b349902d9f681078e01c9d136731c24818fb6dc2c03e40d4f6476a4a9a4278a8

Resubmissions

02/08/2026, 17:16

260802-vs55wsdb796

02/08/2026, 17:14

260802-vsf6rstvft1

02/08/2026, 17:05

260802-vlttaatses6

Analysis

user interaction
yes
max time kernel
299s
max time network
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
profileIcon_8fb9x14z55ch1.webp
Size 22KB
Sample260802-vs55wsdb79
SHA256 b349902d9f681078e01c9d136731c24818fb6dc2c03e40d4f6476a4a9a4278a8
MD5 ee3dec72f8cc12e9b7115fa671377fa5
SHA1 90bb12242f255c747745f55cf3b4aa366ddb137e
SHA512 7a519d37d23a0f4935c84c43b2cc2822ffe207eb73757bc395a3ae667279d5c18ff4dee5cfc9d9a71b17ba9906ae47db5a1ecaf75bb083f155fcd96be1e372e5
SSDEEP 384:lsAiGZ5cnLR36+xR7O5zmY3N7gD1CpAyyWjxc1u8t0J810fCPt6+AC:lRWnLR36+xR7O5rC5CpAy5dc1ufJi0fs
TLSH
T19AB2D045230ABDD3D722EC7A105BFBF6D12298F5D9885D66ECBB201C63CA6F14926218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1000_338189346\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1000_478190920\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1000_659474780\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1244_809853321\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1000_649188807\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1628_317950021\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1000_1991322468\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1000_659474780\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_979729697\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1000_891229018\keys.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2376	3684	WerFault.exe	164

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
616	msedge.exe
3108	msedge.exe
2028	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301646018552146"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{07AB7E31-1BE4-45EF-A15D-373255D8F28A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{84A02584-62E3-4D51-BCC0-D482DC3D46C5}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
4320	WINWORD.EXE
4320	WINWORD.EXE
3380	WINWORD.EXE
3380	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
696	mspaint.exe
696	mspaint.exe
1000	msedge.exe
1000	msedge.exe
2604	mspaint.exe
2604	mspaint.exe
4660	mspaint.exe
4660	mspaint.exe
2376	mspaint.exe
2376	mspaint.exe
4320	msedge.exe
4320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1244	msedge.exe
1244	msedge.exe
1000	msedge.exe
1000	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1184	unregmp2.exe
Token: SeCreatePagefilePrivilege	1184	unregmp2.exe
Token: SeShutdownPrivilege	3684	wmplayer.exe
Token: SeCreatePagefilePrivilege	3684	wmplayer.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1244	msedge.exe
1244	msedge.exe
3684	wmplayer.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
696	mspaint.exe
696	mspaint.exe
696	mspaint.exe
696	mspaint.exe
4320	WINWORD.EXE
4320	WINWORD.EXE
4320	WINWORD.EXE
4320	WINWORD.EXE
4320	WINWORD.EXE
4320	WINWORD.EXE
4320	WINWORD.EXE
3380	WINWORD.EXE
3380	WINWORD.EXE
3380	WINWORD.EXE
3380	WINWORD.EXE
3380	WINWORD.EXE
3380	WINWORD.EXE
3380	WINWORD.EXE
2604	mspaint.exe
2604	mspaint.exe
2604	mspaint.exe
2604	mspaint.exe
4660	mspaint.exe
4660	mspaint.exe
4660	mspaint.exe
4660	mspaint.exe
2376	mspaint.exe
2376	mspaint.exe
2376	mspaint.exe
2376	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 4576	1628	msedge.exe	89
PID 1628 wrote to memory of 616	1628	msedge.exe	91
PID 1628 wrote to memory of 4908	1628	msedge.exe	92
PID 1628 wrote to memory of 4908	1628	msedge.exe	92
PID 1628 wrote to memory of 4908	1628	msedge.exe	92
PID 1628 wrote to memory of 5404	1628	msedge.exe	93
PID 1628 wrote to memory of 5404	1628	msedge.exe	93
PID 1628 wrote to memory of 2640	1628	msedge.exe	95
PID 1628 wrote to memory of 2640	1628	msedge.exe	95
PID 1628 wrote to memory of 5900	1628	msedge.exe	94
PID 1628 wrote to memory of 2640	1628	msedge.exe	95
PID 1628 wrote to memory of 5900	1628	msedge.exe	94
PID 1628 wrote to memory of 5900	1628	msedge.exe	94
PID 1628 wrote to memory of 3484	1628	msedge.exe	96
PID 1628 wrote to memory of 3484	1628	msedge.exe	96
PID 1628 wrote to memory of 3484	1628	msedge.exe	96
PID 1628 wrote to memory of 4620	1628	msedge.exe	97
PID 1628 wrote to memory of 4620	1628	msedge.exe	97
PID 1628 wrote to memory of 4620	1628	msedge.exe	97
PID 1628 wrote to memory of 844	1628	msedge.exe	101
PID 1628 wrote to memory of 844	1628	msedge.exe	101
PID 1628 wrote to memory of 5584	1628	msedge.exe	105
PID 1628 wrote to memory of 5584	1628	msedge.exe	105
PID 1628 wrote to memory of 2452	1628	msedge.exe	106
PID 1628 wrote to memory of 2452	1628	msedge.exe	106
PID 1628 wrote to memory of 5364	1628	msedge.exe	108
PID 1628 wrote to memory of 1244	1628	msedge.exe	109
PID 1244 wrote to memory of 3300	1244	msedge.exe	110
PID 1244 wrote to memory of 4756	1244	msedge.exe	111
PID 1244 wrote to memory of 3108	1244	msedge.exe	112
PID 1244 wrote to memory of 4756	1244	msedge.exe	111
PID 1244 wrote to memory of 4756	1244	msedge.exe	111
PID 1244 wrote to memory of 3520	1244	msedge.exe	113
PID 1244 wrote to memory of 3520	1244	msedge.exe	113
PID 1244 wrote to memory of 4172	1244	msedge.exe	118
PID 1244 wrote to memory of 460	1244	msedge.exe	119
PID 1244 wrote to memory of 460	1244	msedge.exe	119
PID 1244 wrote to memory of 4148	1244	msedge.exe	120
PID 1244 wrote to memory of 4148	1244	msedge.exe	120
PID 1244 wrote to memory of 2564	1244	msedge.exe	121
PID 1244 wrote to memory of 2564	1244	msedge.exe	121
PID 1244 wrote to memory of 5724	1244	msedge.exe	122
PID 1244 wrote to memory of 5724	1244	msedge.exe	122
PID 1244 wrote to memory of 2440	1244	msedge.exe	123
PID 1244 wrote to memory of 2440	1244	msedge.exe	123
PID 5192 wrote to memory of 4540	5192	iexplore.exe	125
PID 1244 wrote to memory of 5364	1244	msedge.exe	126
PID 1244 wrote to memory of 5364	1244	msedge.exe	126
PID 1244 wrote to memory of 5364	1244	msedge.exe	126
PID 1244 wrote to memory of 1544	1244	msedge.exe	127
PID 1244 wrote to memory of 1544	1244	msedge.exe	127
PID 1244 wrote to memory of 1544	1244	msedge.exe	127
PID 1244 wrote to memory of 5564	1244	msedge.exe	128
PID 1244 wrote to memory of 5564	1244	msedge.exe	128
PID 1244 wrote to memory of 716	1244	msedge.exe	129
PID 1244 wrote to memory of 716	1244	msedge.exe	129
PID 1244 wrote to memory of 1000	1244	msedge.exe	131
PID 1000 wrote to memory of 3788	1000	msedge.exe	132
PID 1000 wrote to memory of 2028	1000	msedge.exe	133
PID 1000 wrote to memory of 2728	1000	msedge.exe	134
PID 1000 wrote to memory of 2728	1000	msedge.exe	134
PID 1000 wrote to memory of 2728	1000	msedge.exe	134
PID 1000 wrote to memory of 3048	1000	msedge.exe	136
PID 1000 wrote to memory of 3048	1000	msedge.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\profileIcon_8fb9x14z55ch1.webp
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2cc,0x7ff8e3c2c188,0x7ff8e3c2c194,0x7ff8e3c2c1a0
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,3313165745733206146,9279759943432365550,524288 --field-trial-handle=2632,i,13025496716286639056,11485291272234433282,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:11
  2⤵
  - System Time Discovery
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,5539215214435382623,10602166643386430855,262144 --field-trial-handle=2632,i,13025496716286639056,11485291272234433282,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:2
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,13273340759217263522,691513720321301898,524288 --field-trial-handle=2632,i,13025496716286639056,11485291272234433282,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:13
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,3014784757567007600,13352352055431251103,2097152 --field-trial-handle=2632,i,13025496716286639056,11485291272234433282,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,8561027309466328356,18009296447346723760,2097152 --field-trial-handle=2632,i,13025496716286639056,11485291272234433282,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,10530675807931144532,17927271630076752798,2097152 --field-trial-handle=2632,i,13025496716286639056,11485291272234433282,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,15683482138746650257,7298573147826593674,2097152 --field-trial-handle=2632,i,13025496716286639056,11485291272234433282,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,15796027549397014643,5001278212295131020,524288 --field-trial-handle=2632,i,13025496716286639056,11485291272234433282,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,3559824471105142307,16123279508653671166,524288 --field-trial-handle=2632,i,13025496716286639056,11485291272234433282,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,512624539308442156,12175074976054294561,524288 --field-trial-handle=2632,i,13025496716286639056,11485291272234433282,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,10001610141756854669,16751030847037684871,524288 --field-trial-handle=2632,i,13025496716286639056,11485291272234433282,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,10001610141756854669,16751030847037684871,524288 --field-trial-handle=2632,i,13025496716286639056,11485291272234433282,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x288,0x7ff8e3c2c188,0x7ff8e3c2c194,0x7ff8e3c2c1a0
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,10076647139578902833,11686073927494081147,262144 --field-trial-handle=2352,i,6451302379301213500,14151326064480112262,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,8166681763906163171,4436749787505398396,524288 --field-trial-handle=2352,i,6451302379301213500,14151326064480112262,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,2282114920290582077,8524695759091005926,524288 --field-trial-handle=2352,i,6451302379301213500,14151326064480112262,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:13
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,3930283485337974169,3140270642473590126,524288 --field-trial-handle=2352,i,6451302379301213500,14151326064480112262,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,3930283485337974169,3140270642473590126,524288 --field-trial-handle=2352,i,6451302379301213500,14151326064480112262,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,7960850771257026097,3018698802471102545,524288 --field-trial-handle=2352,i,6451302379301213500,14151326064480112262,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,17232581817044810321,4301213455667328672,524288 --field-trial-handle=2352,i,6451302379301213500,14151326064480112262,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,3338005214852497131,16500972249680377048,524288 --field-trial-handle=2352,i,6451302379301213500,14151326064480112262,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,6133140137365216370,4292098373438461192,524288 --field-trial-handle=2352,i,6451302379301213500,14151326064480112262,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,2825673964548299740,12326562070252840106,524288 --field-trial-handle=2352,i,6451302379301213500,14151326064480112262,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5148,i,11971250571467660809,11181330869288440309,2097152 --field-trial-handle=2352,i,6451302379301213500,14151326064480112262,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5044,i,2299339696714123715,13354865828192523353,2097152 --field-trial-handle=2352,i,6451302379301213500,14151326064480112262,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
    3⤵
    PID:1544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,5228654769452140020,14166989910976225976,524288 --field-trial-handle=2352,i,6451302379301213500,14151326064480112262,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,9325279744779161557,6829593015929794172,524288 --field-trial-handle=2352,i,6451302379301213500,14151326064480112262,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
    3⤵
    PID:716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff8e3c2c188,0x7ff8e3c2c194,0x7ff8e3c2c1a0
      4⤵
      PID:3788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,5677472585018571139,4037727933724300182,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
      4⤵
      System Time Discovery
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1424,i,5370526040101295710,16104046231573677947,262144 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,9863234232762169838,5201760927780307113,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:13
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,2530938163769020790,8599225371005908385,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,2530938163769020790,8599225371005908385,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4920,i,9916344395122991043,1349939069626135202,2097152 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
      4⤵
      PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,11592334193287986234,11188408910192429237,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,4493806719930420090,15073650037815389067,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5636,i,5009122912639076221,18281438854246564081,2097152 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
      4⤵
      PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,15428023217884592132,848309513127573245,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,10964882326972269846,210028219476480757,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,11948613186626718108,18006258033891879742,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,12782217129121990688,10298248505762022036,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4084,i,13614776714832211106,7045630580238399277,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=844 /prefetch:14
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,15966669208638913039,6823469477455071054,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=840 /prefetch:14
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=840,i,8929960240557269469,2587315824785994471,262144 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,9331912075963561008,14782116454677024340,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,3601587438363654881,13385135186427536852,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:14
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4040,i,119887842820658260,14795111021894123052,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,11780278946801254081,11453394323117441261,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:14
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2820,i,16728986596806468095,9698650588795005204,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,1421357928023814779,5409853046713278189,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,17162471079730281164,9233377648906746969,524288 --field-trial-handle=2260,i,560934232687010011,17044684910781161812,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
      4⤵
      PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6136

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\JoinExport.jpe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4920

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "about:tabs"
  2⤵
  PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1972

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\CompletePush.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4320

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:3588

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\FormatClose.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3184

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\FormatSync.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2604

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3684
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3296
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 2740
  2⤵
  - Program crash
  PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3684 -ip 3684
1⤵
PID:244

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\OpenFind.jpeg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4660

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\JoinExport.jpe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84157ff0574b559f668f6ed5a82dc8f2c4124730221472d5871d4a71acbf39c1
MD5 3246c6066002c9c5d7091e79b33f1e23
SHA1 e70c12761f2446946e9a6926642139d7bdc39988
SHA512 1ab753cffec1e47b2a3e88e2eeaca91e129d79d01bb99dc6f12ca63e3bf8acd763d8aae5281b22ea78f4815045d8845d840ddba3b507efeb51b1d06ace738f59
TLSH
T1E1D0C0303E4CE548CEC07030E851DB14F2210135384253848000F01DCC6008227DB0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e61962bb0c4fc46a9cda32f814880539db385180b1fd9695fe56b97e16f1d845
MD5 d8bd6b588c29cd8ae6bacf461237a6d6
SHA1 ae666162790fdd30e7f881bcf8373bdd7a03542c
SHA512 f8c11935775435213a01aaafa926cb64d1fcc6a00c0760369e95831e57f4ed00e744701f07b0c5b8b67b1075180f62b28c93c27bea69fd8c3b766078176cb8e9
TLSH
T1ECD02330BD39A3E0DE2C40388010DE106226037736C323C29041580E89B004057D7CD7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb4de712b84da50b4fb370b5cc72bf219fa8acf1c6e74e1ede2210b183822148
MD5 73a17e819f8fb0128a46865b4e115f07
SHA1 e9ede7c40ab0acc8957e812bcc0e827bc4755916
SHA512 876e1347c997115bf252639340541156d64fa4a92cf9f538ab7851b5233e3f53ee5fbdce099ede138a570d28f8a416b8c32b5fdbe511345d160f7199d3d3f2c6
TLSH
T110D09770AA0483A0CA0880349800FA20A223423430D79BA28011640E05A001893DA0C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 242b934338f1677359e0efe2980a2acaee30b8822c9f06b904e28ccc5d12452a
MD5 d8a9f7fd06f82bb794a5e58a55a9080e
SHA1 2871c260f4662cbfa7424b8d85ba8f2372f89c93
SHA512 827666664d8e13bd80b5364289d955bd21d83f0e0754298f74fffa0b58ed8534465c1df17131351ec9fdcdd4bcbe7b7fc02a62f2022269c90dc6af3032a95786
TLSH
T1FAE078C409C5C61D7947B8A7517C53CCC2D1764BD7C4B9051700CCCD790706073C5D64
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3f879dc81bc4f595bb7cada6c52271ccb1cca296f1c9c823f40c770231cff10a
MD5 a2a829a9eb5204ba35ac6610df5df3f0
SHA1 095bdebbe0802e3e75d7f8a08268fbb9d26ba9be
SHA512 1a4503d7c616d4ab7d07d798268613f6b983e6c35b13501cbd2b2bf0a13fec8fc2c343ce09289ee5f37718f9392575a4dfabaca89158192074c374d1d8286310
TLSH
T143E02BAAC9629C3719FD2B1D50514786EA50235FA7808A0F7E3C910C8FB073A468687C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 ef8093fb05be7f68cc215ec7abcee1bdff8f618ecd7cdbfdb9a98cc18ed5723a
MD5 df872f805acf40b9a5998d51340d8fe6
SHA1 2f4f26377c641ab2da4114ceaea68c7f99d90d89
SHA512 cdb8854e0b55229aced8e8c90863dce11967d21f192ac61b9be3c00f56010f339e15ad417ec8b676197a4714958d5e3767535d0166b014e7086ee4936e661d7e
SSDEEP 96:ftlC+f0vxjDmLxRjoJDkhr0OrIBZiozgBBQRlSCwsT+RG22nACA/sH0NkABVmybf:fj0vBDmFRVNLr6H8s9Roqms6DO3+FH
TLSH
T17F133CBD5AD66C12D6D7993E81B35B34CB30CD46D1DA04C78279B268C821F039EDE12B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 ef4f2e3f4cd1c2ea98338a8700a5ab5de2dfd9c15cf4beeeb58abf0a2c71ea80
MD5 18a2f7035e7fe19290b62cc6cf2a26b4
SHA1 628149e13c8bcfd9fcac26f909ddfe1d4ba7c800
SHA512 aff30af8aafe114cf07380a1b8aa5589f230aabf85aeb27e14425b223b3a9c21a45cb531ffd1acea6244a8e71e7109def1f388f0453e95f1cd7a46e28d9503be
SSDEEP 768:DUcig7CBUeGNmL/UTGL/V5rnimCBcTiAbPpuEbSt1OKqbRgzRwLc/xTRuxEx:4M+L/UKL/VsBmjuft1ayzRwixT4K
TLSH
T1C5444FFB1951A01ACBA852F5D2133A3EC177494E7CD2F8E8D67C4C862825F25B2FCA45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 e86a5eeafbc57f70efbad465014ad2ecfa02257a99ab6d343b406c903eeaa4d7
MD5 403bed153e98462c8089c7b2d7005559
SHA1 8cad3f55fa8baaf767c2ceba5ce2de73494c603e
SHA512 22f2db93ea5caa2d9deaf16e2d66b48af893efd34f21ff06d392942858a10916ace5b2e61697c6204f640781b2042585c0f3006cac0942343a757cb1df3a8268
SSDEEP 24576:LHz81XDnKQKLVkzpirXZlX6HmwZlHFMz:LTsTKVRkzpirXTenMz
TLSH
T19C166DEDC96858C3CD63DA30B4F0E9877C7413C3F995C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c828f7fe555551aeed440ddf1432fcc18c8f97b66f86abceff80fca01df0a38f
MD5 86a12746fd4e8b6d2fb1300ea198d070
SHA1 04a1cf11093d29108b6e726e1be12601f75cf605
SHA512 9ac6634a0d122e22aea1f64d638d901df5c6caa4d9b6c8cdf6c4e800dec042e3c0da39510bb6949b54fe9bb2249caed7200cadf63cd410abea83ce67e96e4eaa
TLSH
T1C581FD4423E118D0DF2EA23629BE4D4426F2EC5CAD132FC62149FD687A1BFB079D1523
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7a3212f77caaa095e5d415aa81eeec166d7572aa6bfbb5d4507130503da43b85
MD5 3d5ab80a9d233f0cb9d6246ed3d8fb43
SHA1 2c20130224d24e652d6a84c3400cebc523777bb4
SHA512 4e6bc7c03d37ae8d18894e466bce4edaf5898b24d2ca1204b9878cbcd494c6c5c0bc099799cbaebf0c6fc68ab19dee9f75764f8d702b280533b14dc33ab592c1
TLSH
T1DA41D65063280DD1EFA2B1BBA4FC460932F7FC5D08076ED07644AE754A02F720CD1A63
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4a2ae938e2bf125fa23ee090c98c229177d687a547fc78383db2a19ad9615bc3
MD5 a91572b0a5f21f2b0d67aa328698692d
SHA1 aee92d01394b9e87b4d4e2381c9a1dbacdb3f548
SHA512 82213d6be8e444004ee67ecd30e7821e8651c089e2d331e43ff28e3d24a53e57ac7162fffd528859406ecd9c3882b5617c74a3598ca40cfab001f3f6998d735e
TLSH
T141614B4853E41990DF5D607676BA4A453AE2EC9D1C073BC2210EEE24772BFB039D1D63
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592929.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592929.TMP
Size 2KB
SHA256 e924bf7b3dca57b5ece402ed8792ced79ef1ce6ed195261ab6affef44e7bf453
MD5 8a593e1b8450d91d89776e21d3cf0ee2
SHA1 ed170a7930de8aed86d503fcb4b732f6ac675ca9
SHA512 98e76733d8633767f7ec251f573b70d72cb85e99022c1dec40607d8af44c483973b87312a8f0c9c76261282b3e5eda9daa7e1cbbb91d87b72575b1600844c208
TLSH
T1B241D75067280DD1EFA2B5BBA8F8460932F7FC5D08076ED07644AE754A06F710CD1A63
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 7ba8ea0d3bc0ea783be910d683bcc0227ec6180d11fc81a95a144e6a2d98f179
MD5 601c0ac4ea276b78d4d868fdb2ebe0d0
SHA1 8cd06520ae9979544163d7c61b5fe27a9f6e1ff6
SHA512 5ea08b7832dd3af001082b73dd670dfd050c27f92dd364de35e1ed3add14bae65ccbd3901ad6a8ea045a657e4d9744169154c6fe1eac6079ffb8590175f4b620
TLSH
T166E0C091E9C6C15D7D1138C3513C679882C830AADBC8AC032710DCC47E46006B381953
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 319B
SHA256 b9d4675ab6f8695b06da167ae56678f261c61dc5d5a6984f24540db3a0c0fb9e
MD5 fe8af8bd4f3798d3d5b9b8f36d6798c1
SHA1 a9b107fa77c9f9c6954ffdcbfe9d757397d1aed5
SHA512 a549c2500f660439790893433b6957c77e3d3553860c667951c7502b2c43b10fee1cfbba46a7fc64cfcf9fc1bf1247155f307f96df532a5557be74cdcd7cf66c
TLSH
T108E0264419C9C12A7957B4E7D3A89708C2E0348BEBC83942170D8C49700B14AF3D6690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 323B
SHA256 05e5f0f973289ea8fdd8bb030a1603d1c220ca3916b6acf5d19a75c3c33b9ebd
MD5 310bf3bd8af3115066a4e19ccb35d98e
SHA1 c743a27b44c5732e33662fb22e62969971fe80d7
SHA512 a1582f2a02f5f929a0a1ec55685c159daac21520a55c8765b43f5fa9b0fb28f3f75733064746c51512a8f44bfff74e858e1671ee5ddd412faf666f65bde2c45e
TLSH
T116E026080DCAC1397A5768E7D378A70CC2E03483ABC8B9021709CC44600B205E3C3A91
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 b0c5756eef031cd672dc6425db8965de3c879f7127065140e33e0c04468f764e
MD5 6b00823139fb5aad0005a427c4af1194
SHA1 c3f1ec8a634a99db0e0487bcef7ac9ae8b1ff6c7
SHA512 7e41fe09173c5cc521444ba54bcc9a288236e66c17eac1649133ab782111a2ba87a7ec7e3c68347a7de40f2840fbce52d48be584127207fa2d880ae82a290a4e
TLSH
T178E0865818C9D539A85768FB926C6F0883D5348BABC8FA03670D8C846547A87A397AA0
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 ad0e0ab4f38988f64ffa761106213e3b8107898b7eba645f1f17ab6d6f4e8c31
MD5 54296d57d58ebe3bcd8da44b4f7ea7fc
SHA1 f3e909bcfd503b225757d03130a06237c85dccda
SHA512 0148386fb2ec56d9a6ea8eadd7ada1b37053beb644958355a909eb0571791acf437ed987dfd0bb2cd112e0504886d552933a40f8aa8a6487851bd5b606c10d4c
SSDEEP 3:MsEllllkEthXllkl2zEflEKX:/M/xT02z
TLSH
T1C54402047F80050AC900503040A187905374D41005115B8326A144229CCA5400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 a01f86b8d80124bb6253c95c29ac0ef9d37d582248a53459355e5c56411fe77b
MD5 f968487b6ac2968f16e11a6363c14721
SHA1 89d96b215e7c6344893dd35536d073dd6827ec62
SHA512 3dcc2ca717503396517e798adeb34f72ee945a022bc59be84bdfa95137f0998bea89e9d9d137283a611fe1d54f8503ada1096b18fc2ba0fe398d420434a48846
SSDEEP 192:r++u1nH+bF+UI3iWGVoWN3qL/CnVVV63:rMIkUI3ijVoWN3qL/EA
TLSH
T11D240E0E5F343722CDBD913668E744A35C7DF03F8B1226DA6C6114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 5c17c0f401dc0e96b721ccfbdfb53e239f689cae97276babef151785812f4784
MD5 318cf559bd5c11cd601fa00d0508490a
SHA1 38eca1d6fa2beaf3433a3cd62d20e100313f19cf
SHA512 ab41bffc3f68cba32e23e9d4782d124798e6db3c6cdb0445a6df907affcd8761c4f6dea4cafd0912e75a2dcff65a78ceecf4e19cf5383638cce8b9945831a415
TLSH
T19EE0206559CDC51F7A46308BD26D770CD3F03447DBC8BE026B049D44B447405B7815D5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 9c1204ff2e69202afcd65be649c8f39cd8178f5deb2b2d9835fd3753e918a5a1
MD5 69f422af24631e4aa3592878ed269907
SHA1 152245b2669e57fc86a5bc262f9554dc76f77b96
SHA512 dbd10638104059168f7e68913f5d288e7ebac49f6032bb5408cb2bbe640ebd4ef641e3c722e4aba8ba384871552ef158fa4f127a76c670d87724a76bfcc61aa9
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAwn+oiwuhS2f0:qDeMatha9RAfpy
TLSH
T17CB21D4D1F347210E0B05B36EDD185633F7C501CD3A3369AAE5860F28DA35AFF9164AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2ba5289ad6478c5fed994a4be87b4042f3d20863e953c95b294c5d7d26ee0dfe
MD5 940344e938fa35483b57af277337a530
SHA1 7637928a4bc8cb0fe955612e39e7fa01e3c811b1
SHA512 774ded9da8f76281ca02fbc51156fdd6996f2749b27b050f8054d6f7974375274a42d4374195918645498715fcd414956fac621f8911465c33a88fb6174dbd37
TLSH
T19631CEF3C2F8953D890185F4AB146E1FCE2D0914432C3D9AC8E4AE2BA3E3471E14095F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 301e597234596ce87ceaf393f21d6d26b8cfb22b426ef4ae259d635cd1266d7e
MD5 c4b628c1c7c9847b079dc0ae7f3c711f
SHA1 32736b9b394981fff604e0af1f2a164ed044b405
SHA512 0aef5916d0589bf5a4fb6e3925bdf60daed7bf086cd5ce4aefe0b8ab6c6a80f87501c605d646341ca11fea5033620e8150fbddaec7da9e5c55ca1a5a0fb26e79
SSDEEP 48:YALlgyvPCDWCDScCDHAsJVuaCZs8VzEsVQzsyfoKsDgmgCYksIC7P0BCKCYzC+sd:DxTAM3uaIVzxMciSGP0B5HzItwBib1x
TLSH
T16E91ACF3C3E9862DC91191F0AA146F1FCF1D0555436C3D9A84E4AF5BA3F2871E151A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f901b968df9e46993a08db006ad7605901e19afda0eafaf661ca83042cc3aab3
MD5 5d68f67bf0ae4d08ff49e62e54ae1a0a
SHA1 916038e3c3a0583d469ac493a99cc1fa07124d00
SHA512 8d0fd80f7dc21787736cf203283116678471ce9f0d961fe8c3a84c334267800326db19e3352cfb8e5aeeccbfebc36ef88952db4302430fbb8ee8596112fe3765
TLSH
T1E8719EF3C3F4852D8A1195F4AA146F1FCE190951436C3D5A85E4AF1BA3F2871E141A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 c38548760a1d2a659a833ac7e6f670568bd9024da8548e333a98c80806a824ab
MD5 703506514c059e55088c819d9bd3e534
SHA1 cbcfb5467fb7b1790fee831e0edb48a57cda9ca2
SHA512 80acaf0cea3ddf62f9c81be744f9847459ba3ac7e71dc4a2775f8fe0a75b730c0383282b725903540d9c5e15f1088d503ea3f022acd9e7fc06394f321ff15373
SSDEEP 48:TKIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBSlc:eIEumQv8m1ccnvS6dQBJif5nFXHFH4g
TLSH
T112F2F0FA07276205D99484B0E4009FCFAF16404B47B6B6EC76D447E3F7A20E2B1B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 3ae40ce4618b1cad085bfa6544760e7d7c8ceb7bfa98b76d37b26ecb5784334b
MD5 73e518170ff874bdc56e8160b5ef3808
SHA1 6fb464ca56c0fd8c3fae19fce3d5ff0b818867ef
SHA512 cb86cf54d88d753eff8ace7f29d59a9d3ed89582208539061cb4266c2f0f7496b2b3b25ab60b621c9364d354e8bb01e3970d21502c326b905249a59a29154953
TLSH
T1AAC012E381BAE8771074467D2A9878817675D436114154E4D996D23CB0900BB7A22029
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 857B
SHA256 e461d07db6046928c3a29c8232d2cef7139eef5a945b2d4449e924017bc7b7e0
MD5 6765451cc8bd6272ae36fae695a65344
SHA1 253b8cd7da09eb99bb844b3cd28cc8a64476bbf3
SHA512 ffae264db5ca9e8df1d0f0b3464a770bfe1cee5a4286a43de396e1196e243deaac8cc2b63e5b8d6faceeaa512861c5de4d2ed1328b27726aff074e0cac412953
TLSH
T1F01163E3817FB42B1028497E1E44FC452879E437868164F5CB97C27DB0894FB5612016
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bbd24ee6390d670c1116351e413f5ee6c6c7d481f18cde61e2a75ff3a0870a24
MD5 56b3f852b1c0ccea8ef292026a564ee0
SHA1 a157e7754a212ba4620d957229b9eecb9a8a007d
SHA512 2fa37aef70d0406ee02f683d7c1dfb7a681f3da5750fd0ca283f1230a00fab19d122398c03f4f4c2d23ab8151a41cef25c2af8edbfd5da016e770e776412cf02
SSDEEP 192:sxRHRUyM/jK1Ml8SCT/fVs6WpVNGHm2Sm7aZjKzoD8p4G/g6+WNIY398ZdwgjIgN:sxRH64T/fVs6WvNG2H2b/5IG2d9N
TLSH
T1D862E915AA249D7BDCDBD20DFA517F63D6F81533A1901E44AAFCDA1C00E6AED520381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 71d2287ab09e01f59799db039036aee3610ed945ae7d89c9808de7165d963892
MD5 bb9be93d1172393dde9d149abb2c0489
SHA1 dab2e8579b7f02791f72751e5099197733d2e708
SHA512 07ab6c9302c8a6b626f348ef0aabe13d33fb30c3c7818e5ebbde097c3da0f4a297898c6348ade9caba360ae40bcf537ea8ad1901b26702eb79ff53111bc3b3ff
SSDEEP 384:sxRIDYT/fVsdWvNJv8AzGysvEJ/5f/F/dEzb:s8ET/faYNJzGzvM/5nF/dE3
TLSH
T1A372E616A934597BDCCBD20CFD51BF63D6F81033A5901E48A6FC9E1C00E6AED621382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 07deabfcd105212cf6c15ac2a980606a67788f97f4d9a4d19fb9f7dff7c1ad9b
MD5 82098a6de3eafb76e8955c574cb4e6cd
SHA1 b12db1d52c8247e72f156504016a514c71f0ba5d
SHA512 bbbd301b7cfa13e67a0561131f6c7105ed416c27822d2c55c7f97aa2c45804abf93e13cfc94457450e98fc7dd94e8b3b2e1deff02a19c5211fa791b6ba588ef4
SSDEEP 768:Giqb0o7pLuL7hkWg0CfDs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEMW6Rrop4ic:Giqb0UE7hkWg0CfDsu1jaXF6qp3c
TLSH
T110E2FC3B680CCB7E4F80499DEC2ABE9B6D9801CB5AD8CD5447EA840C03C6BFB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8af920fa-1448-4f4e-8cef-8ba9d9c8784c\index-dir\the-real-index
Size 72B
SHA256 7b747e30715adbfc999a4065966eec84fbb10ee6f027701e988372b3b639469a
MD5 b5de45f3add8f3792d6e00840fbfcb70
SHA1 a6e0779516509179ea563444d6cc3b9d65fab948
SHA512 c836a2f0371e0b990009eaccbfccee270f6ba217a881acecbaddee19aa731fd1653e9d3caa389e82034e0784ac0004051095631d8a24dcc8023f6815cd65a3e5
TLSH
T182A0021613D02018C48B55B0167A41421306CE384A009705C894D1D4D8948959D7141C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5963e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8af920fa-1448-4f4e-8cef-8ba9d9c8784c\index-dir\the-real-index~RFe5963e0.TMP
Size 72B
SHA256 434da850cfb73a0ea56274816cadc1c2da978590a896ad99da5e9f79c5da4493
MD5 f16080c4fb28dee883745a33da579ec9
SHA1 e4791ac5a8ab00886a30f8f6854862b107007343
SHA512 159680388bfecfeca671fc707f3ea27b23137c11c17bbc4fe39123a293f446eefee9f9cca34539a171bf46054ed8f2cf7fc2d8426d9ba78bc32a5ee21f31e697
TLSH
T14DA0021503C80017D09212B6A5E2027A52009C10B2C0269644D102C4DC50D60458700D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bb8c3806-297d-40cc-a13b-a190a1aed944\index-dir\the-real-index
Size 3KB
SHA256 287c8cc38b245176aa2db5a841564ebd4b90f9bd255615a0d96d375ced1f2243
MD5 b245af58183a402cbe2864b820a65b84
SHA1 ef26a0c74f4d810a2b95a1aef280a06e15be1567
SHA512 b3fa4f575a2c74ae20aceaa93349bcff55ccd738e3717ecd653fc9a47505e69423e100700a1ad1771ec70238084d2fa7f387b051ef112212c381293f8c53e381
TLSH
T18751C70E4D077B67DEAD24B328F61896333624FE46849E07955CE9343CC33241E2E616
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bb8c3806-297d-40cc-a13b-a190a1aed944\index-dir\the-real-index
Size 312B
SHA256 5f2f1c5c302ec7dd4dfb2142ac8995c8ce30fd2d0285d22be15745a45955ef5b
MD5 632fff1f61b9b3ca873035c5a6a36ada
SHA1 34facfc3c3903609a4a4c9f6dd211b811555bd27
SHA512 00bb3f746bbc8f31f37ac9f7f7cad4e20459063fd11b36ca0c0696247de577311202474903adda34637003802cdf59645e8449293d93ae1e5d1c046aca644c8c
TLSH
T195E0978EAC925427C6327C3A0673A42A333F0AFD2101AF6A00BE142E5624B3C464630A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5959af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bb8c3806-297d-40cc-a13b-a190a1aed944\index-dir\the-real-index~RFe5959af.TMP
Size 312B
SHA256 1b15ab464b496e23d491e7f10b3f371c4f255327e60f70903467ba3d501b637d
MD5 99ee2b23149625da4016fa844068bcf6
SHA1 27b9753bd19d4db3c2695097cf504e4ac03a6886
SHA512 c86ebdd16c10591855ce08c7a6941f4a9757566ee3ace53e45f87389ebd0e8ac7dcec9925f33459a66f60438cce05f28b3fe1bef175c5d323b0c7b1aa2765e35
TLSH
T123E097CF4490AC22C63628392003950A333F0C303501EA2A20AA081F543129C4641206
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a90d9879b836875016249e64fd75d5934be7a8be271142eacc5354e578afae3f
MD5 3169e5a732940157bf1e740b338bfa2f
SHA1 afb50a21b899d9642fba5a3506907912741014c7
SHA512 2c724587f5e5d68372ddfab3abdeee4b47728d2e5dbc7cbc8891a7c5b34829619092d72f0042abae8d502e0863dc04db596dc4c997f0ee844f45e123e33f566b
TLSH
T1CCE0C6F76DF31C50F8AFC3D2307094B404017868C84AFC8F14DEAA8310A13563495C32
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 89ef2728fe684429fd405454d022b883a5133b77e480740ced4624a2866f5881
MD5 f6ed7b02d21db8916f1bec4414e946b7
SHA1 d12b621cfef05d750bab4ac4fa2318b8c3e91b49
SHA512 46da56fdeb13bb379b95d59222bc22d0335057cce1b52dfe9c55b92583511ae964b9723699932af89f951ddd3c36d16d8e045b403ffdae34ed643bc3ca7f6dfc
TLSH
T138E06FB768A22C50F8AB83E22070A4A404423868884AFC4E109EA68314A13563499C32
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 1dc4e9612ce15853ac25b0b4bf9df079ee5d0c8cc8753c3f98730b8a9046bcc2
MD5 d719ccc6513a7635f0c6d051914ba511
SHA1 560a1de1366916c319ef2c769707398efcbe8cfb
SHA512 0aa7eb22a6cd873442821b5cbbf6dcf817502676c2f07b7542f2d3c6bc6b7dcb68c1d48ba67c82eca6fe38923e2bad13318178b0c3c5eca65b87fc99628aad6d
TLSH
T1EFE0261009CBD1FD7957209752299748C2F97487DBE83D072F20CE44654B509F2F2592
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 2668f6b4f4ce1d75bcb4f82ba8e9485bc5b7a2e4f6a4b23973f12cb9f7874dbd
MD5 887547af4f75f86c300475c53fe9b14e
SHA1 9a3f0c3e411e9a416d75822e55159919d7618fe5
SHA512 6f9bdc329545c002544aea04c4aa79dc122b66f84dd637f67224e77db485ec0f045e40b949417329ed14b1d4b7226b6640431fd681377584cc84f74c6e214d78
TLSH
T147A002F6CA9D918BC44946701069914173505DA925CA138D989FD3A9ACA719071CD501
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 b81e063010f73bc1c5f82e3153bb159536145d358efe97bebc64d39f16dd9360
MD5 76c3be20e1f4a200a458e1c97376d883
SHA1 9c3e7f7c8816387bf6e1b3652cacc46a44753dc7
SHA512 353d7f944dc023c1c487037740161627b9d01beee0bd4c6ef0b577f8e46160aa0c1099fb96798b04c967d23e4deacafb16d7c490e0a299793f7de0f13321bbf1
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5963c1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5963c1.TMP
Size 48B
SHA256 e1c8e97f87a57433a73a380fdbb3a2f49e997e9fac19b6f7d0096b9bf3354aca
MD5 7d88e8012ee8861554372a6c26866fc9
SHA1 0b5ed38d90ad536074f66681c20ccb2f08c17ccc
SHA512 04c85678c0346030381cd593808e079b4fbe445828ed37eadebe5b03ae594950d8312135eceeb0ada3693b9bfb74071a3a21fc1edaaf6d00590f8ae947f84ee8
MD5 SHA1 SHA512

Submit Download

Tabs_13430164599292885

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13430164599292885
Size 1KB
SHA256 42d6f7887135ee8fd8d1159a5faace41f5a9a4393c7a58541462a0d33a1df204
MD5 1c4aa17afff25125eb1dd30328365ce2
SHA1 5904c8079bbd8ee22be1b2bc5870eb9b00a04c20
SHA512 af35a7eae1e5649e5e29a97ada9db296378d6adefe55c8c5a680b32cd5bb9ba7c1a8a08fb15f8c50938a8bab25d1d7e88e0626a1aff74c144fefa49f491f741f
TLSH
T1F541A8379AD91A7FC17E863DD5DB04EAAB35AD1236D00D0B01B2B6441933B1B2F91D9C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 08a20cc68dd5a1d398f2b3944c2d5508d19106e515780ad7b88c09e6628429ae
MD5 7881724f5793c0cc351dcc179ea7cb71
SHA1 da7dc9d6773cfcdc548226bcfb22fdd86368ebee
SHA512 3fd2c6dab56050fdbcbb6c0797b6c20f4111f4f9c7be36a5c091b01a68ac375200e4103bb615d96cf004e51f997b3cd71b0d577b12ae8ca92f817e11e6263b2c
TLSH
T1D5E0D82419CEC7AAB58760D7526CE70881E27743EBC869112B089948A30B1457373551
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 815a9521bc69082cb947b6e31a86cab7afa30517e8a9773e45484d33782fa83f
MD5 578614346bb6e332d262c1dc29ae973b
SHA1 be74f6a6c75a1a9eb5a0a21f2d787bf4db38f036
SHA512 cc051f6853a903952c0fbfcee5ef06d4b636e02018afd0c385b392f8e98221453ca203db111dfe0c0d40af616148656edc62cc05854e454a7d5b3a00916511f1
TLSH
T162E026704AC8C67D7846B0D342B8E70C82F0F8479BC8BE02A70C5844A543505B3A69D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b27bd55cf815fa283e2aa4bdd57e334fffb6127931e7ae403e50bfa76c38c7d7
MD5 0bdee6451e56f1c6c27ee9770fa05d54
SHA1 849f10a32c919043d953b24899ac1cce6e8f3bbb
SHA512 b71bf63642a185f95a9a218b10ac1b09134b34298ffceae1339631d74599f22f74c5a3c3a215cb7b2afe141bd2dc19763fefc042c309f0b2ce554137490d29f6
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHbEBVj5J1WdSIg91K4EgT1c7j6dJOHJGXO:C1i7PF/DWrwfX9mgpct1o7zsHbEBVj5U
TLSH
T1B891FF15703E1291393EAA0C9079882ED6C274E33499E46F7BA905A21F77E038DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 548a82db53ba7892233e75e1c16fb7adb337f2349d33297edd54ecdaa8252df1
MD5 c59bc471276bd51dade6dd9ac4e9d853
SHA1 fc37899d77f53359d842ff5b08297e492e66dff7
SHA512 340fd70d33aa10530d172adaf907b0723df8afe43e5210d26f7934e79bd2f7eb651c992e6021e681b84a39ffe0daf6071ac4dd756938df9ad9b10c363f4a9c37
SSDEEP 384:DNrRZyCSDnxTIC6TMEhIKyll7svbFKfk7:xFZJSDnivYyI1l7svbF9
TLSH
T14C44740A7B747001EDE6D9721CB080771E3CB16E8F22A6D15DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 466B
SHA256 76539135a44d3f29fb29842e1909ceee8b2c72e51062ff06dffc8e76a1842f8e
MD5 828897a925e9231471e2f8f2556ccb1f
SHA1 08c119f80d32329ae89672e8e97cac6b1f6e75d8
SHA512 ed5ecc5ce8bfbdc2d62bea6ab3e58bf9e06d0b07da18a3a1c2522979566c807947d9c8dedcfe0481202682af5d3a043269646ec1b4a1519c40de60aeb2c485a7
TLSH
T14DF07E55E6E1CF7DC40BB5F58121BB813761B70144245457790524683AFF27FD678C53
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 901876b8cf144b90c5faa802d4935789f314e1bc670dd57ad532907d83e6c966
MD5 4f1b3427f24f3a7b38b5a91dbaafe402
SHA1 50ed828e7328964ce4ac38380ded3b71cef1bab8
SHA512 ad9bd13ac5503c9fe5860ce625ccf0da59c918e72199fda1629c4e7e822156566fbc4a7b31ec75fbf8cd957079fc11fa47196f7b6b641f780fd08d5e7777f2d1
TLSH
T12DE07D24ACC9C17FF86620F712285348C3E43D43FFC869461F04C888A407105B3979D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 933c06f57c72b717f280152048dcbfc1078aae8b7ce12cab66b685dd8117cf18
MD5 4b84c578bc35c0bfaa1630b65dfa09da
SHA1 cd1a45cd8c725149cb39073b40d80aaf50ffac73
SHA512 5150b8ecc4fb1abae13331089aaf91fa38be6ee7cc6a62ca5e1808f11a6e21996d221c1d0201c524712acb73f3d303c467d25e1c1dbe72d9888a680b727e2e99
TLSH
T11621B15AF330C008E14A827E647FAB291738D8168FBCED0F54B920656E76B440E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 ed95a4b37bb470cd7b75098aad5829ec825fc6598e1b2f19e6a510a933a837c1
MD5 d29e5929e78cb0d7f4e4501d2dde9c0a
SHA1 85420757579eb60564f6e6603b7802bcc7212188
SHA512 6894057a4c09553b977c26091295d836add8d1e2c5b437f9812a59585a6bc91846e3d847e77008791ce4ec0d057c53ef3f942ca9243e0bcbf2882f1ff6e9e54b
TLSH
T1DFE04854A8C5D56FA8A620EB11689358D2E53C47EFC46E161F04894855071467357591
MD5 SHA1 SHA512 TLSH

Submit Download

197fca31-a5a1-463b-b753-4f1fe1820363.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\197fca31-a5a1-463b-b753-4f1fe1820363.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b9b933dc73ded69fe2e46caf8ec69d1be9c07af508db7d0acc06e8210754d902
MD5 b0a0e77f113fffa94b887a65a817c798
SHA1 2ad3925bc4f78e958f34f492052430114cdca02b
SHA512 9e17cd6f37ade5e9e418eecd2cf2a9f04d877aabeac3ab0680e946321a46fa5170156d7febc37391b44a3bf57bc6411f29a681c1202a339fd5a3a3e6acf5f214
SSDEEP 3:MsEllllkEthXllkl2zEflkH+t:/M/xT02zc
TLSH
T11E4404047FC0040FC500107140F1C3703370D414451157C374D114335CCF5400C01010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 19e8a8436cb35486215cafdfa33a354427cd23acace60a08e14e37dc68f3c7f7
MD5 1c5d65ccf339e470c3bfac3a37c85bc5
SHA1 da5ff9f91b19fe06dd690b41242a983064b07a60
SHA512 5154de4b500a85970417e2ce7086928cbb82e4039dcb1596af0e0f467a38a4ca4f63f77e54d408292191ca32a570f5dd29101fe98845973096c521e522f1debb
SSDEEP 768:qZTfc+wfZOXfjHufjqvShCQLQB2ewBKZO6WLI:qZxwfofDufevSKB2evZBF
TLSH
T171F2AE74EC7469739DE69649BB0A7B13BED45133D5C81B58CADD9F0C00836AE131BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 62KB
SHA256 dbafa8f49f0faa8995d18070bc3a01686e469a9f8551c6f355bb8e669fc04305
MD5 a1486ff12aad3d2766bce59d551acc75
SHA1 a7c842405e3fe3983d03ac7a664426ac55247db8
SHA512 69360ad7ca5a78fb6706495cdf543dff9ad2d27e8198ed9496a167b01e16d0f911495ce11608723ddb65c70124e3969579c5615718b8e2c6d0f6b013b0785772
SSDEEP 1536:AZevSJMDH5cUVLPZ4RyAStdD7rNPevZBF:AZ1G9c2aEASL75P2BF
TLSH
T11953DF79CC60CA7F5CDAB784AB497616BED40233C5E88A88DBC81F0C10A35DEA74BC55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 928e599fe9b1fe592d4e75b6fdc68bfaae607c6837cffa9cf85dc783fe4ec595
MD5 7b5d365496397077700df783ac0183ae
SHA1 1efbc970b858a8401717849a3830c0b27fe27737
SHA512 e38a2c553f544426758dff518c9f7544044ad39bf45b84d8e15643c4cf28500c9c04e6b4b958be3f843700925f5468e235366246011f535be6b2808942942025
SSDEEP 768:4ZTfNnOfZOXfjHdvShCQLGHbrjhpewBKZO6WLI:4ZdOfofDdvS47rNpevZBF
TLSH
T145039E3CDC655D3B8CEDB3446B0E6752ACA45133D4D84A58CBDD5B0C4063AADB70BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d38681d1375f70cf15e493e87268b6e0099f0009912040fc2a0e80e169c6a10e
MD5 ed9a82b4b9b3272f50193312d1e05709
SHA1 439f78d38fbb50946b6cf4469b984a86928a7a07
SHA512 8913b35b848ac969bdd26aa44e1c1bbf694aa9cac96eb9d060e963eedd87daef720e0bd56f7229f9aea815859b8d7fec7d11ad08d775028cff2a5eb9839f1ad1
SSDEEP 768:yZ6fc+wfZOXfjHufjXvShCQapXZbX4jG52ewBKZO6WLV:yZkwfofDufbvS6po652evZBA
TLSH
T1DD138C7DDC242C7F89EEB7086B0E6A22AC945137D5B84618EBC90B0CC073A59F74B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 349d7e2bfd45b2e97dcf626b7b9eb80e3ae03662b0dfc01116407a35e3620a8d
MD5 1985cd5b0452ca8788626c3cb2b84888
SHA1 a50708cab039ac1b6ed9874640819189f5c5e96c
SHA512 ba0b9dfa847a740bd8fb176d55105f6b6ce50879580d0264fa2160898509d7ed7c302b257c880634c1558c9a1fbf842eb5e393b39dc917e76b93a14c3db5f5fe
SSDEEP 768:Rrv+4UNbd435ikc+wfZOXfjHJvShCQt22bwWV:RbsbO35HwfofDJvSa0wO
TLSH
T15603CF32E868A9339DE79248764ABB637EB46173C8C54744DACD5B0D018369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a67a8108c466499ef2da3522513a39b99f242551824c6dccf29f50e95cab3a37
MD5 1bccc2c14437dc84ae34a0ce25e911a2
SHA1 96e2a8dfb6d707477295939fdcbd271020267832
SHA512 e063ddbeb5c1e618e017b29c21d34310283e61fa8d89bd4843be36886f93076aa879a5fff141d4d7e9383e11e4c7a7a08522d01e1a5b4640598b42fb1923f670
SSDEEP 768:wX3xfc+wfZOXfjHufj8vShCQaV2ewBKZO6WLV:wX3vwfofDufIvSM2evZBA
TLSH
T12EF2AE749C75AD739DE6A248BB067753BDD4A133D8C85B48DADD9F0C008266E170FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 da400626ddee359723beece2d7dc6213289c83e5244b7ceb7d531bf238584424
MD5 5d582e1056621e986172707cdf57d82a
SHA1 ace392380e39e38d541f6f9c27606a0ab4be01fc
SHA512 f3c74769079c56acbb29e152c31237a0ebff3b59008662b4ed812da66784f6f19dff32e3d3045f5e2d124ffdaa503b0fe4f71fa7392b09a097e77b4c0cfa841f
SSDEEP 768:Arv+4UNbdU3ofc+wfZOXfjHufjLvShCQRwxKvsi4jGf2bwWv:Absbm3iwfofDufHvSkxKkr6f0wc
TLSH
T12623AE3DDC64A93F48EEB348760D7A227DA59137C4E88648D7C90B0DC17699EF30B866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 1fdc4bfde70c6f4c2674aa95477b3c9ddf62bb66c828f0071f959d874753d61c
MD5 aa4e5dac4f358d1cf1054fa89320254c
SHA1 ccf08766cf4a7d4f5455941eee8637950e45c6e6
SHA512 d4159921bfd8d7debd2c503504947b66173fc413748dabb0742dac7a588f73d29e080d04ee1b3d6b8933312b32f4efe671293f33f7e5edacd0940d50233dbbcc
SSDEEP 3:MsEllllkEthXllkl2zEflS6/:/M/xT02zz
TLSH
T129440404FFC0050DC53450304471D3D41371D510051157C334D114375CCFDC00C01050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 1b5de2bf736e2bb182cf64bd8a72bbbd6538a9f33dc8020223b2257bad6f7d82
MD5 0e16444393cd322124146935ab837ecc
SHA1 aa1a3e9571e3e067421d940601965220711f24ad
SHA512 26c461b0493c5e0f26aa196ce94c0c9ea5d892220ebe882af4bf2892469515e9b13056ef7ae0f9c429f45c14f334299ccffa5bab1547b3da0e2fce45131630a0
TLSH
T108A0120384738406E4144051C49C1341287C805B0219C0012064932304340CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 51fa2add3b372e4d932d6926ca9be223a98d6ad3b63fcf099338f199d0a4ad28
MD5 0bc15719fed893a50e7e1a0840cebcc2
SHA1 b6b38e62996bd5e878b8bdb423c8908c2c7952d9
SHA512 e8025d1cc226ac64ba4fa534aa9a692475cc6f90a825329d6a12e01c23821f5e08fbdc188e3ec58612b5fc7bedb6f5a7f294d0f22467098763b8949281bee090
TLSH
T1D9011ED158391AC6CA7E0EAFA0472BEC44C8952AB2D834B908CDE8A4957985E304183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 42484fb646b24e78c7ea32caa58d8e537eaae8d5f8a37198daf35700b62d78a5
MD5 6e73d6a201428242efa9bbb4b4815e12
SHA1 a1dc5bcc32fca46ab8dc781edf64fd3ed981c2e3
SHA512 28505f4c741b6b803355e51d048d0dd8cf2702bddade54bbff51068a60f3150d9be5d780dbb8cd28b5f8b638260c6bb908a56dd3d543eff0d97984d75d605a86
SSDEEP 1536:F69ZZ9tbYlHtMfeqWra/p1Y4LL+GqEMi0:FCL9t8Pqia/5+6
TLSH
T1CB154F37A164A088CF3C35B1E5ED5F0DBE22650B12E002425F74A67F7A633C9D91B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f9b8d94-352b-4057-84c7-1d3709a71c8e.tmp

Path C:\Users\Admin\AppData\Local\Temp\9f9b8d94-352b-4057-84c7-1d3709a71c8e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1f62b6a-476e-4045-8e14-d69d9799cee6.tmp

Path C:\Users\Admin\AppData\Local\Temp\e1f62b6a-476e-4045-8e14-d69d9799cee6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1244_2141245944\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 204B
SHA256 6c855a1bc8e820d615faf81b4d3196cd64510d6fab3920e442d2966db8ffa934
MD5 90340d5a4aadd52439876976dfc80aef
SHA1 0a2ed34a4e0fbc26fa6da1c5b1ecb061f29daf46
SHA512 bd883a280e1f2f7322681bc9819d1a5e24efa1831fdb793fdbd0ad37bb6677042dc425617b76618018cfbf3535c3dffe714002b4bfe7044202e5da5a04cb72bb
TLSH
T19BD0E99F5354E7F283BC9198783A6DE55FF34875C299106536DC0C922CA0A133457604
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 eca90bc9085d51f1b6dd8f25790a114a592db3efa005b5ff622e05c21ee02334
MD5 eb19a3d4f76a0bb4885d79465426c383
SHA1 e961fa007f6a9423a9d2a4c0336200fcfb44d335
SHA512 c613866cbd0d71bd8aa71a7b5e9a79e0ee1a7296f56dc5ef8cc46770d110581811ed3306b17e2ea08e9dedcc35454bf2673ae8167df812c69b301c599ca9729e
TLSH
T15B71001167E5210EE0E28573ECBB6B05AB75F846AB1EC60F01CD524A0CB1900B9BB77F
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 f5ea7bc652750a7dafe9a2c4c6cb8341c326d38c5ea9c117b7e6d14b69845407
MD5 4f336b1b26e08b0e38d2446f3b6aa533
SHA1 1024acf794c21b47b3ee76874cfc2452f027b25b
SHA512 340817169a1c84fce849108aec20971fded51d2dbd7d24c08fff45db1f096588cce5bd5bd02e7ea05ce46e4d3eb6c7a966c49a2734181e35d1fe25dd55953d2a
TLSH
T14431021167D5260EE0A28573FCBB6B156B71F846AB1EC60F01CD42490C65900B9777BF
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1000_891229018\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3380-1602-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/3380-1601-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/3380-1637-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/3380-1636-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/3380-1635-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/3380-1634-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/3380-1638-0x000001FFC9730000-0x000001FFC9820000-memory.dmp

Download

memory/3380-1606-0x00007FF8C3FC0000-0x00007FF8C3FD0000-memory.dmp

Download

memory/3380-1603-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/3380-1605-0x00007FF8C3FC0000-0x00007FF8C3FD0000-memory.dmp

Download

memory/3380-1604-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/3380-1600-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/3684-1729-0x0000000007B40000-0x0000000007B50000-memory.dmp

Download

memory/4320-1169-0x000002AA20390000-0x000002AA20480000-memory.dmp

Download

memory/4320-1163-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/4320-1165-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/4320-1166-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/4320-1164-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/4320-1027-0x00007FF8C3FC0000-0x00007FF8C3FD0000-memory.dmp

Download

memory/4320-1026-0x00007FF8C3FC0000-0x00007FF8C3FD0000-memory.dmp

Download

memory/4320-1025-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/4320-1024-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/4320-1023-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/4320-1022-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download

memory/4320-1021-0x00007FF8C6560000-0x00007FF8C6570000-memory.dmp

Download