0221ea965b65539cd82a11ab7851d9823f588a4cd83e109ea8f013b196068420

Analysis

user interaction
yes
max time kernel
88s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
V4 loader cracked.exe
Size 911KB
Sample260803-labc5afn4t
SHA256 0221ea965b65539cd82a11ab7851d9823f588a4cd83e109ea8f013b196068420
MD5 c1e8fd805d6fe38f02f6eb2a75e11a47
SHA1 c5b95c5ea26dba486482aaa6e8a5dce23ba88d4c
SHA512 85ad88d034b9b3effd6444e6fbcfe1d7aa5aadf4a30c584f21b78b2822597c551c6ba58876858599cd5ef13a6336235bd3c24e10401f2f31977d4b51c1742c41
SSDEEP 24576:fgsIzfVTZXf7AMz7yJtZ8xiXOidI2axxh:IsyBjKtZ8x4axn
TLSH
T146157E19A7E401F8D5B7C678CE664503E772749A0331AADF03D05AA62F376E44A3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4616_1345078014\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_860453547\_locales\be\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2112	msedge.exe
1264	msedge.exe
5060	msedge.exe
4132	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302224215133735"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{294C0503-5028-489C-ABC4-2C5710FF5A32}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{6C143B93-F95D-4C16-8BD3-7827C6F4DBCD}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
5984	msedge.exe
5984	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
5984	msedge.exe
5984	msedge.exe
3676	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 1392	4616	msedge.exe	92
PID 4616 wrote to memory of 2112	4616	msedge.exe	93
PID 4616 wrote to memory of 4512	4616	msedge.exe	94
PID 4616 wrote to memory of 4512	4616	msedge.exe	94
PID 4616 wrote to memory of 4512	4616	msedge.exe	94
PID 4616 wrote to memory of 5300	4616	msedge.exe	95
PID 4616 wrote to memory of 5300	4616	msedge.exe	95
PID 4616 wrote to memory of 4744	4616	msedge.exe	98
PID 4616 wrote to memory of 4744	4616	msedge.exe	98
PID 4616 wrote to memory of 4744	4616	msedge.exe	98
PID 4616 wrote to memory of 5144	4616	msedge.exe	99
PID 4616 wrote to memory of 5144	4616	msedge.exe	99
PID 4616 wrote to memory of 5144	4616	msedge.exe	99
PID 4616 wrote to memory of 6012	4616	msedge.exe	100
PID 4616 wrote to memory of 788	4616	msedge.exe	101
PID 4616 wrote to memory of 6012	4616	msedge.exe	100
PID 4616 wrote to memory of 6012	4616	msedge.exe	100
PID 4616 wrote to memory of 788	4616	msedge.exe	101
PID 4616 wrote to memory of 788	4616	msedge.exe	101
PID 4616 wrote to memory of 2036	4616	msedge.exe	102
PID 4616 wrote to memory of 2036	4616	msedge.exe	102
PID 4616 wrote to memory of 2036	4616	msedge.exe	102
PID 4616 wrote to memory of 2792	4616	msedge.exe	103
PID 4616 wrote to memory of 2792	4616	msedge.exe	103
PID 4616 wrote to memory of 3820	4616	msedge.exe	104
PID 4616 wrote to memory of 3820	4616	msedge.exe	104
PID 4616 wrote to memory of 4888	4616	msedge.exe	105
PID 4616 wrote to memory of 4888	4616	msedge.exe	105
PID 4616 wrote to memory of 2300	4616	msedge.exe	107
PID 4616 wrote to memory of 1864	4616	msedge.exe	108
PID 4616 wrote to memory of 1864	4616	msedge.exe	108
PID 4616 wrote to memory of 2768	4616	msedge.exe	109
PID 4616 wrote to memory of 2768	4616	msedge.exe	109
PID 4616 wrote to memory of 1656	4616	msedge.exe	112
PID 4616 wrote to memory of 1656	4616	msedge.exe	112
PID 4616 wrote to memory of 1912	4616	msedge.exe	114
PID 4616 wrote to memory of 1912	4616	msedge.exe	114
PID 4616 wrote to memory of 1232	4616	msedge.exe	116
PID 4616 wrote to memory of 3296	4616	msedge.exe	117
PID 4616 wrote to memory of 1232	4616	msedge.exe	116
PID 4616 wrote to memory of 1232	4616	msedge.exe	116
PID 4616 wrote to memory of 3296	4616	msedge.exe	117
PID 4616 wrote to memory of 3296	4616	msedge.exe	117
PID 4616 wrote to memory of 5984	4616	msedge.exe	118
PID 5984 wrote to memory of 5144	5984	msedge.exe	119
PID 5984 wrote to memory of 1264	5984	msedge.exe	120
PID 5984 wrote to memory of 5392	5984	msedge.exe	121
PID 5984 wrote to memory of 5392	5984	msedge.exe	121
PID 5984 wrote to memory of 5392	5984	msedge.exe	121
PID 5984 wrote to memory of 2884	5984	msedge.exe	122
PID 5984 wrote to memory of 2884	5984	msedge.exe	122
PID 5984 wrote to memory of 3844	5984	msedge.exe	126
PID 5984 wrote to memory of 2932	5984	msedge.exe	125
PID 5984 wrote to memory of 3844	5984	msedge.exe	126
PID 5984 wrote to memory of 3844	5984	msedge.exe	126
PID 5984 wrote to memory of 2932	5984	msedge.exe	125
PID 5984 wrote to memory of 2932	5984	msedge.exe	125
PID 5984 wrote to memory of 5080	5984	msedge.exe	127
PID 5984 wrote to memory of 5080	5984	msedge.exe	127
PID 5984 wrote to memory of 2108	5984	msedge.exe	128
PID 5984 wrote to memory of 2108	5984	msedge.exe	128
PID 5984 wrote to memory of 1496	5984	msedge.exe	131
PID 5984 wrote to memory of 3676	5984	msedge.exe	132
PID 3676 wrote to memory of 3140	3676	msedge.exe	133

C:\Users\Admin\AppData\Local\Temp\V4 loader cracked.exe
"C:\Users\Admin\AppData\Local\Temp\V4 loader cracked.exe"
1⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\InstallConnect.mhtml
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x304,0x7ff849c2c188,0x7ff849c2c194,0x7ff849c2c1a0
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,17620146494675818427,7451408185783027631,524288 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,12520349373141532913,12873385748964830135,262144 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,1536149453940055173,4498220636353251175,524288 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:13
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,468579100698089275,4042201024743432068,2097152 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,16642180187528581281,8794930957767765773,2097152 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,11194796351750524740,4529433406070631286,2097152 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,14838437997220078121,2717876198945853094,2097152 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:9
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3900,i,16837170930606962345,3184151200083710823,2097152 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,17592677450811505646,15448478985840147977,524288 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,14241535583004022017,1641796766133500131,524288 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,5155538921340613868,4582237221154396949,524288 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,17394157468210804262,6542577653657639256,524288 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,17394157468210804262,6542577653657639256,524288 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,14670864294112517171,9127552023622355527,524288 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,4186770330416277755,9950177907260528796,524288 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,14493370436376592121,14220917181655647465,524288 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,15676931065934987296,6788026256594574379,524288 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5024,i,958136203771854344,11297763882098634527,2097152 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4968,i,14777817491327806442,10634532084559470609,2097152 --field-trial-handle=2196,i,3332389740895584793,5656585851483061193,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ff849c2c188,0x7ff849c2c194,0x7ff849c2c1a0
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,2885748486896720534,8651275429661168928,524288 --field-trial-handle=2056,i,8136217411488026736,8385228965517255036,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,16885449594227520836,3083897450218891796,262144 --field-trial-handle=2056,i,8136217411488026736,8385228965517255036,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,1644239800702272656,17667616162767725894,524288 --field-trial-handle=2056,i,8136217411488026736,8385228965517255036,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:13
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4492,i,16388692296858793576,16846698173206803421,2097152 --field-trial-handle=2056,i,8136217411488026736,8385228965517255036,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=4532,i,9375879210671287884,7768225579718560854,2097152 --field-trial-handle=2056,i,8136217411488026736,8385228965517255036,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,7125792050239539702,12088402162832406772,524288 --field-trial-handle=2056,i,8136217411488026736,8385228965517255036,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,4198709339545763185,18244134298338481488,524288 --field-trial-handle=2056,i,8136217411488026736,8385228965517255036,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,16961930963734506239,8430244782879575560,524288 --field-trial-handle=2056,i,8136217411488026736,8385228965517255036,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,16961930963734506239,8430244782879575560,524288 --field-trial-handle=2056,i,8136217411488026736,8385228965517255036,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ff849c2c188,0x7ff849c2c194,0x7ff849c2c1a0
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,16753710355924333973,12072700350339523287,524288 --field-trial-handle=2488,i,10550447347908996753,4185649661655381022,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:11
      4⤵
      System Time Discovery
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,11348143243477134287,14623447933694993662,524288 --field-trial-handle=2488,i,10550447347908996753,4185649661655381022,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:13
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,17939943090905545146,10240320524937333851,262144 --field-trial-handle=2488,i,10550447347908996753,4185649661655381022,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4200,i,14533088189631785560,3335110208367929528,2097152 --field-trial-handle=2488,i,10550447347908996753,4185649661655381022,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
      4⤵
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=4244,i,5112881374732323728,9225774921926267529,2097152 --field-trial-handle=2488,i,10550447347908996753,4185649661655381022,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,13183329994770483202,2619308825292147160,524288 --field-trial-handle=2488,i,10550447347908996753,4185649661655381022,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,7855035853061093119,8988453134759363311,524288 --field-trial-handle=2488,i,10550447347908996753,4185649661655381022,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,13674818402310279487,6059431626995073943,524288 --field-trial-handle=2488,i,10550447347908996753,4185649661655381022,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,13674818402310279487,6059431626995073943,524288 --field-trial-handle=2488,i,10550447347908996753,4185649661655381022,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:1340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      PID:5040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x234,0x7ff849c2c188,0x7ff849c2c194,0x7ff849c2c1a0
        5⤵
        
        PID:4204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1948,i,1587068394621989499,6921574603108697057,262144 --field-trial-handle=2488,i,18142035992299319751,4117522040131832899,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
        5⤵
        
        PID:1252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2072,i,10997176451381975751,10503256871141212515,524288 --field-trial-handle=2488,i,18142035992299319751,4117522040131832899,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,6506748721630132431,2802806230749490429,524288 --field-trial-handle=2488,i,18142035992299319751,4117522040131832899,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:13
        5⤵
        
        PID:4360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,4480853623576762920,1923624373938336397,524288 --field-trial-handle=2488,i,18142035992299319751,4117522040131832899,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
        5⤵
        
        PID:4424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,4480853623576762920,1923624373938336397,524288 --field-trial-handle=2488,i,18142035992299319751,4117522040131832899,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
        5⤵
        
        PID:2688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\NewDeny.htm
1⤵
PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ReadClose.htm
1⤵
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3096

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4328

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4636
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\da5ec121-75bb-4422-a64e-c6c31dfb5542_InstallTest.7z.542\InstallTest"
  2⤵
  PID:6092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 553030e495869d2bd45f313ac5b38994cb036b4ed18dea1e5e58045e89c3d8b9
MD5 f546fece0bf80964b471c88b0abc3c85
SHA1 4f21e5a13c8aa45b68723026d14c38c10234898f
SHA512 be29b6273e9e0c80d3d8765ce0017d972a1445ce3413c3f6354fb56c1c7febce9378ef6c45f49ba1f513fae48cae750b20d87d61075e2b548852d1e9e6404072
TLSH
T1D9D023313A5CFA9DC69835715450475171154862B56143087951951CCEF81C21BD79DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97b315d26447e8786a33528915b2b05de33b27a46a80a3487e8a1992f6e6c5b1
MD5 23ffe93ed212a54391779bbe9d4da1fd
SHA1 be73255d0bce485b1721e4116d0c8598ad1013a1
SHA512 4f43477e3635fc73a45d3748cf6fe3f07d30a91213062c2995f522efb24183510becacfe0164cd43f80cdac9efef203f7fd2bb8a7886b08d197a753880984608
TLSH
T115D022317388EB18CA893A31A852E752B2625860B077C725A861A55DDDEC1C953DF0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61d0a0f7e46a67c001075b0d6b7360b570a433355da1a7177df0ffb3ec8fc12f
MD5 9781d1ef07b33d090191f8f9509722c1
SHA1 a698976aa2f44b2c9627081dd768705069b93cf2
SHA512 e6c0749f7263f81b18b1a52033e5c7d3d379d424946d6f9c25b23d577115b9b00d04e49ac5c1426a1c1564486f576cb6dd3ede08231790f7b1011f9271b93522
TLSH
T10FD022317388EB1CCA893A31A852E762B26258607077C725A861A55DDDEC1C953DE0CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e264229a77d2b66f34912e30992c2c77d8d1f5a05e70ea31137cb46f40d0140b
MD5 590944e3e069e7f8d0509ac2716ab5f2
SHA1 db8aba2f35755d76651107d7a2b4b016698895d1
SHA512 917fe7320b860e19acbf3501c3ad7175484d5a5a00214551ccb5d0d200b04aa5548344c88215f5191d7ca7b65314c2af43854fd7b6989f7da34959e328fdb5ef
TLSH
T12DD02371B345D724CA1D55305811E7512263457030B7C77268F6544DDAE80C893DE1C5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0547334b5331f4979e534fd8823b881b085133e138482330069eeec0d2af762
MD5 a876ca31ee69c8f898d00ebbf435b3a0
SHA1 2b1b5e655f169e768be4c547b0b5bab97b1d4a73
SHA512 5c79ce5aa6b76fba7d23dab0a48897bf5f29d25f5b33ee9ee186e4ac3e73390c57b3c2c9c5fdc43981c40c7dd6517ab620e42fff8c882d744d28db81e385d8dc
TLSH
T110D0A771B345D720CA0D55315811A6512262556030AB8B7268A6544D9AE808893DE185
MD5 SHA1 SHA512 TLSH

Submit Download

04fd3c13-2ff7-4dca-9db6-052b6bcf65f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04fd3c13-2ff7-4dca-9db6-052b6bcf65f3.tmp
Size 414B
SHA256 218430028d2a1ed7d8f0699b9fbb715d6bfd7d4bcf8225e796eed86d15333778
MD5 d926c92ad0f6f6abd6cc0de556f15d6f
SHA1 a2e1d7d0aca9a2133fd7d73cda7e4ebf0613fda8
SHA512 dc4407f3e4a0d5e9faf64a3dd8651d76842da55cb4d15be8a044d1e7f4d8de145c6a1ea973db7061bc02c689121ba3daf46f5262bc28ea704ff20af5b6133343
TLSH
T1CAE02B79C821AC3B18FC876910680B86DA5813271751855F3A3D910C9FB0A3A558591C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 add884dc8b570049c4381e34899d623ca8e0be7420dab189ebd79a00438850f8
MD5 0764bc310f60a2ce3f541c773c82f263
SHA1 d74f33711237636b2776154c21a8c87dae5812f7
SHA512 f1f323814e7c49d4f72614d018b773855b397f1787da01d2dc9933d764c455633a5226259a61afc3f00848e29e284a10ea060519db33dbf6d68b3661245bb1e1
SSDEEP 384:frNHuTcGO6YEibhNbllFtv866D8Kd9I7:1RGOSOh7DtE663a
TLSH
T1CB13E83F76440C5BC6CB6A3C07B3AF761376C01AE6E2445B1A3635628254FA78DDEA07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 93fa19dfab805aadf8ec7e62b53190f8b962960fabab4ec17b544612ecfe3aac
MD5 d763a87eea4a65087390c4cc7035c44f
SHA1 a1010c8a88cd61dd4168a2b37dfee8ea9d24e550
SHA512 783e31f5e1fe0de0c386c6d1d2b89d36eab8df5b9780d4b3d20219c487ffb69ff83939605a6dc3a4f3b36681704d3e1abae5a4ded56b2b0a462ea7c69fcdfd65
SSDEEP 384:f4NHuTcGO6YEibhNbllFtv866D8Kd9IM:oRGOSOh7DtE663t
TLSH
T1C0130A3F76440C5BC6CB6A3C13B3AF761372C01AE6E2445B1A3635628254FA38DDEA07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 70f3d48737293badf597779a5b04b2df09442dd4c75a7406d214f44afee5934a
MD5 940281910e3d2c07fe44402303fa8775
SHA1 84747536be5ef8778bd0373de15dfa7441834bb5
SHA512 de25094d257f33581d70cbafcb017c1a5b948a576af816af09e349d3a1963aeac7d4e03efd473824bff8bbc8aa889d9d1090da799c6c3c1acb9203c4346eeb4f
SSDEEP 768:ap+wbNi/hcL/XitL/tKnCVB1ruYobcYKwuGtbMP/+mqlcB6MfKNfuw0+g5EuppPi:ap+9/aL/XyL/tvewFwuGuP/rl2fuAY
TLSH
T1E9444DF71951A00BCBA852F5D2133E3DD17B455E3CD1E8E9E5784C812829F32B2BCA89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e8174347cd7ac7d6592678c456083b2ce7a1a458c1bbf24184c162ecc8a46f7b
MD5 b6f9ce02519844b060f0f3cf1ad329bf
SHA1 ce0d74cbc90d069a9d1b9238c39537413b9bfe3a
SHA512 2691f8f3f09eb9157dc7335da85c1c84a20f12600e43da1c50c0eb4dea44c3a99111ec3b5c83c70dcd9ceadedebe1fa0d6a3a7821a1cf9f5c5fe60dd85ac3ec5
TLSH
T11D51639A032E09F6D75EBCF550FE6684B3F8C864B1CB9E0140D11E370A42F3690E0127
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1f32.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1f32.TMP
Size 3KB
SHA256 42ba8a30ba6222e66053c3099688d5f523d934afc843edd3bda035c8a092a71e
MD5 f5499fbc0205e59f1ef93ee19d1e0a0a
SHA1 b095c2c429919939f636039da625ad70398fe71a
SHA512 157f723113efd493901bde6fe265790b5ca11c334c7230d59f9fdea566f08e516b980f5909d2887dbd5ade94ede5c7a4d1fc1f0d06426b7e2d41b6816cdfd453
TLSH
T10051639A032E09F6D75EBCF550FE6684B3F8C864B0CB9E0140D11E370A42F3AA0E0127
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 31780605ef9dfe9b00c3de14bffe37f909c144ddd272f2c88fe67379079e5665
MD5 5c29820e05f0bdef7f52fa9340295ec0
SHA1 010589781919f2675df92916f5e8f14ba4c86414
SHA512 049d6946f626bf121c840651b0c2cbb7d342bb816d926f138c91859e66de8bd2b20ab875211d143a7b3fb94f8e8038029981fd0cca51af8161dba683fc8850e3
TLSH
T1B2E026A455C8C269D42468D3837CB30DE7E03812BBC87D5217489C41A282741E68E6F0
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 63f2e7bc94cddff62fc189d4235772b574498988e47c1ecbef43d317eb8c28c5
MD5 93a56277cbd9a63137abe2656a903c35
SHA1 437e3330e2c424d137d471ca9ba7cb68796d89f0
SHA512 d293df27eb2307069752ba152e744ba1eefca2a1775ab5ab0c49f776ad0d3a375a1ab64f8529064df713d8cbb0b654214a3b5f5bd0e9ae9329a467b2cd48af46
SSDEEP 3:MsEllllkEthXllkl2zEfl/zH+t:/M/xT02zeH+
TLSH
T1004404047FD0550DC5001030D455C3503370D4103511574334D104337CDF5400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 3c9ed6cfe5570d66b2b8a62fbf50eca8f147827a832589ab5df05f443e4dd771
MD5 e3d9a578879ce98bdd6dfbc03c914153
SHA1 47cbfd3b1fb756d81f730f8032e5159bdd7f4369
SHA512 287614cb577806198f154b869260c8e494b2a119d2a66aebf2dbb771a4335b1ad1ce838778d02e454fc55fffdecdfef3c81d9af4907955b044ff6090a2a0cf5d
SSDEEP 96:rSW2fWtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/6ImbbEOVpZf24JkMfXSFR+B:rSW2RH+bF+UI3iWGVoWN3qL/aVVV63
TLSH
T1DD24114E5F352722CDBD913668E744A35C7DF03F8B1326DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 1d1adbe2d1d9e102cb2a61871054ff00c91af1e5108ae0f7d97d2c2a1086a21b
MD5 40c874e3ada139619decd2753a8ba797
SHA1 fa4f1a149d410e470d05476ee24949382636e6e5
SHA512 e9d9ddf7c5aa7c5aad5d8d5a0441e422ebdbfd26254cb238c4016ce7252c23ea351e96f718d55fae5d695bac34c7832d280f5fc0caf59014832e58e50b29a9c1
TLSH
T116E0DFE165CDC16A6624206B9328770DEBF0340AEB896F821B14A842F681008E7876F2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 57a6fa737b13e433b7df0a1dba524b3ad8eba9a35d4205b9eee7425c12d04222
MD5 86cc0ea8542951aee08ae77bd70f0881
SHA1 ef6a851101b807baf4fa0c635391a27b1215e775
SHA512 802b443cff54f5c5cddc6ce54545dbb0832d270f01cd5222bacdac4073ad927728d2b78e0f6eb53be074a7c169254e0ebde35a8fb991d513d584020bf8134ccd
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7oDw4l9/8m0y:qDeMatha9RA33x8E
TLSH
T140B2118D1F347521D0F45B36EEE085662F7C111C93B32AAAED1850F2CDA25ABF60516A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2bdf4cb13581eb749b9fa790c38ad3bd89e63cbfd1d6072dacb39d8344d76292
MD5 16bf42582ca67ee409da3878d5405992
SHA1 d7a6d0f10bcf8dd7cb08d9be40817b4dde113505
SHA512 862894a5ae7ef8c0f8768da761f8380d0a594a5e72748ee01ad711507ff2b6dd36786fb3b9b70c3f7fd7a11dc8f759ad1e7b8b348af1e42682b676915ac30bc5
TLSH
T13C51DCF3C3E8866E890196F0AB186E1BCE2D0955432C3D5AC8E4AF5BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5c15d8eb950b69e3beb893903cc0a4b00607cd92390df636c8d9e6c68ebe36dc
MD5 711832440e5df7496af86f3f88188ad8
SHA1 dc114e2ff4dc8e6d38697ec75d2cc1fc355cd5e3
SHA512 204b684dc7cb852192cde13a5bb2628158d63661ab7c893bb997f5d755bcec47416d465cc3a27761e492ebfde4f572d0b3626c4ef0d62ce15623aaa177f2d0a9
TLSH
T18A51CBF383E8866EC90156F0AA186E1BDE2D0955432C3D5AC8E4AF5BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 08af5109eee3a66c06b881dea5d6972ca96e45bde357e0114b4a0ca4a4f7fb33
MD5 374dc7fd12347ac8f9d34b928be2fc5a
SHA1 54439aa1d6592cabb6923fe523d056c848d26728
SHA512 eb5360e5fe99b0189779cbd0a17b6a8357789e63b7eb898b33b709f7484fe5af0ad0e9c1c295f2276573d5e96f586d2f6aa049bfc009ac686ebfee9c240e9a36
TLSH
T13E51CBF383E8866EC90156F0AA186E1BDE2D0955432C3D5AC8E4AF5BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 b81ca5ed6465fa9f344b59d2c995105b4a63402d37100b2b0c469fa9d1d8f7cd
MD5 ee29b078842534ed6c221456c7056f24
SHA1 91bd07595f9a942246d520582192d39156be0bf3
SHA512 bacab83dade4fb56e995dbc62f5bab839920f7b60e32795f22237a987c38d3476bdcb9c3a3c3a696ab77cb30df743d670b0f068ce2cd744d9b426e9491a66977
TLSH
T1C4C0125284B9F8B32028D9791D9568867A76D43501A098A0DAFD923DE0900B76F12069
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 78b1fc4f770f53a3f767fc9d15df500c536c40b91777119ab2f239a51e6e4ed6
MD5 78566cc958e5048301f0d60de574f7c9
SHA1 e1dd67e7a458e8c63b1b5e87fed1bd910ca27137
SHA512 88dcfbd1f2edd66e57b9bfadc747721c3d527a959548c6f320d010eec4a5706824ff22e25e1f30ee737357799a04731f644d8c7000b2e352ffea03cac12e3470
SSDEEP 192:sxRpRvoCT/fvs79KKCA94/hzoA8p4u/g6+WNIYD986SrGlhIgVSWUJ:sxRpxT/fvshKZ8Nr/5ISSsK
TLSH
T1E632C716AE68AD3B4CC7E21DBB15BF53D2F9503261D01E58E7FC961C04EA6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3252b13bff0c6f72e9af54e6f157ded424f23c747c85f4c2a145ec8dee832531
MD5 bf43ac7b74b5341efa5e8a25ede9aac0
SHA1 426f82dc5c915d9b5e648c914bab018d03610fc5
SHA512 141a4c832efb6a55ceb8bf6ce8a054c63d6d8c7c4bccad93c8a5f472d675166235e4e2533ce1f94dcac99da2ae9e7b7cd49eb890b6257939209c602c2c92946b
SSDEEP 192:sxRaRv8CT/fvs4WpVv2KCA94/mUbk6OzoA8p4v/g6+WNIYD986SoGlhIgDLSWUJ:sxRaBT/fvs4Wvv2Z8FaHzq/5IiSzY
TLSH
T13D52D715A968AD3B8CC7E21DFB567F53D6FD103361901E58ABFC9A1C00EA6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 69d1987979764805dc3ab62abc5ee272937404d6aabae8a06610e143e1ac2df0
MD5 5b3e97ef541d4200976ce6bb732e3ce5
SHA1 3087bed1144386b5a4e3335fcba048177bf5c739
SHA512 b0ca33e00699a07d1799bee6d1f8aae4cc057e0299ec6bad664cb3f9455666f7baa1762a8deb4db2cf29e67c8888e5e26a20d5ab639bbbdf0c7cc2f5eab4d397
SSDEEP 192:sxRaRvDCT/fvs4WpVv2KCA94/mUbk6OzoA8p4v/g6+WNIYD946S+glhIgDLSWUJ:sxRaQT/fvs4Wvv2Z8FaHzq/5IsSnY
TLSH
T1A152D715A968AD3B8CC7E21DFB567F53D6FD103361901E58ABFC9A1C00EA6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ad9dbbeb41c2e4b9555b9dd30fa40084a2d834b8f81ab0ca53f7dee065ff87d5
MD5 ade9cdb0ddad67e836b0c9a1df408365
SHA1 ff45f090688e44e3f5b36c84255b7b75fe04c34f
SHA512 7326c18381d2ad9fac28305162580bf78ee1bebae6df59f931c04cda38407afaf773fd59f335054acbdf0bf48a757045de43cbf3e6b395194bde3874f41d2ed6
SSDEEP 192:sxRaRvoCT/fvsH9KKCA94/hzoA8p4u/g6+WNIYD9K6SrGlhIgDLSWUJ:sxRaxT/fvsdKZ8Nr/5IeSsY
TLSH
T1EC32D816AE68AD3B4CCBE21DBB55BF53D2F9103261D01E58A7FC961C04EA6DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 34326e6be0335dcabbbceee257f47cefaeef2975c00b02893f8bfe9fdf1a6ee4
MD5 dd9bd3b23062cd0beae3226bcd602e19
SHA1 42c8f7334adc84a9a9ab61fdbf196dc708c75ef3
SHA512 1dfe535f79f36eea16fb394509b682fa81c553091e906b56aced492d9408b9eaa6db46c66cddc0d2471cae59aac4529c58c69511cced2b8df90f7bec3a921532
SSDEEP 192:sxRaRv8CT/fvsRWpVQ9KKCA94/hzoA8p4j/g6+WNIYD9p6SbglhIgDLSWUJ:sxRaBT/fvsRWvCKZ8N+/5IRSOY
TLSH
T19342E816A968AD3B8CC7E21DFB557F53D6F9103361D02E58A6FC9A1C00EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 376744b92c4ad62b952f3fe6956f39ceb0c322b4e1b4ec2ed4723e713960b492
MD5 2d418d8e8851ebbe9c89abab2cec26bc
SHA1 4646de16f4c26cffb12dc7c28675c8bf6d2291ce
SHA512 f8e1fa371fae57b7ee8e1f04dcd56465c35c06f4c29f6a85f8973147035470726779c4d70db3e2ed579ee795077b979343a2168449e6a909fe37665a600c4a18
SSDEEP 192:sxRaRvyCT/fvstWpVv2KCA94/mUbk6OzoA8p4sH/g6+WNIYD9m6S3hsIglhIgDLw:sxRajT/fvstWvv2Z8FaHzr/5IuSWpY
TLSH
T1CA52C715A968AD3B4CC7E21DFB567F53D2FD103361901E58AAFC9A1C00EB6ED620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c1228a01d775491642b0d1f4495cb893b210a01be648b4e16a84ae5ebb83947b
MD5 69c05e064cfba72a78b5138de588e7af
SHA1 4857c3d6ae2195206855132f399a6035668d5dfa
SHA512 58131dd4f5a9e80269dabd78ce276f28da04925c2a11ff5c80770222f9453b053c3373f31c6d2c0372b02fbc25af3f8afd38dc0a967848414db81f2ea6a884eb
SSDEEP 192:sxRaRvyCT/fvsDWpVv2KCA94/mUbk6OzoA8p4sH/g6+WNIYD9m6S3hshGlhIgDLw:sxRajT/fvsDWvv2Z8FaHzr/5IuSW2Y
TLSH
T11752C715A968AD3B8CC7E25DFB567F53D6FC103361901E58A6FC9A1C00EB6ED620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 43815bd642a20807d9c724b72cdac971811254dcad0676803aca711b72d08f1b
MD5 802f3e9179e1c683c393cc742fce4023
SHA1 d4664d8ae7d6087eb2b6fdeefbc1faa8c8c8c903
SHA512 8b1f718c05410828fe367589315aee0fde65dab28c85d2cba9710587602d797671052841a34fb59f15c3e104f37e3a63b8c1782eaf5608834c3fa35c95ef5915
SSDEEP 768:azfWMK7pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5eYc16droppXTn:azfWMiEf30Wg/XfHfu1jaieYy6Wppr
TLSH
T1DAD2EA7B240CCE7F4F800ADDAD197E9B6DA802CB96D8CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 836980e3b55a02b62c98ae5070081d989ab318907b7818c2e0d2787693c7a400
MD5 c01b3af57d52e5b930758ac069fd334e
SHA1 c1ab65201ccf1fa84ce2acf6e8e1793c1cde969d
SHA512 b903071aeb99d0b86e6abd5adcc051ce682a98b4604ed0bfabf0abd1028697213ea1f10395110072c860f6cde86eebe3961a36dabc854c72c61a85fea2e90632
TLSH
T10DE086A09EC9C57D645930830374A30DF6F87527EAC87E422F54D981E283644F6A66B1
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13430222419425103

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13430222419425103
Size 1KB
SHA256 df72c0746ff7135d9bfb2fbaaea89b3bfb7c13e60acb684afa637c408db84bbb
MD5 feb981237d5750c738b06bc148296b31
SHA1 c698ebac31a9d910f3a642dcf23c1e9531e17b73
SHA512 26b72b84ef049f39fb82cea459b99bdcfba6e11497e5e2fdad444ebcb666aa4fcd6414e6328d37cf52a804545de21eb008e9a8272907ea4b0f05d9650f30d3d8
TLSH
T1634148148194153BC2BF4F7DD6AA05F2FA70BD11BA808D0B527571588C73B92AFB4D90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 55ed3e476a8756fb3bc86ab126ed3cf84b501aaf708c0cedbab901313edfa348
MD5 8c356514876e8ff479d15a35a0556c19
SHA1 0739c0072ce21bee34ae70c7ad127660e2137818
SHA512 7b0e9623a49e8cf3a4257459f2a2ff492c94296a6109848c7f1fc020b3767df2b4a41ae17f2c9f2f7771d29a3d0a7317ec41ee26fc812ba5ad461e74c2449b86
TLSH
T16DE0D87069C9C66B6149208B6328E70DE1F27402EEC86D612F09A840F347140F247570
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 777ad044a826055b50c05ec86de27e04fb531d0d595b3d4286c037539cc6574b
MD5 cd8bd4e8408c6946f72306193d941b65
SHA1 efe37f4284361b5fe6b37aeebe0805136cabda5a
SHA512 e1397dabe16e2fb6e297c790cc1131a8fb5c89bf6bc8633171acc843e3c4647a6f0e497d0cb77b8b02851746f08a60e96c1f95f1dabce3cbffce4b397364888c
TLSH
T153E026F0A9C8C639540060C34374E70FF2F07806EBC83E86570C5844E203100F6AADB0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cd3d742baede1e7fadf67a371cb8366bc48bd2583c12819f6d65fe23f9f218aa
MD5 d18bef56e6a394db5d0287cf6661922e
SHA1 332cc3b15bf164b129a940449c8c0e2926477c23
SHA512 a8b7628b4281b58e1cb944f21c1e2d9f5d3a4274fe8be2e447b34971932abf57d2899289e0d6871a0ab2cfbb5028a2496081b9cf1f11a948b1a6fdb9fc16ce53
SSDEEP 96:KQlKKuIKGzGK4U7hiNBXP/25PA9/B2KnT/T2jJhoDhnv:whZGhiNBXP/EPABBRT/TwJhoDhnv
TLSH
T15691491070BE22422D7F244EB1B19A1B4681B062345AECABBF5911E75FA7E014DFCCF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 d0ffc71287ddf078f096f7a1a0e476c354588565057cb6ef351d465cd0e837e1
MD5 dc4ba684825632efa61b2f2411fcde87
SHA1 91c88aa84985c6d6b43617f1755b11a7d5bc280b
SHA512 1b16b5cb441f595d469d8410f4cc1b7d62ab2f0b7e213b57af6b4ba6346e63267c4f7b8008b1a1feb3eb5df1beb8f734cd6adad004e1aa1ae9130ec13793fc8d
SSDEEP 384:zN5RZyCSDnxTIC0MEhIKyll7svbFKfk7:hHZJSDni8yI1l7svbF9
TLSH
T1A644740A7B747001EDE6D9725CB080771E3C716D8F22A6916DB254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 80KB
SHA256 4583ae777918234bbfcbafb70f87e8ebda49aa2511f82aabe992a72363172cfc
MD5 8ed88e84f78371987481236cf029ec49
SHA1 37b1f762e48216f62fa9a6c6c9e38172b3a6498a
SHA512 3d5e035522445daa961ee3be8f9e668b19b3734e7c2f83daa6973cb7adf2e93d5bc15a619f047c696865759efc0ebf4668de8c482b19f47aed0cba8e5ba865dd
SSDEEP 768:HqW6zi8Mcl9H3DUGMwErWcD2pp6o6vk2YvpmuvtLeUc0q/vMUKVjCfoWJ6dWEtft:HvWfppP6vk20lfKgyJZK
TLSH
T113830DF7AE19D1A6CACE91B4A80BFE8450730621C624D9E9BD3D08D37B396033E755C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 4a7e6d9d40027e252f79f42142484d75213f666fca9c2c51af28c7229ecac544
MD5 e64278383c67d22f7d057b6f08a733cb
SHA1 eaa33cf56697dfaaa319fd72672cf882854970e6
SHA512 7e2a0efa4da9ef93a548d1ef2e032d60d6886323383f48acc85b75659a4f9c071f7e1b5e97040bb0a3242aa38c2a725c6959da4bb0cfd8e26ed846d02a53485e
SSDEEP 192:beQBNIIIybCMIMM9YcYamOmtAsAl9HBCsBdOdWoJdWo+8dWobT:beQBNIIIybCMIMiBtm+siKsBYZpn
TLSH
T1B242725B26051FB7C19F5B3A13668650ABD84C824232213FB1D22D1F8DFBB9782D52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 50c38bf419937f40914a5433f7ce833bcc2a02c351a5c8b442ae3625b51073a0
MD5 da3093ce810ee88e0559411ba67555f9
SHA1 160782024f14b24afda71365e6eb137c683aecde
SHA512 d20be479ae3d34e67d2d34a6da264ce48ab336a6109f0f9a6e3d1e82e22e9fbbd8381c76596f39ad8d41ba1f46af0ac8015552d425df37c0d3d2d250b902d03d
TLSH
T196E026E4B8C8C26EB52420871328638CF2E03C53FEC8AD862F00C444E286108FACE5B1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 b209c05fae49bbe418be6d279a1b025a2e4ee9617373c068c20d72e63c99055c
MD5 d91c72268bed47ae714153e5d6082bfb
SHA1 9a8f8587d2a1950d8b4bbe7915cce2f43788e9ec
SHA512 d10bbda6469fe505658ed555efbf29eae62bb3f045a483b7ba23317a269348dcadae2d984b46848248f79f3163492789fa3ef8b5f86b8c5c096017b99b656729
TLSH
T1C6210495F330C208E14A863EA07E9B291738E816CFBCEC0F447924256E72B400E4B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 38fb01c2cea9ebc13cd22bc1fc80f407b3917f31244d4db97700c5c78ce09286
MD5 0989cedd6bec9f95120a129c91719a42
SHA1 d151f4e568640400cdd82f5d41dcd30338b39c26
SHA512 4ad5af15bf286e438cbcb17363e05b4cfba890e69909091bfd30b500ad711806e2aa2afd8e7175814957d2ed7219435063787f8f06e3c0c1a1a1bf64d34e851a
TLSH
T16CE026A0B9C8C1AF9318208302A8A74CF3F13813FEC82F421F00CC44E242241F68E6B1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 0f7cf2881b859a9da3ca0c98226a4eb480a0575ea2e1a58fa1d11c1f4a9157a6
MD5 832e1b345efc760b4fa93546f50f0c0b
SHA1 41f6a7f20d4ab3fd509b7366d1aa56541ee4a9a2
SHA512 3cce49317ff7640857ee6a4cf10467a5192252b18103feec71dcbeb7bbbfc176e0c3b08e018da6cc72ede29b36ef7d57a3ac60ce89268a324a7e4804765cdbfe
SSDEEP 3:MsEllllkEthXllkl2zEflwFhRKlt:/M/xT02zRFHKl
TLSH
T1D24404047FC0740FD50010304073C3D017F0F7100511574334D1043F7CC75400C44000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 0fbae1515dfc4e7b00a3e57f0c98af9fb77480b845a0b14df72e2a77e5215a87
MD5 683cf7797540eea39d09601ad0b04a45
SHA1 5d1edf13f833dde4b1311c0de8a11e78d4bfe2b6
SHA512 23ae527f29ed2f641793db82e5d0a40801c2b9f6ad2e85f11530fe616c69f98340503465501436469f933143cbd8ca148e0fd993280c0964857e1af99db11625
SSDEEP 3:MsEllllkEthXllkl2zEfldRKX:/M/xT02z9
TLSH
T1524404047FC5140DC514503050D5C7501371F415051357477CD1043F7CC7FC00C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 57facffe4225db998b52488234db6d212861f0dd125b46fcec07339d51664030
MD5 f5728d32581d77d6d314cb8c5ac759c9
SHA1 b19140b23d1afc02e51aa71e04ca639168486b3d
SHA512 04aeaec925f9024ba3684dbb612b3f57ad88103233c54c0734cfbd47873568d8a96b13b2b1a2124c49872e0bb5e67af0e3a26df685f9091e42b49ca710d1c68e
SSDEEP 768:9xrv+4UNbdw3Ndi0jxrEnjN3Gac1Ffhy6Dqq+1:nbsb+3BjxQnjMaETt+1
TLSH
T1E613B03069A89D738CFBE285B54B7A437EF0165389D40BE4DAC96B0C15875ED230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 3c26ecb56835ab2b6885725a35d1a8770d6ebbdc98fe2e815f869a2af7c0eab5
MD5 c1e1fc7bd5e5804854f2774e38961642
SHA1 4ca9aa6df324fa82f29604bca064249b8a03313d
SHA512 761fcd0cd7f04f8c1db351c2c1b4cb15665df1ef46b031b302aa52a9c5647cb53a44f14c604044031211fcd5ee46faca1978f57a25b38f6c6a71106ee129eab1
SSDEEP 768:94rv+4UNbdH39di0jhrEnjN3Gac1F+29dAhy6Dqq+1:6bsb53xjhQnjMaHUATt+1
TLSH
T1AF239D3C9D64997F88EEB385714E39136EA40237D5F40AA8D7C9270CD1B74A8F30B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 3e9ec69ec6b9fd7faf6791380b0102ea23127e160781a48fdcc46eac69aeac7e
MD5 15eb8fb278197a2db256e478534e9ccd
SHA1 3c77e278deffff30553b33b50cdfd1baefeebdfb
SHA512 78d53d2bd16a6dcbfbc7036346acbd290de8f28e3037648a369c8b01f7238e59e9498de6b871de18890e0467f792e001f03e1fee391cd099a36f62fce244ac53
SSDEEP 768:9RMRdi0jorEnjN3Gac1W/N9d99hy6Dqq+J:vM1joQnjMaFV99Tt+J
TLSH
T15C039C3C9DA45D7F88EEB385654E3A126EE00237D5F449A8D7D9670CE0B35A8F307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3835d432ce21e36c18b9771d22a071061b971b7398b6c1f2f44c6233eb5c7932
MD5 e597ee7144b4c1bb3764df151415179c
SHA1 929dc08a91e7f28d4b30f2ab5f47af6f022aac4e
SHA512 684a599fb5a497a3ac27189adcfee29411e1fb1956d408ad19a50e845b794353a2ad800944e72d0b492357879fa28eb9b0549e282d424a75d49d5b63e7d1a591
SSDEEP 768:rrv+4UNbdS3cmi0JrEnjN3Gac1Z+eVH1SCz:rbsbg37JQnjMaFEH1V
TLSH
T13203CF3269B88E738CEBA38571877A037EF4525386940BE4C9CD6B0D06D75EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 06c938ec4e5a68c14ed735666fe545996296e90505b6a847cb55fa8cc0b4915f
MD5 37fcce4f6ff10810fd4ad78d399db350
SHA1 0353543c8c306714e0a5ab81347c1b49a96097a3
SHA512 23106e0884e6cf93c53587d1af7f0b450121ba402cc06b047d6b872db871f0325a4f416e2a1e30a05d7143f034acfea0c2d6776ec89466a61c78b29662982c65
SSDEEP 768:9Qrv+4UNbdS31di0jErEnjN3Gac1Ffhy6Dqq+1:ebsbg3ZjEQnjMaETt+1
TLSH
T12013BF3069B89DB38CFBA285B54B7A437EF0165388D40BE4DAC96B0C55875ED230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 54c727af63278c459cb107d4f475d2dd588653a2f1555767b5767bb5c11dd523
MD5 f0e38ee51b25856f8b2f9793ff7094b9
SHA1 55d283d076bb261c6d09612830115bfb6d7e9763
SHA512 e5abd744472abe27972735b73673702741d40b55b6942e6be471c759d21d944c72ee61ba59c643b53f6e9c1f8dca1f709df42fa9869cbb9abf24af41d14039b5
SSDEEP 384:n9WZcI838NCu/zEBEWZlf8hyEG6TFCYMv2rEoajo4cdR8eHhVODjYPNDUPsDHlyf:9E83Tdi0jorEnjN3Gac1Wshy6Dqq+J
TLSH
T156F2BF3459A49DB38CFBE386B5863B436EE0066399D40EE4D6D9A70D15836FD230F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 3244ca417d9623ced68eba94756761134fa0efd1403db6bec9a2c5ea027a8553
MD5 affa5c09c2d41a2a85992850cdd812bd
SHA1 163d4073e90964a64b8e92b36c984126b41c29cd
SHA512 ec0644325bb1d98d19aab719682b3e608465b00c9f36cdf360e2eff76789fbabe2bd841fe3cc812941e4b90bd91ea1a3f0b7d736d13cf6fad146a4e94e551cd1
SSDEEP 768:90BGdi0j2rEnjN3Gac13L79d2hhy6Dqq+J:OBSj2QnjMacb2hTt+J
TLSH
T159039C3C9DA45D7F88EEB786654E3A226EE00237D5F409A8D7D9570CD0735A8F30B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 2d70ebb6bb784970a691ffd5d3f44402939c0fd6e3d81a833c05cbc42e1b5a07
MD5 1f42ca87a7ac03c444b15b5139ffe08f
SHA1 410624c4b4ae4e537616c9346ed71ba837f8ce12
SHA512 4ce60fe1080abadb58a80cc18c68430c1a55c33d06ad2dddd813e29142afa94db7638fe7594af322046b88f9b60f8cc52aba9168bec747939b4b37a647b06852
SSDEEP 3:MsEllllkEthXllkl2zEflQH+l/:/M/xT02zlH+
TLSH
T11C4404057FC0144DCD0010304051C3501370D4101551575734D304337CC75400C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7fe8285-26a3-4bca-94bf-342952998e2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f7fe8285-26a3-4bca-94bf-342952998e2b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe59f61e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59f61e.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

88fc08fd-c8f4-4da3-9891-e421d5463c7d.tmp

Path C:\Users\Admin\AppData\Local\Temp\88fc08fd-c8f4-4da3-9891-e421d5463c7d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4616_1273942137\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallConnect.mhtml

Path C:\Users\Admin\Desktop\InstallConnect.mhtml
Size 461KB
SHA256 d4d5ab080fe51715ccbaad4e76b4593b2b4828d8764c4eaed062c830265ef888
MD5 f757d52334431f064143bfa43d65d647
SHA1 5f0bb54c53bc07e2cfd46946d957c03692e7ba36
SHA512 23f81ce1b63f85b61dca59a4b54bd927dd6ffedd88d4f3d0639dfa2e8d1d3aff154b90e1a7be9959ba3022643094c2ed96b3de66fd5df15bc2f188d39343b022
SSDEEP 12288:OMybbh5QQxZhpoGWN2ksyDgiEHQJB1y1kXQ:OMylhpoHeugiEHQJB1gQQ
TLSH
T1FDA4239461D07D2CAD42F0C81EA1B2620A125E1DBEAEBF8A29CF8DC771F49F114DD85D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads