facf78d474b66ed821288db41fa6ad8a7b6f30650eb12127cb3e9a3cc6146116

Analysis

user interaction
yes
max time kernel
368s
max time network
341s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
08.13Statement of Account.exe
Size 1.9MB
Sample260813-k2mpsswbqa
SHA256 facf78d474b66ed821288db41fa6ad8a7b6f30650eb12127cb3e9a3cc6146116
MD5 72a8eb805e026accc0a5805847db978f
SHA1 a1589326cc3fcd0c64a7c08ca78fe30b3f7ee5cf
SHA512 c1fa2348f5b7b2938dacc27328e1fb105b42b39a248aa6e765b94254e0ba03b6cecfe6f69d08d7761e6789497663addabf56f94f2b2e5eb7987487367a8a2e5f
SSDEEP 49152:8pojL/+cPZpJGmF+Ml7mbN6ZNjshcYpKkjsVc2ot4+Ej2ED+l3eFq8umM:jZpldnGMkjsVc2ot4+Ej2ED+l3eFqcM
TLSH
T161957D29F6488195C17AC17C8AD6CB4BE7B1B40D87359ACF508547DE0E63BE18D3EAE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1480269281\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1922627141\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1922627141\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_817098152\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_76657682\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1480269281\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1470732653\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_801791642\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1480269281\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_76657682\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_817098152\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1922627141\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3744_745422294\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1922627141\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_817098152\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_76657682\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_76657682\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3744_1076869194\_locales\az\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5188	msedge.exe
5428	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310857482938967"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{80986FC0-3807-4E68-B94D-8C30CDF70DDE}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{517E070A-8A85-4C14-850C-024510BFAE13}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5760	mmc.exe
1400	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe
Token: 33	5760	mmc.exe
Token: SeIncBasePriorityPrivilege	5760	mmc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
3744	msedge.exe
1400	taskmgr.exe
1400	taskmgr.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
3744	msedge.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5760	mmc.exe
5760	mmc.exe
1400	taskmgr.exe
1400	taskmgr.exe
1400	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 5396	3744	msedge.exe	96
PID 3744 wrote to memory of 5188	3744	msedge.exe	97
PID 3744 wrote to memory of 4320	3744	msedge.exe	98
PID 3744 wrote to memory of 4320	3744	msedge.exe	98
PID 3744 wrote to memory of 4320	3744	msedge.exe	98
PID 3744 wrote to memory of 4712	3744	msedge.exe	99
PID 3744 wrote to memory of 4712	3744	msedge.exe	99
PID 3744 wrote to memory of 2636	3744	msedge.exe	114
PID 3744 wrote to memory of 2636	3744	msedge.exe	114
PID 3744 wrote to memory of 2636	3744	msedge.exe	114
PID 3744 wrote to memory of 5840	3744	msedge.exe	102
PID 3744 wrote to memory of 5840	3744	msedge.exe	102
PID 3744 wrote to memory of 5840	3744	msedge.exe	102
PID 3744 wrote to memory of 3068	3744	msedge.exe	103
PID 3744 wrote to memory of 4664	3744	msedge.exe	104
PID 3744 wrote to memory of 3068	3744	msedge.exe	103
PID 3744 wrote to memory of 3068	3744	msedge.exe	103
PID 3744 wrote to memory of 4664	3744	msedge.exe	104
PID 3744 wrote to memory of 4664	3744	msedge.exe	104
PID 3744 wrote to memory of 244	3744	msedge.exe	105
PID 3744 wrote to memory of 244	3744	msedge.exe	105
PID 3744 wrote to memory of 5116	3744	msedge.exe	107
PID 3744 wrote to memory of 6092	3744	msedge.exe	108
PID 3744 wrote to memory of 5116	3744	msedge.exe	107
PID 3744 wrote to memory of 6092	3744	msedge.exe	108
PID 3744 wrote to memory of 3056	3744	msedge.exe	110
PID 3744 wrote to memory of 4120	3744	msedge.exe	113
PID 3744 wrote to memory of 4120	3744	msedge.exe	113
PID 3744 wrote to memory of 2636	3744	msedge.exe	114
PID 3744 wrote to memory of 2636	3744	msedge.exe	114
PID 3744 wrote to memory of 4304	3744	msedge.exe	115
PID 3744 wrote to memory of 4304	3744	msedge.exe	115
PID 3744 wrote to memory of 2036	3744	msedge.exe	116
PID 3744 wrote to memory of 2036	3744	msedge.exe	116
PID 3744 wrote to memory of 4808	3744	msedge.exe	117
PID 4808 wrote to memory of 252	4808	msedge.exe	118
PID 4808 wrote to memory of 5244	4808	msedge.exe	119
PID 4808 wrote to memory of 5428	4808	msedge.exe	120
PID 4808 wrote to memory of 5244	4808	msedge.exe	119
PID 4808 wrote to memory of 5244	4808	msedge.exe	119
PID 4808 wrote to memory of 2968	4808	msedge.exe	121
PID 4808 wrote to memory of 2968	4808	msedge.exe	121
PID 4808 wrote to memory of 4932	4808	msedge.exe	124
PID 4808 wrote to memory of 1728	4808	msedge.exe	126
PID 4808 wrote to memory of 956	4808	msedge.exe	127
PID 4808 wrote to memory of 2336	4808	msedge.exe	128
PID 4808 wrote to memory of 1572	4808	msedge.exe	131
PID 4808 wrote to memory of 1572	4808	msedge.exe	131
PID 4808 wrote to memory of 5388	4808	msedge.exe	132
PID 4808 wrote to memory of 5388	4808	msedge.exe	132
PID 4808 wrote to memory of 3228	4808	msedge.exe	133
PID 4808 wrote to memory of 3228	4808	msedge.exe	133
PID 4808 wrote to memory of 4088	4808	msedge.exe	134
PID 4808 wrote to memory of 4212	4808	msedge.exe	135
PID 4808 wrote to memory of 4212	4808	msedge.exe	135
PID 4808 wrote to memory of 5936	4808	msedge.exe	136
PID 4808 wrote to memory of 5936	4808	msedge.exe	136
PID 4808 wrote to memory of 4860	4808	msedge.exe	138
PID 4808 wrote to memory of 4860	4808	msedge.exe	138
PID 4808 wrote to memory of 3328	4808	msedge.exe	137
PID 4808 wrote to memory of 3328	4808	msedge.exe	137
PID 4808 wrote to memory of 2912	4808	msedge.exe	139
PID 4808 wrote to memory of 2912	4808	msedge.exe	139
PID 4808 wrote to memory of 3012	4808	msedge.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\08.13Statement of Account.exe
"C:\Users\Admin\AppData\Local\Temp\08.13Statement of Account.exe"
1⤵
PID:1800

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5760

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\NewStep.xhtml
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffba80bc188,0x7ffba80bc194,0x7ffba80bc1a0
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,17251091581342325306,2994668554944824694,524288 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,8799018290326947692,8970956738225594546,262144 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,13306657175049624497,16247392780532471298,524288 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:13
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,8666762407822656522,5659814817599275631,2097152 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,2800811486949668909,4615262498319359950,2097152 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,6079554565370487184,3960258880547005681,2097152 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,1281245270168552015,2481757352949081374,2097152 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:9
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,555925505557941969,4933228873230773917,524288 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,16017631360620549994,12950783396740180586,524288 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,10561361011312877147,8970272931693739799,524288 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,15091402706112300796,16409004442456480397,524288 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,15091402706112300796,16409004442456480397,524288 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,8662714182753037224,17229890574730031708,524288 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,14325177940455096963,11726614254331804649,524288 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,4190507794776615465,18339552091867394054,524288 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,10279285977802954626,2528437189989902561,524288 --field-trial-handle=2380,i,5405427670778691972,5286168510592836239,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffba80bc188,0x7ffba80bc194,0x7ffba80bc1a0
    3⤵
    PID:252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,3075244501364478765,1806153688835000351,262144 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,4368588400986410887,8289210785839013250,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,14832739645691007296,6840810758584740899,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:13
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,17212785322242253284,3744904850206965063,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,17212785322242253284,3744904850206965063,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,13080205180207504309,11741151221500537880,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
    3⤵
    PID:1728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,10239296667702544262,17739438607602980931,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,6853046410550351550,9381920602400115006,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,15511364635815728809,15908516216064103053,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:14
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,5686435700075524901,14773898352171652471,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,6486769285798100656,3403036469142091730,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
    3⤵
    PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4880,i,8841314370012591708,11176495289121117275,262144 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:10
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,17757651786287181833,6108944915563610258,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:14
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1052,i,8278175399748128017,5683470128589226725,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,1437320632336170409,17340124612913131268,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,8027953106558758937,3238793476434466235,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,9967281535728668705,1354599072244449637,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:14
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,10530174016124730704,4711260759411998740,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,14038372817571855318,11819091480175883794,524288 --field-trial-handle=2264,i,16321472666136931764,8620225879922841775,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:14
    3⤵
    PID:5456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2512

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 65539b3b2947a15a8ec701eed77f7f9cdb732ec8ff0e811c44f800bbf1a36f8e
MD5 f085b91a112a946d771f68fbfb60f32a
SHA1 59773d6b5f66d9afb7c31beb340fc82d1efa6ce5
SHA512 4781d68407b24929123d43907dd0f9426f10cf5b7ce1feae7f11c6e8407d105f4c8d115778c2b2602ad49aa3b562b0b05688648e5ef1448b8eb4eafbedc6b6c9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
TLSH
T1EBB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b12b6aaacc3531e2606fa5eb280ae4929c75f82670a5fc331990dcf5f4b1e81
MD5 e293a66f886f80f5eeb21878c0c77530
SHA1 3926f358e61777fe2c930dfb5287451f962a40a1
SHA512 dc4bd1283e4faac05fed23611e49d4a83971a25110ee2bb1461701323edbedf609baf8812ae633d8648747b3b817f886edfcd0604af5ed76bf6c8a9f9a75924a
TLSH
T115D0A7A4BE25B290C519503548600600692A46A2396B968660A5941D9974080A297EBF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46d288214a40da60b3230138efaba90b32d8abbff7be59d00f9e8ab015bba4ee
MD5 9dcf627d5a6b130cfb2dc559803a0669
SHA1 51e94c7ea9452a901ce7aa57983a9ca20f124b51
SHA512 52fab97a5bbb6c7a6bb3790d9fa2ee6f003a762d841314651ad5bc2febe114f8739a106698ac6742def9b9fce43637fc56a09587e4d3bc5cafbc252161455510
TLSH
T174D0A7A9BE15A205C9465032685507403777457038AE9D57A0EAA41D6A64080A7DB57F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 585902d1f4dbf5ace60c4bd4a7336b8a72759728cb1694c21d05e7140962e17b
MD5 860384e603ec4276a2fe16ad33fe5d6e
SHA1 e3669b073334a9f96ffd7e6053ff289a744c9ab6
SHA512 9d7d3b7146c94d14a40de8a221c0b1c2b2e8277d40b1088604ff3e091f224778343d8b328d82a9e318500a26c7ed77ac324aedd82b0d160fd7d261f952d899c1
TLSH
T1EFE022AAC821EC770CFD279965144B4BEB45134B26518D0B3B3CC6088FB0B374AC685C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 c7aff3dc1eb12bd4f9ca094849bb65bc1fa2a0ab1167e39c4221a0067b8c43a4
MD5 7d2bf972b8485a0aa65425db1b55af06
SHA1 3e563fa12ccb02a36fe0ee7f112d7dd68016d222
SHA512 976076db00474d6cf5b7bfbd89350d6d4bf60f33c02dd9de97d11485c5b4cb2000d8371dd514e9272a58dd79a3bd609d79058fd2bbb5b05d632b2d581abfefa4
SSDEEP 192:DjedgY9MuwOEFI2+ESGJovPS0Q6cfyetx90m2Gyhj:DjedPMAEFISJ4IPyex4Gyh
TLSH
T1DA1393BE3A404D0ACBE3457C5A4B4F709772CD6AF9D8818B927631286267F066ECE047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 c2b7608d7e22cecee2b8a5e2fd957b30f0069bc874b178f5e9608824c9d94a44
MD5 f74437e335d4d3057044f75a99fa6d96
SHA1 bed07093143229226decb1fa1c07c8f605be6c69
SHA512 9b931498073b005e0244cde90a7653beb814c49980cfeca0f56fd238a0562d0a21cb1e7c219b4255b2d7df7964dfcc3bf34eedc4c917f6158031ff432f1c9366
SSDEEP 768:5ANEJKL/D2L/uJFgnEWKU4RqQCpqPcB6CG3NWhbt/WFTSA1DYvCinPMNKQtLvCzn:zJKL/aL/usb1Tn//MTSeiCiPMvtf
TLSH
T16A443DF70951A01BCBA842F5E2033A3ED177855E7CD1F9E9E1784C852826F21B2FDA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 ceb1cc89697a28793667031f28523f4a7b373c3d13c8b8b7d5e6ed553be57ab8
MD5 a9b353eddaff93137c17af2eab994fef
SHA1 6cdac60e0ba5c27f9f32c40fa0bec211c3aab679
SHA512 b316d0db851c4c580366b974ca634dc308e0da26703baf993da9658d2c23d2947ce9c9ab7497cfe2ede10eb319370eb55980e1f7948cba27c85d56d56cb60a1a
SSDEEP 24576:wH+lZF+KSK7SpYmPEU8litYJ2x5bSsZZZPGdpBF:welfhSwAFEUES5VPGdT
TLSH
T1ED167DEDC97858C3CE639A30B4F0E9477C7413C3F995C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8bd012b24a88159e7e7e993d8ad4bacaefbe2a6c55a31e16a79d391895cc6ba0
MD5 f9faaa4f38603d14081a2a1b50c1c7c7
SHA1 e421960a3d4c9969d71887e8c55fcb779b0b9286
SHA512 4daa0704bd2fa89804cf0e244935ad1702862d12f422d37240c9451c99cf045fa0d1ee915a6b5c968f9495623d3ee4f2d5bc04f7d79c66c5c295ca556b4fa45a
TLSH
T130512C61132E06C5D7A5C5BD10DB98A9F6F7945E3B0F2AE180487CB49B03F0A10C70B7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b01c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b01c2.TMP
Size 3KB
SHA256 941102491f2d67da30a3a6fee02d5a6e004beb5036aa292be78d2d0c5e3f2549
MD5 753fd7ed854f91cfa9e9466c698acd3b
SHA1 dc4263d8493a2441eee29a00bb06da6bf81fd78b
SHA512 927ef871c15c85c9f6fed7ef6e48bc73d899a4a58e8c75ce636a244692cf8430ab7558ddfe00adf3e1a9add3659d047d689689ee1c434c022ac50f0cf95464dc
TLSH
T1A8512D61135E06C5D7A5C5BD11DB98A9F6F7945E3B0F2AE184887CB49B07F0A10C70B7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 28f03d6eaa313134b5ec2257f75d41d81b81991045ea36c83101ed88215ab055
MD5 5d496d8e424a377b778f5f2db3a494b9
SHA1 81d401fc4ee31f38b9735d122e618aad04ad2d7b
SHA512 9c960dbb400160ff68a07bd9c855553ee18db08d93e55697568a4daedf411e2e686831ee36f4de607b2420eac69a40055b7fa4e11ce4f9004ae6596335e8bd74
TLSH
T143E0D894A9CAC13EBE6038836634A708C2803943E795BD03370888C17A42542F286586
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 769e3fed6df63a686b0c0520e8582a430ed9e1cf130e15732bd84644ca850622
MD5 e99ed43e9bc2a0c192a0754ea720a650
SHA1 1ab048396b4f1bacbc27155a3ec738b970bf5ed9
SHA512 492f860563064dee8fcfc8e5bcee2977247afb12c6221b2ae6aa88a75cad2775a255bd262e220946388022f35f5f79f7a7b01677ac63b039f00a69d47928f013
TLSH
T150E0268814ECC12AA864BCD38279630DC6D03902B38839027B5A88C47261B89E387680
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 8e0d84a29f60e6085423b7f5f7fce6b823d54c820d633168fe5ca131d530815f
MD5 4ce09a57bbd419dd73f2fa6c3f78fc12
SHA1 08c676bb0f2c2faa0110bc2e4473ac6b1647b27d
SHA512 e804a046560d20d589289d09fd8f9398b7c85eb585282ff86c1ff80293b05582c01486fbf94617a0f5a888c789a6b86d34b039eb39f6e71835177068761ad5b7
SSDEEP 96:rcutejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/q8pbbEOVpZf24JkMfXSFR+CFqD:rchH+bF+UI3iWGVoWN3qL/TVVV63
TLSH
T122241F1E5F242722CDBD913669E744A35C7DF03F8B1326DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 65f63ae08d64203d074db7b99a5e08ddb50b58dd1679a309816e66c954c0789b
MD5 de36e1adb71783afec7d97a694ff5fc7
SHA1 50ff245f5fd31d6080b0100c577266443eb20a79
SHA512 31b86cdd0cf86cf352561b7e45e472ccc17efb521dd8075180219a435c04ae88c9f18b7fcbfcbd5f764314b2e6eb340f7c3c8940d33c40b5a09f388a58c7a922
TLSH
T104E0D86064DDC5297D84714B92197708C7F03906E7887A457B25D8C1B441484E2931C1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 97782a895f4c50ced07680adbf51a435c871655ceb37655ea3c5774607d079d4
MD5 1e7a07060f1912fbdba95d1e81bf5db4
SHA1 c85dd639d3a4c22175a4b661e9a4e75f8ec9636f
SHA512 d72d1a9ae4bdfabc34adecac67b4ba738ccced878c1ad2a8f02c1736a599c1f4dca9303a5abe22662f2289ce855acaa4c8aa7517ce24801d3a796a20f794ec3c
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7oTw53Z5K5:qDeMatha9RAPA7y
TLSH
T1DCB22E4D5F386611D0F44B76EDD184672FBC201CD3633689EE2860F3CDA229BF6068A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bffa1b760715bf99f2af4330e7a1eb772598398c2da8aa20d2551aef4048268c
MD5 3203ad77a504ef101573597e5abced75
SHA1 e0f4b43dddec96a844cd3fd32e1acb33327ff17e
SHA512 eb2c364475d79c441398eee83fe584ee7534610ba6e197895f2939a036db6b7a5a2c8ec676136a8bc2547911ca78e4de8a260710a1682f26c0e14911a3d8f889
TLSH
T17241BBF787E8856DCA0156F0AB186F1FCE2D0915832C7D5A89E0AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 73970f48cfaa18dbb88ad71e6ca8779cda005d70e62908d095d276b408c347ac
MD5 893f22a3267d6b167fd806e2f13edb91
SHA1 50000731be27a1c6b011f21dd4d861699d324d5c
SHA512 ef7acc8eb395cacdd59027771b32af39926ce44bcca77f7fd6104ec8ac9c8628aa735227732fa555b4b443a2eb8b6a209c8b7e420570bbf1d1eb4ed22bff38dd
TLSH
T10B51DDF387E8856DC90156F0AB187F1FCE2D0915432C7D5A89E4AE2B93E2471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 c6ad7a8ae3eaad43086e65b6f6b5f83ceb586722965628641ae1f5e8378dbaf3
MD5 99e74adebdfa9d4d760f0921bdd76250
SHA1 9363c8fff8ccb9aaf2e6d76b074cf212dea469a9
SHA512 2df54aabf64651ded17085a5160ba5c5bee20d6bcea11afccbaee9c873faf738ac2df91239187f5ef4caaeac3afd2acb90d2963260124154afe86bf17caec7f1
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBiRa:OIEumQv8m1ccnvS6JBF3f5nFXo8mc4g
TLSH
T174F2DDFA07276205D99484F0E4009FCEAF06404B47B6B6EC76D447E3F7A21E2B1B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 238b84a0e65755b161f1a36c23fad959d3f262263b300dc12e9b0063a954b621
MD5 323d41d1a04c6eaa4fb6b8696c5d1c0c
SHA1 da6f3c7885431126a4dd499857a40d3aebe93eed
SHA512 7630fbcaf3f10a9bcc76938916c8087f2ee5ead87b5372882b6db7a68b1dc1923356d1c9daf77a15359e1969b7185c8f4677d10ec865722ea839e03e072bffe4
TLSH
T1AFC022D284BCE0F22038853D1A8C7C807A75E83C2C0040B5D9AA923CE0910F75A01029
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0787ff328bb8aecb848ba8244d4b2e3ebaa4bb70aeb26c0255d56da7b3b7ae1a
MD5 d26ca8768663844d17f1f99b9e20065f
SHA1 7fb47bc787cfe995c17d2ab44d110c853fdb8d7b
SHA512 420790ba5474d16bb3a12b625c908c2f3ff3a4e83e520b2b0b10697f9cef657169944c2ea3efffe7de61bd0eae188e270d99b807c7e8d383f5d1536731f7f6f0
SSDEEP 192:sxRtR4bbA/fasgWpVsIjjZ8TzAvnLzoA8p4A/g6+WNIYMVUiKbgNIgV5B5J:sxRtAbA/fasgWvsSNAAvnqx/5IjJp
TLSH
T17E42B6156968A97B8CC7E25DFB657F53D7FA503261D01E48EAFC8A1C00EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fe2d6eee7a7cbe6fc34720059ca2fabba15f449bbb6e0a601953c871971c724a
MD5 1210dc3fafa3392ce7c1c9f6a886332a
SHA1 05e52a061010e143b267cb7aff3bf08f19a6faeb
SHA512 6cfc3b5610490062a63390f93d4c77108c5cde7a7cd28cc1547716af9500a8324578e00c2ad5a5ba97eab7aac706ff848a5a0d92ec58786bcf51c3143ffdfa78
SSDEEP 384:sxRWAbA/fasvWvn+NAAvVh5qx/5IhlztU:siAs/fRYn+eAO/5IhTU
TLSH
T14352B6156968A97B8CC7E65DFB657F53D3F9503261D01E44AAFC8A1C00EB6ED220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 32b0657fdfd68e13df611f48cba67dca924f1f4a8c92cbc478663e4b3b953c81
MD5 c4b159a8555720e8f7e5283a63b6e8dc
SHA1 5180182710e1411f028e8daddbc2d30969c0462c
SHA512 913ac278113a92844faaa267d89a16e3376513cd402b3ba438adb9b58bba436f11220df5feb426b2fd38159f7b1bc422772b24658aa2b310e4c5c04786bab1f4
SSDEEP 192:sxRWR4bbA/fasvWpVnItjZ8TzAvVh5LzoA8p4A/g6+WNIYMVUiKtGNIgV5B5J:sxRWAbA/fasvWvneNAAvVh5qx/5Ijlp
TLSH
T1B652B6156968A97B8CC7E25DFB657F53D3FA5032A1D01E48AAFC8A1C00EB6DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7957d0244044b3d66a08c2832f4de245f0fd491bb22e0186c106cd1bb3950955
MD5 487f48b210214f206bc4e2a6a9d18d30
SHA1 fedd1bfc3aa8cad92ea72af210d964615e2ea15a
SHA512 44bea4a0f574fc8de53e98ba84700795fa8ad3a49cffb39ba8f1fb2346c8ef80b07f7c2bda15c95e3d84f00f931ace1ac1898f2b221df4804b19ba894ac8aad6
SSDEEP 192:sxRtR4bbA/fasaWpVnItjZ8TzAvVh5LzoA8p4A/g6+WNIYMVUiKtGNIgV5B5J:sxRtAbA/fasaWvneNAAvVh5qx/5Ijlp
TLSH
T1D152B6156968A97B8CC7E65DFB657F53D3FA5032A1901E48EAFC8A1C00EB6DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 f829cc81ef738e2c06be2fb5d85dd81aa02613896cfe3e9c691048a285df38f7
MD5 e43583c4a5c2cbeb6fee56c7eac3c686
SHA1 4e3d7598a848bf7190655def927477edb7b01442
SHA512 e6c13604c409553bceff49d787e91bc66a358cdccdc451edbb276cefbd8eeff3a1d9b647a966580be32963ad6451c67d2ccbaa7674ceb7e3a8e65e07525a411b
SSDEEP 768:0UQieS7pLuLfJaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcX2OVqNrob6c:0UQieqEfJaWgH7feQu1jarX2IqmV
TLSH
T156D2DB7B640DCB7F4F804ADDEC197E9A6DA802CB9698CD8047FA845C03C7BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 80614cd3588a30b25afa3d1364be92ddcf4a68a341facbd67fc82662b7887baa
MD5 0750abe2247f95e7da58353e91224b40
SHA1 0f44ba20a2e91923b0191086774cca3e81095d0b
SHA512 58d801f67863f752fb7f8677140225ef852153705bd4915c446469a8b1c76a345873c3d4a005d5a4662241a8616fd4ee566534da645e1df87cb9844f6f9b7670
TLSH
T1D9E07D9415D8D17D7C59708302659708CBE47827E3CC3D463FC0CCE36682988F193180
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 25249b9967c0d9cb1be1c7e1bb104e4c7a4580252aaeccb76df5ff65e3f4675d
MD5 b8719debae53d3efb963094e02f44e41
SHA1 43ec65c7248ad2f4a4380f8211ded4ba048cead0
SHA512 f8d53d25dbad9f26ea9586919a0241ae9113e84b1d68930d73041c56d975c4d0f2abbb5a1da2d6f848d682be51b95b4c7efc96ed8f09aabb3997716eb1144668
TLSH
T1C4E0D824BAD9C72A75857187523AE30C85F37806E7C879213F4894C1620A580F253140
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 365781da95acf59814d5061c164eca893ea22e987d190013d1f2934cc1725988
MD5 84467cee5ec694ffd7c454d5d0eb1a37
SHA1 d032f289793b1953458e7c55947310a5904414d9
SHA512 afa34d5903f492ee284dae117cc8f744e82f2d5ce665c3a8ea6191e885c644aba0352aa4ef083ac867a32dddee6acf5813b0acdea6f4b4774b8b65221fba16ce
TLSH
T17BE0267455C8C679694071834268E70DC2F17C06A3C93F02774C54C7A901680F2A7280
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 55affb0a54abc3fac9c32b2c071b3dad863627f08afcb9fb2ac7cc32398b4910
MD5 c7872157c3d93f255082ffa4a31d4677
SHA1 9c4ed46b57bed5e06b48caa7ce9fab014a6c7597
SHA512 8d979f194a2ba3c718764d2834d64b15a7be66962285b9b5e60cbaf83b96809aaed30b2292b51a05dea48e484f9271a8a70e31cdcce88888f75a874c508bb92c
SSDEEP 96:KRB+PrZ7/LWPM6gTLK4ygdLcBpkXAlhXVFJWx+EgpJK4AgnJcPnmZl6OSjUIaM8d:CB+PrZ7/KPMrTxygd4BpkXAlhXVFkx+D
TLSH
T1E9913402357A02803C7E664D957D8B5B828178A3316A64BF3BE805A76F77F424DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 eb4cd2443720c963ca99524a870329b1397e6a159b8877757fd52045ffb68d9b
MD5 b8c6cfaf265203fdbf3f6a88bd3ebbfe
SHA1 1a4c1af2b74b40f7e328666d6342354ba184c387
SHA512 0e5c4108ae1a0cba98fd363e02aa144be8ccb90b595c870dee515ee89f57dfcd2a4aeda1a89e12137e2d2344ed3ca7b1696fca9797d1119f54c4dc86b790ccb5
SSDEEP 96:KRB+PrZ7/LWPM6gTLK4ygdLcBpkXAlhXVFJWx+EgpJK4AgnJcPnmZl6OSjUIaM8w:CB+PrZ7/KPMrTxygd4BpkXAlhXVFkx+a
TLSH
T1CEC1770136BE02803C7F664D947E8B5B428178A3315AA57F3BA805A76F77E424DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 fcfa0125dae97ed77d982c75032ea51f17734b6825bc43d71725a1de87e31450
MD5 3373305a857dfe0df8d3e176b926af42
SHA1 fe66a3d63918b95f69200ccee6213a39e023c9fd
SHA512 083a9793a56f579dc20c64be7dd9556c8f8d3edf2031f5023fb7334d0894639e2b93869c9a6b017e7697aadc48bee26e557e0bbece079dce143f3d3cbdecc955
SSDEEP 384:DNrRZyCSDnxTICZyMEhIKyll7svbFKfk7:xFZJSDnigyI1l7svbF9
TLSH
T1B944940A7B747001EDE6D9721CB080771E3C716E8F26E6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 399B
SHA256 cfc0871fd4cb084183717c237d36933ca4df2016f867303ddb6270f2de2562d8
MD5 8c32dd7c084bf7cf9e79d50b12ecfa7e
SHA1 35b2cceab9d270922381449ad299d7d34d92997b
SHA512 45ca0c403d9523c6248afa91b147814aa64cb72276cfaf7b58f208e3cf5e21cedb8e05a3bedee86eccac87b6749532260d4866d30a2136de8619dafda14cf84d
TLSH
T19CE06590175970D07E8DA944D13E2B0360843D57160F4475335945E9DB84C4A5E2ED76
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 0d9fdfdcacc03006cc2b67990593432c3230e29b10426ec62cd19d8d9910c426
MD5 ed85f23abefa9f57f94d04249b2aefad
SHA1 ed95d6f05d7648e8d858066c391fce106f1550b9
SHA512 d53b46178c33183afce8e9fa854875460b4b5e3bc6a58502c4dcca95ef1c65b6eb164e01a2aba134c15b154b6a1bce262b37a959af6552f44609ba79027d73ac
SSDEEP 192:cQZIIIAbAMIM6bYcYImFOzmAsglrQ5Q2siNc4tR:cQZIIIAbAMIM6BBtzvsCz2s
TLSH
T10C42835B5A461B77C2AE5F3A17B396807ED848824072212E71D23C1F8DF7E9782C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 d6352e7cd92afc355e54e3bc332ad8ab5ebd89b30fb04253239915ca23e00af6
MD5 52d974448ce93ff3b28e669ea6dc83d1
SHA1 6d3c02fdb75883acef4d029247c6f80f73c64fdb
SHA512 6425b36cc6f3fcd10cb4a63037dab21ee58b8be631a03e1aefbc4d8976dd2ced1dad467daf08a3e4db5dfd834985e5a1886cf2aae384020ff6362e349cf6eb90
TLSH
T145E02610BCCCCA6FB96475C71135630D82803C53FB8839067F21C8C8B401980F6C7581
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 458ba97c2f44990083b60773154570413ac2fe6a5ab68785d7f6fa3aca8f361c
MD5 ecdf991596c09d172c417ed3b9fa476b
SHA1 3307f86baff06bf4fd43d4e7b731a9de25138a56
SHA512 64e9844a0362b90d60d40a90ec57410d0dee142212752ccd08c85dc002f9af7b4abe1c823b241670c7a4aed24751aacb26f4af5f293040eba8758499eed4ce58
TLSH
T1D1212655F330D108E159827E907E9B3A1738E8128FBCEC0F547920346E71B440E4B2E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 355003b004fa05b6edfcac09d4d8794e17076381c4e4b0ee0ea1e08ecbad9168
MD5 6f4e4e00eaa7d148e0cc54488bef529b
SHA1 221a316a35c78e2b1c2a6af8913046a2e90aaf34
SHA512 a2468507c6dc565a41d2b91f9a99db5b7ad48687227fea4fb96c64f79e82489e78f8b44802fb56565d4915ff6c5ab7334095ffa0cb1854ac73cc0f30012dc480
TLSH
T11DE02691B8CCC1AFB86074C30175A34D82913D0BFB8C3E027F19CCC8BA61689F68B581
MD5 SHA1 SHA512 TLSH

Submit Download

e43b208f-ea4c-4a3d-b894-28c06325f7a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e43b208f-ea4c-4a3d-b894-28c06325f7a9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 13f4559d46e180b3d2279ea248fc60c63423cd000e169bc6ecb235b213757016
MD5 dd00033bc260b9f714e88fa3fe0af812
SHA1 f0c27444e5c5a8784f8422b06d59ac5d07de179c
SHA512 0d20520470143d035cc2d3b8017ed3e2e7bc67cc161630e8eacd5e233b54faf09b9a1bb601fce1d40cded63b4ee1eff536e506dead68eafde30d3d05450d8c15
SSDEEP 3:MsEllllkEthXllkl2zEflhKlt:/M/xT02zTl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 e5b5975a98df2ece7b358aa2658300d35ca4f1e9cbbfe126d3bc621f73f1d727
MD5 2e83c5e5d5df8bc362c57ca845a93623
SHA1 64283cf4e23b4914bf9afb50225262779a828eef
SHA512 1ad2bf14699b9817a2ce26f7fcb0c653024b8e3a1664d6f5122c54123d7cd1550c11f076bc8b6a6fe9beb9e2457f5ae4702c68748917a5e68acbf3648f330b5e
SSDEEP 3:MsEllllkEthXllkl2zEflmY+t:/M/xT02zVl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 731ddb521fd7510f63eeef7a0550dc6193afa9493e33010f5b4fb43da9917fe5
MD5 cf11e92a0b3f70e0876a8b6f1342ff68
SHA1 81e89242b59ca3a01877679afc774fc622c70401
SHA512 199a3c4a04aa719f64789ebf9963845bcc9baf3cb241a390b7cca1fb0ee35968f64c6af757b2a1359cf195c50e96664ce319820cbd9c8ace8f6cb773505da958
SSDEEP 768:Qrv+4UNbdf3AqG+fDhK48dHeByERRFzjK3YEeVH1SCj:QbsbJ3BGOo48dHSyw/WEH1Z
TLSH
T17C03CE71A8A85E778CE792897643B657BFF4412382D41BA4C4CD6F4E868B0DC130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9dd073ee152029e53927d18dd7fca762cd648e925b1052ec0151991113b586a9
MD5 6fddf86b7306c5398a2e43b8b40e2bd1
SHA1 0d9eaa0361bedfe673d8f858d78b8cd1a13458e1
SHA512 28a999f29999c33c20661f6ea88bf555e9d98b0c6ac7326cb8c0e9373d4ee084a89e07962a1ab12c6fa6d5c24b51452210142d4193eff97968fb4ed6a23281e4
SSDEEP 768:hD3sCqGlVDKK48dHeByERRFzjK3T9Pi9PtFL:hD3AGrD48dHSyw/aPSL
TLSH
T168F2AFB068A99DB34CEBE28A76537797FFF00123D4C45E64D5DDEA0E048259D1B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 56KB
SHA256 0c442eae40e8d78b4dfbf710cc24b2791cfee263ea59dee182bc89f439aacbfd
MD5 1d1ddb87116cfa69ef95f5822cfdec58
SHA1 ecfa94484b4e80e3d4c45daef56df76618b438b0
SHA512 b89202eb1d6d57c482b04af8f0577d1ad322a95117896b941751c26a52752acda8393045735dc6ec02f695f0d9b79b812d5f1f8f77e869b227d2197b12b80cc2
SSDEEP 1536:KD3KGG48dHSyw/CnPk/NLJ7cGA/0np89CNESL:KrKGGldH2/ZLJ7Dvp89C3L
TLSH
T10943AF79CC588EBF8CEAB7C6675A7606EEE00073C1E899E4DBC89E4D50964DC9707C24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2ef6a64d40583023c263c6874c34ff47cbddf1ef7d8224f4ac75d0ede3563a41
MD5 400223add80485ea05a7e5e13e459de5
SHA1 0376b8115b2a57ddcfddf0bcebae60df9934801d
SHA512 3e7f90c59fc7ddd721f7c3a7c9522f3140cce8ce145612cdb397bbaeef9f65804edff112f2657c50c3d689b38250cf2ab9475e5e6e2c6db6970c56017a98e318
SSDEEP 768:zD3pCqGEVDBK48dHeByERRFzjK3YTw9zWPi9PtFL:zD3xGWI48dHSyw/ZAWPSL
TLSH
T157038CBC9C649D7F48AEF34A325E2666AEA40137D0F05968D3C89B0DC47259CFB07C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 4849702539b56ec84f6021062a3f172887dc9a3860a0ba6355e9807211332c9f
MD5 4f12e4a13cc6c87c3b5b79393a616396
SHA1 d10d55bb61860de458b02ce7fe8a3f4ca7c1e432
SHA512 7a95301fed1f5997a0998f56eac679c904b0dc36270cf5a8011236fbbb360362430169ffbb7718ef592c296693a536f0a8aae5689f944579a49a79401a37531c
SSDEEP 768:yD3sCqGlVDgK48dHeByERRFzjK3TVlbCjhmi9PtFL:yD3AGrt48dHSyw/09CNmSL
TLSH
T14803AE789CA45D7B4CAFF38A36462716AEF04133D1E41A68D7DCAB0E809299C9707C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7a3721a7fe93e511682aab3e9f00e44f74414b42df292c9c8604bfeabcd4e33b
MD5 9d7296ec12eb06fd3e58946f540a4ce4
SHA1 9cc95a5bfcf76333ad39588d56b399c69c45932e
SHA512 c7e3fb8eb5f71742234952a35a35c93527659093d98bdd593b193bdab7585d941b10faf53b13ce484ff5620a5bfa4d7e784db0f05f397da70dbe2110e50dbeef
SSDEEP 768:zrv+4UNbdf3pCqGnVDMK48dHeByERRFzjK3YkMU:zbsbJ3xGZZ48dHSyw/eD
TLSH
T18E03BF70A4A89D738CF7E28AB2537797BFF4016384C41E64D5D9AA8E44860DD1B0FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 9fdb01875d41a182517d010044b301f70202d4cfa38eb91884bf70cd4e1ad098
MD5 9b82b84ce6e71f5cb7800a0d9178e7c3
SHA1 fba808145c60bc533f05b950e5ef12a5595a9abc
SHA512 d09cbdc6af81270f1de53032193962b3c0e86a4d5d34bd549514c92a709733b07bf3ac10076cf5dd82d9301d4e48ba85bdb770e5aeb3765b350b30100b4a0774
SSDEEP 768:krv+4UNbdf3rqG7bDRK48dHeByERRFzjK3JkeVH1SCj:kbsbJ3WGDY48dHSyw/tEH1Z
TLSH
T19803BE70A4A89E734CE7928A7283B797BFF4016384C40B64D4D9AF4E45861DC1B0FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 094a5735bdce7ecd49ef3a9ea0a3c3776dd2c38cc5d5c94e493fe124fe304829
MD5 6cc101f980e374207e74a2860c3f37b4
SHA1 336edcd20d83a4ac6cfc6965f88d575990747b17
SHA512 a9c0d206f1a92b91e9fa667c804940235dd703e5adafd949c96cb056fb341db8aeb2a781f256ce8be37d4292adf033c67b7a59b8b0414e1b823ef823e31ec692
SSDEEP 3:MsEllllkEthXllkl2zEflft:/M/xT02z
TLSH
T1BD4404047FD40C0FD71110304071D3501370D4101513F74334D104337CC7D400CC0004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json~RFe5b01d1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5b01d1.TMP
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62dff2c4-e546-4581-8aa9-cdfe06865b0b.tmp

Path C:\Users\Admin\AppData\Local\Temp\62dff2c4-e546-4581-8aa9-cdfe06865b0b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3744_475153186\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1922627141\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1400-27-0x00000272C9E30000-0x00000272C9E31000-memory.dmp

Download

memory/1400-23-0x00000272C9E30000-0x00000272C9E31000-memory.dmp

Download

memory/1400-28-0x00000272C9E30000-0x00000272C9E31000-memory.dmp

Download

memory/1400-29-0x00000272C9E30000-0x00000272C9E31000-memory.dmp

Download

memory/1400-30-0x00000272C9E30000-0x00000272C9E31000-memory.dmp

Download

memory/1400-32-0x00000272C9E30000-0x00000272C9E31000-memory.dmp

Download

memory/1400-31-0x00000272C9E30000-0x00000272C9E31000-memory.dmp

Download

memory/1400-21-0x00000272C9E30000-0x00000272C9E31000-memory.dmp

Download

memory/5760-4-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-2-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-7-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-5-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-6-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-15-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-3-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-17-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-18-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-16-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-20-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-1-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-8-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-9-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-10-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-11-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-12-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-13-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-14-0x00007FFBA76D0000-0x00007FFBA8074000-memory.dmp

Download

memory/5760-0-0x00007FFBA785F000-0x00007FFBA7860000-memory.dmp

Download