313c906099932b393d6e3a38224dd77e7e4997aeb4feca75f35b0245f158cb7e4687e942e55c79f0bd058479563f93f535051dca420e38568a
SSDEEP 192:sxRmRYyMqZjK1Ml8wOw/flsZ+NRZ8yzoD8pZi4/g6+WNfHXdYcCheQ9sGQSGrrIN:sxRmZIw/flsZ+N/8ul/5fdWh3sGQVjOF
TLSH
T1F772D916A9789D7B8CDBD209FA957F93D2F81523A1945E44A6FCCB0C04E67EC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a4d4b6d728dfc7c536d3d6bcb19fad00638687f76418bbc84d9bf210e4905258
MD5 6f39294cf14ca60e275cfa7cc5358dd1
SHA1 20656405029fa7fa9cb6192130afd97c5fbdfec0
SHA512 c22d3054358983bd8c5a7a39c9e261ba1ef2eb198577010a99472ce441058e643759d9b93918b82c166c1c587eb5437c044cca436c27dbfc7511dad19230e500
SSDEEP 768:Ob4YATWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBbDwzroT4z:Ob4YATWg1NfwBu1jasHwAUz
TLSH
T142C2EB2B244CCB7E4F844A9DAC29AED76DD801CB9B984D5447EB890C03C67FB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6c4dacea-5962-49f2-bcf6-9981eaee137e\index-dir\temp-index
Size 1KB
SHA256 ccc136a57878751e053e35064c950d2b1360d96e80df92d25e4406bbb9eb3934
MD5 921ade39c93e2c45d861cd605d76fb36
SHA1 cdcd4d224ceaa3010d4ed79d6fb169f03c6b8934
SHA512 ca79c16568ffdbe1b4c1f190c0d834622efb2843b49c0bffa0ce6105205d3099b7b9e08b39fdf68de791bae940d9685a2fb8b4e78ef546a263c7c59423ef1a7a
TLSH
T15321C5538CEBB897DC2150B6213E25C7373ADCED2214EF8B102D74316DDB638B555A58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e18d5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6c4dacea-5962-49f2-bcf6-9981eaee137e\index-dir\the-real-index~RFe5e18d5.TMP
Size 1KB
SHA256 f95f37d976e22354f64cb1ddbf186c5b681d285b17486f1870d978e3f863f5d4
MD5 9a3d19d9cfbfc4486a07597118d7dd6a
SHA1 efd3d6e72d9922394cb3810afcce22693cf4a572
SHA512 eeb9b4b2e3e50c30b45fb18ac1b0291be04a84e414043ad55ba42eb1ba5742a97393a6ec10f694674606968f05124d75df312a8ca4f823d4551f9aab2d2cf876
TLSH
T1EB2120538192FC17ED2A50B6610E109B773BD83423A9C707215ABC792C566389DA1995
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7be1d31f225fed3b20927a892ecd396d3ee0e9c5e4cdfd39ca79eea7af93a352
MD5 b94c80620992f0afba7506e670249884
SHA1 41afd86c3b916642a4ebd251826109a402883fec
SHA512 24b129da89e269a56a1a3b91cd4ab67e006195d5b832a86340ddd55a4557cd3e7294cde839462e43086efb1a3a712cd65552b49df2bb600823c075e608c7d3bc
TLSH
T1FFE020B73EF31824FD7F97E21470E4FC040175B68949ED0F7419A2D75472766249AD22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c4bce35c85fa35c0af0b4fc47f9b3bf2629a5cd2cc23ca70a5d73c163901d9ff
MD5 7b362b9119a758fcd6fc16408aa75221
SHA1 0c22f9c2950478099c882daf64830867b6c0c416
SHA512 613e6c54d8ad676b560b4bcb78845b8e8e4935821e13787ca513de89cb67ed8592a46f7b166a0f8869ae4f94c2cdfca51a92ad2667d00ccba551e61b8910ce8f
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9X5T:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDR4
TLSH
T1B8B24B11753F4680387EB90C91B8982F86C2B4637519E52F7BA801A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b176bfa086067da866e7215798b3ea0a855750c5866f558287f22f137238f192
MD5 c4c3d858dca1a7003b11068786ef36d3
SHA1 770a126f8ae197677e43c238f3a85c03eb8d2a43
SHA512 c99d729b71eafd2c80483ac44afa41b4e64dd6fb462175b84d399c0b99b2990e34a44d7757a0b9982059f515be36c4ee99b176b0d9c89f83b442c2544b377310
SSDEEP 384:nJiF1tNn/s3n9Si8NLT8TUNTUlIRtPvuT+3EEqfbzGwwjNJw+0OObjI9G6w7H8Ll:gF1j+9LQTwgXuk6GxD5029Mo
TLSH
T17ED25B36EC65CEB7ECE68ED9A34A7646DEE0426385CC5AC8E5C95E0C00DB1ED4707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 96ab2ab1fad42615c8d5f076c04600dfda6ac6eeb437a24dbc7fecd86c0829f2
MD5 39ed9b2e122ff09aa55c5dc2fa56ff48
SHA1 26a5e6c3dee980022b7de5e0b4c645f5c2ae842e
SHA512 92a9294b7b91e382af4d78046a38037dccc88aec4c62a7c80cb32797014bbb9de278050553d7b0ad9a079321d51ce0f68cd82ab6b5a2ae1ce93bcea4e5696c13
SSDEEP 384:nJiFiZcIo8NLT8TUNTUlIRtPvuTX3EEqfbzGwwjNJw+0OObjI9G6w7H8LEEIzt:gFQoQTwgXuD6GxD5029Mz
TLSH
T1F4D25C32EC64CAB7ECEA8ED5A6497606DEE05263C6DC5AC8D5DD5E0C00DB0ED0707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 65a8c6b0248207a3181e3e9242aa14361de07acec0bee3658fed865f6805a7fd
MD5 a4d0bc97ab3b79c18e61bbb84704581f
SHA1 40d0ca9a8816461c614585a0ba50446a9aa13295
SHA512 cc93bbbb81d2b6faca154ebec85044c366a3c7ffc6945f9170ab443cf34e0e5f778abb1ba2f403528aed83340b508406358c0fe78cd905764fe038d8f1c9e101
SSDEEP 384:ntiFwZcIc8NLT8TUNTUlIRZPvuTxFEEqfbzGwwjNJwm0OObjI9G6w7H8LEEIzt:kFOcQTwgXuX6GxD9029Mz
TLSH
T1E1D25C36EC64CAB7ECEA8ED5A64A7606DEE05263C6DC5AC8D5DD5E0C00DB0ED0707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 21979d699375682430458cbffe6bd0c8f79e3fad5ae8aea0e15c27ef20dcfd2a
MD5 2dcd6ba41019bb2cd718f543b98f10de
SHA1 4f312a4e9ae7c1dbb62653fe163d640ac4b37c50
SHA512 a19c0298dc2baa914887dd564a818589b3a4abdcd5a688148c9f9d680a9a9f39ed90b35b53f735d4558ec8523e7917bb38cc4e0aea96017dbbd1de1754a4c80f
SSDEEP 384:nyiFiZcIo8NLT8TUNTUlIRtPvuTXFEEqfbzGwwjNJw+0OObjI9G6w7H8LEEIzt:5FQoQTwgXux6GxD5029Mz
TLSH
T11ED25C36EC64CAB7ECEA8ED5A6497606DEE05263C6DC5AC8D5DD5E0C00DB0ED0707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bfbd0c269caf86898a31137fc8677b7b758989b7d4adcc61dc5fe246558a19d7
MD5 8989bd7517c5198abf669a39c726a78d
SHA1 34eea5de8ca937806c98b52fe9de37231c6d0c77
SHA512 080f5810bf80a62048b9c690302a142a2c62b7f000caaa49c4ad87981cd3f72306a4f57307cc2f8083e57da1a4ebdf940e421eb8309e2b81c9527cb3e4064191
SSDEEP 384:nViF1tNn/s3n9Sn8Ngb8TUNTUlIRiPvuTuQREqfbzGwwjNULwOObjI9G6w7vw8LE:cF1j+9SXbwgUufXGxMw29MI
TLSH
T19AC25B36DC65CEB7EDE68FD9A34A7A16EEE0126785DC5AC4EAD81D0D00C71DD070382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0e600a4fdfbb961dd348ee934bfb6dd633bff4816c5dd90d9132e2e2f6b9e329
MD5 2f28307c84e46bf217626c4b6313e967
SHA1 2100afd62c4b211537397f823e215ac80b2a7c3c
SHA512 22805b04c42055028a5a202659709db71f37447308faae0762c0d4c6ff1cd70687f593349cc986c7d0b2170b21181e8b16aed557f50ebabbbd5ca5eab0ef5ef2
TLSH
T1C9E00203D70010D7C135033040D32B517BB3D431239743468D2005787D713006E20980
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a108c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a108c.TMP
Size 392B
SHA256 99e3d3fe240ef28cd79410c95f1400a22fde1ac7b8d25124e8a8bc34d03dc292
MD5 196662651c7da68e1e4938b8cc6e1db9
SHA1 f0f727eb90c7b4d7cc94812a11cb0c2e0cd7bba3
SHA512 40e66b4d14d837d65c96f39a8f6358ac7378aa0996666fe44d73674cd56271a50b5daa2e3f33a16cb948d2b7c20822526e768c2673b7a16242fa9ac4e418129e
MD5 SHA1 SHA512

Submit Download

vosk-model-small-cn-0.22.zip

Path C:\Users\Admin\Downloads\vosk-model-small-cn-0.22.zip
Size 41.9MB
SHA256 3af8b0e7e0f835ae9d414ce5df580237a3cfb08d586c9fbbb0f7ff29ad5b14ba
MD5 d1a8e82933dcc7632667c036b0bb3dbb
SHA1 a35d37017586822e56646154d2261b740992ef16
SHA512 d4189c40931016c6af3db3c12598b750bc4955cad0ce129ed9a27ce819fbfe06413418dd5b6349c28be12a983300276d872474f70460bf10e22f2d448a1bcb95
SSDEEP 786432:uxMNOb4f6C5d5ll4u7YuRLPYw9wzazU96FJjp8xuea8r+49Jo4IP2C1cnqX9yKtR:u6NQ25ll4rULaGe6Fiuea8rDarXrZvT5
TLSH
T1C7A7338C35E6B2C7B8DA80075D98A746B6C359F48AB5A79FF6FB374C404058862F3790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download