3fe9e9c9ca39d00d112cf20d22e8a7d5f3fda5116ae38ae0c797de076c1793be

Analysis

user interaction
yes
max time kernel
236s
max time network
242s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/07/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aaa.txt
Size 82B
Sample260730-v7hcdada63
SHA256 3fe9e9c9ca39d00d112cf20d22e8a7d5f3fda5116ae38ae0c797de076c1793be
MD5 d533c6eef38de727321a6a567e5cd7f4
SHA1 740eeb27c0a977db535d17b68dc0f73477704ed8
SHA512 02745819398f27d80358707e79ef9f3278e1918e3d2060953121f5fc7099e16049c7a2a8c0b610b08bf10bd8c0a7f857347d1e6755de4ef9642ca41ceab59343
TLSH
T16DA02441C4C10700C5307105D00145C54010D10C51D33F74C540DFC13747310C04DC50
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution ransomware

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
203	5772	powershell.exe
210	5772	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
210	5772	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1328213815\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1734816622\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_475006112\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_475006112\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1339298449\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_475006112\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_475006112\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_475006112\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_475006112\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_475006112\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1339298449\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1303616510\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_475006112\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1331210181\_locales\cs\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3460	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3868	msedge.exe
4444	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299067194252450"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{4E6A9C28-60FF-4A88-B716-7B7DE66A9E0A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{A8C86C01-A2FE-4BFB-9470-BCCD4B3D245A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3292	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
5772	powershell.exe
5772	powershell.exe
5772	powershell.exe
5772	powershell.exe
5772	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5772	powershell.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4028	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 3292	3460	cmd.exe	81
PID 4888 wrote to memory of 5588	4888	msedge.exe	83
PID 4888 wrote to memory of 3868	4888	msedge.exe	84
PID 4888 wrote to memory of 1956	4888	msedge.exe	85
PID 4888 wrote to memory of 1956	4888	msedge.exe	85
PID 4888 wrote to memory of 1956	4888	msedge.exe	85
PID 4888 wrote to memory of 5136	4888	msedge.exe	86
PID 4888 wrote to memory of 5136	4888	msedge.exe	86
PID 4888 wrote to memory of 4996	4888	msedge.exe	88
PID 4888 wrote to memory of 4996	4888	msedge.exe	88
PID 4888 wrote to memory of 2432	4888	msedge.exe	89
PID 4888 wrote to memory of 4996	4888	msedge.exe	88
PID 4888 wrote to memory of 2432	4888	msedge.exe	89
PID 4888 wrote to memory of 2432	4888	msedge.exe	89
PID 4888 wrote to memory of 5272	4888	msedge.exe	91
PID 4888 wrote to memory of 5272	4888	msedge.exe	91
PID 4888 wrote to memory of 2076	4888	msedge.exe	92
PID 4888 wrote to memory of 2076	4888	msedge.exe	92
PID 4888 wrote to memory of 1712	4888	msedge.exe	93
PID 4888 wrote to memory of 3372	4888	msedge.exe	95
PID 1712 wrote to memory of 5520	1712	msedge.exe	96
PID 4888 wrote to memory of 4212	4888	msedge.exe	97
PID 4888 wrote to memory of 4212	4888	msedge.exe	97
PID 4888 wrote to memory of 2116	4888	msedge.exe	100
PID 4888 wrote to memory of 2116	4888	msedge.exe	100
PID 4888 wrote to memory of 2116	4888	msedge.exe	100
PID 4888 wrote to memory of 3728	4888	msedge.exe	101
PID 4888 wrote to memory of 1168	4888	msedge.exe	102
PID 4888 wrote to memory of 5580	4888	msedge.exe	103
PID 4888 wrote to memory of 1068	4888	msedge.exe	104
PID 4888 wrote to memory of 1068	4888	msedge.exe	104
PID 4888 wrote to memory of 1760	4888	msedge.exe	105
PID 4888 wrote to memory of 1760	4888	msedge.exe	105
PID 4888 wrote to memory of 5884	4888	msedge.exe	108
PID 4888 wrote to memory of 5884	4888	msedge.exe	108
PID 4888 wrote to memory of 4884	4888	msedge.exe	109
PID 4888 wrote to memory of 4884	4888	msedge.exe	109
PID 4888 wrote to memory of 232	4888	msedge.exe	110
PID 4888 wrote to memory of 232	4888	msedge.exe	110
PID 4888 wrote to memory of 3212	4888	msedge.exe	111
PID 4888 wrote to memory of 5660	4888	msedge.exe	113
PID 4888 wrote to memory of 5660	4888	msedge.exe	113
PID 4888 wrote to memory of 772	4888	msedge.exe	114
PID 4888 wrote to memory of 772	4888	msedge.exe	114
PID 4888 wrote to memory of 4660	4888	msedge.exe	119
PID 4888 wrote to memory of 4660	4888	msedge.exe	119
PID 4888 wrote to memory of 1432	4888	msedge.exe	120
PID 1432 wrote to memory of 3308	1432	msedge.exe	121
PID 1432 wrote to memory of 4568	1432	msedge.exe	123
PID 1432 wrote to memory of 4444	1432	msedge.exe	124
PID 1432 wrote to memory of 4568	1432	msedge.exe	123
PID 1432 wrote to memory of 4568	1432	msedge.exe	123
PID 1432 wrote to memory of 5624	1432	msedge.exe	125
PID 1432 wrote to memory of 5624	1432	msedge.exe	125
PID 1432 wrote to memory of 1228	1432	msedge.exe	128
PID 5772 wrote to memory of 4916	5772	powershell.exe	129
PID 4916 wrote to memory of 3896	4916	csc.exe	130
PID 1432 wrote to memory of 5840	1432	msedge.exe	131
PID 1432 wrote to memory of 5840	1432	msedge.exe	131
PID 1432 wrote to memory of 5840	1432	msedge.exe	131
PID 1432 wrote to memory of 5332	1432	msedge.exe	133
PID 1432 wrote to memory of 5332	1432	msedge.exe	133
PID 1432 wrote to memory of 5716	1432	msedge.exe	132
PID 1432 wrote to memory of 5716	1432	msedge.exe	132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:360

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\aaa.txt
1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\aaa.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x240,0x7ffcbfd1c188,0x7ffcbfd1c194,0x7ffcbfd1c1a0
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,5588295960323111139,15678097322146108927,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,11141793926240063689,13146008688655741475,262144 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,14350579320059932505,13785946282725275750,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:13
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,1252710398538095883,5773854360474276037,2097152 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,4146201761299032196,9060418350967112177,2097152 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,15316326446919416169,5699578715493949376,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,1715035439386195548,14588653197388025248,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,11693289219128275590,7216827064608178110,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,942623143669992971,3468199933337349470,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,942623143669992971,3468199933337349470,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,8194544271386950677,11524905558073111595,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6192,i,14161241618216443221,3681224894515390265,2097152 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,2279883804519320521,6479056194797329987,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,12946465675561321358,12794245019809419720,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,9863973677227152899,822626035485264850,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,9830761590013791875,14938351607737051697,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,13147021236916357842,3727630865233906834,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,4238094474327671231,25950070866842559,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=1236 /prefetch:14
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,710336810709328474,5343940432173988430,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,3928966346377333576,9532235433472780855,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5508,i,8941083053160812469,12836570455069724484,262144 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,6777761246985872724,9529253270137718406,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:14
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3280,i,2250598853735626725,8389559372789833830,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,4115313914450947625,8359755479490392173,524288 --field-trial-handle=2204,i,238902061159060511,4727834460415007758,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:14
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffcbfd1c188,0x7ffcbfd1c194,0x7ffcbfd1c1a0
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,15814486186950637509,7075999469180296766,262144 --field-trial-handle=2968,i,6143507801685771679,7328454618945671235,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:2
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,9398521859521296607,17953299644347755996,524288 --field-trial-handle=2968,i,6143507801685771679,7328454618945671235,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,9159278900656138109,16078094020152349567,524288 --field-trial-handle=2968,i,6143507801685771679,7328454618945671235,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:13
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,2992457528317871450,5628012113048374177,524288 --field-trial-handle=2968,i,6143507801685771679,7328454618945671235,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,2992457528317871450,5628012113048374177,524288 --field-trial-handle=2968,i,6143507801685771679,7328454618945671235,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4820,i,13231585379433006972,13627729909462211204,2097152 --field-trial-handle=2968,i,6143507801685771679,7328454618945671235,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,12555552074961971771,15509725573278373537,524288 --field-trial-handle=2968,i,6143507801685771679,7328454618945671235,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,18357491900016778066,3208862443761506052,524288 --field-trial-handle=2968,i,6143507801685771679,7328454618945671235,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5600,i,258464077213542811,7179117754621991337,2097152 --field-trial-handle=2968,i,6143507801685771679,7328454618945671235,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,11765575217088316562,1991242363726643068,524288 --field-trial-handle=2968,i,6143507801685771679,7328454618945671235,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
    3⤵
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,11787792694805264300,5159630153176274588,524288 --field-trial-handle=2968,i,6143507801685771679,7328454618945671235,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,9466069400578277907,3257386701834570390,524288 --field-trial-handle=2968,i,6143507801685771679,7328454618945671235,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
    3⤵
    PID:900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1964

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wjvhzgum\wjvhzgum.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8CEB.tmp" "c:\Users\Admin\AppData\Local\Temp\wjvhzgum\CSC4DF397525B9C410BA3802BCA8C699C6D.TMP"
    3⤵
    PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cc9cf848cfc6b3cee74946413693dcbab33b7117cdf781cb992582df418645f
MD5 14141a7d178e0786f91c9ad8dacf07e1
SHA1 fabc9c7a5dbbaad876d2bed6abb9152b8422f73f
SHA512 6078f06bf8c4dffcfc7a6f23965bcdf1d0461c3c7e7cfc74c942267c36ac233010e3c1c1630fa84941de31a52daa22eb896e4044ee8d8228e4d836bc3d5dcfde
TLSH
T1D9D023B4783675D3C22C003940D06603321606322993E3421081D80CDE74481E2EECD2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 42f674cda42a883dcc1daff220353b419726d021342be5bfefad4bdb4878bbf6
MD5 3dd50b8bee94ca572956ac96e2ca4152
SHA1 3ca852585e7b4388344678f0fd55582e8eb698f3
SHA512 d80fdaa218ad232580486c92f733407ea9c9cfbd7e27a824bf2a69110c4a009f104ebefde1f1c2a091e9366ee14a7c90622ca423159b968d771ccd4539a08953
TLSH
T1C2D023F47A757813C70B353161C0E613339347706D57F57240A1A01CAE74491D6DE4D6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

470a1938-6672-48e4-8f8d-f052e4458080.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\470a1938-6672-48e4-8f8d-f052e4458080.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 4265ccadae63febada7b8a2572b675a5ad05106ea81f507b4d9c1a840acc3fcc
MD5 450f655815bdf812243892170d6ff487
SHA1 16c10ace58fa73d826054357c179a6183664a99c
SHA512 55fd02632cfe9f6d2df49e50463529bf0ba8d2564e334be51fe0efab6c4c30d4042e9f09cf9b4ae756c22f9783871698f1d1d44224a9517327937e59f2ab5799
TLSH
T16DE0D81486D9C2DB950A95868065B39C4161F407BAC8B8797296A47A2C41981A7534D8
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fdbf3dc33585d50288b12d0da0c86497ae38e12c4695b1754dfb0bbb14cdd2cb
MD5 1779c18374b5d6832a1b1414a305cd36
SHA1 04be552d33da58dc7feda993292e7d369ac92554
SHA512 a61f50a1c9137353a2d078a8f6c201270e86227b5c2b0b8177d97784ed98e14432e0f4944494ea61053df192fccfaed64799da79770fa45b7ebe185e0c1f240c
TLSH
T1E0E02BAEC921AC3718FE4B1EA0550645EA9013572680845F7A3E450C8FF172A028585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 8e28aa923ae182d6f3655928084c8cd2633a96e1c87390a2950b2288a9ac1ae2
MD5 4fc6d1703252312fdf596f6d729f0722
SHA1 476836b4e858a5f029594e8d8aa037a2aaaf9fad
SHA512 2026db9c6d6b73ffd01f21c53cbba0611bcbb841ba2d949c8ac3ccf6d0a332b9aa1882a31224798ad8c9f054d0be29bc814d3bd7b973da55e9444a0efe1696e9
SSDEEP 96:Gw/k0AXkNK+EbGbBdv3X/B7AUr/iT4prFDJ5DrMUL5UVLHBPoaBx6bCb1cmpLX4B:Gw/cXkNxEbGNdvX/BUE/s4prFF5DrlLt
TLSH
T176C150678DF03A0BEB22153CA1E5B8CF3E7278640987AE33C1A41671253FB92C19D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d55c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d55c.TMP
Size 3KB
SHA256 b4c65dcfc0753d8e08b7caac6f56a28027e7d689f1100bed948c1e32ce716a24
MD5 ee32147ed93b10f6112f19d84ddd699b
SHA1 acf6b9bf386baafb1b18f0157d74f5e5fa960503
SHA512 3d9fc25713c9d52d1d6a1a9231fcc832f9a69e52ad7d7f69e6206b3f2b1be2530ade73473a4345012311076cfc59c470ac3e7572569f3b28800999a6fd604b2a
TLSH
T1E9711C1302A23E47E373227072D1F6AF3E7488B41E572E3142585B713A2FB61C5AE853
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 55d72e47d44fdaabe8c8dbdcfbe37f2b202d15ff748701289272c00fef9dbec9
MD5 3631fc677ce08dfe38997fc2055b1622
SHA1 5720f4c6d3ad2b796be4accb03dcaf40be2c472b
SHA512 24b8ddd349c8a58d1c6e3e3ee167d204974f2ef73138b16527b183f446e502f3d2486a6240a26acc10bd0313236ca165954820b27426b403be682db274421d0a
SSDEEP 3:MsEllllkEthXllkl2zEL448a/:/M/xT02zz48
TLSH
T16C440404FFD44405C700103C5113C3D043F0F410051157C735515437DCDD5400C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 513B
SHA256 388c5c95f0f54f32b499c03a37aabfa5e0a31030ec70d0956a239942544b0eea
MD5 c92eabb217d45c77f8d52725ad3758f0
SHA1 43b422ac002bb445e2e9b2c27d74c27cd70c9975
SHA512 dfd5d1c614f0ebff97f354dfc23266655c336b9b7112781d7579057814b4503d4b63ab1263258bda3358e5ee9457429c1a2451b22261a1f1e2d8657f31240d3c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 7ffd9254c6aabac65359f940702524f2db27ba67bdc5bb6aa9e0a3e8217878ed
MD5 a27c36544fd6d91e8e7b754da3c78cbb
SHA1 5ac23d7b080e056a94d57089a581a308c6c4a886
SHA512 cf05e5849ae08ff3f664de62f604ff8b744f81c263bc6be9291b6ddf19df044b4f6dbf324156f147f86ad97d6d097580da12948a6bd3f222f57e739f55255cd6
TLSH
T121E0866444CDC2ABE41968D38678735CC3E1784BB6ED7A13274F88926502AD5A3B72C0
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 a078f87030758bb047c1a6ea41d2b0c3505d44be084d62dd113477e7f9121dbc
MD5 50d11adf42b5b05e8b891007f0d44d6c
SHA1 7387ef8061bec258aacb709d53ccfee56bddb8a4
SHA512 ec06b1d8b9c1580a7530629576f839516cc5c080405bdf50656644bc0383a66e66c8b695304b09d9fcc9ff2e65b309e5902946b650c8b143b6100b652b8c669c
SSDEEP 192:9l4wXB80+G83uxXBBK31GkSJn6EJH7DNspUC:9lhB8a83uFBBQ1GkS97DNspUC
TLSH
T1B514534F5F343312CD7D803669E744A35DADF43F8B526ADA78601461CEE3B52A06C8BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 16KB
SHA256 3b69c9bf830b2eb59a71489c431afeaaae04537957bbfc20a90e809cbbe004bc
MD5 b649ba5eb8bbea8e3175dffabe36ced4
SHA1 e9856f57fe729262e0e7df264ad88c57f1abd090
SHA512 204a171f0842618346fafd401ca38d23967e4ce779e769558cf357e49e3d81cda9a42c4d0facefe8301059e863f138de999373664bfb8fb8099f906d17e66670
SSDEEP 384:fBuCVvAPRyaeao4Ock7kn3kAklkskCksk2kEkIkoxx73NkMCMA0iD0:JuCVvAPRyaeao4OYnyxx73NkMCMA0iD0
TLSH
T1A372BA6675F8560EF27B9FBAA8711BA5487ABE452D00D81DA8A0711E4C31F40CD73B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 16KB
SHA256 51989229d7853a2c07abee9783df4a1b63c052dbd3cd52b8f4d74091d23fb796
MD5 39024690939f02c2591b966f88771d30
SHA1 ddafb36dded12b9294bad9449aa568a260437b9d
SHA512 6fac7e603ab747aad122c36f89aa2fcc4f69b6d8f752390223f365f8a442a867777ff29db23148316fe414d65635577a78c04c0645f24b3800bd66815c2fc3ec
SSDEEP 192:gKEJwRr4GePQH4tb8DrJnrHotnsnIh7OZ:cJwRnGoDr1mnwIh7OZ
TLSH
T1077274B7180CD457CA852DE686B2ED4DD3838D2BCE96ED9AD66CC16F07AC03436A6143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 8807eb5d2d97de1b9155060ca6911aa069e35c5b15ff5feddc00b7901214358a
MD5 261c0d3bbb9e2afef1db3139480ab54a
SHA1 8331c7a5de30b0c69bc26c4da3390d969d259f59
SHA512 b3419d08f89d1c406f193f176b6956d699312f80cb9d30fcf814f3ee59f8a09b70560c37bf0931237564b5f7323f48ba3bfb1f0231045fdc6b0ef6d71bf7508d
TLSH
T1CEE0206085DDC32FA50C6047A234B74CD3B03907D6CC7F155B0D9856B442544A3832C5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 28KB
SHA256 f2e29a9ee2e9f710cb53809ac576d47b42afd467d930cc5ac70a56b175337d46
MD5 bee015893132a67c0bb92ec05f675eea
SHA1 8b5f018857b97b2403ab66cdddb8c20fb57a4da6
SHA512 b7bd32701e1a96920f655f70dcfdbbd454574d504b65b89c0472ad0dbbc9b5a3968fb2b1ec53fca287a370cd9a15d11ff0224b71174df0d926c17fe01e5aadcb
SSDEEP 192:rLaSapiWKwAgi6fK6sdnU0mPykcVVBRLMEIufn9E:Hvk0si6C6sdnV4yV313P9E
TLSH
T170D2FABF7D408501C5C7DB71987B8C6AA87820557703E0EB50BEA1E07CB4A83BE77966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1445e698ec11982889863b12f6ef889a286008b3cf46abeeeab22caf751cb59d
MD5 84d7f2a79f907ef545813f4c421558d8
SHA1 ad8df99fd1db07f946809a74c1591ae2fc9ec5f9
SHA512 2facb055280f816d587559c96113b3eec23d33748b79a5ea08242ff7cff65c6b06163bb362b2f6a6d09c635e22e23b903ceab389d0acd764b9862ef8600044b3
SSDEEP 48:YALlNROgyDPCDETCD/CDZagmgj6AsGJzBCnOCKC+suJCvs0JCLsYJClCICYCsDJn:D/O1hEoaij60zBGO5hAgGtHrt0WawDx
TLSH
T16791CDF7C3E9812DDA1195F0AA14AF2BCF280551436C3D5A89E4AF1BA3F2471E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2e086c4a5bd1fb57f06d0e5db9627b7b9b3ae3d823c93e34851829447d99ab20
MD5 62a3dc62be0fb815aba30ba3e9586eb0
SHA1 4078932e08a87a55e2356bba9115f890d419887a
SHA512 b8a99d5470aeb5232545ca109d5f733a4eecadbef1edf678afe2afc6ed2a9cdd2d17824876d0698315f62e9ca6c565e51cddf7ab73cd84bd3474a072f3b7f058
SSDEEP 48:YALlNROgyDPCDETCD/CDZagmgj6AsGJzBCnOCKC+slJCKsuJCvs0JCLsYJClCICR:D/O1hEoaij60zBGO563AgGtHrt0WawQ
TLSH
T15C91CDF7C3E9812DDA1195F0AA14AF2BCF280551436C3D5A89E4AF1BA3F2471E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 857B
SHA256 d8e9ef15484a339cee029dee9f1f694b05eb3b9400ff384e2187149d088877b7
MD5 df3904d710a86cdf64face7714b215aa
SHA1 46c7bdb6756c5d7538dcb569e3c6aead1571d54f
SHA512 c39d2240757946540d59ef4a9af5158eb0c9c53248bc824284fcb2e1359d12131cd3c11b46444597308282ae14cc20b13e83502c4e1e7b6533c24bc95c8fe1eb
TLSH
T10E118CA3D0BEB427103909BF0E18FC491A75E431819264F5E9ADA13CF0C28F75B26032
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 3cb505b15b4a45a46e37cb8d2567564e25fdce50cd0391bad0ec01d8c464132b
MD5 cec52bb72a6089bcffc507bd7737321b
SHA1 d09c58f7071fcdd3bcdd5cddb5f298639051f943
SHA512 4c16d917f7041da4c5131042179323aaec2b0ab4728cce0f5ffbb52d0c42ce9fc7572c5ee3275254a5fc27c47e74a28487a76c544ed862cddf5129564e220764
SSDEEP 384:sxZin/Uqn7/f1s8WvC00Ly8INNKR/10mR/5Rx6TBS81:s0/Dn7/fZYC00n/1b5r64o
TLSH
T1E7A2F806A524897BCCD7D61EF9267F62D7F81063DA514E4899FCCA0C04EB6ED2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 c1e15e3cb3b852cf071bd497ab05184383a09565410578c8125921f6d62ca9dc
MD5 a8f2b6606ac09a066b8a8721dfc78b09
SHA1 e1d088b37e93bb8e9a8b9001498e29f8bb786040
SHA512 5fc416ce138cedcc981bffa8896079328c7a6b1fee3e10608172ada89ca661b746781ec686fc44fa51dd5fca3974c99d1e1f76f8796c6df83f891c19ec54cf44
SSDEEP 384:sxZin/Ud7/f1sc00Ly8INNKR/1feR/5QxcDS81:s0/47/f500n/1A5cno
TLSH
T151920906A6248977CCD7D619F9267F63D7F91063D9514E48AAFCCA0C04EB6ED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 2ff8cabb0ba3fef403771b4981a8359dcd8cdfdfafc9f286f1431032a136aab3
MD5 533a307fb928b73ecbcfe822fcb43642
SHA1 77e559d996052bb6c58c7003be55c69820e951ea
SHA512 e4ee4eca151326fc2a5be3d5acae4b41a94ae433d80b0a38c86f756a306e5294c75619256eb0171a2bf2b535dfd3fc1c79a3dce33e4be19fbe8d81bdabccf819
SSDEEP 384:sxZingU/7/f1s8Xp60Ly8IN6K3/b/R/5GxcjD81:s0gs7/ffA08/b95qEo
TLSH
T18692F716A624897B8CD7D619F9267F53D7F80463DA504E4899FCCA0C04EB6ED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 f110bd1faae65551315fb5ed4d065f10c900a01ce967c1ffff47d8b02be338ee
MD5 bf24a7714edfab6e4848e41b54a7f06b
SHA1 80affa0711b905efedb188430bf7c721ffc3868d
SHA512 d23eb3e54bfa98f21ee4ca4bc66cd638be715e25c43219a6108bd24efb1f37aee9018f56a594b278c1b66be193d957c2f54e8fe6ad65db7b923e7e7b4595e802
SSDEEP 768:ciWKy8Eq2W07pLuLfydWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3h3pQLl3:ciWKy8Eq2W4EfydWRm5rQW7u1jaKh3pQ
TLSH
T1B9030B3B6C0CCB7E4F805E9CEC266F9A6DE8018B6698895447FA844C03C76EF55164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 0115354714894c866f01c2829c8cee55120dd5c068fac3058ad1658799af6aa4
MD5 07d411f83f7164a436a3d6a3056a3af3
SHA1 b0993537a17246e32d1d978b48a752f1c7d84e4d
SHA512 3bce8e6564b870f5b5195afb2cff228820c54c70ddc7a80b7041ab8d977c28412cf1822b8d7a009580685ad7df7751df4f06951e1e2492bc55f600094f48d6c5
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Y3pQLl+:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKY3pV
TLSH
T178030B3B6C0CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index
Size 2KB
SHA256 9be3df63f1ecb7c0ab08263f07f64372e49857438f4e99ce434e812cfc0a375a
MD5 693b24da38d71cc7567037ee1db9957b
SHA1 4fdf30f4930e5473d99a9206e8e34d36470dd54b
SHA512 8e3fef221aa812dc902297f7cf629562fddf5eeb1978295bff048832a447faa061e2d5c05b055522a357e5ae5e06ba14e12af8b2d9efa7b9977cdea03903499a
TLSH
T1F251C50E0C873B5BCEAC107328BA14C43731B4DE66844A23F4DCA5707CC72252DA9B28
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58df4f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index~RFe58df4f.TMP
Size 2KB
SHA256 bf76fe723e807922fb696cb9f4e1d2eb08e50790b3f5735066fa69aeaa57edb7
MD5 f469032f4c738c899015ef7fc981effa
SHA1 2cf16b09b47fc1a2f6beacb6649b486bd28ea6ea
SHA512 f553211dc80e3d7984fa7f5b7ae13f33734d1bd77e93c80f45a25cdb6d7bfbac6a3f7031f0a7332d0b21a172de14ca6dcbb29ff35089982aae4a4698a4c3e7c8
TLSH
T17651849A4D824639E8D4417709E3A8A437392900C71ABF5374FC9636ACD27AE3D0E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c373911d-998d-4542-bba5-e9e6787044c6\index-dir\the-real-index
Size 72B
SHA256 39cf97b03590a133c9e98f76d743fe3d2d9673a85ce068dbf589014ccf6b8aea
MD5 acc91492507d3b8065f0887342df89dc
SHA1 0b48c51a844b4b243e74eb7c73584be2e0701967
SHA512 4b49f44de939260da5b850b5663e43ed885301818451833e54d32b3e7d60cb120c84bf3446df7a03aa68fdda50e17dfec0c8c1e32ff8007774e4499b689a890d
TLSH
T16CA002250BA03002DD001776228745406B12FCD009864227C390F5B8CCF1F81C659E58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b793.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c373911d-998d-4542-bba5-e9e6787044c6\index-dir\the-real-index~RFe58b793.TMP
Size 48B
SHA256 16c257f7b8219733704014c0a0fa3396480e9f514c9781adc37fd98b2df33948
MD5 a4935b8eae8eefdc3d22da5e2d1dfbb4
SHA1 1802e358d03c25b4b75d77566e01e05665a8c364
SHA512 b7faca780e10892db5a8fa9baab4a547c6c12500bf5ae7b24d5743c05f0cb012325873bd8975015d95caff939356009d1ecfd68f8c2a0f3126cca9ee79fd9b5c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d54a3707-cb0e-4bb5-ad36-fae9c8c805ea\index-dir\the-real-index
Size 72B
SHA256 0a610a960a06a17b093e3ca9aa12ab5c581dbe98fc3a8779d2a3a76f886be9c0
MD5 f9112138bafb6c535fe7028305ad5e0e
SHA1 273c1e23a7743c69b5f193d5ef933f86c6433f1c
SHA512 8b4b42f6e80f4516854f6901facc821ae1b13641aad466d8cfcc1d85318ece6620966adea1e3988b092dbeec3268e086dc3ab8fdefe77f96695c028b5bba3232
TLSH
T104A0025442D14003E01372B825F651A6F6105810E202620585A90245CC64560498710C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bb0e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d54a3707-cb0e-4bb5-ad36-fae9c8c805ea\index-dir\the-real-index~RFe58bb0e.TMP
Size 72B
SHA256 7671634beb3dcb715f653898ee95297caa51c7fa2eb750b2f8cdcf9461902173
MD5 b434eb29b866fd200c56c303227734de
SHA1 824092da4885fd3b35ecffde4b79b81731a88c79
SHA512 490d1e940a696c41f103866ace7beee376d7e6ebb22b7d084a8e48d5f5d593814b47932cf4c5ee8cdfbab019e1e481879402bc3fafda706aec4199136588cfdc
TLSH
T1F9A002100780210ACE1251B1565332522300CA501111D33B60EE0084CD564C18D4510C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\efa5fb9a-837b-409b-b4ae-b9ffdff33476\index-dir\the-real-index
Size 72B
SHA256 4e7a5a01713c2fa8e7738183576ff09de9a48b24efac4a2ed48b9a2b8bf0fafc
MD5 8ca3ef13a6447d0e34698c07c1d46eb1
SHA1 30c469fb50111f760721bd826be4c73e308b9a82
SHA512 84b904906de399a841aeb65fa10bcd59a207b892519149b11a4378fe53daa2b1f1175de52b7e4ea508104068f948f12ccd4854b126d3014caa05e82f1627ef60
TLSH
T129A0022482E88341DC0107B4515AC9513B995C154202638DA5D005569D615F88625144
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 362B
SHA256 cec75ab01e4c22c8796e797c378ca5887bf335f9dd1af08f68b1fc5c03148259
MD5 ec63df384ad3e4961d455a42c4c79663
SHA1 d78cb506f4bec76344aed86d9fd78c1c4bfe169b
SHA512 1f8601f07356e7a55fe4ee58c788f2cb6984cf0caae5abbc455714d2a5c325dbf6c0032b9eb2d7391de7a9540e26339a7a2a94b344c679ff5792425c37f3497c
TLSH
T1B9E0D8732FFB2404F98BD3D9643008E55656B85CC4159D4F511676A7957121E1018C51
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 264B
SHA256 5082dc4ebf852b22edff7efe03603ec01dab3fbea7604c938f1f12378519722d
MD5 54e00060f371aa92e74899f71eb6dcd4
SHA1 da18efe79cf61b4afc009b4bb2b419aafc6d9f70
SHA512 e05ff76e7670f9ca080e8cc8f3c5d86d9a53f29653c6cb7a01d897e866af5bf8669236b8e89b6db36f31228515e8ba05c4bc6fdc97bb5b3da1b4d6a185bbe8ac
TLSH
T148D095732FF72404FE9BD3D5303108E6510B3C4C8414DD8F51197693547121D2024C11
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 593B
SHA256 8813ce4fe068c3c479c68a7fbd519c25486bb1c1f6370970883ef40a5ce9d37c
MD5 8336c75453584b4e65294514a84cd785
SHA1 c4706d5ba93e87248e35bc28354141bc89bd696f
SHA512 f596e333b6363fa6a97d4afcbdb67e6687d93c0495af46fcffacb854492f91f652182f9db86492249aaf16209795eb05a6ebdbff4682b71def144f82b7ddc635
TLSH
T18BF0A6732EFB2418B82FD3D6607124E40011BC0CC415BE4F652672A3A4B032E2008CA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 161B
SHA256 90d32dea492289644b182b3da10f03525ff568020a06c3d9efc8991393409c53
MD5 6aa554e59155583429827d8eb72d107f
SHA1 3260d77a591ec44482e9a33dad92105241a1481e
SHA512 7fd39c7340f62aaf10548240d7b9d215a8385380adaaf65c2e01e467ab9bfe8e5c663415f3ff8e6eb6aee9b85aa14f4fbf37a813d460a5707ccdedb76c224d63
TLSH
T18DC08CB71AD52404EF8BC2D2787148EB824B798C4A08EC8B801E199321612163021C65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 fc037c6c8c7fb446232efc63c23fbe2ea3f2da86836d63fa61dd7ed80629ac99
MD5 6d2c7fab759fe8a882ef6d3c0f9a61a3
SHA1 9032a4c3af792aa8448995ddd0bf704b81e030c0
SHA512 c0cc2372d978b78efaaad35ef18a9b9d3dc2e36d4ccf770e3250fc8a2fd4e799e33fd338d45e97e5c7907dd4b58fcb4d1f7ab7bec56e31e3563f322e724c033c
TLSH
T193F05C732EF72858FC6F93DA507218D00061BC59D856BF4E253AB2E7E4B135E141DC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 d7604cd0c0cff5709b2c3e92f6db0aeb6c0658572ef634f8312343871b724f35
MD5 4906afd88ebfb8707157e6b0783c282e
SHA1 7f091f3f1ab5c6b14ecaff19aad949ab10457f9e
SHA512 5cd28dba09b60d4b1556355f07d55492fb40b64485eaf76112232eaa99f59752d4740576460ad55381e0dfb156275c8060ed1036bb2b372af745d90b96a2eb8f
TLSH
T11DF05CB33DFB2458F86FD3EA507228A00451FC58D466FE4E653AB2E794B136E141DC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 489B
SHA256 41cac8a035e1b0cd10c1215911fd7489b96d6e917dc559921824d786709a5d18
MD5 a077d01c706369398a0b417926ff359a
SHA1 606af480637d499d68c526494c1ebad0085e4d36
SHA512 c3841554a1bf4e964cab909f216e2f2ac7bda85ff19f7f441060972fb0eb51a83f8e75120852eee977fca4353b92eeced3f226a5dbb8fd429e7fcd794610c7ce
TLSH
T1CDF0DC333FF72408F9ABD3DA747104E40546BC5CC426EE4F612636E794B131E1018CA2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 8KB
SHA256 6cc07c792fb500e1f8c6904ee22c96efe33cdf10c2b7c0a1ea381642391ea53f
MD5 36f7d777e9e8ee15fb53d767fb7c1e4d
SHA1 8b7dac574b8f5bd0ae8428c1c25e1371e4dd5703
SHA512 8a26511465a83671bd98d0e96df776a9c44747f49d50671ea4c7f5a30a73fbe0aa36b18b7308d4f203fdccd4cd6f49dde68734ade298142f361cc225c1f7195a
SSDEEP 96:F1m5HjJp6cvprGip6lpUpj/6OapiXp+QJmpNpZ:F1YHVt9Gi62Jy1MXo5vn
TLSH
T119129AE3DA149053C9C866FA2039F6E9552DCA067FFF87A511BC8F6E52412D67328B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 b1dd37938063573b0b11a675297484011ba3a80f704328347d4e3c1faa04d25e
MD5 aae6f0f0c8a42a21aae9c87e7cfa75e2
SHA1 3192a607b5e345d46335aa200d36fed3d4f18a32
SHA512 ac96e7eed45bf563c58a0b5cd1af3b72a6aa9481d04d8d03bd57a74cd3642e1a35af5b052428d1c0825204a494fc812788d7ba8b0bfb9658615f9d6755498ab1
TLSH
T1D6E086D045C9C27EA51F31474268E38896F57827E6C87D122F99D9516543D88B3971C1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ffe486b92b3b7e3783c5a732687f6186897a77eae966a147d1ef7a412f4ba4f3
MD5 79bf4c71232329b19608f396a775b92e
SHA1 8a5591cfe018ea1edda8c8f3d6733a529e59d322
SHA512 aaf72f597fff3e1d51747f57b6952b613333226639088c8544072d16316b47d5340667a888820d475fde04d51e301f872f7e4a1779ae0e22edee65d55c1bcdeb
TLSH
T176A00221C964A081C41402B59FA562856A959CB89A09A3A1C2AC0058C8B81404992306
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58daea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58daea.TMP
Size 72B
SHA256 c83cdae8f02d9c36d752f46948cd32099e67c521fc77ef0bc9b2cd6b93043538
MD5 f6453ab897a04c88e4fca63bab5dbd92
SHA1 d0ae1c76f5bb9143a9b117ebe0df24bd90449f52
SHA512 5ccc9f86326e2c805c48a9bc38c16695e8af281dc4817175ac31c9681c762372ad90b1471e9eea1eef9e36097b0da66881ea9bda5a681a68325e0cd77e9b427d
TLSH
T18DA00233D2BD2409C41005701007D26033258D9B0B1D1612459591A9AC950515963149
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 172B
SHA256 a6d2de088e2704d0bce6f34cb560dc85d8db3dd39f83efdc4ca9c92024e3a627
MD5 ea8c0f92aa371e214d388d01b3cd0388
SHA1 25062577d1369d0aa52412ebfe97414d4a210c70
SHA512 edd7ec9297e2d370ee4d0bfa9ed280b0570085e73f9e19424dc9f0cf9262b8651f3632053029a27f70beb03e4b6c22e47375390a2e70665e1d717789ef9e8ace
TLSH
T176C08C65B7088386C8C60F7421604BA9E714ED4902808327CE496E124D06A682D838A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 79ef6fde1ac30515378a9774adc9fa9b56f208baf2098c5c1fd10c323a33fe14
MD5 6b3c366abff1a408f3ff81dcc28b335a
SHA1 3d6fdcfdd70e8d639275c5fd1af5393027f4d754
SHA512 b8e47fa4ed4ad2f8a8119142cad214b7a7c0f347c7b869599f0b65428e23c70cf9f7356856690a81419f3c94e12e68cdc1e5619aafef9bbc10f8aff8ffaf6d99
TLSH
T167E04F6496C9C32BA58B30AB4265F74882B27807E6C87D262F2F9591B607584F393685
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 dbd716e36a7146b62d93e6092d3c3feac44f1d2e2aec329b89e8a96a2fa02ac2
MD5 94480515afbeac27d6749f74d240f39c
SHA1 0d542c64dc243ca893f9b8158583ba9285f8d09f
SHA512 7909d9a96ea8952da868ef913b349ce8d89f503c185e6c317e0a25546f2f5f6dac094b2df22f1f6b7ca0d6a7565bb6ff292b252a3460dcc074bd07a8b68f9709
TLSH
T1BCE086B0CAC9C33E948970834264F74CC2F07C07A7C8BA566B1C4495A5029A4B3A75C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1ebbca9cfa980d27b0f53b762bd13936d4b16dd075d37015df511f248031bca5
MD5 9628da5baaf15eb22051bf7684159d42
SHA1 4320392838c22f614405009fccc927534a9b42a3
SHA512 45922320d0f0f673676ce800bf68c6c03dbd8209aa63da7c2d130a3859ccad71631b371edd9519d9073887100ed4001d3dd427bff60fcdba35857777e4917402
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7qnm:AFBHhTofhno2mB21q3Llbfe3sLDdeEpR
TLSH
T15DB28056717B12123C3E291CA6929B370E4272A3355CA56F7BB800BA4E67E215DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 64c4c45a577a513bbbf6fdc90883db54abf05c6ac4b29f610736aba41278a949
MD5 d0a2f77a0e46c8567e91a27fcabf5e29
SHA1 af1e22fdd9f751742497d77db61ad3081026ddc3
SHA512 48da3bc1ded45c9e925aed24906a426aa186141d14087e59ecfb3d8cb91f3a9367d0b2e35dfd3362f5448c050b8bf20ed658b90857fb448750c2f7b73bd91a4e
SSDEEP 192:FvoW2hfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:affQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1F724730A7B747001EDE7E9725CB080771A3CB16DCF22A6D15DB254698DB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 24a2f3ea9126ad42bb0b186f2e45dbe1ef5776c4ec89fb42003454cc44fe115b
MD5 eb5e78cffe879a75197d8e89eb3ccfaf
SHA1 2511b2162f1b8ed9d8b808c372c2ac247f757273
SHA512 896729d62a49124acf319da232f7e12864533ff4f57c45a363409f94bdedf85d0e3d2fb8d9536dc8e7b096ef507a575fa00e7930e0d3a0fa532edab85a19c270
SSDEEP 192:E+OWeAsSl9HNus20XL1B6QfIII+beMIM45YcY1j:GWHsoCsLiQfIII+beMIMSBSj
TLSH
T1A952842926255FB7C06E6FBB13A58B9417D9A841417722AD30B21C8F8CF3B5387C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 0dec2da87e74360acd95c7eac826c775b17d4ae22e8eb0d89b636e9f92652158
MD5 b06116859969243267b828b48ae90edf
SHA1 77af5519cd8666a587424b42b3461b7b6ef0779d
SHA512 d0bf656759308852db859f93c02d7a4897519c8d66aa256958d04930a5f51c00d1dc2a707339a0593960c0b5673c8ab6ef009f7dc11c7e4b241ba6d6672096f5
TLSH
T141E04F50A9C9C2AFB56930C70164639CD3E1790BEAC979565B498895B502D84B3B7181
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 1263f94b8f28fba2074e4667a0e439748504fa455c4b96717a1b6588af8cc99b
MD5 86f04f4adde61561fef67cbaa5860abe
SHA1 95429ff2d75b58d1d2a4f1b0b11d049bd45a2af6
SHA512 ee6b6637e4b906b2cd1cfbea8a7f622dca3e0e93902dfd9feaa4c80db3a13d56149d6c803f9615cf6f95c142ea1711e71dbc7c16cce50850dc32301b16ae7679
TLSH
T10E216D56F320C159E14A963DA02A9B291778E8169FBCEC0F55B920252D61F001E8B7F5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 0027fe445dce16c2a93db39b40a2dc5e613560c7daed53efddc5cebc9165032a
MD5 3665c89ccfb0f0b4d548284e2d075548
SHA1 7dbb9db130194da5a7355fcfad9fc527628422e3
SHA512 354cd265c30c1cff6befcdbc68aff63489a088caa4783df806800bf5b3c7c60b152ef1a43549e88dc8abecbd402f21a423337cb668b5d8a38b92b0ce8cdba54b
TLSH
T1DCE0D810A4C8C3AF916530C34165A388C3E13C07EAC83E021F858C45750268177B7181
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.19\data.txt
Size 150KB
SHA256 e589f794c343744314bb92dc03cb87b0aabe1a0e4df61bd77327638125d6e1a3
MD5 67a2e4e53750b6b992e203c4e98608bd
SHA1 f84203baa2f63c3dd4e3e6378e9d74faaa27a35b
SHA512 86c77bc809e6e9d80b1e1c16ad97f6a3e9fad6b010f322e0e1146c8cccbb9c0f71146a87e1e6094034c0adb5c2e5f9229a90551bea00b9df975a4a6c05246a6c
SSDEEP 3072:0PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEEn1dm//OKXXJ1RxGfI:YX1aI5aZoKzMJ07NC1d81xGg
TLSH
T11BE3F210CAC41FECDEA4262C60FE0F1D6790C78D883B6A89D7A7FE4A5F9750895274C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 a93d6877d8cfefc019ed3efa611ee6f28311cd531e17d5613cc5282c2d73779b
MD5 0626cd3a933951da26f16bee45b09f16
SHA1 6bfda54c06c97f365e5172b402d03a662f2595b8
SHA512 7cce47916678b5aa0d06871bfe2b6d4a40fcc7b579507e15572a7a31455c7800cf12aeac1dca96d5ec2bee909049a78c444f49adaa50cefd581bdf951809e6b6
SSDEEP 3:MsEllllkEthXllkl2zEFllZP:/M/xT02z
TLSH
T1D34404047FC00515C71410344011C3D053F4F51045555F4335710437DCD57400C15540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 776838e0f5e093c5a9e391129c19fd1adabcd70f7726f28e707a714c4391d564
MD5 6eaca3deaf6db60bdd998bdd106a946e
SHA1 3cda70ad55b5531eb4ba2e4acad1501d67448699
SHA512 6a1b1e89f9f7048a12151c3aba9e4c90e09b77054610d6b87165540058581a2b6d5d4d631d44c423e24bb59ffc3d04c5baf70ced751e841713fe7ed7b7457a9c
SSDEEP 3:MsEllllkEthXllkl2zEFllb6Bt:/M/xT02zD
TLSH
T1B54404447FD00415CF0410345013F3D003F5F5100551774334510417FCF55410C11510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 2705dc9dc822a73516c137b2c3f5b76aa92d264a6e010069951780f35e1c57df
MD5 4a074afc9db0fc9642454b8323e4afad
SHA1 84a1f860257c328155ca4f966cacd1022afd5335
SHA512 207d4cdebaf225e1eb92b6f406afbc69c919464a4c2680efaf4defafc1e87ca0b55928884bd33850714ea673ca1fa55c72003ad79c7f5d148255af3ad289a447
SSDEEP 768:XFjVQXwghboRX3+sw3WMOVFf48grcOd+wCRU:BVQ2X3+YMwFgTrcOd+w5
TLSH
T17B138EF198D39DB6D89D9BCB577DAD0269BCC023B1484588B7E4692DEC8B1BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 ce7780f7a4a78c547752599f7d7f06a120ab12d6473ad61bc1e5679c527a3adb
MD5 feee9645e4460d8d675baabdc440449a
SHA1 756309b8730947c082f143ac9530d1129d942294
SHA512 f2c7218fc3fda25aa93f59e91dff23ac9c48ca9202538022630813b7f9b2b66c9e5830cc3e755d0ab21243ffc6ac9ab2b0506fc3d4182d08aea49a32711c3330
SSDEEP 384:nsiF4ZcIL38NLX8TUNTUlIR4TePMbjSfQpoR+q93yV0zesd+wvDm4vXpKMHy/7Ih:XFGL3QXwgeHoRX3+yBd+wCRU
TLSH
T147F2D3F598D39876E8AE4B8BA73E6D0299FCC053B5884584F7D94D0DCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 441494625e769d0d529aebe6ca8032dc295830a76e909cee672673a5aff741ff
MD5 70f7f4998d5b3b75d7a6f3f1e0891695
SHA1 cf7218c924e5180f4e2a6c3586017d6f1f437179
SHA512 76c380e2908b0eed6b933708d237d0eea401923e3f5df09ecce246b177ee15d6499d58b4d521e39968fd9b7c0aea7a043692e8741c89732952227b8ccc11ded2
SSDEEP 384:nsiFPZcId38N88TUNTUlIR4TePrbjGfb7oR+q93yV0zesd+wvDm4vXpKMHy/7Ig4:XFHd3LwgpeoRX3+yBd+wCRU
TLSH
T1D2D25B36EC65D9B7ECFB8F89B74A7A029EE40063C6888AD4D9D94D4D00D72DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a42128e18e97618f7b08a6935bf3de877ea230fb69b83c9f776bad78ebfb1d37
MD5 533870abf624d9604696a47c17888928
SHA1 20e61919afe256b45855a280111403feab20ccc8
SHA512 499e3cdea94979676cd9bb77108d04c306b9ffbdd535c5100673e681fcbd5de1d96b0da88dfcca66a1b3f028be7735344a0cdb529191a11b49b8f03e48b0c243
SSDEEP 384:n5eiF9CcmyWCs38Ng8TUNTUlIxByda/YjGfb7oR+q93yV0veshkP+lFYS/I1lfHF:TFccps3bwgXLoRX3+OBhkoFYS/Mt
TLSH
T12DC25B36EC99D9B7ECEA4F8AA74E7A03DEE001A3C5888AD4D9D91D5D00CB1DD1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 fe8b01bd85f6a08166fe0f667d1b9af5b151e25adeee08d897c81d9ef6ba6b8a
MD5 06774bc9d0716a82ad9fb30845842c9e
SHA1 f895efe5c2965e839e6c164f477b926c9633d0cb
SHA512 fddb8d9a699d4b66e4706d21dde5f243e4e1eb21a974937a21720178cd4b25cddffd8d11776e95f8c9fbd186d6fb72ae2d5692153f728eeab43052b5be732df2
SSDEEP 384:n58iF9CcmyWCs38NE8TUNTUlIxBydvcotajGfb7oR+q93yVOJhkP+lFYS/I1lfHF:9Fccps3jwgx6xoRX3+OJhkoFYS/Mt
TLSH
T1C8B25B32EC99CAB7ECEA4FD9A74E7A06DEE001A385888AD4DAD81D5D00CB1DD1747C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c0b3248f00bf70b53125a4ebfca01354123ee93ca4356aa3cca745ab4c1578f1
MD5 7c8c3d194cab13314af0098dd0e4a69e
SHA1 9084f6780483bfda1cfa8235bb6658d955cf7a37
SHA512 751f008651fecd87c74a494982d4223fe7de7617acee5230d9127b1fec28c17fd5b0a0522aa375c9d7596437b269dea8891a6b654b1734a1509f782e3d7f6c28
SSDEEP 384:n5yiFPZcIi38N88TUNTUlIR4Te6dbjGfb7oR+q93yV0desd+wvDm4vXpKMHy/7Ih:XFHi3LwgeeoRX3+aBd+wCRU
TLSH
T188D25A36EC65D9B7ECFB8EC9B74A7A029EE40063C6888AD4D9D94D4D00D72DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d4507b7bad942fcfe8b1e29d4bd93e1c7dfb157d5030459d397a8a4b16bffc33
MD5 a52dd9f7c97e51469bc6a87f55ea7b8c
SHA1 e4ad4f0d27b22426603d88131ab40d3cbee61cfc
SHA512 f74a83d382b5d753c79230e92b00236a1cf6f91cdd26e38bbd5cbd812528147704e440f5e9950e4be2d11df3334e1458bc1adce50f924a7a643680e092df0334
SSDEEP 384:nyiFPZcIi38N88TUNTUlIR4TePrbjGfb7oR+q93yV0gesd+wvDm4vXpKMHy/7Ig4:5FHi3LwgpeoRX3+BBd+wCRU
TLSH
T143D25B36EC55D9B7ECFB8E89B74A7A029EE40063C6888AD4D9D94D0D00D72DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 0ad4fb23d3321f9cd5cf0c48600db4f08c2b1179ba08894df75430d24c5b45aa
MD5 7690c281fea834df1c4d54f0c65debdb
SHA1 5c4042981c40f648705624026359783b5f5d3b53
SHA512 a4e0a321fc393902b99b6d0b094117ca872621f679341b72079d32ce6288b8cffb94645cc85160006e4503f3086c55336df76bab2bc7a74dadff576982ec882a
SSDEEP 768:XFjVQXwg+boRX3+sw3WMOVFf48grcOd+wCRU:BVQ9X3+YMwFgTrcOd+w5
TLSH
T1A1138EF198D39DB6D89D9BCB576DAD0269BCC023B1484588B7E46D2DEC8B1BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 2d719e1ee3f13417861d479a9431bccd71f0f9d622ba363eb54e564f41afaff0
MD5 a7b82904d216bb8ad94261cfa69fe86c
SHA1 27890f91db48af96644f9bfd1b0a06e479d2e642
SHA512 20c979d19d564e75a9798aa9e53682940a6b75f3260159ca99a11b2749e041c9278d8f5c6bb315f9f4edca591a45b94a2ee1c20945c64660b055c2498336c06d
SSDEEP 12:TLpOPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isOmQQtudA9zQdBzcQAM:TL85UOl0afDdWec9sJExqGDB5fc
TLSH
T1ED92F422BD352063D8DF0B76F99349D10DFD16AFC9A7B804DAD04D6109A2BC1A6540FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 aba566db9921d446cc730102efc1a9fd5ecdf632735a30d1a24ca5ebe48043a1
MD5 a24c02af0d296d7961779abf608f11d6
SHA1 364f17d1f367b4d85a7670fe673ba407185bff61
SHA512 9a1117c48a1fb2c7cccd1df4e98567357329ce3bdd0f923fdd0b4c8e7bf83006bc4ddc77bc9ffd9c7757c4eef244f38719bfb8fa4c5f1e29b33b2b0bcd04b669
SSDEEP 3:MsEllllkEthXllkl2zEFll1//:/M/xT02z
TLSH
T1DE4404047FC00415CF04103C5011C3D403F4F4104D71574334510417DDD55410C10500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.29.1\typosquatting_list.pb
Size 927KB
SHA256 8da21018e6a6063f029ab8f81ef3de28adbd1740594d43934a231e9bc8458496
MD5 21617bc586960af1751aee4ef90d7b7e
SHA1 8e44d591d02917d5470a382ba5ecb31d03f0cec3
SHA512 75afeab96c768f0647940e940d0e842b2ecd422628a9c0adae06442dc6a27020c85ab03580e6f56382cc2dba3c6cca1f3b8b3e42194f5d27c211075a1faffb27
SSDEEP 12288:a6q8A6KIEJiCG5sskil3XYXHm+nQBfjvG605F0:jGskil3XYXHmyQT
TLSH
T1B215B5B9DFC00194DBB8112D20BE71D8181412A540E9EFEAFE7C855F2BC29C977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a676d28f37985572af58cb2ec6bad9d5da923eb0fdbc547a06799b87813ea2cb
MD5 f0d9462fa5e0debf7f0b330073d94175
SHA1 2c569da035f98e0e029e435a7931a7cc7caaa95d
SHA512 138180360a4b471e8f5d6d2d4c5a363f971c0c96d31a6728353d4b8afbdd7336031e2c7273fa3b94faf09f22c0b20dc2f1ba26110dee76fe69dc38fa1b41213b
TLSH
T1704141D04C3C1AC2D5BD0E6F748738FC82EC9725F4A035386898E9981A7A25D309487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 178fc91a50f24fbabdeb27a7667b349d3e2e924014921d21783054136d6a7b0d
MD5 5d2be1421f5828b91639c185dd42c19b
SHA1 600cda2a6df5196b257ae76c2a432744f50ae0a7
SHA512 6e3cc46afc4418e70cf9b8b666e72d6e2a45b731b8ecf4d127163f6a23d7e4ff69d84f0119a0823906e84128e296c762af52c4280de2ad8c484946cbce483c00
TLSH
T1014131E05C3D1AC1D5BD0EAF748B38FC82EC9725F4A035386899E998597A25D308487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7683b904d607b9fcbf1fdbca0452112555d99c48925968b768206240d61f910f
MD5 a17ac254597e648abd8e6a85e65baab6
SHA1 92e70e4c34ff3385103687a31a8bc8fe843b0125
SHA512 8b0b2b710f52e3a34691ecb5c964a77ea2a4ce442433d233460352211e490c04e4834a40bc59ec5517ffc6b96ee0f86850bb7092e46d869512310644cd6e232e
TLSH
T1FA4131E04C3C1AC1D5BD0EAE748B38FD81EC8725F8A034387859EA98597A25D318487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3804abd25219202fc1d4fab6e5cff19055c3af44ce0e8074df4f46e6f58e2fc3
MD5 69df4a6c435725916fecc8df73021da9
SHA1 139829b5156e8b2a62743460c020a61f0705692d
SHA512 66581da303557f0e1488f02423cbc85375211f851cb932acfeaba48384e97e32cd8cd3765d83729c12e5f93815714dd4ff0cfaecd323ea3d790611773ba51b4d
TLSH
T1E5414FE05C3C1AC2D5BD0E6E748B38FC82ECC725F4A4353CA858E9991A7A25D308487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 de02d7998dbf0f9354440f08f64ab502e2093fd065365d3e461314bc383cf325
MD5 34f2c352551d0e00283f10eefd4523d4
SHA1 4d844aab40d2fb31a55dd7f6296f2a0681c26adc
SHA512 87899307856a9ac7ee654a962cc1b5bfad0a75192131ad24fa37079aa3dc913b2c53225d20cce367b006b44060b5eb7cc66d80bb16bbc68102d618f38283edaf
TLSH
T1444120E04C3C1AC1D5BD0E6EB48B39ED81EC8725F490343968A9EA98597A35D318487F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 19KB
SHA256 fce6395edae90c458a11df3d4df5c15857471d876de4b90e9a07db55ed9f335d
MD5 5c4a6b41299e9e218faaaca27d1c0de7
SHA1 67b505d471e67b275069c2cf845b2a8c20e4c29f
SHA512 20fe41a898340dedf193919db5ad3c75af9c12cb6eb393f12dc53a290831bf1f3ce356fe823518c0242faafdb0982c1c39e5fd7468d7d244ac68802fcd88e8fe
SSDEEP 384:MJWJ/Vca12krtuVm+OglBOVjeQ8RJo6DghvjUSruWp5P1m59+GDa50bVyc/:Y+/VcWr7l8RJxDgNjUeuwa9+GDa50bVd
TLSH
T148923A743AF41365F3B29F749EF1A95A653AB8629C00DB5D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bdzbbtbn.so1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bdzbbtbn.so1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1303616510\manifest.json
Size 118B
SHA256 a50a524184b2420fa2d050e10c7ecc90ff3ddddbc1d39dd7f6ee65aea7e89904
MD5 0839dbc235945a441183b3b1c54e7cff
SHA1 7d50cc09092601adbdfb99927ad0cea8f9b5be01
SHA512 5ef438077e1f23aa36d9abd6639769eedbdffdda85ee368f386638c288893a1b80c8ecac9eb9659b5559296a189c77fc24a7b716bb7914868e6744a30e7bd50e
TLSH
T1EBB092B00C0AA03B22819B60ECA0668683F81218E8029B1A088036482F8817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1328213815\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1734816622\manifest.json
Size 53B
SHA256 551c5f7ed9a2139eab8089f6fd9724b0b38d226b369209cb2ac295b3884571d3
MD5 1bd4aa2766777b47a4fc061677395793
SHA1 5e88d6015511963e10083771e9747459117b0eba
SHA512 0d7d7b5d8f5ea16308268e5ac5986195d5238bf5f30465fc541c70de8dcf8b3f87bb1e2bc38e837119df1d52a78072088d5c822836d04490027a8e071f52db0a
TLSH
T1519002604424951716C10F5065B0BC819391765995850D1D0545155902A546CE054298
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_475006112\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_475006112\manifest.json
Size 146B
SHA256 aeefe4f81560fcaff3291ea907bb7a77361e90e68b866a3e30305edb239c8034
MD5 b5198ae671d9790681e5f5531b056679
SHA1 b53dd9270669ddcc2e53dcbde5add5baa165e29d
SHA512 9107edede2dfc2fd54b2dd11f434457dfcbc79d859172b6bec71afc97bef626e751bf3c5fb671c3f605d07e56f86d222586e4801ec7b7a2357f9067f069611c8
TLSH
T132C02B33C831AC30053007D408F08741EB34134BF500B0163730008D0B3C4706030AD0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/360-1677-0x0000019B41550000-0x0000019B41578000-memory.dmp

Download

memory/360-1680-0x0000000000890000-0x00000000008A9000-memory.dmp

Download

memory/360-1670-0x0000019B414B0000-0x0000019B414F4000-memory.dmp

Download

memory/360-1672-0x0000019B414B0000-0x0000019B414F4000-memory.dmp

Download

memory/360-1671-0x0000019B414B0000-0x0000019B414F4000-memory.dmp

Download

memory/360-1669-0x0000019B414B0000-0x0000019B414F4000-memory.dmp

Download

memory/360-1667-0x0000019B414B0000-0x0000019B414F4000-memory.dmp

Download

memory/1228-1639-0x0000019042140000-0x0000019043140000-memory.dmp

Download

memory/3372-778-0x000001BAAE1E0000-0x000001BAAF1E0000-memory.dmp

Download

memory/5772-1659-0x000002A7F46B0000-0x000002A7F46BD000-memory.dmp

Download

memory/5772-1710-0x000002A7F46B0000-0x000002A7F46BD000-memory.dmp

Download

memory/5772-1367-0x000002A7F4B60000-0x000002A7F4BA6000-memory.dmp

Download

memory/5772-1366-0x000002A7F4600000-0x000002A7F4622000-memory.dmp

Download

memory/5772-1658-0x000002A7F46A0000-0x000002A7F46A8000-memory.dmp

Download

memory/5772-1650-0x000002A7F4D80000-0x000002A7F4F42000-memory.dmp

Download