49cbc2951b803792803d61d57b8fb3125cd0cb253c8466d64a0a2a5d61e2aee0

user interaction
yes
max time kernel
899s
max time network
770s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 384B
Sample260805-c3gaeacc27
SHA256 49cbc2951b803792803d61d57b8fb3125cd0cb253c8466d64a0a2a5d61e2aee0
MD5 efe98884f3bc94d67597fd13ac30a4d4
SHA1 c3e22a30777cc35f250bf20e36f59b61860f067e
SHA512 6b2871d526faacf9f9066933ef79e1d20b7e9f974d6c4f8f5e1e7a19e19ab2d801456b5464f7b5516cc75f8b7963cb1befa83692ebdc7cc5cacba3f46f8b8569
TLSH
T13CE0C00FE8CE484C544350BEF0325E415D808AD377015EB7309B509E312A3091853FFD
MD5 SHA1 SHA512 TLSH

Score

8^/10

adware discovery persistence spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Explorer.EXE
File opened (read-only)	\??\F:	Explorer.EXE

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1911507316\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-notification-shared\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1088277627\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-ec\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1911507316\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-ec\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-hub\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\wallet\wallet-tokenization-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\Tokenized-Card\tokenized-card.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\vendor.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\driver-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\wallet\wallet-notification-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1088277627\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-ec\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-hub\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-mobile-hub\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-tokenized-card\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_677419731\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\bnpl\bnpl.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-ec\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-notification\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-tokenized-card\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\Wallet-Checkout\load-ec-deps.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-ec\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\wallet\wallet-checkout\merchant-site-info.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1145667106\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\Notification\notification_fast.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-mobile-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-notification\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-shared-components\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-tokenized-card\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_673600298\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_673600298\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1145667106\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-ec\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-ec\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_673600298\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-mobile-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-mobile-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-shared-components\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\wallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\Tokenized-Card\tokenized-card.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\Wallet-Checkout\wallet-drawer.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-hub\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-tokenized-card\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\Wallet-Checkout\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1088277627\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-shared-components\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\wallet-webui-925.baa79171a74ad52b0a67.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-mobile-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-shared-components\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-tokenized-card\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-tokenized-card\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_673600298\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1088277627\Part-ZH	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1244	msedge.exe
3380	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303709800514535"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "856"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "856"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "823"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "856"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "823"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "823"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{E9775706-C829-4ADC-B2CC-EA8CF882F22F}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{2EDB6FE2-7171-49A6-B0EE-4E4B8660EADE}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{764A4228-50E1-4CCE-956F-F38B603C2255}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{E5C019F4-17B2-42C9-86EA-709BAB84B44E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6940	dwm.exe
6940	dwm.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6620	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	6620	taskmgr.exe
Token: SeSystemProfilePrivilege	6620	taskmgr.exe
Token: SeCreateGlobalPrivilege	6620	taskmgr.exe
Token: SeCreateGlobalPrivilege	6940	dwm.exe
Token: SeChangeNotifyPrivilege	6940	dwm.exe
Token: 33	6940	dwm.exe
Token: SeIncBasePriorityPrivilege	6940	dwm.exe
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: SeShutdownPrivilege	7100	Explorer.EXE
Token: SeCreatePagefilePrivilege	7100	Explorer.EXE
Token: 33	6620	taskmgr.exe
Token: SeIncBasePriorityPrivilege	6620	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe
6620	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
6620	taskmgr.exe
5944	StartMenuExperienceHost.exe
1380	SearchHost.exe
7100	Explorer.EXE
6620	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 6756	1352	msedge.exe	90
PID 1352 wrote to memory of 2700	1352	msedge.exe	91
PID 1352 wrote to memory of 1244	1352	msedge.exe	92
PID 1352 wrote to memory of 2700	1352	msedge.exe	91
PID 1352 wrote to memory of 2700	1352	msedge.exe	91
PID 1352 wrote to memory of 1308	1352	msedge.exe	93
PID 1352 wrote to memory of 1308	1352	msedge.exe	93
PID 1352 wrote to memory of 6416	1352	msedge.exe	95
PID 1352 wrote to memory of 4088	1352	msedge.exe	96
PID 1352 wrote to memory of 6416	1352	msedge.exe	95
PID 1352 wrote to memory of 6416	1352	msedge.exe	95
PID 1352 wrote to memory of 4088	1352	msedge.exe	96
PID 1352 wrote to memory of 4088	1352	msedge.exe	96
PID 1352 wrote to memory of 2016	1352	msedge.exe	98
PID 1352 wrote to memory of 3108	1352	msedge.exe	97
PID 1352 wrote to memory of 2016	1352	msedge.exe	98
PID 1352 wrote to memory of 3108	1352	msedge.exe	97
PID 1352 wrote to memory of 2220	1352	msedge.exe	100
PID 1352 wrote to memory of 5868	1352	msedge.exe	104
PID 1352 wrote to memory of 4640	1352	msedge.exe	105
PID 1352 wrote to memory of 3812	1352	msedge.exe	106
PID 1352 wrote to memory of 1344	1352	msedge.exe	107
PID 1344 wrote to memory of 6572	1344	msedge.exe	108
PID 1344 wrote to memory of 6740	1344	msedge.exe	110
PID 1344 wrote to memory of 3380	1344	msedge.exe	111
PID 1344 wrote to memory of 6740	1344	msedge.exe	110
PID 1344 wrote to memory of 6740	1344	msedge.exe	110
PID 1344 wrote to memory of 3920	1344	msedge.exe	112
PID 1344 wrote to memory of 3920	1344	msedge.exe	112
PID 1344 wrote to memory of 5412	1344	msedge.exe	114
PID 1344 wrote to memory of 5604	1344	msedge.exe	115
PID 1344 wrote to memory of 5604	1344	msedge.exe	115
PID 1344 wrote to memory of 2608	1344	msedge.exe	116
PID 1344 wrote to memory of 2608	1344	msedge.exe	116
PID 1344 wrote to memory of 7132	1344	msedge.exe	117
PID 1344 wrote to memory of 7132	1344	msedge.exe	117
PID 1344 wrote to memory of 6796	1344	msedge.exe	118
PID 1344 wrote to memory of 6796	1344	msedge.exe	118
PID 1344 wrote to memory of 1392	1344	msedge.exe	119
PID 1344 wrote to memory of 1392	1344	msedge.exe	119
PID 1344 wrote to memory of 4584	1344	msedge.exe	120
PID 1344 wrote to memory of 4584	1344	msedge.exe	120
PID 1344 wrote to memory of 3404	1344	msedge.exe	121
PID 1344 wrote to memory of 3404	1344	msedge.exe	121
PID 1344 wrote to memory of 716	1344	msedge.exe	124
PID 1344 wrote to memory of 3344	1344	msedge.exe	125
PID 1344 wrote to memory of 4484	1344	msedge.exe	126
PID 1344 wrote to memory of 564	1344	msedge.exe	128
PID 1344 wrote to memory of 564	1344	msedge.exe	128
PID 1344 wrote to memory of 2456	1344	msedge.exe	129
PID 1344 wrote to memory of 2456	1344	msedge.exe	129
PID 1344 wrote to memory of 4436	1344	msedge.exe	130
PID 1344 wrote to memory of 2664	1344	msedge.exe	131
PID 1344 wrote to memory of 2664	1344	msedge.exe	131
PID 4480 wrote to memory of 7100	4480	userinit.exe	133
PID 1344 wrote to memory of 6172	1344	msedge.exe	140
PID 1344 wrote to memory of 6172	1344	msedge.exe	140
PID 1344 wrote to memory of 2848	1344	msedge.exe	141
PID 1344 wrote to memory of 2848	1344	msedge.exe	141
PID 1344 wrote to memory of 6728	1344	msedge.exe	142
PID 1344 wrote to memory of 6728	1344	msedge.exe	142
PID 1344 wrote to memory of 7144	1344	msedge.exe	143
PID 1344 wrote to memory of 7144	1344	msedge.exe	143
PID 1344 wrote to memory of 5040	1344	msedge.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x234,0x290,0x7ffb28c5c188,0x7ffb28c5c194,0x7ffb28c5c1a0
  2⤵
  PID:6756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,17522876306831682630,9730826251458893445,262144 --field-trial-handle=2104,i,1418026892876153145,6844942195282503603,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,17594467358554182519,17690555856727099503,524288 --field-trial-handle=2104,i,1418026892876153145,6844942195282503603,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,1963048918463540496,1616709696669007233,524288 --field-trial-handle=2104,i,1418026892876153145,6844942195282503603,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:13
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,7248686531067905784,4692831133765404419,2097152 --field-trial-handle=2104,i,1418026892876153145,6844942195282503603,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:6416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,1879155049391175801,3180018744779389011,2097152 --field-trial-handle=2104,i,1418026892876153145,6844942195282503603,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,12486088455999796438,8763321460791893479,524288 --field-trial-handle=2104,i,1418026892876153145,6844942195282503603,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,18402620639936301352,10125309100175447730,524288 --field-trial-handle=2104,i,1418026892876153145,6844942195282503603,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,14585708326596370625,14053737493269839445,524288 --field-trial-handle=2104,i,1418026892876153145,6844942195282503603,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,14585708326596370625,14053737493269839445,524288 --field-trial-handle=2104,i,1418026892876153145,6844942195282503603,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,10614036215677706032,6979582605704134545,524288 --field-trial-handle=2104,i,1418026892876153145,6844942195282503603,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,6213956075367452678,13341687467748268706,524288 --field-trial-handle=2104,i,1418026892876153145,6844942195282503603,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,17349068608445141713,16028145353801134566,524288 --field-trial-handle=2104,i,1418026892876153145,6844942195282503603,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e8,0x7ffb28c5c188,0x7ffb28c5c194,0x7ffb28c5c1a0
    3⤵
    PID:6572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2020,i,16810499487949349909,11165065328415521035,262144 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
    3⤵
    PID:6740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,3899873686614659769,6845993310737361054,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,9375827773278123514,8843432940137980975,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:13
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,9619804910068275523,17454050304947594977,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,9619804910068275523,17454050304947594977,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,2561445712527093239,9572132981027993868,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,12145131404556843965,11267274089179343528,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,6599053262910936621,10132212499146531801,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
    3⤵
    PID:7132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,12043580328868230093,14143705960245074652,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
    3⤵
    PID:6796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,10055277245920394924,12546308765055344957,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
    3⤵
    PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,2232776765339022295,6041269363264590392,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,1971845923236064835,6656775808137951669,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,14489399666781990352,16030358903895686852,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:14
    3⤵
    PID:716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,4402014046266849448,9922907698539606531,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,4385201605220257664,13080778268261451603,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,9710117129135960144,13590047810248474550,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,18439031354206572267,5895157890051999689,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4860,i,11695907483877231999,16333894902602704927,262144 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:10
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,18057369345020267783,17773732195679093246,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,7236362959725678412,5117934108754514681,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
    3⤵
    PID:6172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,364935228228996462,9886523161511542142,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=836,i,4944411688682437683,18369992383720448640,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
    3⤵
    PID:6728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,13602366498337264753,7401564773649057824,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
    3⤵
    PID:7144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,15939692988742536842,14815801714105411526,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:14
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,4816706221450503134,15551583238386990594,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,17553608027536017464,16646119621367617919,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
    3⤵
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,18118320047015820219,4034753908128913501,524288 --field-trial-handle=2516,i,419216826939882818,12432580425979062671,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:1404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4396

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6620

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6940

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:7100

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1380

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6116

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8183d470f57b27b94a58c9530308c32cc34fb52997fabf9e812a8ea6bde3b504
MD5 045d132ad1898716bbcac82905624cd2
SHA1 013635de4de9ad3768b9e18de73e63f3cbcfb6d2
SHA512 6097eab5e6d3c6c180a825c961ee505b41a3ea107cb4198355c3c8d2d1008105a9a71ba12304c25095065df9d10d7598088f62e4654603d216df440336900bb5
TLSH
T145D02371FE34A5D1E50C013080208900361B013321F763035560840CAD70060A1DFDE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00dce36fe5462622e0a4e55e81f05f3f7deb67f11e0c82964cf39a1e5fdcd3d8
MD5 5222daec270013eb25464a170308df2a
SHA1 bdf21b859214ce73402b4eba63e72d4e38d79a1e
SHA512 756a9bb3693f75169b772ecb353bad4d1e3a20e9549162b046ce222341d54917b1493eb94700761675c13a457ba1e86b3e4ae6ad732106e30286c7b67ff5c1bc
TLSH
T18ED023B1F7149651D50D45319451F6013B67413230FFE73395B0A44C79F5474E2DF499
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

000006.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000006.ldb
Size 330KB
SHA256 723094973136923cf292ea90b566001cbda0ff3250bbf285e0bcf06d094e0668
MD5 1b90cc6687a55177abdf79a65da29302
SHA1 3e2e228cb99b90ec93a459b92d6910a5be5a6f33
SHA512 9816c4cefb779cc60a5dc6eb22c5ebcaf9c8a405e0335f5f1cd787e10a3ec6a08fcfddcf0bbb5657513927f025db098a96b45edb77fd3fac392e2b3009ff688b
SSDEEP 6144:SrJal6K1U8TCEI97rUfbBDWEIYoIuxCgs08MnIznfRzwA1hJnys/vCkB2:SrcllWPEIegZrxCHj2I7fRzwA1hNrig2
TLSH
T1D17402F36C75D34B41B643CBE5FE74C6F6A98AD4640094FB610E4724A10F7827AE13AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 352B
SHA256 03d675c012be6d6a30b3956bd146b175fa3effac825b24bb3a46282d7a0b3550
MD5 f60fc6e7f782896ef2596d341c1b05d6
SHA1 c22bf5f8013edf997d646cbb8def9ee86e82b325
SHA512 e7ef90ce6b884613ba16d92e3bd473632d1d6002db99d44b5d7a5c7a07a6208705d971948d243f2441594f8699ca91e59007c90fbfa83b89c5dbf93663c2f03f
TLSH
T129E0DF2887E4C5B40A4A9BC7F0C4D337C1907E27EA8CE6D932287F8C2440C1292A6CF5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f201db118e9854c5f07db276b6fa44b63166a8c4e3bcf95aa388ddba659e9501
MD5 a5661a7428899ac2bd14f1377a8f67cf
SHA1 d8cab34b6853f3e5eca2eb1a545c32f323ce9622
SHA512 f1eb3623c9c4d0e5f7a9aa70d8230414c4db0ed90f1c684a99204a641a6026f2c3cdfe858bae34077b105562eea5376ba1ec4da8a5e3a4c80fa59593a87cbed0
TLSH
T19EE026E54ACAC2AED60C74C7A1F4570D92C13A2E9AC8AE8A1700CD883145880BE86FA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 cb4069deb2525b4ebfb0ba073ab7b31df83d93ec3add375da24d5860e9b57e26
MD5 79f04d77809aec5a949fb2821bea7f58
SHA1 56125463dd115d74b02870f0e986521137bf0316
SHA512 8d3d9747cc7fca2a09b576a401500b4c917d8cc8b7c7619dd2ee8de1c6c6268697b1e94fa7a8fcf0cdaf14d0e748cef80628aea4049dc6e525bb9661e21232a2
TLSH
T13EE0209449D8C27D66446BCB727A531C41F03B1EDAC4EEC6570489C83042440E193E60
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 ed9213056ae74bab1723509a60f5bff2d26eb586bac34d2fd71f1ce6e2853860
MD5 a743c3d6de41ca00ccb2cafd2fb5884f
SHA1 f457b825e75a96a9d306a3be49238c0b20ec0e44
SHA512 7edb56dd603f7d38bf5dc4235910af5ad8db833164905db50591542be6a6f2b5ddc6d59e79a0b535a1ab59473a1802e677bd8870886ae79d59bdbf14a68a774d
TLSH
T1B7D0C2A8A8ECA94ED6E409BE97A5F0100F6402820416DA120160F9C136A52E41BAA020
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f63e9dcdc7776ec837e19519195e301a2b9e38d9ffdd654ebec7198602d16467
MD5 167926912a7fc83c54f253579acac54d
SHA1 35e9ee590c5d1c94707123dccc3ba19cbc729142
SHA512 0b3395fb34a44d308d5cc257a332c60260ddea222c773a2f0d34129cf72e7f4d56df9d11b765594796b1191bb48662eb5f8cea76fb13a2910a93a0681651b93b
SSDEEP 192:hAOaiG9jlmyA6E0OYHz3oNquiur85ztdOpLDaZATITsd45cym1LKD/EXiQW:h0jlVf9zAqoAjYp/MTse5P86/EZW
TLSH
T1D3132BBE37566D4ADBCB01BED8270BB62BB1F91ED4C5642B9E3232119664F404CDE123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 bc37c089915d2950a7ab2067e94518e85d53c6819c713a0bad7bcd0100f92d8b
MD5 440aea2c7f29770b1220f29c6324d3c1
SHA1 2e04b56ed838d8f87478abd13d69cfc8de595f48
SHA512 61650c194854ae8ec1a387541692c207b67a4ac5fc6e1fcc5d752cf45f7d9ee55da67c4a37ffa25eda0b9e12e63900c734879bfbcc431357f35829fdb2c2a071
SSDEEP 1536:POL/kdL/S8zSIiVy8EE7Sshia+L/t6L/GL/hMhVpodjfTP/T:WL/EL/TR8yFyua+L/kL/GL/iUF
TLSH
T157443DF71951600BCBA842F5E2033E2EC27B855E7CD1F9A9E97C4C812825F25B6FCA45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 ef3dc0a7048a7e82863a0f447470fa52d7e0df27f1f7f654ac59df556e1ea69f
MD5 e4edf122fbf4d9012668a1da23f67bfd
SHA1 301957a1aacb74a9fdb1515b1de61ef3666c42d3
SHA512 4d1e2e789afa23f0a3e6fb72a5f69318600c19734341038457ed44496083db4f062dda921d89cb91268033b7609e3392ef9e69940796e1b9ecc0042a87b638c1
SSDEEP 24576:sHc1EmH0gm3FDNlGXfIVZZg63gZioXuU2tl:s81VHLm8ISFEoXuU
TLSH
T15D167DEDC97858C3CD639A30B5F0E9877C7413C3F994C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 762d1f1c166449346d73d103b5a3d86bcda9f274e5f9067db56bd80f5bb34543
MD5 8ee8aacb3185831cee5b29dac64e0591
SHA1 b6e0fa2a4ac4cc3d2788cd0460295b996fd5f341
SHA512 d20856a6399864e9160b6eb6c97bbd316959139f75ffd5904c9ca5b170233dbb52a2e7b512d1873cfae256fd80c03df40c5283332d5f66e0dc4b0cabb788916c
TLSH
T1B451F60E0B271AE1E3A187F1C2A1119937F4B8BF028E8AD02E046D3C05ADF2922C149B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 395a7a1ba9546a5fd9b0758f35bc65c20d2520b2d6bb5e397fc910fadc3daf33
MD5 5596553aceb35859fbbd1c2204c17003
SHA1 fb60e5a431230a19ecc2fbaaddf11e5c0f4d87e9
SHA512 913a74552f15d520be00151b6e7920b4e292d8c72b655a10fb2fe47a5dae666958a346b0e48656d146140be3174cd4e6dbcf4a06ddd38760fa317eb55eba02d3
SSDEEP 3:MsEllllkEthXllkl2zEkl6l/:/M/xT02zn
TLSH
T14B4404047FC0044DC54010314013C3704374D4101F11574374510417DDC55450C00440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 1fcdeb54b24bfcda456ed1d19b78c3f89fc2139784a319ed92521fc0071682b7
MD5 ec3a891ae052a71db7b523bb7ce40cf7
SHA1 d1a1fdde45f1ca5154a2ed06bbf1161163e7bb3f
SHA512 5b5bdbcac23807daa32b0ae93311e0136d939b1b4a6122d5364e4c39e5dd4a60c2e5996ae53df3fa11327752f1b406af0bc59434e068f6f79d0578587a33e8fe
TLSH
T197E0D8A455C7C2AD59103BC3E268572EC1C03952EA95FE431700DCC47603013F281F56
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 13d2f3f173e4a329af5db70ab593ba750e11b3a6141e9c1b83bf5fd661a49114
MD5 4417c163a51485dfd9fed54713a9f9ca
SHA1 3919cb685a80398bfd3720817461f835c7f3deb6
SHA512 3da71faad6956b078abb499eac3f199932d3ae9ebada3c5ed30799db6d1769cdd12f0eb120eb390300e32950110835797f8c7f01e2ebf07879a62decc62cb0a8
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfjl2WW5LbYFtIMNVqYp0:TtD4jJ/0UC+lf5JbWxbYFOsVTp0
TLSH
T196E2E28D3F11F512C4ED733DA0D2C5E05EBC682C4A5DB1B0513C5D728D635A5F59E21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 322B
SHA256 b2bcb06340e848d04447dbdc044b6eda738f8773d5202e86e4adf6bf74c628f7
MD5 cee04c55683238dd5d9b6e04e892749d
SHA1 fe20f8a76ac0a8e723678c3bd497b5da8d814808
SHA512 75d9e76fc71cdb09ecbb26eb10d530dbd324a73cbfb5620d2b0771f95ea32b934c2b1c8f18d8a4589807cc50b1d198aa02e250b7728fdeed05be6889a508531a
TLSH
T109E026A496C8C17951A6B9CBE3E48729E2D0391EEB88FA421B0C88897001105B3C6E90
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log
Size 304B
SHA256 1f844da045ae4e4e56937a272b1c4679f12badfc99e892895bf61bcaea111fc6
MD5 e31621408f289cd9771b4a7bee72f0e6
SHA1 730336e9c21b7f4f753b1fd9c4cafb9d868be5e9
SHA512 a0fe5b23623294e52f151bac2e1d57ecdcaaad55297289ddf3657329e75744e6776ddf4421e5d7e89f899f72465181a9e33dd8e0ac64671678ab6126344a1f60
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 326B
SHA256 d3aace8fb611ece249fef8d8cffb6bdbe876f6cd6f21245fa96f59ad7bccac0e
MD5 ff498bcdda59601935791fdf1fe89ff3
SHA1 b296d3ac79bc813aebcf6c3742c2a7b443678271
SHA512 b3cc90963c1744836a2c0c049481b5904d7b0f104a9c8f66c9935d6efd20e8b4241cea265730e2830c2487339f0472e4365c4b4e48a77f4a2c270dcbe2d80320
TLSH
T15CE026A85AC8C13D51266DCBD2B7972D92D0392AAA88FA471B1CCC846001221A3C2ED0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 b070ec0b4b5513ae6d225c5cf928a774190ee6920491306d2f8dc2ce77544aa5
MD5 a57c8f0dc3adb9066c224d0b09bf47d8
SHA1 b7471e2230594cc81fd671acaea1e6c46eb9add1
SHA512 f5a184abb0e44f7d058b87521ac70ea83c50a98e4c281d72919b5c9b73f942ab047be7a74f27c95541972be9993a46b547e7eeca00c695619e4bbce3e78b8368
TLSH
T189E0785405DCC17DD575ADD3D3EC431DD3D13B22F6847E41570BA8CD72011427249950
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 48b04af01e2804a35ec1e0c02c196fd84c336b5d66c00287e0307cdbe336b69b
MD5 ced1697cd86a5c3b831855a3c8d0dad2
SHA1 aff864afa02eff92026df2b3f554c33f7d678d02
SHA512 62004c80159fbd4fef8230c5e0a96b30ecfcbebd2cf71dd0a3f7be09e74ba8a6c4df09c51f86913f91db527762a36df6b91d37968b0708a409469d1278189ad4
SSDEEP 192:rcdWYPH+bF+UI3iWGVoWN3qL/FleVVV63:rcdRIkUI3ijVoWN3qL/FleA
TLSH
T1F7241F0E5F253722CDBD913668E744A35C7DF03F875326DA6C6114B5CEE2642A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 8KB
SHA256 b9cf7f57311f32ba2dc2c728477d388043ddd8266cdf3cf1d0a5a0493d4d7327
MD5 089c4a411ceaf367bf4536d1f3f60734
SHA1 73063550a0c83239a53e84b67e688a15802e427a
SHA512 181819bbc1eb8bb2c1f289bc02f974cbc6e4f9acdea7b47b1c186b8c6375b8273a876217ed9b2daa554a6024072fa9d8b7e8cccf933f723b036ab0f18b96f22b
SSDEEP 3:aLl/d/n3lljq7A/mhWJFuQ30VkWUS/rLl/n4/dwenqFtjE9SFcTpL0WWaV1vGrVd:AM7/VkyrRQ/d4FS99pLTB1eB1f
TLSH
T16D021291EAA09873EC08AB3DA29B42ECAFB2290C8962D81180088C120E41EDC824849A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 a43794a6fa746d812a45130073a9a7db43ba70418da019589403190a671f7c67
MD5 2cab2bf696f1088354977adb136db62a
SHA1 fd5ac7ac6e3a47ba093154c03d89d777fc0cee1b
SHA512 da3502b819a862c3e36d2526cf8b9f172c49e9c619b56677bd6ded136ce4b2791c759a3291fd0ee29954eae46c0c621852f48e4d03885d5d3e9a1fb82dfb8ec4
TLSH
T1C1E0C07409DDC17D161424CBE274771EE3F03906EB88BF425B04A844B002004B781AC2
MD5 SHA1 SHA512 TLSH

Submit Download

90bb4d9a-5450-4251-988b-e4fbc07a7775.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\90bb4d9a-5450-4251-988b-e4fbc07a7775.tmp
Size 188B
SHA256 a7457a16e76060cdd2c00688da1a4d492c50267445c8ff75431e3fc09fbcaea7
MD5 5c38c92d66188dc826bae86b244aed4a
SHA1 5dbc3d98cd977dc7dfefda4309002ca688b4688e
SHA512 489ea362a2c90bd6306c5363cad54762859daa5aedd4de30902555d64958f608d9703574a1c8b2ceba75df5cc99e8de06f03d3f43bb1df0e9c331a9ac26cb1f9
TLSH
T1A8C0126288BAF4F7107549791AD478C56FB5E434144058E5E9A5863EA0900FF5A12029
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 11323e2826b16dce95ccbd6f805b8732521f5b84fbf393448e641020b829e497
MD5 fa4e1d1fb79af1c80f6666bbdcab334e
SHA1 b837ec1c287dcc8107dcfb1a8a9b11ce26157c8d
SHA512 7315f9ccd4dba3c4270febed0b7a1bb31c2d175094ded165cf41dde76756eac94ad6165b1bd3cdb5717156c66d3166ddec9c248ed6d9f0df4f959ce95f93e0a1
SSDEEP 48:T32/LopFMaty423w/a9NUuTjAw7owwvXNCV0:KDeMatha9RAkE9CV0
TLSH
T1AEB2004D5F707151D0F05B3AEDD189263E7C201DD3733689995460F3CEA359BFA0646A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5a186f2b1963c9749033ef5596272282da9415e6cc170aa106a587c896358cdc
MD5 a268c2bf2561c7dd4a4fb73698a19136
SHA1 bd8dfc35b1de9d77dfe6bd44aa6aafdbd893aa94
SHA512 5ef20419e4e6f622458c30ddcc24339d01e05b85511ca8e24681e6bb8573546926c009d3fabd235c25b83f9d51609129babcbade5670bc28b8ad875db9eed1fb
TLSH
T1B741BEF783F4866EC91196F0AB187E2BCE1D0915432C3D6AC9E4AE1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9f93143ad252911de84450fddedba332eebd7bfb13f48e2d6a75b2f8d91788e8
MD5 3dccdec14182aeb3e827c86a4113a328
SHA1 7a7550393bbdb86f9b9d37be46580f43fffa33da
SHA512 bc7ceb62bb6effec92edecd6dbafd24fc92984008199180a8f36fd943039c0e8c9560f45ca293b8e149e32bfcdfa4791f61729d2b27b45ffebfd7d3eadd66dc6
TLSH
T1F851CDF7C7E4866EC90156F0EA14BE2BCE1D0954932C3D5AC8E4AE1B93E2471E181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 4a623d1cee5779478e7a224a9c5317dec0c097c64e1cf29b2512bda4c8bbbc16
MD5 e7bec615f067de53e19b2a96c067acb5
SHA1 70384ff52bd07f3474ca3245848c4044a0e40e0f
SHA512 90b2033fe09fbd04c905a58d134c16da875420f3138c511d9cc9a7a6a304702a8960548e9902eacbbc6a05829c20c55765848451782d59158f6a94a8ccc44bec
SSDEEP 96:eIEumQv8m1ccnvS6Ot8ekacf6CnFZ01u4g:eIEumQv8m1ccnvS6OtVmd
TLSH
T1A7F2DCFE07276206D99484B0E4009FCEAF1A010B47B6B6DC76D447E3F7A20E2B179756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3d257f89819dd4c54609bbe301300b57ae11d9310e24ce08aee84cfb56920bf8
MD5 4940215dec94b801e23e990b86753850
SHA1 5f190a762b90a72d93c15a772f5df49c5e7cde31
SHA512 664fa01caf6da0dc81c6589a4a38ff774c1a161caf3c641125b352fa90dd49d4558e0bb3eae093f0ac61e67c397ced1149b872e5a5afa3fbdbfa874adc4399d7
SSDEEP 384:sxR2wyf/fdskWvG8N/O44/5I2qfsGQ90Zd:syJf/f3YG2a/5I2qfsGQ98
TLSH
T15772D716A9249D7BCDDBD209FA957F63D6F91533A1905E44AAFC8E0C01E7AEC210381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a4d4b6d728dfc7c536d3d6bcb19fad00638687f76418bbc84d9bf210e4905258
MD5 6f39294cf14ca60e275cfa7cc5358dd1
SHA1 20656405029fa7fa9cb6192130afd97c5fbdfec0
SHA512 c22d3054358983bd8c5a7a39c9e261ba1ef2eb198577010a99472ce441058e643759d9b93918b82c166c1c587eb5437c044cca436c27dbfc7511dad19230e500
SSDEEP 768:Ob4YATWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBbDwzroT4z:Ob4YATWg1NfwBu1jasHwAUz
TLSH
T142C2EB2B244CCB7E4F844A9DAC29AED76DD801CB9B984D5447EB890C03C67FB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 5b1ac2a4a68cc98b6761d78836a06f3ea08212067da6c22e11b8aaffe49c9dd6
MD5 ecf4efc73f1da8da35fff633af659b1d
SHA1 84b22dc4acb3a9109ad361ca5701eef2d0b8596c
SHA512 325e68e969f28c2fd3259515241195713bdc4c24c937e947c21a9bf5d6d07bcff0210feb6127a6035ab49b6bb6772f7db2d17d8f652d8fec9ea37cee832d1137
TLSH
T140E020A006C4D17DE1A625835198832DD3D5791BD6C87E421F00DF896347509715AD50
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 4da18fb482f866f67473fcdd0705d24db5f52bceee8f677b599af61b5e7fac50
MD5 05916fe8368916895b23e50372158098
SHA1 19d113e736bda1a15d5a0ead9d6366d21e0687b5
SHA512 8445bbe111b60cd12b0debe2bbff0e14a7d5051ed9b135302949e78fabbd27c41b63345b7d9d1bc5ecf550fb5e36d84d24046c846de411d6ca080ed4fffa08c7
TLSH
T1EDE0D87017C9C23EA19725C7A2A8D71991E3BA16DACCEB563B08AA4473061847247D50
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 6f1c3a9f3f2656d32ec8e89a5c69d6697cb86270fe47134798a1d8f1124559f7
MD5 2ae2018e5405cbfe56014f5873727669
SHA1 0e52e551e682f641a4626a56771b374e17b4a52b
SHA512 80fb488fdfca3734636386edd462a3894e9277050d12cbd8a7e492b4a9e79b020ee29a4aceb76ae7fa49b7ce698ba5e66e31aca322bc4383b7563bf3f2ec8648
TLSH
T16EE026B046ECC2B95518E5C392A4D72ED2F0BD27DFCCFB82D7085485B542111B2AAED0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 6aeaa052aa706628e2fba21e982fcc113ad71f4e48d48e686f681e84d5281a6a
MD5 a5dff1ac3a832d7683e71a2eab6f4f4f
SHA1 989aaa0d69a8546235c757b2cb874a68a6f9fc7b
SHA512 47fe0dda0ad7b1ff3200c882ce5eb8da9246586e76118c23851b80264017442493c3078a840c223df14ec18531305e9265e1275266907c894c4553fdda70300a
SSDEEP 768:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9d54lbB:yv+RpPYDDRPbIhJ9d54lbB
TLSH
T157C23B11713F42903C7EA50C91B8982E96C2B4A37059E53B7BAC02A65F67E139DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 010724741796716d438e64a6f9fb16bcc02dac2b634f972c5e81f5f96f7b4a7b
MD5 c0af172fa57c73e6c6c412ca19e6b49c
SHA1 f8a7a1e413316f6561681ce7dbbce8b3432e1708
SHA512 9e1d813a7b30b4c45d07859bdce89037444ab0d82536c0c8b00f23063bb6eecc5e970b4e88d41a9706898e6070346dea1bacbd54d3a4c4a9098352a67c721bb8
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9d5y:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRn
TLSH
T124B24D51713F4680387EA90C91B8981E86C2B4A37459E52F7BAC01B65F67E039DFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 06e31b3908d8ca8b2f02d45e219e57772f1a7e4689ec268ef7379bda3c5d5afd
MD5 4485322a2089a6e27ad5dadf11eb6e11
SHA1 aac9dbccc72a80ef124bc69e3c14a86f25718b82
SHA512 b490050d1f8957460f5d960092768ceb54415ae2d8200ff2a352d9307bebe9eae0e5a4ee251cc52482dec1fc7a10ca91fe619465c1c95b924936c12dc522e064
SSDEEP 384:DNrRZyCSDnxTIC3MEhIKyll7svbFKfk7:xFZJSDnixyI1l7svbF9
TLSH
T1AA44740A7B747001EDE6D9725CB080771E3C716E8F22A6916DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c70cfe04-242b-482a-91a5-33a36de201fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c70cfe04-242b-482a-91a5-33a36de201fb.tmp
Size 649B
SHA256 6e4868eabb08badc3447c076ff194008512e7538b61715a3de8e5679f11daa65
MD5 4ee9d05ea21e2556e18d91b86f5269a8
SHA1 7e635037785122597824c45c8fc9931b54b128d7
SHA512 defb4546f0654f3226cc54c2ae53db621a2b5940485670a82b63016e36a15f42624ce902db3962864df7c010a6c4be82d9587d71c5682c99f32dc47e7681c777
TLSH
T17DF0F9A6C821BC7719FC1B2860554A47EB90132B3B41989B7B3D921D8FB063B464681C
MD5 SHA1 SHA512 TLSH

Submit Download

db1163ac-042f-4f2d-86b2-01d8e58dce76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\db1163ac-042f-4f2d-86b2-01d8e58dce76.tmp
Size 15KB
SHA256 78cef642c9732eacba0d3d60eb7bad1a26436ce0756997cbae7043a7694639f2
MD5 2f2ae5359ae599f865b40bae95fbf291
SHA1 9ff9549596d4389a22c548e5f1d0e6b5e1501793
SHA512 3d815e219bece90b4eb67661539131262b2d91b1f37f2a8ccdc0e27e743640480b34b60984369f3bdcf71de0643e581ed9e41093097ebd4704b5e1d3fbaeac1e
SSDEEP 192:sxR2RbyMqZjK1Ml8wbf/fds8CNRZOozoD8peH/g6+WNIYcC4CpsGQ9GGgIgjQsJ:sxR2wlf/fds8CN/O44/5IW4usGQ9Kjd
TLSH
T14162E91669349D7BCCDBD209FA55BF93D6F91133A1905E44AAFC9A0C04E7AEC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 a5d36d005f693c9697dca2454e22cfcfe1293b9c06027f700ba041f27626c3f2
MD5 7844f72497b76d6e68bdf825219dcc9e
SHA1 8039a719ba52b51ab3f97a377db9bfebeaacb4e9
SHA512 139e8a7bb9cc8b6d8ea8d48e8a23099670d4547ec4764b8197b4b649ee7c2c0a4f1232ef53a52a234ab141dffea3aee829117b035adc079232342c88f04d2009
TLSH
T1013164C0636E64D4BF8AEA41C22D6803E4D57E67260E9872331D46F55F8481B8F2FD76
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 e6345783d5c5f08b1b0481a041307493bd5148a71b22e800cb0ca34395c99435
MD5 92d9c9f4a0d3f4b8ff07e0bd68993b82
SHA1 94ad1a9892480a608bf1893c664b6a0ab10a7b8e
SHA512 0ee6f44a98d59a78a0b57ee23eb7282d1e5edf4e45eec0652ea108e3e73edf1f73a34906c2b6a59a8c6b033f00247828ca543c06e4fee5aa47b398601b0e8959
SSDEEP 192:z1+OCCAstl9wDQ2szAhGXIXFQxIII4bIMIMijYcYX/:5FC7sHD2s341QxIII4bIMIMKB
TLSH
T14952749A7A061F73D05EDF76136687545FE688814133261D3262384F8DF3EA786C92F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 3fb2516bca1ea9504e28a133652050ab517b1dbe5f9dd57caa1cc9de72eac2f0
MD5 a943a2e1e66a41be5c18d96e3ddf21b6
SHA1 5a4ada0abf87ad9595f9d88de48a2311cfffc9f2
SHA512 55c4eb4970502338dd2a58a7439be13067aea983fae6f635f89bbca6d6c28edb852acf47c1f8e98456caeedad5d8dc1f94a77c9741fa600c43cc8905ad7294a7
TLSH
T16EE0206055C5C17EF47536C7A1F4931A92C03D23EF84EAC75F04C84861061017655951
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 2aa52458d3b457753e38f37416b9c949d69f866161eaff62967838aedf7dd884
MD5 d6bf00cd8b902c465ec6117c55c353f9
SHA1 3f8e8116cc8e63ac065177cd43dd8f8bc855af46
SHA512 2b217bf3cd803a369ccbe54cf2896c119b00582172f049601309f33b82e8e180cd29f79d23577a3e030eb84b93b477e325c4b6c8a15eee1f15ab767ac5ca505a
TLSH
T1BD31DD15F320C14DE54A867E906BAB360738E8568FBCED0F84B920762E71F441E8B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 e27afc5901a8b3dbf76d6a64791340c408af8948410dc91b50b45df4f6f53699
MD5 d4848768a7e1bc20b48e4ea219023f40
SHA1 1d8df938485de56f1f739dc7776e561f032eae8e
SHA512 afbf9708c8ba2a7605d5b15cb73ed30d0b5ef3915e63e6be2ccc4a2a61e9e549382c1766ebad25e198be636ab288a062552d6452dbbc1e9ced4623a4cb62f849
TLSH
T1C1E020E065C4C17FE07125C371F4D39A93D13D23EE84EF835F00CD4952051427656951
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 4e64c8bbedc4b551ee5beb7e71a194a3185413688e2a69662bb822f11f757258
MD5 4feb1862c965c90c2f881c7117a13b43
SHA1 1320923971f19f1b1f1f0debd54f389320aae440
SHA512 45bd7223dfb303ea6ac1011b8e13e37221571ba18c0a61295f19e3bad3fbf5b45e25d80d67e9e5a28932f10f2996b268ecc236b5cc907cc391c86b3d3cbcee02
SSDEEP 3:MsEllllkEthXllkl2zE6Jll/:/M/xT02z9J/
TLSH
T1CE4404157FC10445C70430304031C370037DD7140D11574774710513DCC55551C1D040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b4d481e6963a05f89901d640b330a6dc6f8a447b44291ca4ec29b80057c2fdb3
MD5 7d80e0e5f275e2e5b6bb479c28e269a2
SHA1 3c6e73ea126a38851e0dfca6042520fa38f3c146
SHA512 943b438f59cf5fec428cf81f802043ad04c8a7fa363117ae229ae9d2b244fb27bf33c34ced1036b1a985d693e2a1f18f4fc4684fd14787b00f7f11bf010404fd
SSDEEP 3:MsEllllkEthXllkl2zEhKX:/M/xT02z
TLSH
T1F74404057FC10405C51010304C31C3700375F5110D115F4774510413FCF5D454D17050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ec3f74c44cbe55b451ab42176aedb782e3e1ba1b00372cdab55840600ed64bc6
MD5 bf941546f7ae42ff59b4095a3f1bf901
SHA1 2ad53085460b7d8c1036edd78592e07f3b16635a
SHA512 22442df25c594a1755abbaab531ee036afbea932b4d0d9ab37593c8739b20c050297c31978631db83cf4474eea895e91d22a629a8f4435832120249ad4eea00d
SSDEEP 384:nriF1tNn/s3n9Sr8NL08TUNTUlIRWPvuTpu1EqfbGGNcA831yHZ9+Cy4j8LEEIzB:GF1j+9KQ0wgkuI+GaA8lzb4n
TLSH
T18CB23A32DC55CEBBECEA4F99A30A3A06DEE0525384CC5AD8EAD95D1C00DB1EE4707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 df5371b18fcc04714733b1e35a9f080094ad715e549854909fc4d893f1003dc1
MD5 e0b7532d4495bdd3a357adb391a97e1f
SHA1 6b63f4562c04be02638d80a6a85d627a8f4b526f
SHA512 2a37e8f70dbdc85133ddd9849159060db36a15e4e0cfb743000b7e83eed27e5d874e976b52f7504e26b07fd867c3fb4feb62e685c5087546477c8414c019dc9e
SSDEEP 768:tFPAQQwgDuEA9HaaA8lB542DKRjRNjKgqmUM1:jAQYuDA2u2KJRYgRUO
TLSH
T166E24A3ADC55C9BFECEE6B89624E76169DF01233D4E88AD8E7D84E0C10635DDA307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 afc284926f511b977fe8b04c3580eb2d0a5e5fb85f8bbda8485e3b2853630af7
MD5 4d5f15316662b3e0597ad2e914a9dcf0
SHA1 7c0004e7158584f3846a9b9d25965cc6665c1fc3
SHA512 d5b173ee2e066df6aa62e48a29b97f3f8b0a90d244c93089f76569a1e0138e5582cdc7b88994dd134d15e2bb56a8059ff4e532ce688415f9c3642eebdc769a81
SSDEEP 384:nriFiZcIN8NL08TUNTUlIRZPvuTcu1EqfbGGNcA831yHZ9+CyBeRs9JKgqijUMIt:GFQNQ0wgDuZ+GaA8lzbTjKgqmUMY
TLSH
T1BAD25B32DC65CABBECEA8FD5A6497606DEE05113C5DC9AD4EAD85D0C009B5EE030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 abdbb449cd4886d3f8f83dcd495ffa6c42869df0a92e2aa8acd53ca150c46dd0
MD5 2f9c437b58a717988e159cb34846a664
SHA1 e45b2b7f8d2811c06bd1dcfff42789a5243a63d3
SHA512 0f679aabb324e2836358aa573bd0f5279f24d3ca2f6b413485e02ee5d891eaabf0ef039f04ff735b2f8935de55736e6b5b4fa7b8b580af19c44449213fb7cd20
SSDEEP 384:nCiFnZcIA8NL08TUNTUlIRZPvuTcm1EqfbGGNcA831yHZ9+N36Qv9Cp5FBeRs9Jy:JFPAQ0wgDuz+GaA8lz8c9gjTjKgqmUMY
TLSH
T157F22839DC65C9BFA8EE7F89620D69168EE44237C4B88998E7D50F0D807349EE707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 00bb582cc3626f4ac9a79524c2566b0d398b3dd2baff6493299e674384be232e
MD5 53d5bbb0841abe6a5bdfe344e0dfe4a2
SHA1 5fb5718eff91438be87bd64b6b54091946c77bfa
SHA512 d8257b20f1efa44f6393c808fde6170ed002e922b39dd0372f7b33c12e54076dd3184ea1379dd95f4923b22940953acc869536772d5e57995ff2e76c07de01e4
SSDEEP 384:ngiF1tNn/s3n9Sn8Ngg8TUNTUlIRiPvuTubREqfbGGNcA831yTLcOObjI9G6w7p4:7F1j+9SXgwgUu+qGaA8lYc29M2
TLSH
T1EDC24B36EC59CEBBEDE64F99B34E7A06DEE0126785AC59C8EAD95D0C00871ED0703C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 282cde18f0c05b371633fe23d8fb26d449c95659821d5e7bae4b9e300d9ce2d8
MD5 0e469fd1d6e4c2bbfaa9724268b476d1
SHA1 b8742b46170b2abff15716ae415c1b15b2889d09
SHA512 c64f3980e5e7b2852c0382f9055044dbf08a272ff37f6526c68d478aab1f623e8c65f7de923a9ed6402bbeefd21d13612b23b40bc5ebff204170beaa9baccef5
SSDEEP 3:MsEllllkEthXllkl2zEel4df:/M/xT02zN4d
TLSH
T1724402086F841805C71410304122C3A04364E85409115743A46504129D869410C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

bec4d506-8c44-4ff0-a275-4b07850a7df9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\bec4d506-8c44-4ff0-a275-4b07850a7df9.tmp
Size 2KB
SHA256 fe9a30d8e70ff4d47591d4df868f40b88437abe8ad4e3877de6cce1008382b7c
MD5 56526ca66de8cbbb9f3f9a9e75c5aeb7
SHA1 fee8fb56f16fa9e99455f4e396b3ea0909f026da
SHA512 a550c2e28462a67fec3a1f22963d3240db53c0df7212cf046554e277aa41a7674098e541751513150e64b1fb40492419a5b3aaf3a5a2b91adbe76d1f7cd1ccf4
TLSH
T1284130E04C381AD1D4BD0E7EB48B39FC85EC9726F894343C2858EA589A7A61D348083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 66a5730f489e2671486544d09fcd9c24f8891908be69c1e5f4444d2f5f61c074
MD5 6f3e0abffe000d89905e0babfec25279
SHA1 7c5a88c0f4bf025ee997511cb946d58ce650f282
SHA512 48a1ca4963b43cae9984899699d16d1a2052b1f0e383e9c1330f9cdcd453f2cb946e5c17a53a45c01ad49d934c1b85218a8a3da9729a4d4392d06ecaf4b3cc27
TLSH
T1385140E04C381AD5D5BD0E7EB48B38ECC1EC9726F89034397869EA585A7E21D358483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4a1935a13067cace34d243126d0918015371bfadf1423d1f50859bd5414f8689
MD5 5924bc9db1083f41fa2b5141f1bde1b8
SHA1 6c2b77a652f5ef9f2efaad4e3fbd1ddc5d61f1c9
SHA512 c45b41fa9b656b80cdcb237810a2b132a56e04d72789d815358f420fefb14fb940df8c70c65ce5b17290259ca3b93abe546d37a29280559cc7b49adcb3d68e47
TLSH
T17A513FE04C781AD1D5BD0E7EB48738EC85E8D726F8A434387868EA4859BA21D308483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7495c56ecd2ee46c52184e955b339394fe6f1b96f7eeae2ac7dbca66fa38956e
MD5 5996a5b3d579fe16ebc9ab2f888fa6b4
SHA1 c41ebd8f71d6e327f9d6b9f698c1d9be7cd7daf4
SHA512 b2cf1107a144670816abad845ca656b36e985c2ff2410eaf9e12e9ffbaadf15a640482435a595a659c3b30e5e75b828cf57ede4703604d2895c6e441630f606e
TLSH
T1BB5120E04C781AD1D5FD0A7EB48738EC85ECD721F89434396868EA5859BA65E308483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5e1ac623976339270996805c5ae1e78f9c72ba48a488e508ee29a62254cd8aee
MD5 69b9818bb4d9462c0e95509831e61d2f
SHA1 1bef7647e7973551a73471b2c800c84489857672
SHA512 f87d8bfb11288a5d18fb2bc77455addc275b19184cad08d9bf9b4b6fc2c9d6f07379aaab80a63ef11d77750c1f3c1f83d0d3a43cfdeb3079b496aa256b88aa76
TLSH
T13E5120E04C3C1AD1D5BD0E7EB48B38EC85EC9726F89034397869EA585A7971D318483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f4ec52ffa6ee53100c1a08ea589a7412fb4bda53305abd04838e2ed6ca5ac95b
MD5 3acba6bce4d9d1fcf62c1c93a6c65697
SHA1 f960e996ea9dde9fe4af1b61989930fa77936f9c
SHA512 4cdc774a96f116d683dd8df1ca5bc5ec711e77722593d1fdc28081d949f93e608d56d436ee633646e7efb887e06728e20bdb0d20544791a551439517348ce833
TLSH
T174412EE04C381AD1D4FD0E7EB48B39FC85E89B26F89434382898E958997A21D358483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3d788a59a605ed17c95f085f708aadbdf3662050312a9957d1725de4ed769a31
MD5 7c787dcd8d1442a60633e89535fb1d95
SHA1 afb2516a430e532e24662779c7d22da32506bfa8
SHA512 1937b5f8c0a84b4f4cb597c25ce4e54a783c7a1497deddfee07130a9a99c71a5f5c0b3d9add69c95b1dedfc6058aba8f036a3649042a9b80b4e6a62bca913577
TLSH
T155412DE04C381AC1D4BD0E7FB44B39FC84E8D726F890347D6858EA985A7A65D358483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bc7ccfad070063abf12b7fa328782c7f31bae4e24c643bfe38361d7c6c20cd45
MD5 8ed08300e05c54f75d5e2b466c38c735
SHA1 365cbab4abfc500de3d06e28e0dfea1451f55115
SHA512 cca482c1f12dcf79e09e5298720e19aaa83a4f88eb58e37e105a85e52d0ee54471255e95cf6a9388bd95bd8b92d2e4acbd087853941668dbc13d5036d24ee4ec
TLSH
T1F34131E04C381AD1D5BD0E7EB48B38FCC5EC9726F89434386868EA58597E21D358483F
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 c0fe2f04315b378538b8e74b74d20158619a6f6abb1e55974caec817c57fbba6
MD5 b8b4b6ea27ccd1f39a9750c5a53fd645
SHA1 10f5941d622cff953698cc4eacd21c4e49459705
SHA512 25226b96a8d1a8ecaccd2b6ae7ca62282effda296e7261c6172c731bc6ba47f7704949ac95f6c767f22a15c95036e056e0ab8514c81d410d2dbb675c8e6966aa
SSDEEP 768:6QCOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:9ThaqLI1WcxKgdfHJHH
TLSH
T11963D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 2a77bc2f75c7edf1b6b3c66c214f1e101d5b02cedea954d6746b711bddc45d34
MD5 32c0735de9472e243b2e856f0bf83ce3
SHA1 4f3c9b32d05dd244f357d442b4aac8cdd53c4c1e
SHA512 5743171b92e009f9c6cce91ed3d4a7845ed22b60d80a951f31f15801161fb10cc1b6d1db85d93dd22025b99dff221540d5ff9ddac79c7c960cc8da1a736379d0
SSDEEP 24:v4461t8fnqLI4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uwc:tOCnqJ/IHRH34kWqB1kQnjhHmr6ITmUj
TLSH
T1ED42996EDA2CBAA2FEE00B3ED7D1D0127B3AA60EC2E4D9F1095B505757C440401DB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

2f034fd1-d225-4cdc-b074-99ee293a9dc1.tmp

Path C:\Users\Admin\AppData\Local\Temp\2f034fd1-d225-4cdc-b074-99ee293a9dc1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 a1b14e25dfe6af143092d144f5ed2c83562d68e491aabf3d35e6770d3c801c58
MD5 c59659707324722122686aeb5c19ca34
SHA1 0b96e5047626bcacdef1cdadc50c72be1bbd1f49
SHA512 c9f6c4d925f425c15fb497974d155ce35cb26ee421a4e77f5574a282259488cc07683729e36b301db12b3f8571d43f7fb7de41dc6d752103f9e15a10bfbc529b
TLSH
T1E0515CD53932727F57C787E4A0664C945860F085032E6A6CEE0B9434FE6CEA0A35E7C6
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1344_1839862810\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_673600298\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miniwallet.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

notification.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\Notification\notification.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_79652818\json\i18n-tokenized-card\fr\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1380-918-0x000001AA82D60000-0x000001AA82E60000-memory.dmp

Download

memory/1380-909-0x000001AA801E0000-0x000001AA802E0000-memory.dmp

Download

memory/1380-929-0x000001AA946C0000-0x000001AA946E0000-memory.dmp

Download

memory/1380-922-0x000001AA82B80000-0x000001AA82BA0000-memory.dmp

Download

memory/1380-917-0x000001AA82920000-0x000001AA82940000-memory.dmp

Download

memory/5944-1063-0x0000015497A50000-0x0000015497E84000-memory.dmp

Download

memory/6620-730-0x0000014299F00000-0x0000014299F01000-memory.dmp

Download

memory/6620-728-0x0000014299F00000-0x0000014299F01000-memory.dmp

Download

memory/6620-720-0x0000014299F00000-0x0000014299F01000-memory.dmp

Download

memory/6620-722-0x0000014299F00000-0x0000014299F01000-memory.dmp

Download

memory/6620-731-0x0000014299F00000-0x0000014299F01000-memory.dmp

Download

memory/6620-726-0x0000014299F00000-0x0000014299F01000-memory.dmp

Download

memory/6620-727-0x0000014299F00000-0x0000014299F01000-memory.dmp

Download

memory/6620-729-0x0000014299F00000-0x0000014299F01000-memory.dmp

Download