4dd26e159aa413c1e8c7406128e40ea729ad258548b971b5f04eda15f8775db8

Resubmissions

04/08/2026, 14:33

260804-rwxq5szsfw3

04/08/2026, 14:29

260804-rt3jlsgm9w4

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment (52).eml
Size 30KB
Sample260804-rt3jlsgm9w
SHA256 4dd26e159aa413c1e8c7406128e40ea729ad258548b971b5f04eda15f8775db8
MD5 74fc07d25654d7f1fa993f9fd55fccab
SHA1 875e14c7241deb0d3818c5b232ab9f995a17f7d7
SHA512 ccde04afa65474ec8360d2445a5ddd57bf314009c21127f3423c9d89ccea23e4e2d15d609da7c105d1fcbfab2b574d2d22260683764d1cc35d27fced4aea5036
SSDEEP 768:4B1/y3/MKe3W3GEoUMvfhpKv1L2dfSQEdoxx4il:4BMlMvmvQdfSQEOj1
TLSH
T1C7E27E12C6E24CC2D1B38979B05AB619E0B11E8B4FEB4944761F17F99FCB46B3382B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1236_1028154056\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1080_1259999956\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1236_2142534391\_locales\mk\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4092	msedge.exe
1472	msedge.exe
4588	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303274294607278"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{945A7225-CA9F-4FA6-B914-3202FB77E923}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{6F5C7B9C-D5A1-4EC2-A01E-F8C24EFD6EE5}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{B20D09CA-1CCC-4E6F-A95E-5FFE60F5E0B2}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
1080	msedge.exe
1080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
1236	msedge.exe
1236	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3428	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE
3428	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 1236	3428	OUTLOOK.EXE	90
PID 1236 wrote to memory of 204	1236	msedge.exe	91
PID 1236 wrote to memory of 5476	1236	msedge.exe	93
PID 1236 wrote to memory of 4092	1236	msedge.exe	94
PID 1236 wrote to memory of 5476	1236	msedge.exe	93
PID 1236 wrote to memory of 5476	1236	msedge.exe	93
PID 1236 wrote to memory of 5380	1236	msedge.exe	95
PID 1236 wrote to memory of 5380	1236	msedge.exe	95
PID 1236 wrote to memory of 4240	1236	msedge.exe	96
PID 1236 wrote to memory of 1472	1236	msedge.exe	115
PID 1236 wrote to memory of 4240	1236	msedge.exe	96
PID 1236 wrote to memory of 4240	1236	msedge.exe	96
PID 1236 wrote to memory of 1472	1236	msedge.exe	115
PID 1236 wrote to memory of 1472	1236	msedge.exe	115
PID 1236 wrote to memory of 4960	1236	msedge.exe	98
PID 1236 wrote to memory of 4960	1236	msedge.exe	98
PID 1236 wrote to memory of 4960	1236	msedge.exe	98
PID 1236 wrote to memory of 2432	1236	msedge.exe	99
PID 1236 wrote to memory of 2432	1236	msedge.exe	99
PID 1236 wrote to memory of 2432	1236	msedge.exe	99
PID 1236 wrote to memory of 2312	1236	msedge.exe	100
PID 1236 wrote to memory of 2312	1236	msedge.exe	100
PID 1236 wrote to memory of 1220	1236	msedge.exe	102
PID 1236 wrote to memory of 1220	1236	msedge.exe	102
PID 1236 wrote to memory of 1220	1236	msedge.exe	102
PID 1236 wrote to memory of 3452	1236	msedge.exe	103
PID 1236 wrote to memory of 1064	1236	msedge.exe	104
PID 1236 wrote to memory of 3452	1236	msedge.exe	103
PID 1236 wrote to memory of 1064	1236	msedge.exe	104
PID 1236 wrote to memory of 2356	1236	msedge.exe	106
PID 1236 wrote to memory of 4720	1236	msedge.exe	107
PID 1236 wrote to memory of 4720	1236	msedge.exe	107
PID 1236 wrote to memory of 4628	1236	msedge.exe	108
PID 1236 wrote to memory of 4628	1236	msedge.exe	108
PID 1236 wrote to memory of 4312	1236	msedge.exe	111
PID 1236 wrote to memory of 4312	1236	msedge.exe	111
PID 1236 wrote to memory of 5796	1236	msedge.exe	112
PID 1236 wrote to memory of 5796	1236	msedge.exe	112
PID 1236 wrote to memory of 1224	1236	msedge.exe	113
PID 1224 wrote to memory of 5332	1224	msedge.exe	114
PID 1224 wrote to memory of 1472	1224	msedge.exe	115
PID 1224 wrote to memory of 2944	1224	msedge.exe	116
PID 1224 wrote to memory of 2944	1224	msedge.exe	116
PID 1224 wrote to memory of 2944	1224	msedge.exe	116
PID 1224 wrote to memory of 2932	1224	msedge.exe	117
PID 1224 wrote to memory of 2932	1224	msedge.exe	117
PID 1224 wrote to memory of 4584	1224	msedge.exe	120
PID 3428 wrote to memory of 748	3428	OUTLOOK.EXE	121
PID 1224 wrote to memory of 2684	1224	msedge.exe	122
PID 1224 wrote to memory of 2684	1224	msedge.exe	122
PID 1224 wrote to memory of 2684	1224	msedge.exe	122
PID 1224 wrote to memory of 4236	1224	msedge.exe	123
PID 1224 wrote to memory of 4236	1224	msedge.exe	123
PID 1224 wrote to memory of 4236	1224	msedge.exe	123
PID 1224 wrote to memory of 3484	1224	msedge.exe	124
PID 1224 wrote to memory of 3484	1224	msedge.exe	124
PID 1224 wrote to memory of 876	1224	msedge.exe	125
PID 1224 wrote to memory of 876	1224	msedge.exe	125
PID 1224 wrote to memory of 5924	1224	msedge.exe	126
PID 1224 wrote to memory of 5924	1224	msedge.exe	126
PID 1224 wrote to memory of 5924	1224	msedge.exe	126
PID 1224 wrote to memory of 1080	1224	msedge.exe	128
PID 1080 wrote to memory of 2724	1080	msedge.exe	129
PID 1080 wrote to memory of 4588	1080	msedge.exe	132

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\attachment (52).eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url.uk.m.mimecastprotect.com/s/TPzeCzKw8HRgoo3I4f7Wh9XSoh?domain=api.cloudinary.com
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x33c,0x7ffa775ac188,0x7ffa775ac194,0x7ffa775ac1a0
    3⤵
    PID:204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1960,i,17301910395020062011,6915397922193563568,262144 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:2
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,16177947671491999154,13238323057861881299,524288 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,5094839135904958347,6371684556607485316,524288 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,2383615734089336704,6509078974346732283,2097152 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,18247430922085358410,3740444246371086245,2097152 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,12290907805957492709,446302026371707776,2097152 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,8567372143031409492,13294433834662757305,2097152 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:9
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,441990273322939727,5166509368167854267,524288 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5456,i,16907250143389527136,15244838271908039734,2097152 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,10938630860156206926,3928540307560639633,524288 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,4681733000165877923,12347340842061614144,524288 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,18073222315001754864,14171205467040473175,524288 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
    3⤵
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,18073222315001754864,14171205467040473175,524288 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,14111013280585983100,10454673712043080268,524288 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,3974684142112721335,12386632148476392842,524288 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,14099310380652505294,840531460906422226,524288 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,12009011750455176564,810822434062124453,524288 --field-trial-handle=2520,i,10426275226015034796,17454178807918025352,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffa775ac188,0x7ffa775ac194,0x7ffa775ac1a0
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,7873813494590897612,11323870403649683600,524288 --field-trial-handle=2468,i,17514038398854115982,16670659621427296021,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:11
      4⤵
      System Time Discovery
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,16340864652452413580,1010127257594828945,262144 --field-trial-handle=2468,i,17514038398854115982,16670659621427296021,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,1262682513468598829,9159305411848537066,524288 --field-trial-handle=2468,i,17514038398854115982,16670659621427296021,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,9611353885152032728,4351837348586861927,524288 --field-trial-handle=2468,i,17514038398854115982,16670659621427296021,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,9611353885152032728,4351837348586861927,524288 --field-trial-handle=2468,i,17514038398854115982,16670659621427296021,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5108,i,12112381502491873352,9904091502516859787,2097152 --field-trial-handle=2468,i,17514038398854115982,16670659621427296021,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5112,i,16581254539278372790,7619117000536702336,2097152 --field-trial-handle=2468,i,17514038398854115982,16670659621427296021,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,7696358216905031281,17424235526132760629,524288 --field-trial-handle=2468,i,17514038398854115982,16670659621427296021,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
      4⤵
      PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,16410284184220630549,11805077576212669322,524288 --field-trial-handle=2468,i,17514038398854115982,16670659621427296021,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
      4⤵
      PID:876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6092,i,7550698683814543257,14842204370663734973,2097152 --field-trial-handle=2468,i,17514038398854115982,16670659621427296021,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x264,0x268,0x238,0x274,0x7ffa775ac188,0x7ffa775ac194,0x7ffa775ac1a0
        5⤵
        
        PID:2724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,18347542537861508643,13877781857608045669,262144 --field-trial-handle=3060,i,3803638072737788466,13874483654561486236,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:2
        5⤵
        
        PID:548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,18387617684229826045,1871060364388447918,524288 --field-trial-handle=3060,i,3803638072737788466,13874483654561486236,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,2027423506515531683,12588797827110896434,524288 --field-trial-handle=3060,i,3803638072737788466,13874483654561486236,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:13
        5⤵
        
        PID:2624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,17518373774101351541,11235468798679944542,524288 --field-trial-handle=3060,i,3803638072737788466,13874483654561486236,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
        5⤵
        
        PID:3368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,17518373774101351541,11235468798679944542,524288 --field-trial-handle=3060,i,3803638072737788466,13874483654561486236,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
        5⤵
        
        PID:4728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1240,i,17021348794055071598,14995737870892961112,524288 --field-trial-handle=3060,i,3803638072737788466,13874483654561486236,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
        5⤵
        
        PID:2316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1244,i,3592280946882355851,16655887618852119077,524288 --field-trial-handle=3060,i,3803638072737788466,13874483654561486236,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
        5⤵
        
        PID:1648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,9730924500433732678,11443968563734933342,524288 --field-trial-handle=3060,i,3803638072737788466,13874483654561486236,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
        5⤵
        
        PID:3236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,15840008706136697464,10196484874297925561,524288 --field-trial-handle=3060,i,3803638072737788466,13874483654561486236,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
        5⤵
        
        PID:364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,1378676076383964505,16655671196901649582,524288 --field-trial-handle=3060,i,3803638072737788466,13874483654561486236,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:14
        5⤵
        
        PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url.uk.m.mimecastprotect.com/s/TPzeCzKw8HRgoo3I4f7Wh9XSoh?domain=api.cloudinary.com
  2⤵
  PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 484bcb5c661e6c1ab7c1e8eb0c2dc5467b2aad2bbfa7193f8c39808e2bc6a2bc
MD5 0303b5ff4733f8166294ea49530b902f
SHA1 dcaf0862a7b91f354c8fbd6433da224b0d79fe0f
SHA512 3c3ff7263abf5e7941634b2d489f03a0b875cc87021be2b45ea0f9cc3587625ccfb24009d6570292f82c542e63f3bb31ee266157332eb559db4019f9a6131084
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4622ae2f21d865c5a5e253d35b1a57ac9ce454182669355ebc9592d9d0f14f84
MD5 5f465b2374f6dd2d61891d782bb65181
SHA1 cc675eb358d485606114eb848272e366b831033d
SHA512 08562a947997428ece850a38d9fe2d077063daa644239d27e2e1da6d43d3971613b38d0afb86afd47ba282ae91a3faae0b28644d93e175bec8673c4f4396e2be
TLSH
T194D0C0B03A44E509C6811033B8A14340A2124910B803D2084000F21DDC584C073FF0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0874dc5f22e8bca36f445b35a2e547dc5583739455f101364cc54d1384001f3e
MD5 0a3566fcfa2b3b1bd146893615fbc8b2
SHA1 d08ec2e900cbafcafa3307ff6bb7526991a9180d
SHA512 1907c8d0d9abe18c85d32812b8cfcacd7893c8bd7f478c45a265b170d1b62d813de412d114c76e59e1e3bdd17dceab251e16ff660acb80d9b5b07afe4a2cdf88
TLSH
T1BBD023703D04F9CDC2441032A5F00300A2050A126502D3085000F11DCC780C177FEDCF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa4b92a3964d86d88c386c550ec70f2d11fdff44aec0d289297bf277d6ca14f
MD5 3b71f5d1732e0be86f36f4fadfa0bbb2
SHA1 06e65f6ed24780ce0c11986385b3bd698d10d5a7
SHA512 a0d00dc6e9d7dadf4249fb94f236c8253228aa361649909591493a7bf370306c1b082f9189d5721129deb63595f4539fd933bc8d3dcf5a711166165950740930
TLSH
T1FAD023F0BC22E3D1C61D003184700600121747213683E3925080740DDDB4040F3FEECF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 45617bc782cc56f362823a07f65c45b036d5a0ccb38e833a525b540436943d9b
MD5 aff4dc2d7438e8c822227c9bb9ee9cf4
SHA1 4193c18cbbeee1f90677e0028ec4b9e83bfc2d3b
SHA512 e0d8028a885a54fcd6bcf5fb798840b55c1306a909ef7bd66633ae145078f45e4f3fc4c13e77fc1524622690199adbb3236c6a29f419270eb9ee85f8edb1d404
TLSH
T16BD0A7F0A641D751C60E0031A865A660566786203497D6B29090750DA998054F3EE5CE
MD5 SHA1 SHA512 TLSH

Submit Download

38a15f5b-38dc-4299-a3c4-c05d94ca5735.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38a15f5b-38dc-4299-a3c4-c05d94ca5735.tmp
Size 11KB
SHA256 e1c872234bd61e2eaafdc22512f1beedd72a747d31b1309d56944eb27690b718
MD5 787b38675b22f921ee8fa8c93d8aedf7
SHA1 795766bd966d6e2ef89a4a0f8e013cc92b899b8c
SHA512 3c00c6ece0b1d9453ad1c6e954e1e95a3333b3b5293044f0c767251a6463b0efedebc755b9d9fd0a227105f74950c06b8fa6d52c2304366476eb734e39500aa6
SSDEEP 192:sxRyR4Cg/fps9EiprQ5GzoA8pfG/g6+WNLSj/YnY3hYGAIgVBZaJ:sxRy9g/fps9Fqe/5w/FRoY
TLSH
T1DC32C9166A68A93B4CC7E21DFB15BF53D6F9603261D01E58E7FC9A1C04EA6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8d953c86e74c933cc0c7967b9cdf25bec2f95955d1b7cae013c8946e412b92b9
MD5 45c85fedeece0b47dd8a721979896297
SHA1 bc2b3931161d0fb3b6b5af6c3d4a43ce5ed5600a
SHA512 9fbb61e9df72170a6e430a1105a174bd44dd6aed5d3742c659e993ba472b1dd4fd8a54ddd7da91f241e0ee0b7e464bbeb958348c5cbd7331604a0de9a41c72a9
TLSH
T181E02BB9C822FC374DFD1B2C54A41681E751130B2A804D6F7F3D914C8FB073A468582C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 434f8a86b2258addb1b324cd4afb38442c07b821e9d593b287a0208bab96f60d
MD5 16760c9359a9041f340c23eecb53c83c
SHA1 c00d9a5ebf7d356ab93155d5c05cd64700f8d22d
SHA512 e428480ef7b9eb3585999f4a9b981a6b41e209596dde2e7af10c3dd22e97fa7d69c02c7c129af6afbe57be882d1dbbd186f83f6df8521991a527c30f298a2710
SSDEEP 192:vRKd/1krpAFqut9AAgoFfPeICZ09XA6IFFkuAlunILI:vRW/1k1AFVA8neICu26oSDuIc
TLSH
T11513C33EB7094D93D6C3647C680BBB7193BED529D5C0942783B2380C5E65FA918CE26B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 94a91738739068e16d39db7b6b8152fb2336debc23c40fd59f29ff9a1815188c
MD5 8971bc32ad3b5a35fac5c3c5368d5e26
SHA1 f326780b828c782e3b77165b6736ffed2fe5f0a2
SHA512 0b60a1025860c49cb00c1a69c56e1a61b7bda83b2ab1acf99a90dce5bf83a7eb741906de8183ad8c23a3f22577e07c89bac7448e6769c5ac01c2b25dc5b54883
SSDEEP 1536:riFwL/TlL/r+raoAEV4wRj5XUND2PXHL/ZcL/HL/0:riwL/5L/ar5pB9L/GL/HL/0
TLSH
T130444DF71A51601BCBA842F5E6033A3ED17B451E7CD1E8A9E13C4C852825F32B6BDA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 13c6115565d1bf69402bd3ec3158b61e55fdd26bb0a7afefd01962356bcfd544
MD5 4043d97c9f5d79399777fd53b681700b
SHA1 b177ec1cab89545d95993d70898e873a4e457f7e
SHA512 bb8b5b73ab6f5496013a667c237df8c69ccca9a33aff6dccbd1a46aaeec9255bc37825890b1baff4535f2ecc84e7a9e5af1f9d8d6f1bc6905a3ea6a8aab29db7
SSDEEP 3072:5v9G+HNF7JiHv6K42b770sHDk9vq4ExXx:5Q8/7Jc6KdrjobE9
TLSH
T1CA2518EECB682C42CE6B877074E0E9077E712182F64DD0D39944C5D89BD6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 8264b07797332e79653c0dbb4a072887204d026e3a2af4947c7ac7f43c558c4d
MD5 b9f95f9d32ef61e06d2a60b0a31d5594
SHA1 ac4d65c00dd49b3268a16a9d4ee22b3b3156a758
SHA512 90c0a4fed3b0bafc518e8990862e99a7a2d8b9289c428fbef5b58fc1a37bfc011701e9dc83a3219aa2e32d91813e08aad7eb78fe7454abaeef58e822bf9e67a0
SSDEEP 24576:dH9yij4MP0StZl84JIhZZ4dK10Uxj1KmoP:ddynMP0huI/yUl0moP
TLSH
T180167EEDCA7858C3CD639A30B5F0E9477CB413C3F594C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ecae8e5d005ac32d66d3ae9d6238423911589b4f3faee689447507a7cf0cf9d8
MD5 47fa3a3bb70ab8e810e852af9ca2b877
SHA1 9bacbdb7dfc3d50cce937d9f0b9b8cd1769712a0
SHA512 43588f878bdba8f7d7cdbff3c6a1f9599d00993a7358f19d24af95aafbecf1256cb0e59247ccc94c9f89b6bd5ca001222209f8ecabcba003fc876fcdd1867d3a
TLSH
T16961C86403222AE0E3E8487671E577043AFC9C650567EE1C836CFD786C12F9CE5E902B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5999f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5999f4.TMP
Size 3KB
SHA256 9cb58a593d2b61b77e905ba4497efef09b20d5aa1274f6a11f946cb7b6d464b6
MD5 2f443d7f9c283a96fa12aa465aa12767
SHA1 05963874d4b8a72a613f61f6487698c0d3cab6a8
SHA512 318b8563303bb985c1c49f480b9ca21779df801084f6a5850e2b94a17a605d01a4ae1cf52ba6d6e87c5a14311d2fad9d89f4280d408cbc0813f6d73280869278
TLSH
T1B361C96503222AE0E3E8487671E577443AFC9C650567EE1C436CFD786C12F9CE5E902B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 a529f0e731fa022eaa1a7df23788d592a46fe0d1ed23282487f830aac6d4fc8b
MD5 23a9e23ad2785bff5603376fbb52b1e7
SHA1 e9ce9f6ebf790d37eaace106946deb4fed399e80
SHA512 e68a105d49dea47e9125864c13e19df718b883a94d10d23cfabc820b28f5191998aede04db07080f16a2baa0fda95c64f732073ec2aee9fc33e37f6db68a50ac
TLSH
T18AE0D89659E6C17FAA6034836268674CC1E4394AEF85ED431710C8C4BA02001B2A1D5A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 b7b932bd88552f32a9b2074027b5aed06f9785daf765a2202de2a1f415076ec9
MD5 bb380d67f0affe836f9a3332e8a05816
SHA1 54e5853b09fca9a2d779eba5ed1861db88d2998a
SHA512 9a5fb9d5e0d4caa82fd855b626c6490d54b2599ed6bc625f7523aef55ec903c41fbefa4f3954f246bb19713cd7f507a9e4c0fa76e2b2aa8ce153b5f8bea2e177
TLSH
T1AAE0261409D8C23AE5B4789787687708A2F1388EAF88BD4217098C41B101B85F2F7695
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 9798a303424c129b1f15c37b015c3c2e60043e25098f91ad3e21634abbdf7bfa
MD5 5f07048af390d9d861eb81dd99f37052
SHA1 441702dabcf5890c59e5f95696c2bc8508949872
SHA512 867eea41a71fff861f1ed99a021ae1d5f005623ec0fe5778eb50e534a067181bf8cd6a734a391fdfec30186b34b0b89a96a2d546e753b4c304cef07d85a3d35d
SSDEEP 384:G0cIJ9iY6jIkUI3ijVoWN3qL/TbArJ9iY:pJJ9iu4i93qD36J9i
TLSH
T18E24E85E6F313716CCBD913169EE18A25D6CF13F8B5266CA7C9044A0CFE2652B02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 6ab784b3217d75255499ed97b5307deee4510df8ca617272ec2d83f511717753
MD5 8b122fe77e95166e49be8990c7d8acc9
SHA1 c203567490cc517671759928cb56f06011dd42f7
SHA512 b6c38526161a855662fa37988fe06b08dd83af8b4d9fef4a08386e473d82c9fe5e5c16289b9d622f92c275c208599347ba9426a9cc259f54a06077435b9e3a5c
TLSH
T109E0D87245CDC13D9564308F53247708E3F0380EEF88AE426F049854F442604A6F25D7
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 ecad1e882fd3c3e1f28133180140bca72a2e95435931ea8516554fdddc05ee1c
MD5 57036b668c44bed7e75958a249842e92
SHA1 c6902e229501ebeb308119d6f4fea0a8f4a863bd
SHA512 03ca911e3ae6cd763ba5ff2a0f37a386ff912b23ced017f1f9b50649cc6e04a2400595aae281bf63b5090e80d90e51af6763b2533959d0370fadb1776123dab9
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7oHwnuz:qDeMatha9RATpz
TLSH
T174B2434D1F347111D0F45B7AEDC185632E7C211C93A33A99DD2460F2CDA266FFA0506A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 32a1e0eb2b40136058376e30ed1fde915b0526f8b9e07b4839f59e66e5ceec8c
MD5 cb6b6c8a20a772fbe4ed25233751d751
SHA1 f32f153f5da1712c7b238be39870a7e1f3154865
SHA512 a9d1d254047760ecad3aae06cbec668ba2f18d183b387cef76308556d600c9de63ba955fbbe530fb69a85a82e8daa807aac482b2d79e6527932d01775d90f656
TLSH
T15151CDF7C7E8926D891196F0AB147E1BCE2D0914432C3D5AC8E4EF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4f60df368ab52407d0de1c74fab6567d6252529b8eb6a1ce91e8c75f81ca07b5
MD5 fcbf33343c26a8a11fcbe558f9619532
SHA1 39f83fadc1c38fd778ae5e700e57b5c416073ddf
SHA512 6929fdf5f991a0add23cf78d76c7d25379eaf6a113e425bab8f8f8391b43ebfc205e7264d593eec048bb6500d3910a0c8f9ba94c719fa92b4f36308f4f7975c3
TLSH
T17F51DEF7C7E8926D891196F0AB147E1BCE2D0954832C3D5AC8E4EF1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 dccbddbfb61e9bb299073a6f44b36a63e8d8d15cc87e778ce1d9600f908f6dfb
MD5 17ab245844c74852e5a763261add44d4
SHA1 0c023236321204c0facdca88fbd1582e41496495
SHA512 a0c58b7ec16c746de23ebd3691665fc2dbc37ef2197e7c08b1dbae9e9c8966997505f81fd5db5a7063ae02f46255d6e794eb52fd9c4343b6e935f94b46896e0a
SSDEEP 96:OIEumQv8m1ccnvS69fckacf6CnFpjQ4m54g:OIEumQv8m1ccnvS6yL
TLSH
T147F2CDFE07276106D99484B0E4009FCEAF1A010B47B6B6DC66D44BE3F7A20E2B57975A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 355B
SHA256 f8c300f34960530072937587562694fe75e845766bdf3b281873a4d79a9f8758
MD5 8a5982e197a5dac353b92e2ed10a9108
SHA1 b944488569783423652b432f22df6d6667207ad0
SHA512 8eefefe7c0ec936b300757dd09340d60a76019b5c0078831c74b3faba912e7e142892b616692119e1cced90779b3b4c1f4af81c4bc87a7a2e686c2047f248d95
TLSH
T1B1E02097847EA4631038097F0EC478017736D031024158F4EFE5C77CA0910B71615015
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 355B
SHA256 fe89338acbc49b19b1d94ada7c7c7e746f55b2b7ccf853b95cb4eb2619873385
MD5 08c0312af7745b6874890d854553b0ca
SHA1 c80a73c8ad922102ba8ce8b333bbf70b9536b713
SHA512 76008d52ca31d7c229bdb17ebf44f2c9e544f44728272a7aee4f59dde3cb85a18c6bdb7cd0109a8b254274432245377599dcce65b69bc98270457bc482061cb5
TLSH
T18FE0209784BFA46210380D7F0E8578857A35D035454258F4EFD6C77CA0500B7161902A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3bac6c0156c7074b645a6334222d62697575a14f55c8d599d96692d6ac5ab160
MD5 2792b7da0174dacda957ba2ad705ce1c
SHA1 0f42be956eae2eed791dc0b886d41d39c8c0b108
SHA512 f1f72544b7470dded3dad43762e84cdce68f83d59828c399c191f773ccc2fed2ad079e13be3470d06517ae88ef09c86ce354cc8ae301213ae7e9199f283f8f4c
SSDEEP 192:sxRJRFCg/fpsYWpV7kuprQ5DVczoA8pfR/g6+WNbI6xfYFbcFheHGAIgvBZU7J:sxRJOg/fpsYWv7TA3p/5fflHC4N
TLSH
T16A52D855A928693B9CC7E21DFB157F63D3FA2032A1D15E14A7FC9A1C00EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 97272a92bbf3281773bd4588a8a0cad461b1e51feb3c22e1e93657b0ab41c3ca
MD5 02f7ccadd6b650e5d00e4f2ae7fd342e
SHA1 647243995267b87366815a1c6661c8598bea3467
SHA512 ecee53ebfc57e3ecf674b9f638db52c6132461b47acb22fc89dcf6fddbc82a64dec26f39c677b5ff6e2e0ce881e514dbbabbd99a86667ed71891bd49d75c5fcf
SSDEEP 192:sxRJRFCg/fpss4IIWpVhvuprQ5DVczoA8pfR/g6+WNbI6xfYFbcwheVgAIgVBZaJ:sxRJOg/fpss4IIWvhmA3p/5fflmuY
TLSH
T14452D9166928A97B4CC7E21DFB557F63D3FA203265D15E14A7FC9A1C00EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f457ca4047fd36d05ef5a6530f5c1cd5ea02731944b9ed8f4b211b38701b5f46
MD5 8575559cbb2a866e1132bca13fa2b02f
SHA1 346253642cc6665c4656753de57635e0bfd47a84
SHA512 d3c4811f3423f6385a542b8063d6daf54d2cc7f8eddb8b145bb776a757bec4f1430778f0f463be52402da507cff7a8b18844d0c5514976f22d877e5e752d49fb
SSDEEP 192:sxRJRoCg/fpss4IIWpVhvuprQ5DVczoA8pfR/g6+WN5F6xfYFbTRhetGAIgVBZaJ:sxRJpg/fpss4IIWvhmA3p/5EfELEY
TLSH
T1F252D9166928AD7B8CC7E21DFB557F63D3FA202261D15E14A7FC9A1C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2cea1b2e1688fafd20c317ae1e19cb7448bb477381351ea8ae796adc80f8498a
MD5 1b74cc7b09fa213b4c1a200fe84d7581
SHA1 4672180f8b563a0c49b50be814617849a64128f1
SHA512 0b77274d177de3538d9076e2cf3e7d18a84904509ea510168721de39a63bbae2d3366dd10fb41084b104a51b231f78253a29e710be5a4e669775781358f51176
SSDEEP 192:sxRJRoCg/fpswWpVhEiprQ5GzoA8pfG/g6+WN5FSj/YH8RhWgAIgVBZaJ:sxRJpg/fpswWvhFqe/5U/vLkY
TLSH
T10F42C8166928A93B4CC7E21DFB557F63D7FA603261D11E58A6FC9A1C00EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b7a9c958438247d8b9ad5e816d5d8105c96193292967ea9ad2399e328c75aa25
MD5 57e9f3f4df7394cd32e0e49775392bbf
SHA1 7644abbc6d1bb59cbe3596681134f34e0df15118
SHA512 91f52d9a737ae2b6680b7f327d13c4949de9dcf19a1e229f1d2b14f31dfed355e74c62293b3a6c8dc6ee182767d226a49e35ed1fe5a937a40b457e3cb554a5cf
SSDEEP 192:sxRJRFCg/fpsYWpV7vuprQ5DVczoA8pfR/g6+WNbI6xfYFbcwheHGAIgVBZaJ:sxRJOg/fpsYWv7mA3p/5fflmCY
TLSH
T1D752C9156928693B8CC7E21DFB557F63D3FA2032A5D15E14A7FC9A1C00EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d06f25482ed8063188383975ebc4f8f72c9bc11605a4975e2331005b33aff773
MD5 19a55a9548146294df4bc188f95361a5
SHA1 9a686862568e67a601134847942a6634cdd9f6ab
SHA512 f391bebecb44e12e177f2aa1e35fbe7b7f20685c80e597d1794e3d5e09c811afc20dbceea2f6cdbbdbed6ad5fedbff007292dc7b904517471896152bc01c5428
SSDEEP 768:wb8dq07pLuLfR6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxPmu46Nroht72k:wb8dq4EfR6Wgouf6Mu1ja+PmV6mGk
TLSH
T180D2DA7B640DCA7E4F800ADDEC19BE9F6DA802CB5AD8C94447FE941C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 f5ae2c3583d5c4ebd7cc2b94a6d859a2e4be6fcdccfe5c0aa138880d07d3c036
MD5 73df294ee6d8d46cff7a5ae5e721fa00
SHA1 4fd5576aa4400406f1804556a5e0d3869b062f28
SHA512 fa9b40875eb06639b20ee92d6d371af717a5548840ac360d729d553a339bf14c1712eacaefe2d80f3f56fca87e911cbd047bbe3f5938b0aea0fef34faaac42a7
TLSH
T1B1E0DF280DCAC17DA0A920830324A30CD2F4B80FDFCCBD422F208944B183905B1F29A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 5b55f1d19df25dd5f62c8c51a489ed55e2dd1969b86a869c0a06da47d506344a
MD5 8c3c219fd328e50bd115a00ba67d5afe
SHA1 b3096b058bf7f3d9550b386b9c6d8e93fc72b5d1
SHA512 3059c5c61dc5547110063a21c05f51fa2dd696f8dfeb42f3663ae78f37626c859ef5239b8c5df14daf6b9ead0c4989a779ce6efcac40e8dbf0e01d879348be04
TLSH
T1E8B012107F04420EC7C504701D9C67819350E047704486735E68AF644C597F93FC0CC6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 9fed25c3431b9637ca9b2b91c8b6971b51de45988c79c1fc62427f15a0c197ca
MD5 487ddb82b4f5dd9521fa38232a96202b
SHA1 73bf8344fa72bf26b2cba95ba6a4e85b3d3c5a91
SHA512 05b8fe206f126b1724448e109d9109408d7296fc706e384e1143efcba160c21fb06a1d5ebc6a9fe16db9fd479fb6a0ca3d58067443d4a41c08ae0cb3d79a03e4
TLSH
T193E092251DCEC63EA19520875314E30CD2F2780EDFCDA9956B089485F24634072A35A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 54b373b23e7dc4f316e3e2dcc965a9742b863b4cd040a2bba40199fba5c2f88f
MD5 8443f43c1e6836a1dac89b571e358555
SHA1 c1cf5c76b99cf12f16b843c44395c47abf21d67d
SHA512 82b9a6c5910faab5dccb338e34afe08942e9b0fd93239fd5f69061c215b9cd0d9d8d8eeba2950820a35845f18998e4ba26e0bd0863bd12d50309012986a3d19f
TLSH
T163E0867449EAC639945564C34374B70D82F07C0E9FC9BE86570C4445F102554F2F69E4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ee4034b52c2398174686b0d2c34dbfbdf717841b1b5ca02f70d043eb8866114c
MD5 8b21824c51594850acd0100db077002c
SHA1 fd10976e180c960be0af4b3ac566db55337edb35
SHA512 e78f6c0184af630c6aec9e9ff23df175302350001d287db4d15c05e81e73ee18c1303bb9ff0f4988eb8a216ae9a67ecfcca5550fcf7ee2cbb57019d59a97d031
SSDEEP 96:KRafG6MsMaW0xpgqaK4vgwac6yZIKTFNcX7NnHx+busEzxKs4EtxIl9GzHSyaQKF:CafG6MsMl0x6qivgwh6yZIKTHTPEC
TLSH
T1E4B1318571BF06703D7E6A0C82648926628374A3361DED2B77B880655F67E015DFECCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 02bf7f46d625825266dc78b417822d6b6e29e053d96508cd0b3c8088d1c78a1d
MD5 f3674e34be3ecd0750d97cecb72f6a34
SHA1 e9bb6c1aec737bcacb814a923d6827dd780b81d3
SHA512 2b39558340a4ea550925f68f1b6f7a6ad7f30f43c743060497759ecd74be7f4622d74e8379088ffecf6608393c3ff49dc60d660fb7aa5b14ecd22919eff84e45
SSDEEP 384:DNrRZyCSDnxTICEMEhIKyll7svbFKfk7:xFZJSDni8yI1l7svbF9
TLSH
T12E44640A7B747001EDE6D9725CB080771E3CB16D8F22A6D16DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 09e772cbcf94099dd6fe57b94a1b434924de3c2eae2af80122a3435b9b766537
MD5 271ec19ece98d52d358e1b4e53c45923
SHA1 5216a1263535a6b5d580a8db9b77339891eeeb66
SHA512 2a8a51522b6bf4e690491054073b8c944eb5f6c0617d1e4e09901dfc03ad502d3d5888b31b572f3e572aea12ce49ac821e4985e8e8ff9e29baa9130d02765653
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBgm+xGt:DEK3tjkSI5IUltGhp22iSBgm+xW
TLSH
T14252879BEE342212DCEA83318AC001E17E7A903E8FC1EB0254D610211FB4691A31E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 fb3414bcc4526a8293425b33e200e6d2510228956480e1757f838fec0e5ba127
MD5 e413834a26b8bf3ed0f4c82959f3d4ec
SHA1 58e9a425a244d79fde7726d9294aef0c24c464f8
SHA512 a2ac352c2d40ca442299845e70e45099a5804cfe915731341122f3425e474db910bdd92ee6d103a801699910c33a0b64e0248c348eccc59633b8b43651e264a6
SSDEEP 192:CQoxIIIRbhMIMr9EYcYYuyOo4HAsE4lrhMQ2sENSjogpZ:CQoxIIIRbhMIMREBuo4gsE6N2sE8
TLSH
T1C042416A16061B77C15F5F7A277386849AD898820073212D71972C1F8DF3F97C2D6AF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 35fa8b01d55902f55ae472a0c8d645fd8303609fe51225a79701f5a608510148
MD5 5aca08e6f6165b0daf3afeb462804c19
SHA1 68c35b483307402b8d09a7ef04ad6dad65e0a9ed
SHA512 6d937d177f83bdac362690e7ff7169186ce51d2250d2f5d25ff1a13145c9faeaa283146e817d377c79078679f08acdb518a64c9a14147e7b0bcadf95d0d32b8b
TLSH
T1B9E0DF10A8C8C17EA474748752245388E2E6388BEF8AAD861B118484B041A08B2A6992
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 13f2fdf5b3fc3f3a6dfac3d1fb31f7771f2357f797f269a26a8b2369b4ceeb84
MD5 d176a7d1260f9704c12efe4cb4e49fa4
SHA1 34050d8fee1ac6f8afb689a131b92941840919d4
SHA512 4faeff98ce9c696dc1a5de4ef15f668cfd87db9f0677835b0f836d163f7bea30a98a95b9ab8b19860a1756b1c9c6c8448f48687e911e629e33a771a46afbd666
TLSH
T152210451F330D108E54E923A607E9B260338D8438FB8ED0F44B670792E75B141E8B2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 1d7a4b444a7dcae882b891616b7ef0122fe74a76a0faef9c7eb3d979d32bc502
MD5 dd3c7358c2af4cac9f2802a2f98ad4b7
SHA1 4d0c635d350a782774dbc9d9ec2ee3433b6d210c
SHA512 8613b55887f8024d3fbab6826e012e1a92d7df08e9cc3796a9ecd84962c993c2547832303df6d3f27770a402c6ac6e0b7efe1b9f56ecfe3301d784747846f75f
TLSH
T1E0E0D86078C4C17FD070309343649348D2F13C4FEF846E421F169C44A10164172A7592
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5abf3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5abf3a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 5ce4b70714a14d6edd3984aff6ffbf91500bc469237550e8fd2812a4b6ad0e23
MD5 c2cc02209692a818860bc7cca262985b
SHA1 eace9a5e211534271e6c46edbfb65dcd62031ffd
SHA512 ba7e89b94315fd7c09b67a6a9ad133e4c1b566da570f2096d931cc8263bac30d4f9ec28d491e3f20ed22b7bb5b71ab7037692a40d790e4a0d5292d02fde33f58
SSDEEP 3:MsEllllkEthXllkl2zEflxI/:/M/xT02z
TLSH
T1B2440404FFC0040DD50010304051C77033F0D4104535574334D30473DCC75400D74440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 9319a453c459bfe130c27749277bb17b6e06ca48999e91ed97badba972a4c84c
MD5 e0e3fa179d9a9e2d1c1aa98b7a29606c
SHA1 099ce220046b005d8a30592c9389ddc390a15145
SHA512 ee3c0d1e3e88e8ad601cca2a03cc27ab3b013e9892c2e153444ce9876a9fadcb7f4aa1ee7ac916c9f131d5840c06b5d14e85689b8c93f79fc12db5066c77dbdf
SSDEEP 3:MsEllllkEthXllkl2zEflWhEt:/M/xT02zb
TLSH
T1C0440204AF808549C9001430406183602370E45505115743289508229CC69C00C14010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 60KB
SHA256 6b08f7834c7fa3ac758bac8eb3b111cce10113e46b777617fbac5ac98b50f7eb
MD5 fb08031cf348a1fe124dd07bbf262e0f
SHA1 f6a66875cb3aae3cfa8a24787ab430304604843c
SHA512 2f474e71cb81639e935027c50af41b609fbb7e155bf4099539dbf43c7df36919c16b5e56bde590cf0408fa632856eedb3249f1067a054a8a172f915fcb4ca058
SSDEEP 768:UFjcXwg8UeDZB/Nzc4ReyIs6s+m8Spl9FohxPwHmUfJMMFkxHLqDAQHkT9OjLjKv:KcaHtc44bs6jSjohxPS/VAt0jKgRU7
TLSH
T1A5536AF598D3953AD8AD6B47A73D2D116DBCD13BB49498A8F3D94A0CCC121BFE306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4b93dcf1c0ab704f25bbfaaeb7ec3bd929d9f4c2b76a4e4b15f9f46ada7f8375
MD5 365df5cf60a038a8d5163de3a1cc4dc5
SHA1 71d3334495934d2fee64e46801259b1e1f37b901
SHA512 c3e131bb55a1274ac40e153d502f9a08672f6af3ea41e704371f51584cff2cb3c4ae1fe23d45e24e8bd6bb72d2a3bccb95370ef03a1a9419f2dce855ebef2ac5
SSDEEP 768:VcMUeDZIO0WzTNzc4ReyIsNpojKgqmUTn:VcMdftc44bsXfgRU7
TLSH
T1D3F2BE30A8259D73ACFDA686F6463693BEF56027C1D85E94D6ED9F0C080369D171F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7c29055a29571d80c3a00e764e7e11fcc3d666e4646f1ed41d35b43b9231d66b
MD5 3ccd1e2f25f64a6bd8a2a2fd2ea969f3
SHA1 64c18a19530023364f6f352a8430a5b045cb780e
SHA512 e2aa514148dc4781c54c990f7246354680266aaafb9986abf4748f3992180b29f8ed3b1a007841089e2878997999b3393c38f8a3ffdfd106d11c481cbd042210
SSDEEP 768:2cMUeDZBfO0WDRNzc4ReyIsNkT9Oj/jKgqmUTn:2cMeDRtc44bsS0jegRU7
TLSH
T11503AE38EC25997BDCFDBB86B20A36526EF5413BC1E41998D7ED5B0C48136DC631B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2759dd1fa3da05d2deca2ae6a38912b5e4b7d2186c97068c080b80e6af48526e
MD5 81f32f48fd2c9941f2007006549fdadf
SHA1 5005165e177949efe4ea7d8570f10e234a39f88f
SHA512 925291584049d8ef7884c0d93f8f2cb88d396f95266f1b3e08cb286e1a39213915614d8f93ef413e4b5225c639936744acefe9ea1ef99df72321b86b52d8dce5
SSDEEP 768:u33PeDZIO0Wz+Nzc4ReyIsM/ojKgqmUT5:u33c6tc44bsqfgRUt
TLSH
T161F2CF31AC259977ECF9A686F50632537EF59027C2D82E9495EDAF0C09472DD031F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1a385e75088942efe2acf04429f0516291a5d55975e080cff8ade1cbe3814277
MD5 2c8eda2d23d8b8d96ac30c13fca16669
SHA1 775da0164d81ea3afef6dc011c9919f73690bf39
SHA512 f147e8aae5e61546d14ff7b67042551ca47d27e1a8ccd821e813b32b742eb93def9ab1af5fac9c19e47f9befd3e6e3790ec3359b5dbb99c2560492a142b43fa8
SSDEEP 768:QcEUeDZIO0Wz+Nzc4ReyIsM5RKRpK5ojKgqmUT5:QcEd6tc44bsSRKfK5fgRUt
TLSH
T1ED038B3C9C21993F9CEDBB49B60E26266EF5503BC1F419A8D7D95B0CC42358DF31A422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 a71d5772aefba8f2fb5e761a4f130187382d00fffc61650444a4ea8c036d6480
MD5 5f3a71f3916f2f30ef7d67e790b15e6f
SHA1 388a67ca96c1ba6667546fa7279840b7706f9d8e
SHA512 b6b3b1dd593c51c05f80e63d85b2ca3af65ac665c1676904d445ed9cccb6a6f39fb28741a4323abb4a7a477aec8c03227469338ea2944deaa198be24569d93cc
SSDEEP 768:Irv+4UNbdE3P5eDZIO0Wz/Nzc4ReyIsP+MKRpKNeVH1S5F:Ibsbu3Sjtc44bsmMKfKNEH1W
TLSH
T19A239C3E9C24993F9CEE7745B10E35232EB9513BC1B819A8C7D91B4CC53A09DF34A912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ed09c8f5b0ab23de8e1355b2932b3719e5b30211c072ed7282ac67d649cbe00c
MD5 9e297c51689b66bd14e83adeaf79e48c
SHA1 6f02475c32fa81e04b1ec874e59b485099f1b693
SHA512 5b08b0d89874ae46c6d67b0b7b41cf264514a9a0f6c4d2837fcb3a875a9ddaaa2a7d7d5ca2292d334831cc02f273fa64c351ace8900bb3abc28ddc0013754efe
SSDEEP 768:zrv+4UNbds3PkeDZIO0WzTNzc4ReyIsPNeVH1S5F:zbsbS31vtc44bslEH1W
TLSH
T15B13BF32A8798D33ACFAA645F14B36937EF8202B81D80E94D9D95F4C09472DD035FA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0f28e38441978c3368f577160287c4633b002246415807742c4fbf6148da2861
MD5 827144af78bc73bb2422169556acae2a
SHA1 b2899c570cdf5c24e6e40be796de3e94697fd691
SHA512 b06f7d71e2a64be19849385a377c457ed42253efb794bab0ba5d09368d88fb8ca35f69018c5e13ebdb76c19afa3b29411fd8d1b83f3af3e20d009905ae39e44e
SSDEEP 768:6rv+4UNbds3qUDZIO0WuNzc4ReyIsXkeVH1S5D:6bsbS3dutc44bs0EH1Y
TLSH
T10403CE32A8788A77ACF66685B54B76533EF8912B82D81A94C5DE6F0C064B1DD030F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 72c3f5f1fb1beb08acb09ec468b4f21775648c6dc399b96e636e03c37f5c8199
MD5 6fffbb37a25451ca0fd1ce8b982bd702
SHA1 ee40866929229bc347edfc804e39a3c5cc43adb8
SHA512 12428583e6d01cb824604849c36a07a1e8fa4e989833b90dfc76b8ca17621c72308867209d2c01fca5956783d24393968b7668b119a1b1b6b86c4bfd4ec73707
SSDEEP 3:MsEllllkEthXllkl2zEfly:/M/xT02z
TLSH
T14B44040C7FC11CCDC50034304451C37033F4F4500511574335D10573DCCF5400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

e9f83914-8797-4edc-8d4a-93d4eacd01cb.tmp

Path C:\Users\Admin\AppData\Local\Temp\e9f83914-8797-4edc-8d4a-93d4eacd01cb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1236_739071217\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3428-11-0x00007FFAA7D00000-0x00007FFAA7F63000-memory.dmp

Download

memory/3428-4-0x00007FFAA7D00000-0x00007FFAA7F63000-memory.dmp

Download

memory/3428-3-0x00007FFAA7E5F000-0x00007FFAA7E60000-memory.dmp

Download

memory/3428-5-0x00007FFA67E40000-0x00007FFA67E50000-memory.dmp

Download

memory/3428-7-0x00007FFAA7D00000-0x00007FFAA7F63000-memory.dmp

Download

memory/3428-1-0x00007FFA67E40000-0x00007FFA67E50000-memory.dmp

Download

memory/3428-6-0x00007FFA67E40000-0x00007FFA67E50000-memory.dmp

Download

memory/3428-2-0x00007FFA67E40000-0x00007FFA67E50000-memory.dmp

Download

memory/3428-8-0x00007FFAA7D00000-0x00007FFAA7F63000-memory.dmp

Download

memory/3428-9-0x00007FFAA7D00000-0x00007FFAA7F63000-memory.dmp

Download

memory/3428-49-0x00007FFAA7D00000-0x00007FFAA7F63000-memory.dmp

Download

memory/3428-0-0x00007FFA67E40000-0x00007FFA67E50000-memory.dmp

Download

memory/3428-10-0x00007FFAA7D00000-0x00007FFAA7F63000-memory.dmp

Download

memory/3428-12-0x00007FFAA7D00000-0x00007FFAA7F63000-memory.dmp

Download

memory/3428-13-0x00007FFA65110000-0x00007FFA65120000-memory.dmp

Download

memory/3428-14-0x00007FFA65110000-0x00007FFA65120000-memory.dmp

Download