93796b80530a62897fbc15fe2b64d9c3c4c60b3793e09fba9524200765dcda0e

Resubmissions

25/09/2026, 16:10

260925-tml96afe583

25/09/2026, 15:52

260925-tbkxyszenh6

Analysis

user interaction
yes
max time kernel
744s
max time network
741s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Admin Center Portal 46421587455375320807518866537740.html
Size 8KB
Sample260925-tml96afe58
SHA256 93796b80530a62897fbc15fe2b64d9c3c4c60b3793e09fba9524200765dcda0e
MD5 d7c8e0645494fb37014995df0fccc571
SHA1 880daddedda4022d732735ad3af8fafa723a258f
SHA512 2487ab1a0453c8b40ad7caecbe6590f467af9a77eb65c39d4628537de32ca5423368e370dc767e3ba0e9dbbaf64cdc31454728dee714e2c537fc95b3166f90ae
SSDEEP 192:6/5NLafV2QuNbo5Q2OjfmsvhTgKeM/lHM5DY+RgJNPTJJoEiziOm:6/35vjfVCZUbJJoEizNm
TLSH
T1C30264161E4240294633C3A6DFB2290DEB664503A38644997EEDA30A5F7330A956FFFC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3048	msedge.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\DOMStorage	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdomains = "1"	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com	TextInputHost.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{206ADA7E-F736-4543-84A2-4D96818863A4}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
800	TextInputHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
800	TextInputHost.exe
800	TextInputHost.exe
6564	msedge.exe
6564	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
800	TextInputHost.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
800	TextInputHost.exe
800	TextInputHost.exe
800	TextInputHost.exe
800	TextInputHost.exe
800	TextInputHost.exe
800	TextInputHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 3800	3060	msedge.exe	90
PID 3060 wrote to memory of 3048	3060	msedge.exe	91
PID 3060 wrote to memory of 4348	3060	msedge.exe	92
PID 3060 wrote to memory of 4348	3060	msedge.exe	92
PID 3060 wrote to memory of 4348	3060	msedge.exe	92
PID 3060 wrote to memory of 3464	3060	msedge.exe	93
PID 3060 wrote to memory of 3464	3060	msedge.exe	93
PID 3060 wrote to memory of 4268	3060	msedge.exe	94
PID 3060 wrote to memory of 1580	3060	msedge.exe	95
PID 3060 wrote to memory of 4268	3060	msedge.exe	94
PID 3060 wrote to memory of 4268	3060	msedge.exe	94
PID 3060 wrote to memory of 1580	3060	msedge.exe	95
PID 3060 wrote to memory of 1580	3060	msedge.exe	95
PID 3060 wrote to memory of 4772	3060	msedge.exe	97
PID 3060 wrote to memory of 4772	3060	msedge.exe	97
PID 3060 wrote to memory of 4772	3060	msedge.exe	97
PID 3060 wrote to memory of 4328	3060	msedge.exe	98
PID 3060 wrote to memory of 4328	3060	msedge.exe	98
PID 3060 wrote to memory of 4328	3060	msedge.exe	98
PID 3060 wrote to memory of 1552	3060	msedge.exe	99
PID 3060 wrote to memory of 1552	3060	msedge.exe	99
PID 3060 wrote to memory of 1552	3060	msedge.exe	99
PID 3060 wrote to memory of 4580	3060	msedge.exe	101
PID 3060 wrote to memory of 4580	3060	msedge.exe	101
PID 3060 wrote to memory of 4580	3060	msedge.exe	101
PID 3060 wrote to memory of 5116	3060	msedge.exe	102
PID 3060 wrote to memory of 5116	3060	msedge.exe	102
PID 3060 wrote to memory of 5116	3060	msedge.exe	102
PID 3060 wrote to memory of 4912	3060	msedge.exe	103
PID 3060 wrote to memory of 4912	3060	msedge.exe	103
PID 3060 wrote to memory of 4744	3060	msedge.exe	104
PID 3060 wrote to memory of 4744	3060	msedge.exe	104
PID 3060 wrote to memory of 5772	3060	msedge.exe	105
PID 3060 wrote to memory of 5772	3060	msedge.exe	105
PID 3060 wrote to memory of 5772	3060	msedge.exe	105
PID 3060 wrote to memory of 4640	3060	msedge.exe	107
PID 3060 wrote to memory of 4472	3060	msedge.exe	110
PID 3060 wrote to memory of 4472	3060	msedge.exe	110
PID 3060 wrote to memory of 2080	3060	msedge.exe	112
PID 3060 wrote to memory of 2080	3060	msedge.exe	112
PID 3060 wrote to memory of 2080	3060	msedge.exe	112
PID 3060 wrote to memory of 4120	3060	msedge.exe	113
PID 3060 wrote to memory of 4120	3060	msedge.exe	113
PID 3060 wrote to memory of 4120	3060	msedge.exe	113
PID 3060 wrote to memory of 5276	3060	msedge.exe	114
PID 3060 wrote to memory of 5276	3060	msedge.exe	114
PID 3060 wrote to memory of 4084	3060	msedge.exe	116
PID 3060 wrote to memory of 6732	3060	msedge.exe	115
PID 3060 wrote to memory of 4084	3060	msedge.exe	116
PID 3060 wrote to memory of 6732	3060	msedge.exe	115
PID 3060 wrote to memory of 1340	3060	msedge.exe	117
PID 3060 wrote to memory of 1340	3060	msedge.exe	117
PID 3060 wrote to memory of 6748	3060	msedge.exe	119
PID 3060 wrote to memory of 6768	3060	msedge.exe	120
PID 3060 wrote to memory of 6728	3060	msedge.exe	121
PID 3060 wrote to memory of 5684	3060	msedge.exe	122
PID 3060 wrote to memory of 5684	3060	msedge.exe	122
PID 3060 wrote to memory of 4228	3060	msedge.exe	124
PID 3060 wrote to memory of 4228	3060	msedge.exe	124
PID 3060 wrote to memory of 4228	3060	msedge.exe	124
PID 3060 wrote to memory of 6564	3060	msedge.exe	125
PID 3060 wrote to memory of 5948	3060	msedge.exe	126
PID 3060 wrote to memory of 5948	3060	msedge.exe	126
PID 3060 wrote to memory of 5948	3060	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Admin Center Portal 46421587455375320807518866537740.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa3f74c188,0x7ffa3f74c194,0x7ffa3f74c1a0
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,14137552051952778524,13868899458581290292,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,14219883653584817771,6885388871004485428,262144 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,10839329252753469112,16739623161093243587,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,15075259361744028592,14966614406941628375,2097152 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,3918556298667751362,8247655639751676419,2097152 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,10252780320365222672,10455377110271406991,2097152 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:9
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,8857174327080823425,11435027336450123024,2097152 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3864,i,15829031269703660789,1659718998520534743,2097152 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5536,i,15137098362812823931,16598868157652131712,2097152 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5672,i,11054921395697187851,5450681543311337915,2097152 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,9739440519128287030,17513777956435943498,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,12626678897108997522,7591526247543729133,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6560,i,9923103494744173122,11163698138501011499,2097152 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,116754446192465877,10371021740253666615,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,116754446192465877,10371021740253666615,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,17196550356707526613,2624089138900011405,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:14
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6836,i,4563859149495766890,3086843704299051082,2097152 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5056,i,12119579460504942301,17234124355010273698,2097152 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7504,i,3425973418917512036,3979409368178864133,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7668,i,15613130571105515051,3921657350279941723,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:14
  2⤵
  PID:6732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,5444047891589845126,1019727659079040849,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:14
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,6312412020396255673,15143846354992527016,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:14
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8188,i,10235549497051019419,6596984316734958232,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:14
  2⤵
  PID:6748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8304,i,7270901276519570652,14269751705456683222,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:14
  2⤵
  PID:6768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8336,i,6980641053049716992,9928871075283608141,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=8380 /prefetch:14
  2⤵
  PID:6728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,14012551998264577334,1856545106301761500,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=2040,i,5872936152575722129,6941083073775015773,2097152 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8124,i,5840091335840437593,18103544221783248181,262144 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=8432 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=3320,i,15488043415532031564,7598757681807520997,2097152 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=1096 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,13732128666371566059,17106631447505838423,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:14
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7344,i,5780976892021394179,3210429438864187435,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:14
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8440,i,15658064422344138714,14195761089629138516,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=8252 /prefetch:14
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7464,i,10075910314047173210,5547586255993724224,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,18271136516177825430,13230920342011834700,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,5707786565577072092,5691514952512184034,524288 --field-trial-handle=2548,i,10898215824302620456,6884291926339252158,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
  2⤵
  PID:5788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1428

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4684

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

270c4036-2ff3-4a46-8757-626e1935512c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\270c4036-2ff3-4a46-8757-626e1935512c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 74ab45190f31fe60d99f1d40992895f80e4a3d234bd7cb00da96ff9cbcd9b913
MD5 1bc0b1eecff1229115f2574bc973aaaf
SHA1 b16c62717930f77cbcf4016731a3a51ca92cd62d
SHA512 68c870280766084f2559cd797606e1b66e31e51f1134a5e7ee215ba5265af9c7a5fb1109195819e01a1bd4e801e422c5e1e10fb44d2fec878f99a85e7269f161
TLSH
T104E0269805C8C22EB34CA48742BDF74CC3A1375A92CC6F1A170085C87102450ABA2691
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 cfd9a6db1123fa7eb652b7acfa805efb3f923e9b2d94bcda968fcf89a3075021
MD5 a3961f4eac84f279484efe5833b7e0fb
SHA1 a6b4032d87b394ab5624b9b0225647dc4008bd42
SHA512 04298f93ef832e8ee6b9e04635665e72ffcb6bc48ca1e6b583153748b48e0a890b8e628224a5bee5b64ae34be66a41fa8f166ac19506b259ac4ac7f1741f1755
TLSH
T1CCE026A916C8C2AEF389A88741BC678CC3807BDFD3CC6E5E170A88897006444E7826B5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 eb50100ee63313aebd4d41dd2a1dd4d46befd4b0437a831355349db16b27ebb3
MD5 6b39d8996c5c7e1c7b45c74b254f5e45
SHA1 b1189d05bde9ac52e51bf6072a7ebe163ad61b81
SHA512 44713f842445d0cd1e7f83dece9c3a9d94e2048509dd0f9b699ded88e8c7a7186e45efa6ff61427c22144527d1797e58f663a4289df04655daa91aa3c8ecf2e2
TLSH
T118E07D8854C8C22EB348748B41BC5B0CC380375BD3CCBE1A370385887043444F3C2699
MD5 SHA1 SHA512 TLSH

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004c
Size 205KB
SHA256 9c794330f4c8eff5d5444acbaf1b52daaa0cc77b1aad15fdfc19b00380a54773
MD5 9c57b99ff9d033a14e1df9c5054f0484
SHA1 0c7f8d015e4eaf911a669ea2d48a4fdfaea7f8f3
SHA512 14884a8252a2cfdc6fd9cfc78ccf8ec3cb9dd6ef88475bab28e304f638ab20137e3b794cee637c89c4b50068422eb075f88bc67225e5021746d5d3d55bf69d9e
SSDEEP 6144:eXFNHZGX+Arz8esKNYPg4OfJysPNWvhFeHHtIk:eXZjkjsWM3O445tl
TLSH
T13F242264249D473F862AE717F0286402AA2C4DF2C6518312BE5D9373F46ED49CBFB672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 117KB
SHA256 48afbcd5293b8bc1b8e5de2c6896b41198746d8f354ff5ade57ab40d6e8ef2c3
MD5 241c20fea39528d59b77826538032aed
SHA1 0a1c20587a3b04763caab0b04e1d47d3e4430d31
SHA512 c57a42b1e7dc12b1be8bccc86cf1bed3a34ae6010b38cef9ee91ac5288f96355a0e8ccbba50c3e1d453f4d72259b620716bcfb2710b21510a5aa828d6096a794
SSDEEP 3072:HAye83Uho/W/IL//kkaw+wmBfO0sVzFru8e60hQWtMo:gf83jW/IL//kkiwmBm0ozpuR2uMo
TLSH
T1B1C31271762386BDC263B4E82163890CC4E83ECD065466EC51028A7E7DAF3ECDC5A89D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 37KB
SHA256 f5bd157d24d9aa3d742f0645174cd4d600b9c638d23cb7387177a5ed78839cc7
MD5 353314b20d3232607c051f5a6984398b
SHA1 5399994c33da9f8366d0cf83546cc5b3f888bd6e
SHA512 3d5d079aa7466c5010a3a6e1daf35e38cd5645173ecefb9c0191ada2db240c906f33b182324969208eb78c65ea5446b1a27522b89d41828691428f55b80e42fb
SSDEEP 768:1hV/AC55gwmoxCq54s3QdSOfWFUhIP3fUEx8cl5+Gb6O2i:1hV/Z4qms3QdST+hIP3fNx8cHPL
TLSH
T13C03F113643C5DF4FC02B82E9C852B8A82F7A173895713EFA5E57D5412E01F8750ABD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 68cb7b472e7041ca91d69bb3180ab1c5a6bc5851a5d8e96c15cea27913917c19
MD5 e417a9bfc939405ed84d5de93b8159fb
SHA1 fbcde00379f1a797b56e29d9afbe4397117ac243
SHA512 9e3ff08b046722260c56e12547402226158b9ce5b540de10727a1ad9d3167f34caf4a31bce31a74fd2c30ad566df3dfb21e32a9354a2f07a75c6c589006f7612
TLSH
T14461839032BDCD8BE79E303594C28D4235E16B6E134727938528E6FBD716FAE940B08D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 07201965fc62fd65d2155fffcfa4c9d1d1b341051f65f194c04d70c679333445
MD5 115bc47101a380628a0f90b465345553
SHA1 75df4ac1f555b500ce394778718f1dcd81c5cc10
SHA512 a2f4439cc4b3cde24a08432fc98d60d8b33bcc3ad2890e613668f34e48912695a8875842e033042ce16220c2ffcbfc40586d06269cb7f9b99a35474644d9923e
SSDEEP 96:Y8n4YX4X9VrLIj/XKJHPb1xVO05wtLc1o6rJg1UQV:Y8n4YcVr0LEHPQK1o6XI
TLSH
T13791DC9222DCD197FB89303EA5C19C4622756F6F238227931114E6FCD717FF6850958D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 da94c3f29ccdb66b08e23ef188afa5518edff5ebbd9b162de292e295a1a8b7e0
MD5 4d6844459d0683e44645e81395e14073
SHA1 688394d97b815a863aa6f62c59db7958af09ea47
SHA512 f120f0cbfb8e3a554f10d8d8f98d1f8dc48a6be3818ff615d0e0c3da9250e0bef53a73daf68f00c10227886c69f9335505de66fa359c63cb218a885c14b10685
SSDEEP 192:DNYbNEJ93Vi3lgjhnt+EJjYirDJjO57Hje6MPtGhx:DNYbNEJ93Vi3lg5t+EJjYirDJjO57Hj7
TLSH
T1E0E1D0F7C3E5822DD91195F0AA14AE2FCE1D0556436C3C5A89E4AF4BA3F24B1E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 545db9b2b0f5cf0fc2da4e5fe1308e8ea453603c40585435626dbc47014b0712
MD5 ef5dfd39b75c257cf15eeb7170a0af3f
SHA1 89772c7038b6045d45c7e00fe5fcb96c4f331fc1
SHA512 6e84604aac91cc0d72849beb56356c671fb7ed0cf48960a00e04631b0903cea6eb707ef1830ae33b2b93ad8661c3264cc3f576de61369fe0e5882a33ff1dfcbc
SSDEEP 96:DeOYbNEJ9r3lgjhntzKzc5GORBHiSi/jVFJjlBj2Giwpx:DNYbNEJ9r3lgjhnt+zc57HCSi/jVFJj9
TLSH
T1ECC1DFF7C3E5822DD91156F0AA146F2BCE1D0556436C3C5A89E4AF4BA3F24B1E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 aec2143cff1dc065a692505d1af491e69a8eb4accf80bfbb2c831ab55d87154b
MD5 2ae12547d7f2f1b40241b5f59ea50d03
SHA1 8bc18e41d4b9803f32203d085b6a94902b247a7f
SHA512 d4314dbc1dd1e9b0d90e3276b7ee5d38c9d2aa34020342a791e2f2d4dc2c121c13307c5f97a5096b8f39f020985d7b9c28a1719a53ab3b20d51ad9eee658ecde
SSDEEP 96:D/Okkx7/Qk3m3lgjhnZzKzJjlBiwB5GORBHzct/GtjJ0j2S6j4/Qx:DWkkx7/Qk3m3lgjhnZ+zJjzik57HTctY
TLSH
T14BC1A0F783B5426DDA1195F0EA14AE1FCE5C0456436C3C6989E4AF1BA3F24B1E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 dfd707b110e87d6ad452c6d672ce44ff58f6342ce5ea6d386ae2b9d5b231ba0b
MD5 02bfe4be5d66ad69e2069f5728937a43
SHA1 3181e86d128a9b144086a57a22f26c0ca22515f2
SHA512 3ae969051bcc69510e857079f06658900b9df600023283e7355967b3ce71b2bd49269b97ac17d129568ad1787ee4dfaee4602a94f1917096a4960a9ca81b4f8e
SSDEEP 96:D/Okx7/Qk3OQ3lgjhnZzKzJjlBi5GORBHzct/GtjJ0j4/mGwBj2Et:DWkx7/Qk3OQ3lgjhnZ+zJjzi57HTct/B
TLSH
T16BC1B0F783B5826DD91195F0AA14AF1FCE5C0456436C3C6989E4AF1BA3F24B1E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 651e09a5f06666b5e93a639115740fda20adf2e6eec2306c954e02913236b566
MD5 bdf55c22a0fd38e11d8ec2c9b71bf4ed
SHA1 e4f39114eed44c4d420aea274cb4a23d131a77b8
SHA512 edb15d747e112f3f7f2f1b036d5fc3aeadb92d0bcafc2ae50dd31ae8f4df7eaaadcb684a1c8eca5d7b6e365614f5b6868ea16fac8f1bb55786ad654b28b3d4aa
SSDEEP 384:sxRenUn8/fMLpXsN+anlFfdn/5vS/CmofrI:sUUn8/fMLpo+Mj/5AmfM
TLSH
T1A482B61A5918997B8CC7D61EEA357F73D6EC146399801E1CAAFCCA1C00EA6FD2313807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b4a03e45e533625b0f03f886ed9f5dd584a0fd162c4d71371acda7f2e90b5bb5
MD5 7ac0673005d6050a2faa83088da6bbeb
SHA1 4608f3bc4559399f358ca50feda9db283b33a062
SHA512 8dbdee94f180513ad34af95ee51c1868b77cb2832235bff70b5b161dadd03d7293e25c515ae5321fd357924a19ae2e9041ed5001f2566f18ba773e5833932763
SSDEEP 192:sxRyRdboN/fwN89bdM/PsSUC+3bcOoA8pJJrX/g6+WNPc81/YU2HgRoGjIgDQ5oE:sxRyn8/fMob+XsNCPFnb/5t/jmofrI
TLSH
T1F172C61A6918D97B8CC7D61DEA757F62D6ED043399811E1CAAFCC61C00EAAFD2307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e2f67be95d4474d43c2a2e1a3c472ef1b29873cf597509fcd3c111456216631b
MD5 8ecb78e9219b2f08b6886768a91b17c5
SHA1 8fd26dd6f89d6a2cb5a68971f54b9048a0ac08c1
SHA512 a93080e66969fe11564dd46a2964c46d21491f0482e561af08816b469d772899054739e157e52846fa31622aa5404a5eaae5c6953d1de6eff3fc40cdf2a8ea1c
SSDEEP 192:sxRdRdGO1/f1s+C+3bcOoA8pJJrX/g6+WNPc81/YU2H3RoGjIgQ5oMmrI:sxRdKO1/f1s+CPFnb/5t/qaofrI
TLSH
T12752C6166A28D83B8CC7D619FE357F52D6FC503398951E4CA6FCCA1C14EA6ED121780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4beaf5214957c5e4bf116208c0ee598afc79b729a5c81d5f8ebb43aff1b34b12
MD5 c8e1db91fc1b2aa98727b25d2fd9d79c
SHA1 f2c3c0b11bc81ea3905ccc4ac7ffe990c789f594
SHA512 ff15a04abfc9f8e05990e4119ce3a3f7491b413122512c226038cf751c6c45d3e912b51f8976d52f0ec5f6adef4021799dec702cc4db459f9da8d6afbeb38ed4
SSDEEP 192:sxRyRdboN/fcy7PsSUC+3bcOoA8pJJrX/g6+WNPc81/YU2HgRoGjIgDQ5oMmrI:sxRyn8/f1sNCPFnb/5t/jmofrI
TLSH
T15C72C61A5A18997B8CC7D61DEE357F62D6FC403399811E4CAAFCCA1C14EA6ED2307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 5c72e2744d2a798479f15a23e5a0896a60d5c349ae16f3b4e3cb23866162510e
MD5 dae4d20bb849ff0c9eff5b1567f0c147
SHA1 04adc37c5e8474c4bd60762a3fedec2afd61b94e
SHA512 2906501ec886029b63a95ec607666fceb0066fed213fffd30521d99562f49569852ecd2129a580cea8b6c614a3fed28b403292b97f39da1d950879f15c4c6fc4
SSDEEP 384:sxRen3KO8/fMLpXsN+anlFfdk/5y8/NmofrI:sU3t8/fMLpo+Mw/5bRfM
TLSH
T1B882B51A5918997B8CC7D61DEA35BF73D6EC146399801E1CAAFCCA1C10FA6FD2213807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 5205d553a3c1e628f745dcebdb1625763f74b7f34b728ebf78c41423e1b722a8
MD5 614861744b2ec27aab820dc4cce466a1
SHA1 5402f761d365df6fbaf7fe158728928c478646ec
SHA512 5c3147ea121c9c5bc823250ba5b18afcb0ab5c4e13b843782c72f2d3a008153615ec704fe8a6c939e8ee370b6597ca2dc80aeb771649a4a09f80cef99715e54e
SSDEEP 192:sxRyRdGOoN/fwN89bdM/PsSUC+3bcOoA8pXJrX/g6+WNPc81/YU2HgRoGjIgDQ53:sxRyKO8/fMob+XsNCPFZb/5t/jmofrI
TLSH
T18672B51A6918D97B8CC7D61DEA757F62D6ED043399811E1CAAFCC61C00EAAFD2307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f30c938bc60d7c11e17689f1054819b3fcfb2eeefc040bc7ebea46c76f5c9eee
MD5 24e9b7c415ba84c6cfa5ee08fa97b78c
SHA1 940f133f802f96ad5691e7c76718326dd0a49b78
SHA512 eb275875e2cae9bb11c2fa8a3a4af277b66afc8fe96db6f6db1237913014381142b43e516a38100f63869569b51fe7ca3b68549968f71ee47f84a1fa136fb2b2
SSDEEP 192:sxRyRdb1/f1sSxC+3bcOoA8pJJrX/g6+WNPc81/YU2H3RoGjIgDq5oMmrI:sxRyn1/f1swCPFnb/5t/qMofrI
TLSH
T1FC62D7166A28D93B8CC7C619FE357F52D6FC503398951E4CA6FCCA1C14EA6ED121780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 40a587a69884fe7d657e22cc4cf8987c26f3d86f74ef7e2d00cb60c245b0a350
MD5 5571d2425aed76d5929f3efd0f9a0a7c
SHA1 77d8ca04fc92d0ff08f5d82c82f1ff578141b5f2
SHA512 730342147b2c2329de935282617ed59139f63d8656649a46f983f93835884820feae59f8d7e86b82b3c529cb2e1641c1a585b9c3d555e99851691f77f0145407
SSDEEP 384:64qajXwfCtgmcFf4O7nKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV+a9mWRujroE:6JajXKWgm0f4O7n8F1+UoAYDCx9Tuqhi
TLSH
T1A2B2DA3F600DCB7F5FD00AAD9C19AF976D9802CB96588D4047FE984C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 b0e26bd28c1335f6532a270ec8aa9b0b575da03cf109da68cd0927fe249f6cfb
MD5 56c540c1aea5e02a2dcce0e7b1b8c555
SHA1 2f81e6b4e2ef970aca3f9b25c4cadfff0316affe
SHA512 07c95ab297c856aa92ff224a2b187e18b6e31724bd2478cea70ad9a067589d6ce57c992c46dec63a97d9be0bb106a075f3503f2ef09d3695230efb02dd65f2bf
SSDEEP 768:6VlpajXKWgm0f4O7n8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcGomBjro8a:6VlpajXKWgm0f3bu1jaxGhBQh
TLSH
T1CFC2EA3F640DCB7F5FC00A9D9C1AAF9769A802CB96548D4047FA994C02C77FB921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0e9219d5-fa7d-46f0-9dea-f99b360c30a1\index-dir\the-real-index
Size 72B
SHA256 41cbd1b46195957ebdf959f01b7ca81418b5ba425ef74a87b45ba98299746d6e
MD5 267a0196cc296f0a3f2e1483bdb19832
SHA1 a32811490370c42112afc471dfcce980d81dd11b
SHA512 5abc2146e5cd4d5a1319946182cdf53e6a7188639157611f58b58cacef2df7bd2dad99d9c9b1b7786e97cf843e32b8ec3ee672f7211d95b4974ad355a9ade6b4
TLSH
T186A0022C027C288AD24406B0554205A8636CDD1507519307E0914B5ACD5167F99C3052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\537d36dd-661e-4f11-a552-12709d323539\index-dir\the-real-index
Size 72B
SHA256 87bb7cf7be55c540ed8060172e55351161a8efd7d8dfa9f9968a3fed71274d5a
MD5 90bf0e3f9b3e9e9820ea42a500deea59
SHA1 d6b8dd8c271a2b895714c36eb1bbef0399080fdf
SHA512 077d4d8ac7adaf8493148d02789254379840f81f2ec21dff8a3bcbde8ca0f4a302c9e28876af09009cb7f78ad417a703ba7884b7d77ee6d2fda0fef8f487588d
TLSH
T1DEA0025805D15562C00056F59743114426549B240A4686A98690B0B798B8F54ED27085
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bb3db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\537d36dd-661e-4f11-a552-12709d323539\index-dir\the-real-index~RFe5bb3db.TMP
Size 48B
SHA256 87b62a0b80005c259e9697fbdfc71f7e4b045496d3044ed440c7b56799e28ce8
MD5 4313e8595b6449a6cc6690131c6c8101
SHA1 f8ed44c4b981dba0a77cb36c82bbe8b44a4d9d85
SHA512 daa02ec4d286dd507e8aac672a4e83da74e601a06c7cd01a7334271566e694f6e31f2b756ff366a35e8ad0a2be76a38b5125d99db948e45f9120100f39c94173
MD5 SHA1 SHA512

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\869d2256-a596-4abf-8a5a-1c5c217aba40\623cd082b6202da0_0
Size 81KB
SHA256 f82b79b5c5685864847ea8b7138c229334f5b441e7561d8ab47fddbb96a60c75
MD5 b241b70da3e2f7933e7cdbaa3bfe7e6d
SHA1 eb90a7ae0a1dc9df5cb5016d4c2223cf15a89784
SHA512 2744fcb3c95d0f62f4989c8b59c66f1c81750ba19ef3acb3e2086bcba93f31b4d4f7a90cb6dca5a6fd9dd878f6b41c55f4d1d583c75dddfe899d4d57fd2154ee
SSDEEP 1536:zlH1dg++HqsJs0wihp2VMGznXoHVyOAcU9dP2CsXPoTepPgMuI2qHPwqYzGu/LR:zRc+nKMVMGzXo1yO4Z2dSVV/LR
TLSH
T105832BA7B252703587AD11D594566B01F22B079A1448C8FCF0BCA5963F28ECB53B7BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\869d2256-a596-4abf-8a5a-1c5c217aba40\index-dir\the-real-index
Size 72B
SHA256 13a00e61526c2a7794b2b99fa43f6ee6dc6b6f050f1eb65226a82187a51b6226
MD5 81e481015b17d30872d0c4dfd5ec9d47
SHA1 2ba1e282a67b783d3c7a6215eb12960b9fa7a423
SHA512 c89ae71620fd09681802363bca279e41c23755b30049d64cdbe969e45a3c87f50dd3dc0f0a97a10b3381a2b13d8c5a7a60a34a4f3c872114bd575229c2c28ec0
TLSH
T1B5A0025413E044A5D49623B7699701412324C9350702634741EC429DCC546454E4161E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\869d2256-a596-4abf-8a5a-1c5c217aba40\index-dir\the-real-index
Size 72B
SHA256 cd94dccb37d18b7e2dfbaaa31dc67c81c4206dfb2cbda81fc6e3d23a16c632c1
MD5 56952fe4c2de8006fa2724e5a6fcc543
SHA1 86efb153f42f98cdd3b38e0e1c9afdbcd9330b1f
SHA512 7a6843d11e78f2ce5d72da8c1c1419bc376f5dd18811d92e3689a46d402394e4a4a239ecf014f9bf5af24324e6cd8151c9fc116759e9b810d163f5bf816e8b42
TLSH
T10CA0021C22D11469C15317B6399B02453360CA640701134745A80245CD50D6A4D41B9E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a464.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\869d2256-a596-4abf-8a5a-1c5c217aba40\index-dir\the-real-index~RFe59a464.TMP
Size 72B
SHA256 5bf99bef5d6970b4afeec169d5109c5c1ca9bbc812d147fd6ecf1a512e8e33de
MD5 f076f3a8fb06d77e732100dcefda34a1
SHA1 d3ef2c340f3f0236f2f41380028d4e2309f21a62
SHA512 0053d7554e4e7019da29607def7f72b8429e51557717913be71fb4f5e2a70f757172300dae131f56fc8d82394f9b19752f8ed4f63dc27dc10badc018eac105c2
TLSH
T1E6A0022543D04066C16321B3265613451341C85422401307449A5284DC969414D4121F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cd36c074-e35d-4b6e-accd-20a9169ef736\index-dir\the-real-index
Size 96B
SHA256 60b1612c6745611fc3842215aed725cb104502e7f6d4175f771d6ea50d077ee9
MD5 80e39277a31aeee65ac2e79c27b4504f
SHA1 59c7ee33786ccdbdbb9179e94c2ca87b7522a853
SHA512 8a5915b9911e1ead3f7441f813575c0775891c4ba821cee8dbd0ea7580205370545a03063884b8dcfaf93cbb0312fe3849e6039c70509a72d54d98868d207e6d
TLSH
T12BB01220B0018257C00503B004C58010316458D0030A325294E014F9D4503840709050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bb3bc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cd36c074-e35d-4b6e-accd-20a9169ef736\index-dir\the-real-index~RFe5bb3bc.TMP
Size 48B
SHA256 5dd9276c1a3a7d26d8163d2b77e352b4abe66bc5e69118c79977b9388fea81b8
MD5 cb786164e89ce0f97cac40ba18088fb5
SHA1 470acdd8717e10963caf4a2435a1c33cb0286c9a
SHA512 ff237d58d81510ddc6393696052ee6ce5c5c53265292c4181f072b343cde4dd6a05747d480f75233829f67ce4ec2a975df5658c8096bd07e3894776674d0cfa8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc2e9447-353c-47c3-91dc-c2db3d743cba\index-dir\the-real-index
Size 3KB
SHA256 9ab35453dc474b259ae54c525a1daed86eea2c990b86832932c633dc3fe17ccd
MD5 582b3522318842900904d4cc6c093218
SHA1 e1abff047fc7f00990692209c57114fdd398ee61
SHA512 78f52c9f19884d69f3f06a50c63e8390a85d8e4667f023e109267d939817db0430572dd1bcffc312fc6d728e0332ed667c58e2e6b9656ec1cc88483d9dab5c1c
TLSH
T18C51E74E4D032B1AECACA67004B2040537B875EC23981E2764FEA635FCC7739598C66C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 77e418e7cbaaa2b0be3306c1c091bde6ef82c43f8130cc758311669ed9b75b34
MD5 d7e205a3480a0e2bc29b802d0cd3bec8
SHA1 bdb82039f6f69f8aa61bed92e53aa3f53497d71f
SHA512 7e9d70140db5899fc061e827b0461a79229d2f76c79f8cf96dcef7b8f3b032188c23280433eab0a1fcee4b518ccdea01dce19c2a406dce97341a1407d72afb40
TLSH
T1FFF046F37FF72C10FDDF83E924B204B840297C48C944AD5FA466A59290F264525A9C76
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 ff2b9c646b983d0eab56cafd88c1884062574f522501bdab71b7dc25d8318a14
MD5 eee10e9fae13c2bf6a31cefcb251519f
SHA1 de556d8040ea9fc6bea99bf41783e320755834d3
SHA512 7f8c86458d98d833f1ca1b6daf09c919e20c2aff4e69b3ef4439c81a024260033d95585cfca27faf5986a802e9021e7d68d2ad4b813590958b8ef87305b4430a
TLSH
T148F09EF73FF31810FC9F83E424B204A880167C08C504AD4F9426A18350F2785356AC36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 6b45714b1d76d8bd2de6acf380bd1795af1e8d8a24f246fa77bdc57a91316d29
MD5 8e90d993169127aceb8664d6b44e7018
SHA1 d0b27ddd2e099581d0bd7797cd90d4e23b751c13
SHA512 f79a44eab875d10b0884325a8532b90ee54e0f2d330f348f581676ca888efb8dc1ae597568b3840eb261bef02116c700821f0897e0243e3b586288b15a271854
TLSH
T1ACF046F37FF72810FDAFC7F424B20478402A7D58C554AD5F6466D59280F264425A9C76
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 810cdd047023313a2d743dce902f025bb323219505f01d993c0357dca326e382
MD5 0971f478e3e193aca5516ef3436ba7d8
SHA1 b003ec8f3fe29dce4278b5bb3a09fc2226070ff9
SHA512 250a51564284405d232d24047ed38fa8f5b824c70935f4037c5908126932b792b8b43a7503b62f6a7d9630f371b2e827ef4ef4af1d1ce3c72115d5f1eacff1b3
TLSH
T105E0C0FB2EE31800FCDF83E414F344A840457854C4406C4FA42D91D390E13543A97C36
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 130KB
SHA256 e51b354928d59a86de112ad2f9bbafeae11a3b41b5aa5f8433c3fb3be2697894
MD5 feda71892c81618f53d5cd4bb7570d78
SHA1 b243db43bd2bebc2847ec44e4bacd1be890509f9
SHA512 ca7f623f5a5c8b33c77cf4f469b5c17c77279df08ab993047b9552035b7cd54b94ab889fe66783ae0ee2fddd6f49831184e37fd82035e60b86e22be03c13921c
SSDEEP 3072:VItl9BQxPCx1joDerhZL/x3ei8MiiZL/WL/CL/1L/xL/Tk9TwAuuQ:VItewZL/8xMiiZL/WL/CL/1L/xL/TkR+
TLSH
T15DD38933769D50AF0E89BA645156B50392BC7467B844A038F214A7FC25DBFB013FAEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 9893027a184a3423d191f4ae538c08ed3aca33ae3769bbd1330bdac25eecb487
MD5 a00062dbf5ab08b112115fe8484d20bd
SHA1 997e0912222f5fe59e927147badabc425e09eabb
SHA512 da6e339fd06368e6cf4d5dbf5d33f7f9aa40958a631c2638e13d85a78af9a445036f4c1bd592fc8d0daf624e9fe27f50cf6ef64fb2759bd863492cd292f93b02
TLSH
T11AA00250CAB2E002D14112F421F542D76218DE9E97952212C4ECE44BCCB074F71C2450
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a445.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a445.TMP
Size 48B
SHA256 b3a18edc27ae3633c3333925027bd4dd60a2f0e4881262b43a3d0a8969b1e409
MD5 a5ea37b38ebbf8a549cacd7697caef75
SHA1 c5fa6f3d2307052af579d4deafab01704119cd80
SHA512 9fb5b978ae42ffdd0dac9f201f81e1f97dd0474ea80b0dac17c371fec28099f2369a669a2c0a745c17f094d7869b9972ccc524e7e71135dfadde948f52630924
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b2fbf610adb29c9cba6a8c8d4a0879dc0f3bedfe751d2e126a9166953f4ab579
MD5 bc99329a7eab3362c1bfc53cf080d3d1
SHA1 14cb292990ade101210600d0dc9da5940c3db9c7
SHA512 5bfe709ceba1f912c2d6f3e2e262687dce8c2a79ca6920d4746787880feea13dfb5bf6daa240ea8fad7c8496b3799cafd7bdcc8820cbb8e3331e581c1f18e589
SSDEEP 96:KaRk1xTLL+xbmlDR+KrLD3+fJRunhfG/6KMQHuMKLi+yz:SzN/ba
TLSH
T10891051232771242397D2C4490D0EADE578232A27064ED2F3BDA44A58EABD240FFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 881d332641f798cfa3f76b77fde25d53325e571ab60b85a7801307aff11b5039
MD5 b02fe6e151f474276ecba7495a997370
SHA1 4738ed6b9b43de7928608c475f326b67209719bb
SHA512 824980000aacb95df9d7802338cf817246cea6b985a0db29c70807d1112498ecdf1772aba754936f3850d4431010e5fc339241b772a773948e4996f08f2eb314
TLSH
T12D61D02132771252397D3D0490D4FB9A534632537064E92E3BEA44A58DE7E140EFECDD
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a224e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a224e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a7203275a93fac980792819bb798fa6b9bf5d8ea4372b0af21fa027fedbc3880
MD5 cacc3d9a4776704f05dfcb6c5d6b103f
SHA1 48e7058fd20c3025cd55758c932838dfce96cc07
SHA512 bc933daeb0d7456f0ff6d4dfd104e90f2eeca0aa00191f2ffca9148a4f972c50fd1494493d849d4e7253bc75cc5c0f182c6762203c165a9513f039ae2a10856a
SSDEEP 768:t/UxvxjgC+I3GvAK4wZE57Y0GZxJsXBdK8ZsKc0:QZj3+I31w470/JsXf7eT0
TLSH
T18D03C035E8A49D6389B7D391360A3797EFF84AA3C5C54EA88ADD9F0D01C729D034781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 8a6b8b6cca0eb99fc76ddbbfc33fffd47debaede0f369862de1b41a0a487ca82
MD5 8fd47bf767a317627ff67b9ca220d762
SHA1 9e55d53b2d31b84d9042d59924631ce769eb02f3
SHA512 99ea12ecb00a4ebe62e6731e326797a749ce7f13bd14db5fdf7c732bad360ce32661963f9b4d929205632f7936bd58371b6708bb0eb902fcf41296c0411f070e
SSDEEP 768:nFQA3TwguvAK4w6E57Y0GZxJsXBdK8Zs2sen:6A3TwJ70/JsXf7e2sen
TLSH
T17B03AF32D8A4CA77ADFAD7D1B60A3302AFF846A3C5C58E54DAD99B0D01970DD0347C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9ddcfdc0f545aff734476e199f43e0c95dc488bbcade04bc7c3a4389a2058218
MD5 b4056d2da4f9fb0f2741233c8059561c
SHA1 0756552f5b4c4415be3f91a4ed865392eeff8bcc
SHA512 175d0da6546ebe30b74f0dea1a8c55b8191fd6ed5a74f0321994120b1c42c4c56ac55b2e79f9afa6a430df74e89f4007fdcc06aa0e022459a9eaa85c1a64bcb1
SSDEEP 384:BZcIJ38NAaTldYjv2T/nfydXMCUEO/1UBrgYg57HD8CJGZXhJqlX/XBdm/e5x44N:JJ3VvAK4wZE57Y0GZxJsXBdK8Zs2sen
TLSH
T174F2BF35E8A08E735DFAD39176063742AFB886A3C6C94E84C9ED9B0D01975AE0347C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0873182dd83a5b25d8fb7ad2645bafeee5468b2e3ae8b518b41f0505f8f255b9
MD5 d2357dc2e143127f45fdd0e4e9079bba
SHA1 60ed65caff562c28e6f6ad775b1b0542f1b359b0
SHA512 511dd9222573e1bc05868cf60ddfada29eb783afbd21e405603f80f3c55b5d020ea259e6c323c4a9afb401d98d8899988e83abf0e0338a8c07db409b70e12817
SSDEEP 384:JZcI138NAHTldbjv2T/nfydXMCUEO/1UBrgYg57HD8CJGZXhJqlX/XBdm/e5x44N:B13ZvAK4wZE57Y0GZxJsXBdK8Zs2sen
TLSH
T1ACF2BF31E8A08E735DFBD39176063742AFB886A3C6C94E84C9ED9B4D01975AE0347C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 949ce1ef958c60dd0202f591b6b4d999cb6da4ed29e71df43cda9ada4622688b
MD5 700f4ea29e40cab9fde1a3464f31adcc
SHA1 cf32c920e10b1fe0803890e20bb6a529ad7f409a
SHA512 7134ad7be5c1518a9bc72bc3b4ba56739540e1779bdf3423fb42be9b9f2f397f4808b9f594535d613ba675f9532429ed5ff39badd343c84035e1ea40f22ac874
SSDEEP 768:A/UxvxjgC+I3hWK4UE57Y0GZxJsXBdK8l+SHUPpMs:tZj3+I3qj70/JsXf7YSfs
TLSH
T1C303B035E8A09D735DF7A3903A097397EEF446B3C5C54AA88AED5B0D02872AD434391B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 96557a8776c15e8fc8f8bbd051d817a598dc2a40b67b744e23e941e4d3e2b63e
MD5 5bf1abc7a9b1940fa0623daa70165b2d
SHA1 61816464aa94b2a56da6c2bf33f45c02b316bee9
SHA512 59f144856a0b0152338c9ba3ee9a0cacc10fbeb88d384f2eb9e68639d9a33d4f15dcb37f060693c75be8b69675f5536e9c4c3c177a7e31ca7215531d427d70b0
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9e1b7e220f5bedbe5342c197404521d23e7b8c5bbe5145a1f79e51f3d6fd82d7
MD5 8a54d6dc35846592edefc8d3c628e219
SHA1 0bd09893cdcd1be7e14c683ac085f2a27abb5a56
SHA512 44ca90ab30a5e8946bb75216f590a2b8d9a63eeba626bfa8cf392737a696111e62933f5612b30fa42c093384ea135ab300f3901d07a3da7ed3e518492426863a
TLSH
T193E00111230000AAC46C033400831F206FD2C42012B143876B30465C0C333007E74F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b6c14.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b6c14.TMP
Size 392B
SHA256 5beeb23252f00347c03321e18057f3321d479e6793bd5cb99e020b3d9f25327f
MD5 1b8c3ca390164dae3bc308e12644c8d4
SHA1 a552b11d653216c4e9c564fce3f79682cd9f3ad7
SHA512 01a9a3a3f94aec191c57baae219ed8904049d039384c0242fc381554a5ee48d1556570b4ef50ce2c46d91ab00a6fad10dba5b79b01a59e6cb8e167b3c8c5c851
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

da354576-0218-475b-8dac-5ca9032cf017.tmp

Path C:\Users\Admin\AppData\Local\Temp\da354576-0218-475b-8dac-5ca9032cf017.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

memory/800-816-0x00000210003A0000-0x00000210004A0000-memory.dmp

Download