hxxps://ms-secure-sign-n0p71mo[.]vercel[.]app/

Analysis

user interaction
yes
max time kernel
299s
max time network
285s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ms-secure-sign-n0p71mo.vercel.app/
Sample260810-seysjs1fme

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_877698202\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1381206275\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1258476975\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1780305897\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1780305897\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1489146730\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1812265175\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_411882704\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_877698202\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_877698202\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1381206275\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_521240185\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1258476975\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1381206275\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1381206275\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_521240185\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_521240185\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1258476975\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1258476975\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1780305897\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1812265175\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_411882704\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_877698202\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_521240185\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_521240185\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_521240185\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1780305897\deny_full_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5648	msedge.exe
1888	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308478277860271"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{B3353A06-1484-415D-9D6A-7C63F02A1C36}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{1F8F4886-6A78-4710-BECA-55A5F5593D76}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4528	5072	msedge.exe	89
PID 5072 wrote to memory of 5648	5072	msedge.exe	90
PID 5072 wrote to memory of 6040	5072	msedge.exe	91
PID 5072 wrote to memory of 6040	5072	msedge.exe	91
PID 5072 wrote to memory of 696	5072	msedge.exe	92
PID 5072 wrote to memory of 696	5072	msedge.exe	92
PID 5072 wrote to memory of 696	5072	msedge.exe	92
PID 5072 wrote to memory of 4772	5072	msedge.exe	94
PID 5072 wrote to memory of 4772	5072	msedge.exe	94
PID 5072 wrote to memory of 4772	5072	msedge.exe	94
PID 5072 wrote to memory of 5756	5072	msedge.exe	95
PID 5072 wrote to memory of 5756	5072	msedge.exe	95
PID 5072 wrote to memory of 5756	5072	msedge.exe	95
PID 5072 wrote to memory of 4880	5072	msedge.exe	96
PID 5072 wrote to memory of 5688	5072	msedge.exe	97
PID 5072 wrote to memory of 4880	5072	msedge.exe	96
PID 5072 wrote to memory of 4880	5072	msedge.exe	96
PID 5072 wrote to memory of 5688	5072	msedge.exe	97
PID 5072 wrote to memory of 5688	5072	msedge.exe	97
PID 5072 wrote to memory of 3880	5072	msedge.exe	99
PID 5072 wrote to memory of 3880	5072	msedge.exe	99
PID 5072 wrote to memory of 3880	5072	msedge.exe	99
PID 5072 wrote to memory of 5684	5072	msedge.exe	100
PID 5072 wrote to memory of 5684	5072	msedge.exe	100
PID 5072 wrote to memory of 2092	5072	msedge.exe	101
PID 5072 wrote to memory of 2092	5072	msedge.exe	101
PID 5072 wrote to memory of 5332	5072	msedge.exe	102
PID 5072 wrote to memory of 5332	5072	msedge.exe	102
PID 5072 wrote to memory of 5332	5072	msedge.exe	102
PID 5072 wrote to memory of 844	5072	msedge.exe	104
PID 5072 wrote to memory of 3524	5072	msedge.exe	107
PID 5072 wrote to memory of 3524	5072	msedge.exe	107
PID 5072 wrote to memory of 3524	5072	msedge.exe	107
PID 5072 wrote to memory of 4168	5072	msedge.exe	108
PID 5072 wrote to memory of 4168	5072	msedge.exe	108
PID 5072 wrote to memory of 1336	5072	msedge.exe	110
PID 5072 wrote to memory of 4500	5072	msedge.exe	111
PID 5072 wrote to memory of 1736	5072	msedge.exe	112
PID 5072 wrote to memory of 2808	5072	msedge.exe	113
PID 2808 wrote to memory of 5660	2808	msedge.exe	114
PID 2808 wrote to memory of 3928	2808	msedge.exe	116
PID 2808 wrote to memory of 1888	2808	msedge.exe	117
PID 2808 wrote to memory of 3928	2808	msedge.exe	116
PID 2808 wrote to memory of 3928	2808	msedge.exe	116
PID 2808 wrote to memory of 708	2808	msedge.exe	118
PID 2808 wrote to memory of 708	2808	msedge.exe	118
PID 2808 wrote to memory of 5564	2808	msedge.exe	120
PID 2808 wrote to memory of 3196	2808	msedge.exe	121
PID 2808 wrote to memory of 3196	2808	msedge.exe	121
PID 2808 wrote to memory of 5008	2808	msedge.exe	122
PID 2808 wrote to memory of 5008	2808	msedge.exe	122
PID 2808 wrote to memory of 4720	2808	msedge.exe	123
PID 2808 wrote to memory of 4720	2808	msedge.exe	123
PID 2808 wrote to memory of 4636	2808	msedge.exe	124
PID 2808 wrote to memory of 4636	2808	msedge.exe	124
PID 2808 wrote to memory of 5836	2808	msedge.exe	125
PID 2808 wrote to memory of 5836	2808	msedge.exe	125
PID 2808 wrote to memory of 5588	2808	msedge.exe	126
PID 2808 wrote to memory of 5588	2808	msedge.exe	126
PID 2808 wrote to memory of 4556	2808	msedge.exe	127
PID 2808 wrote to memory of 4556	2808	msedge.exe	127
PID 2808 wrote to memory of 5112	2808	msedge.exe	129
PID 2808 wrote to memory of 5600	2808	msedge.exe	130
PID 2808 wrote to memory of 5860	2808	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ms-secure-sign-n0p71mo.vercel.app/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff9e4a2c188,0x7ff9e4a2c194,0x7ff9e4a2c1a0
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1676,i,9829203257196002618,678515072820446572,524288 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,326349858245023274,9849233693777260887,524288 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:13
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,4489987584709227430,6983253459559243083,262144 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3652,i,14432406384950301556,13668736809450071068,2097152 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,9599383962191608267,12880047376794411087,2097152 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,15264975473148530611,9012671884764705490,2097152 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,16057956616393503087,17786691505212110560,2097152 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:9
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3820,i,14402580823326951694,1153180875935074092,2097152 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,2122710416945552249,4125224708324326728,524288 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,5424459434481836882,11793142800924373943,524288 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5728,i,4873317746029632236,152402679554137490,2097152 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,6863949163079669483,10792581191768636843,524288 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,6863949163079669483,10792581191768636843,524288 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5456,i,11120214619428809337,12112083328459433450,2097152 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,1388517372959391586,11383522590463379252,524288 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:12
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,16694446365693250099,13643852932287000023,524288 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,2583813560888797669,6064750140391054239,524288 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,15652665707580971844,1805516066798931842,524288 --field-trial-handle=2308,i,1569389214514182786,6478222904409408269,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff9e4a2c188,0x7ff9e4a2c194,0x7ff9e4a2c1a0
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1940,i,12798771574331101463,6735705932262633379,262144 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,9822046572745677463,11189255037705695256,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,7152678091779102592,12061110145305910111,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:13
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,15057580436423043098,8199909294985396903,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:14
    3⤵
    PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,15057580436423043098,8199909294985396903,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:14
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,11946306146610334551,1354706814306558826,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,14128469287491483493,17286948009452048146,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,888484952866291973,10825241946456668465,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,16302637234796960411,15679214980989596604,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,16857330337916304844,9028921243400807119,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,3804540538019559189,17375810781707158048,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,17431247247781250431,10231066371858399554,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1448,i,7910350189671633768,7345901348397740070,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,18417533545257060971,14659773890828508971,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1464,i,201772544560579516,17728430753068952395,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1520,i,16521851802078108069,10354176249324127340,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:3524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,10902424384878347861,11899879106511193867,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1184,i,16341622634771626351,7987283098650966532,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:14
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4508,i,14930158906260941980,1916320069678416140,262144 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,18348887463046702869,1427554933881570624,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,472705223510165824,2394340939003334913,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:14
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4044,i,1100453690043986916,623428502182942388,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4076,i,17500350664402852832,15139029870896287810,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,4749085813218714171,7472655500712420991,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=1520 /prefetch:14
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,679476802883198138,11137551313058937950,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,15245172711514822676,5637697589889476,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1460,i,17429697467713119115,9153479118786333383,524288 --field-trial-handle=2388,i,3367356220114652389,3238024961384328371,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
    3⤵
    PID:5128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0f6e8797ec44866b70bb772777fccc9be92e480a6a74d7167030771d5c750125
MD5 139f17fb31df92791073000f1c84e70d
SHA1 e9e6e51d88d598a0b84044bc548b3e26e257f9e4
SHA512 30f90c4efbe6cb8610346955dea4171a79a315ef2747e4c055a5e807cc34af0e84a2234edf261f8a42231ace03a62a4fa6dc3295b65a412ffec3b262af4e0d9b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T10FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8ec36895d743d8e4469cc4f9fbf5cc2744d7a861e9b00c3cc5f4f838cadf1e58
MD5 224ef95b48e31f3ce2071ce3884b1727
SHA1 5c2f2f234d1245f707e38b5f8ec27ef3c2f1ae87
SHA512 78b3882d4aa7bdab3c0e1346f7d91e9a7edac4c0e2f447391fe1b02593e29f4f00c57203eab0a2a67e397accdee3ce445bd3d6acbf415badb0600f50a37abcc2
TLSH
T1B6D0A7747A9962A2D12C417941705A01653586A27ADB9247A451580D8970182A1DAEEB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 55f9a91bafa06f2bb55173b0abd0c22fa6e9a6ee127c1473645026e1a1031149
MD5 54a32674e4a19d907f736f9c018ea585
SHA1 547d893713a39095cc529b64a09608e0088bcd20
SHA512 bf35dd8917ffbaef0f45bb8c9a1558ff566430d6aca7c7b17f460bef04aa26aafa603e5ed20a0c959b73059879c3ad2b20ece1f3add26afd9d531982e5113957
TLSH
T1C2D023B4B7848311C10C80354431A7115E72C37034DFC623D461680C8860045E2CF8DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4cbbdae51fee10df92e753cb99b78b752476073622e1828be5af64c33cef7197
MD5 40ca8b248873f1602cb2f4b105bdd674
SHA1 a6f2c8417e325a5aa6224cc27969201cd2149184
SHA512 b11d8439d3eaf99690ad2322dac36ee0bed46aa5a41a4e4133e8bd4fce506e1088411f48cbcb704b8750fc749672b889d647355f621ad9b707a3f1ba700139bc
TLSH
T1F8E022AAC922FC3F18FD0B2950548A86E78413572B81450F7B3EA90CCFB4AAB0185C6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 6547ea44ca90f8f1a7d41d29343d36e2591c0e1c0c70139bab4669ef43fa96f7
MD5 2bd099ba1ab33a23b0de8fe3ab4db3dd
SHA1 c25ff91208c64d2b5aed94a40c12b0a808b09356
SHA512 da1324bf9cc695ed826bb7d25f04ddcb012dff7958dce22ebfbc7e1bedeaee3b3fc635f3b83d2f4d9435c66aabd516329c045a47220ffada0532e9f3b15cc966
SSDEEP 192:pD42OFDq77dyvNIj2ng5HupEnJd0dEOzlbh50t8EO3H5pi3orhQ:pD42EDq7cvaupEdchhh50idkK
TLSH
T13B13C2BE3B436D86C7E6967C450F5F7A9B36D2E0E8E0118B5336F1848B163161ADF805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 89a2d641da12d12e8107de9587c9ef967262ad88314b179ac74b6e55090f8ebb
MD5 f187fbd40f6f9489b90ac88cd8102367
SHA1 44ab2f01a8f7ae3f0a1c7b31ddcdf62af34a712e
SHA512 4915a49814c4abe59a92acc4dd5123d734d7fb734482258f22dedcb14765d847824687c0a2b329f2eec09f148569f81a3900e13e94755c1b027da7e4ec43d274
SSDEEP 1536:GWAOL/ZgL/ifoozRSCqQ06R8rVtW24rr79WB:GDOL/OL/h3QrZ
TLSH
T1534473F34401501BDB6423F5D3127A3DE13B5A4F6CC6E8D9E0BC6D851832B69F2AAE94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 cea16029a8be80bc3a91d845d39edaf4b5c7cfb83bd05401fff23e12ad0d6b7e
MD5 0c908021aee443487c88f4a8a76a2473
SHA1 7e2957c37e875a53be292c0906a3d740780c889c
SHA512 07d91ad52cc9ec5f34ef55eaf1855279b54b3f503962f0daa58a66b84745e8b55043685c7175069743e88788c20d033e51c2929a707ddb997691b9d930ee9905
SSDEEP 3072:1v9G+H4t+iHQovAmUM70hxiD6ieIpqIsIBI7IPInIpIolIAI4IaIsITI8IAIEIrd:1Q8m+fovAmZJVl0Webw
TLSH
T1D6257DEEC7681D92DA2BCB34B5E0DA173D7011C3B589D0D3A949C49897D6B8036EC27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 333f1b15406d69684953797b778eba22e068a6b5d0bce3c6ea200f3bf1a9cdfa
MD5 d623c3bc37be8ffde2ce73f71be25896
SHA1 1387f70e1b6f618657b70c37634896890eeecee2
SHA512 8c001d2889deb9285f0f241e90173bd6cb486058e34367fe42b7a9ade85aa523695c453edbb39ebbd3b291816cdb9fe8bbd36224954a1ed9082903ff6cd2aee5
SSDEEP 24576:eHYhbCXKImUro+jDXrSl+0Te6iMzYJyIdPYVxfscFBbYVzBUN3kVSfdgyZ:e4h+6Nao+jDXrUHn
TLSH
T16F165BDDC9786883DE52AD30B5E0E9537C7423C3F994C2E7889CC544026B7C5BBAA26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 c0016dc2164fbff6e12dea6a73517d24e526e7cc762412f4c840bc8164e99773
MD5 fc09be25339f7a91f561091d87396979
SHA1 a273f827140994b1751141f83f872017121e91ea
SHA512 1f0fa1b545e42f9066850fd5b4442172f58da0051c44a478d814d36ad4ea91fd348b0278e5c86ad5334896c5b5c0f1a11e286fb4bf92465a401b92b6ca35b137
TLSH
T14041A8A40B9B1DE0CBD945F4B4DAAC5876F374DA09477F33521A2AB56C0F38107D8E10
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0754.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0754.TMP
Size 1KB
SHA256 3c080825fa9a0cba5b2979ca2d6469c59874a33b30a80a6fbe3b11ca83df777b
MD5 5ad03b6435517efe4f880bad9d8fd328
SHA1 b6c79be1568ad4a5b351acc83862c916590935b6
SHA512 76da304c32f43d7a5e74230f4d419d61c1abe492bf5c936c4ffc346c3b30900632ce0dc1657062d84350db7d4ea7d99b30d77d2e819322a9e40e58372391aaba
TLSH
T17B3173A04B2B0EE1D3DA41F1A0D9ED4D33F7A4D8054B7F72864862B4AC0D3115BC9E00
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 ebb8e94a3388c89cad621ac21846f3e3ec019414b5032aac9b57a29a7fac962e
MD5 d92015fb14e6129526f2c8df1fe78427
SHA1 57a70c94df61d79988f5c2bc8cef456b5aca2fb4
SHA512 77b8578c9d1e5d5c8f29954b7cc0a8524a416f215d84e8a6058d25ca41db115e0f151e54264f90c003c00becdad6300b4b67bfaca3a0c74c77379d7bfa412866
SSDEEP 3:MsEllllkEthXllkl2zEklhg/ll:/M/xT02znC/ll
TLSH
T1824404047FC05405C5405031C011C3741371F4500711574334510C335DC55C00C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 e49012bd61388284cf5726783f0c9a137071a58d1e750555df08e9e934cda710
MD5 f852e03142ddf49c45b7a4acb2c00896
SHA1 258c23ff5f666194bcd92d77d89fcdc74b1fc569
SHA512 cb43ed5f73d909b5d47d23ae9d3ffda83d30f014d9aac31b00a798e7df8b6563f1260af425338d63a685f17cec86f03c62647d63534f8da0f45037a60f51c252
TLSH
T14FE0D89465CBC39E9E5074C351687718D19034C2D795FD4317058CC0F607A0ABBA3946
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 a715caf56337e211b44c53e7162d7dcb8bcdb4b8135b5fddd825d1955f3c6866
MD5 f91296f5089b15228ad3d2a8e2c11cb3
SHA1 61c9afaf371c67d10ea832e5f2e82de0dd9008c4
SHA512 69e71ab80e4f3be41ed189b844efefc263c029efbffdd889a1302dd18735b448127c688ded94889c6276ba7facc74203ae818ad153d57fcc9084cb6b630e165b
TLSH
T163E0205806CDC21AD95465DB47AD730C87D03843A2C4FA47274D9C40F241785A757341
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 600a66c9d280519bbbcbc0311786647ee8586544371ead8efbe2ba9f7ca6cb83
MD5 90f7289157b61190a7fbdfdfa16f954f
SHA1 80770a31c3d5135f7fa95389b05519237b4420d7
SHA512 b0e7224edb4ffc228cdd9bb5e220ab16c6f00f23ee4119e85b5c9842e4b98d30f485096b72ae439871937358c0ad37cd9f9ea0d98bee7959c7b6ca1aed861f88
SSDEEP 96:3BCxA0mv2XoPuGpUunaA1uXNxeo4X+Ux6iZxBM6XHrn:xa7M24WGpUTeCzeoC5xtLj
TLSH
T110B2185B6EB93402EB510F3D306F387CCEB3A41CBFA78EE4212489614AB549655358BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 8f2ca326ed83ea2fd681b872922aef9a48862f3344b5f0cf9208448c92735296
MD5 91da39a12a4361a36a2ec11d454bf2cf
SHA1 f025f80bb0bd6811cc657bcb65144be175567c0a
SHA512 806cf9e415f17827c842b640e8e6fde1225c718cf349df06e516526e32d3746a530e53e999212f98b4d90ecac491ff3492dd8245de1c0bcdfff193b395a4e535
SSDEEP 96:2adqf+pCgVkhotejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/Rbadqf+zbbEOVpZp:4ykVH+bF+UI3iWGVoWN3qL/36VVV63
TLSH
T18B24221F5F342312CDBD413568EA44A35D6DF03FCB5266DA68611874CEE2B92A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 c82ab6852425dedaf15cae7b2e861f3ac798b4e158163bae0b304f495f4d464f
MD5 df70433c0c07bac7678aa943ef6183ff
SHA1 921c7603fddc77486637d83c3f971245451a7278
SHA512 fb67d05a12e339f4317828affca530aa1141217fb31db8797b3ae4b0a7e2ba6a58a35e069bbeead589ef8b7c323fc6224bf8160afd41875a081f9cfaa57eee62
TLSH
T18121FCBFAA1C8016EF4002F5140DFA5CD7674EBEBD48EAEDC958A72446E1065961E806
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 134cbbcd6a76711c11d9e0d78d525c26691aed01d28e87b42de34cdc71325d96
MD5 57b10e36ceda8c3e0399bcba042b40f3
SHA1 fcced0c94277891909691203992091abf1e1f7f0
SHA512 3ad0e64826d24a2c540edaf5e0ff9e1d7367ffe09fa0508cc74bdec2a4e9b3dae2e69c53d90686fe1e2548ce87a29b059ec16f166cbf28217ad9c9354c1e1d1f
TLSH
T164E0207046CFC27D9A4420D792AC770DD7B13557D688BF421B089C41F041708EB933C1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 28KB
SHA256 13f3573cb5e2f093d60354f6eb27fe5ac48a44170d4dfc4bdc0846969462b49d
MD5 c32249b35e82862b3ceda4f75b8c89db
SHA1 72cd97f8e427075b71bd56d6303b9108e92e6c76
SHA512 285aed4b76cf81ab35f8a9b7d5e852741f6b09573658677544aead9bd36e6a7db8f8cc7f4e883dba02ab5259c735b2acdd53bbfc9963f3b792141f63df4c7338
SSDEEP 96:dDeMatha9RNn2TiQ/BsHBsj5O+xR4+q4G4oEuhij+AR/jIFkNh1sjjFrSPRZ479z:dDLaTaZvEN1UoINGFF19j+
TLSH
T1EBD2110949A8513DF7C16672D770DA027738660F956BE0B57086866C2E6628CD30FEFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6a37095c2c87b6253ec34fbb6b95cdf334fe91b5ef6dbb50355b577d7559de0a
MD5 644f1365f5ac31aa07e0d0cffe8e6546
SHA1 db7b077a9e3c9e64d7a35fdd723cffc1a79ef9bb
SHA512 452c83a21dcf68a06b56483e811f1b90f3799f5fb26584fddcdb0998bedb7250d5441c4fa8d8b9e693e59048d21c5e265d8c1157c471890483d149bfb4c3a575
TLSH
T14A31BEF3C6E8567D894146F87B143E2BCE2D0955832C7D5AC8D4AF5FA3E1871D28094E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 10156808f849227e3729a0b34570e9d3e51e5d428d93a57f4a9f91a0797cdcc0
MD5 c4ed81ab4e9225a020d307aacea74296
SHA1 86abb9f1f0e13d0ed6ec0c264ba31f7ffe6d38ad
SHA512 9c040f260570700cbf9a6569ffa8d998cecdb8bd03bfe2939f9f234566080f2e8a7ca21207ef2573e17bc4d8772b225254d19d24e83459b392614a9af784ff29
SSDEEP 96:D/Owj6bVaaijhnZJ9z2u5XxfJ1YDhYiMPBGBKfUNBwBg0MQ:DWwj8VaaijhnZj629JG9YiM5eKfULkBv
TLSH
T18191BCF783B4856EDA1196F0AA18AE2FDF1D0516431C382AC5D4EE27D3E34B2E141A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 a857005c5ad8150ff2d93f6b9cf877c1134495fd908946039c38aef261a1cd46
MD5 d3e30e9c2b979ed14f7dae978ad1bf2a
SHA1 3537067d10cd15cf6a008ed324f1bc61d95d568d
SHA512 6c3449d7a715664c103d95e13a9c6f701bb895c9ce7075003a9f59d0bea7de025f4dd03a2d7d7df82212c436fcfb6da33a304d2ca61e495938edc4481408b97c
SSDEEP 96:D/Owj6bVjhnZJ9z2u5XD1YDhYiMPBGBKfUNBg0M3HGwZql:DWwj8VjhnZj62DG9YiM5eKfULB2HGIql
TLSH
T12DA1BBF783E4852EDA1196F4AA18AE2FDE1D0A15431C3C1AC9D4EE2BD3E3471E141A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 b8cc0ec9b8ae497a5f8cd0ecd18543c38d853c52beeb4a52820ccc67a7c4c001
MD5 dcbf618a5c5e2877874687a0841e3af7
SHA1 0ca2d795278fb66babfb0ca92911593e3dd727a5
SHA512 d2ba97a88dd4257a34241f83f36597e1e4a0f6177e00a6a968aee57ee48bf5d971e342b32257e73762c8ed9c7977356530827f8da55e875e04add23f399ac31b
TLSH
T141318053A6BF6C7710285CAF1D447C0639BDB872124268EECF96C57EB0D55FB0B52422
MD5 SHA1 SHA512 TLSH

Submit Download

afcfaf7c-0ee9-45b9-8bec-b964acbceead.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\afcfaf7c-0ee9-45b9-8bec-b964acbceead.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e041cbff023c80c6e29984786218f16f0512521f1e29be59512bc73913e0c879
MD5 5353eb2b6f28b53c77d28b86fa7ab2cb
SHA1 f92b9039cfc8e6a34b4833f9bbd1d3354d2f4408
SHA512 5130ebb9bae918885b40184f69871c2848dae0d157a7cf059111d2451ecfb6a6ec7a21cee9b96561c138b43b183d9c43fb77fae883798124f9c1655d7cdffaf6
SSDEEP 192:sxRLRSbv/fjsf98TW3AtdzoA8p+ho0O/g6+WN60f+F5s6/YZFL4ElXGGNBIgDibJ:sxRL+v/fjsfoWNH/5yz/S4KNtOt
TLSH
T1F042D8166924AD3B4DCBD219BA59BF63E2F95033A1911E58B6FC961C00E77DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d31c331cd9f600aa36c57d9939b595a8e533155e18ab2e0d11b8c5bb2177f7e0
MD5 cac394e31a59d88e6603eaf0dbce06ff
SHA1 a81202936f37d4a41809c87db9ae9b2620c936a7
SHA512 85feb1980877f22994729ba002d3b96f1d1d3fca457ccb7939d2769fff83c833558a29bdc271700194a73a07f1817c7b49203121b4e2391161b98f0dd2ed902a
SSDEEP 192:sxRURSbv/fjsR8TA3At/zoA8ptz/g6+WNE+F/YZFLklXGGNBIgIJ:sxRU+v/fjs8Ax5/5f/SMNts
TLSH
T1DD42B8166D28A93B4DCBD21DBB19BF63D2FD5033A1911E58B6FC961C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e1d5678464ef6b0a2dc3105a4a110f8e1fa644165c9e53e9f798898a4929a0b1
MD5 364fb791072bce0279654c09ec90853d
SHA1 65bdb7f73ffa6cbdd25958c8f15878da70e88697
SHA512 bb2f6e4b257f334c4350d9fba78626f03c1ad50a404876371c03165b027f34329e25a46095a7137e5e3f96e066f3e47766a47c977c9f663d688513343697ff50
SSDEEP 192:sxRLRSbv/fjsf98TA3At/zoA8p+ho0O/g6+WN60f+F/YZFLklXGGNBIgDiVJ:sxRL+v/fjsfoAxH/5y/SMNtO/
TLSH
T1B542D8166928A93B8DCBD21DBA19BF63D2FD5033A1911E58B6FC961C00E77DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a77eee5fbb4d30a9fba436710110122f0e03a9eb76ee8bf7d100453476a6c9b5
MD5 c7aac027eb33ce70484b63c6d5964daa
SHA1 775dc591e32db191ac9449fcf995274ce5afef39
SHA512 e5835bae4770e828f6dc06abe66a5a73d592f288ed4f99c50fa0b93baa9b9e028c4f1f5a3c615343c1565cb64692de731599d529c586114f37d55a05647de2bd
SSDEEP 192:sxRLRCbv/fjsf9iWpVkTW3AtAzoA8p+ho0O/g6+WN60g5+F5s6/Y9FLOEBDgGNBQ:sxRLev/fjsfsWvKW4H/53z/2OINtOt
TLSH
T10452C8166924AD3B8DDBD21DBB19BF23E2FD5023A1915E54B6FC9A1C00E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 21bf1889038c450c4eb7bf19c9b9d6104832676e84c834486589035f8ec98ecd
MD5 638bc002c727ad20c286103a9e611d6c
SHA1 d052cc6eeb95ab601f8af90b23b6036f4d0ca1c0
SHA512 87f8322cac9f8fbeb3e6c743ce60a413a62470f8da8800fa3cf7214c8bca5e6b7a2a5db660832d0915e26ebd243ef2d5d176fe1b5b1ccfc9a3b2d12b8cfc80ef
SSDEEP 384:sxRLev/fjsfJWveWyy7XH/53z/2OXNtOm:s/ev/fIYeWJ/5L2i
TLSH
T1C152B826A924AD3B8DDBD21DBA59BF23D2FD1023A1915E54A6FC9A1C00E77DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 d5411babedcbb33b663dbcc9ecc71aafb74ded07c3b3322dd531bf5d5d48b4a7
MD5 48ed7c38c6447657d092b4c356933cc4
SHA1 d112d3ae3b8ba0963745249067c1a4398b445219
SHA512 2e96d02b6511dee39bf92410073f4d68b4b98e2516a5d5525b7d57df45f338fc001eb28571a4d21d06969447bb72fa4afa43850b72a7c743bbd43587aaa3289c
SSDEEP 384:KAX0EdqfCtgNbFfVNKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVui9LZRGcrocmU:K80EdwWgNhfVN8F1+UoAYDCx9Tuqh0Vm
TLSH
T17BB2CA3B640DCB7E5F800A9DAC196FD77D9802C796988D4047FE994C02C77EA911A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 e4d98ca491433f709dc0190443b610a9494dd2dabae6891ec9dd39ba0d2be907
MD5 741105b6175175036fd297076bfc2e3d
SHA1 078cc8495dae8c3ed11f8019b28381d4104547db
SHA512 d304516cb4a159ac1004a13980b30fb0ab2f3880b0b4a26c3b186d1f614c08b784cb2fb2ccef3a60a732b6310deec0bb6edd6a0a815dfb09c56ad181583d5251
TLSH
T1CDE020101ACDD37EE5D530830264A31CD3D47457D2C97D411F84C881D186F0877E7280
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 172B
SHA256 cdcaff04117eb8faba67d9d562a0bfd75009eaf756aa5279fd7239b787ba749c
MD5 a839888ad82d81c31baf71259b4b792e
SHA1 4f563b6df7086a64abfc4d92301f6a4269b25800
SHA512 b81918eab77e566f6499d741eb086bebf8628ac796c91f81ab9884389ea3c3e9d96968caa07290cd54a10a98ebbdab11ed90bf027776217b1a0a5cb647aaf2e0
TLSH
T144C08C847B50C9ABC9CA193206B827827B20E902010208938A546A31AA07798AF8AE80
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 283acefcf349e48c4addc4b761da88a7619ce7ff02443419173781b19995a83a
MD5 a251c6a8c70724138860a307ff63a4e0
SHA1 bd60d36892e324daa6e68ee527ad671fc9181d32
SHA512 f728408ede9ec0070b5dc20e21785625d73d4466f2a3717e907e0e0a180894665a38568249be12a3afc7150d298a62129c2c1dcaa0126d710e5139c0d8b9d16a
TLSH
T146E0D82466CECB2AF58521C76269F34881B2B443D6E8B9513B08E541E2467447753641
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 1e747e129e95c165ab38ce225e523085497814b9eb6554f74580490a5bc39a8d
MD5 79213d2a045f3efbdbb5b936e0ce977f
SHA1 a87f97921e9f571012cc73120aec3959359bf697
SHA512 4b5ecd58055ae616edc5e00437a7b41959d97e6b7a74026e8da7d6feff6ed88cfbe8a85f753ee33d0ec5d719db9c1eb8174082b979b7121545b82f7966e72981
TLSH
T157E026B046CEC73AA84860C343B4B71F82F27C4793C8BA8267089445E142708BFB7280
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c9b42e7aa52de6b888cbfd8554e101fdd021c0a058092c89d69c4e7dc143d7e3
MD5 6b1659f5d77945b5748a05c229a0da51
SHA1 850ecede8a43c4a02ef1034742093da524fe564d
SHA512 90f3ed6d61ac9487a4817fe78ce2137ca241e2558a0641c675d9ee147a4e207379b7164c31cb8f2e903365c10aa1c45718798fe42536c5467490c5a542e300f5
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5F8HtaTHd3LfWTI2gPfK4Ogxfc1NAjWogKViA:C3gFB31lERe1JDggH2vHG5F8HtaTHd3b
TLSH
T1D6911601377F02803D7E754D90B9E63B428274633018F86B3BA942665FA6F124EFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 5d124d6a52b005e9ee68268cf88e0668b4755e3734a6db9f71db32d5741b51f7
MD5 c5b626f906e40cd0fd085b61a74d2e4c
SHA1 975191cf80989531c8407d862a8f3971ab615add
SHA512 27d6bf56754c0088d11cd359a8eed6785747fc32c1d911bb6f23bb731d216b9c5ab499ef53787223909b858f08185690b7ea08fbaedfab3ded715477ab740da8
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5F8HtaTHd3LfWTI2gPfK4Ogxfc1NAjWogKVi0:C3gFB31lERe1JDggH2vHG5F8HtaTHd3l
TLSH
T159C1F301377F02803D7E654C80B8E67B428274633018F96B7BA942765FA6F124EFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 8965d8905e84f748ff383429c2486ee0027dc2063f77f1268e3be1daeeb9ed9a
MD5 45e1d0cc5793e43d22f3e4c088f718a6
SHA1 6caadca96887917c115f48fe9090962fefe75090
SHA512 c494a4fa75f02c6fc9b10259359e6101b17fc8a612864562f7f4135337d3b872a7f92633c22635c9b87e54b92a125766084625152518ca1c06393d3d3264b346
SSDEEP 384:DNrRZyCSDnxTICsdMEhIKyll7svbFKfk7:xFZJSDnigyI1l7svbF9
TLSH
T11344940A7B747001EDE6D9721CB080771E3C716ECF22A6916DA254698DB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 9bbde169ce9ce71257c1f2be476e4158a285cce353ab247f3bd4588d35f5bd54
MD5 2a4acff88e40e949cbe4469fcf95ae00
SHA1 722c6fc841f23c96a3edd040fded32494af3842c
SHA512 b8cb57c516c42d1e58ad7d2a8c0e94296d76f69218461c36a7f2e6441ffd014b54e34d4d8caf0e77a966413e349819a52cff11a40b61a8fa65ac64b15311cfed
SSDEEP 48:DEK3tjkSI5IUltGhp22iSBgk3asgXqZt+AozJfx56IkrDpasgXqZrW:DEtSyGhp22iSh3adqf+pzVx56ICadqs
TLSH
T1D552514FED202113DBC05371AA9081D17F9F173F7EC1EAC140D986010BA6ECAA61F0C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5af8a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5af8a9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b456706f252f2bcd53d3030387ca374b9ff63c23e741f3273947897e1d305bfa
MD5 48c730647fde073450531332c05a2965
SHA1 518b57a0b4a20ba84295fd94d3b6b8c61d5327a2
SHA512 3b11d3399c29679abbc45fb571fe62a272d392d7f51823dedef586be8a3be71d62b3c4bb37336b977d989473772d67d02fc38bf009abd8a58ea2ea4666819b8b
SSDEEP 3:MsEllllkEthXllkl2zEel9q5tll:/M/xT02zN9Mll
TLSH
T1DD4402086B893405CE1C20304411C3500365D8900611574364510832DD865800C44100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7e53f987bf1790d5c042bdbefb65b762e7f02bc078a4ae1dd723088d8789585d
MD5 83e97c200695c78d73331e557253628d
SHA1 4c1088ea65cf8ac4882ee6600cc46cb90acd2489
SHA512 b0b0008a6ba35af2189cd0acfdf8759aecc25f7fec85586012205de1322c98fb8e894d4063b4cd5abfd4403335dc00472ec4493f45ff8d704986152080a7088f
SSDEEP 768:Irv+4UNbdH3Ny+LeSFOUAQX4fouOToPvB2thtA9VABeeVH1SlX:Ibsbh3BsnnwthttgEH1Y
TLSH
T1E103CF32A4AC9A33EED6C398310B71472FF4916396910FC49DDD2B5D069B9DE430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 686c98a48a1b50b47e1d83b8fb54e606f924b013ff712309a3f84906751322bd
MD5 55c7ae0262943ed6fca939911cfb74aa
SHA1 d0b7b22e7477f5da888b18c68fa514ec85dab9f3
SHA512 85013e2794b0a8c6d68b8bab807557bdc7dfc47df04b7b60a91b71e4f2c83db98edf09e29fd1c1ecab023e9f6c26c27bc09df7d07a1a62f300ff51e538a119de
SSDEEP 768:3X3V64k+LeSFOUACX4fouOToPvB2thtA9VAgehy6DqA:3X3V6gsnnwthttPTP
TLSH
T1AFF2CF71A4A98D33EDDDD398710E36425FF0812396D41FC46AED6B1D05876EE470BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9b65a1a386f679f7027cb6e694330512acfab55d923c4983fce9cb4401fcc151
MD5 c72d27a81e7f7d8c2ea27cd33e9640c9
SHA1 5008bd0d9cfa441a32871e593c2735bd977c3295
SHA512 0797a0737d3d7dadb16385690311eb61bf77820c1582327c1e9c6e3705eddf7463808861f5e243b911317467579b9fee19a53e61eef283fb39d75ac4ed1ba3cb
SSDEEP 768:LX3X6Gk+LeSFOUACX4fouOToPvB2thtA9VAgehy6DqA:LX3X6OsnnwthttPTP
TLSH
T14AF2CF71A4A88D33EDDDD398710E36425FF0812396D41FC46AED6B2D058BAEE430BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 22b9753ae9dcd1a86477dffff7e0a9b9fe6211caff310197582dd3e71a5de84e
MD5 ced091bf9ff84a27b29324f3cc32d59e
SHA1 39a096817489908bc0797f42124ab388d637d621
SHA512 1e58c66ec12702578d486da70ba6b77f542c3de7d43f4d6d68ef2f0df9f18cdde333f809f4b7bd854b856f809cd9fbbcf6d2fe9995d4f3b593f53541b875bb43
SSDEEP 768:kX3f65k+L1SsOUARbX4fouOToPvB2thtA9VAro693Tdy6Dqa:kX3f6ysnnwthttseTvd
TLSH
T16D03AE30ACA5493BC9EDF788720E76565EF4413795F51A98DBED1B0C0423AAEA30B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a9afdd0ad60ae55aa2e070bffe8809d9b2cca6208887b0ba558b0c714e271e30
MD5 f5a5b3a60d63e10b540e1c67e9becaf8
SHA1 13674c4da3927199441f6ab390e63f85e0c1df32
SHA512 1e7857fbb5ddbf71f0f5dd8976f3f9b3c02008438eb902921058c147ce32646ecd32e13d05f46fd9466f03cdecb8c273044a56b549b2acea8635aefccd7e7e30
SSDEEP 768:nX3E6Mk+LeSFOUACX4fouOToPvB2thtA9VAgyCK7xjhfhy6DqA:nX3E6UsnnwthttJCK7xNfTP
TLSH
T102039D7C9CA58D3F989EF348310D36665EA44133E5F40A98DBD95B1C8073A9AF70B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ff71986f2d1c84261952e73d9e69eaf881ed9a056b4e5e4aedcb47c7801594be
MD5 320973e083c5c4aacc8d4a5a11961668
SHA1 17829a7c98663e228b2b6e01ce6bcdc784357842
SHA512 d195bb7cb11c27414698016b5007799188142df810244424e3a05011f01fbb8956b3d74a631f07dde191d2b71b60c0c0a3fd38b34b9599134192259285c907fb
SSDEEP 768:grv+4UNbdH3xL+LeSFOUAReX4fouOToPvB2thtA9VAwFeVH1SlX:gbsbh3MsnnwthttcEH1Y
TLSH
T10503CF32A8A88933DDE6D388320B72572FF4915396900FC49DDD2B4D069B9DE570BC6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1995b687efa4e2d62f45e3c5451459189c1f075a65f89af2e5976af0e68c536d
MD5 a10042e676c9bac1ffddb958db3ec9a6
SHA1 a27246d76a84b68a7a90fe4a84573c19fd0bf5e2
SHA512 dde3d8d2f3cb8363136d3e157aafc2a3101a84ef23e2ea474004911626bc54c450fb7cf822db9ee4dd1a2291e1d72dfb1ab12191c6e14ed3ef64f230306d17a2
SSDEEP 768:rX3f65k+LeSFOUAXX4fouOToPvB2thtA9VArThy6Dqa:rX3f6QsnnwthttfTd
TLSH
T143F2CF70A4A98D33DDDED288720E36925FF0506399D44FC4AAED9B1D04877AE170FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 60KB
SHA256 7a092ad1acaaa19604ebc8a61a4eb2567c8f291c221572c6d9a5769b749dc6f7
MD5 c3ffa5aa45ee0e2796af3c8171099eb4
SHA1 2d49f7e168289142c8a5ce0ebfbd440a0a8c0e58
SHA512 a1d5056cf324ad82400a7fb7686344dabfd4b5b8102b9351008ff71330a4df089b598ad1e4d506e0aefb49441e1485e385ef51e268406c7d9ee689994792578f
SSDEEP 768:3zF4X3Swgq6t++eIocFF8X4fouOToPvB2thtA9VAZ7NMvxYLs4asABZWgWo693TJ:3WX3d6IsnnwthttZ7NMX4Y3eTTd
TLSH
T198537AF598E3897BE9AEA747633D6D459DBCC123B0A49884F7980E4CCC525BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 ebe3ebe31e62cd9a1b3fee4ed17b725684f3f2c87c45d84ff50e07ab666307c7
MD5 d9610e312afff12c1fb989a80489fa85
SHA1 c722002e26537e0ad9ee65143d21ea49c295cfd1
SHA512 83d0f561e042730b9f480d2564c7b3342d147f7503d76f12626f448187ae86a9c5d57e1b242036204838f1fec6c261bb47549bf452db51241fec58e231a8f1a5
SSDEEP 12:TL6KeJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isHYzcQAIdQ5mQQF:TL6Rj0afDdWec9sJVUOBZbGR2Vjy
TLSH
T160920266AD311433ECEA4B36BC5349D00EFC175F89A7B914D9D409220DB1BC2E2492FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 beea22ba860179227684d4e76ddad7959943eadc6bb71ea0429f8a8bb7bc387d
MD5 f78d2e888ca6a9b7ef358e7e47139b37
SHA1 179ab96620532fa231adeb5bda4da1915aca58ac
SHA512 a8c92414ecd9316518b0110421094b9760596c81a2f758d234ca7539e1b7cac152a1fd941b85a1a877c3790409e167838db42a6bcae9a0c0a7415c13da261c34
SSDEEP 3:MsEllllkEthXllkl2zEklBzll:/M/xT02znhll
TLSH
T1C344044C7FC04C05C50034304111C35043F1D45017515FC334550C375FC55400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
MD5 54b0cf5610d4cbeadf10f35941bea007
SHA1 8bcec79787775ec6c2625b88611eb0de385e393b
SHA512 3f6d82da490f1b52647d9f376be4aa3159f57072ad2b52a048895bf7f53255d860bc12cc4b5af53cf9d9ce8c76cfab722e47cef3b58fa776a8ffd7e991630253
TLSH
T1841184D00C7F1AC7C6BE0E6FA0872AED40C8A622F09830381CCCF964917901D3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

bc9c8279-1195-402c-91b2-8eb8246ce83e.tmp

Path C:\Users\Admin\AppData\Local\Temp\bc9c8279-1195-402c-91b2-8eb8246ce83e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2808_82572606\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2808_1258476975\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download