hxxp://outlook[.]com

Analysis

max time kernel
900s
max time network
888s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/04/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://outlook.com
Sample260402-sdxtvsew5k

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-notification-shared\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\wallet\wallet-checkout\merchant-site-info.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\runtime.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\wallet-webui-101.079f5d74a18127cd9d6a.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_1398225307\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-shared-components\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_76468610\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-mobile-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-tokenized-card\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\wallet\wallet-tokenization-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\Tokenized-Card\tokenized-card.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-notification\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\wallet-webui-708.de49febeeb0e9c77883f.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-hub\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-mobile-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-notification-shared\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-tokenized-card\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\buynow_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-mobile-hub\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\wallet\README.md	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\wallet\wallet-checkout-eligible-sites.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-hub\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-notification-shared\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_1688586384\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\bnpl\bnpl.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-mobile-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\manifest.webapp.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-notification\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-shared-components\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-tokenized-card\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-tokenized-card\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-ec\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-hub\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-hub\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_502835938\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-ec\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-hub\nl\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4948	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134196157298806324"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2397528088-2630719772-1129911217-1000\{95D22A63-F822-4455-9CB4-FD6B7E94A511}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 5108	5084	msedge.exe	78
PID 5084 wrote to memory of 2168	5084	msedge.exe	79
PID 5084 wrote to memory of 4948	5084	msedge.exe	80
PID 5084 wrote to memory of 2168	5084	msedge.exe	79
PID 5084 wrote to memory of 2168	5084	msedge.exe	79
PID 5084 wrote to memory of 2688	5084	msedge.exe	81
PID 5084 wrote to memory of 2688	5084	msedge.exe	81
PID 5084 wrote to memory of 4064	5084	msedge.exe	83
PID 5084 wrote to memory of 4064	5084	msedge.exe	83
PID 5084 wrote to memory of 4064	5084	msedge.exe	83
PID 5084 wrote to memory of 1112	5084	msedge.exe	84
PID 5084 wrote to memory of 1112	5084	msedge.exe	84
PID 5084 wrote to memory of 1112	5084	msedge.exe	84
PID 5084 wrote to memory of 5864	5084	msedge.exe	86
PID 5084 wrote to memory of 5864	5084	msedge.exe	86
PID 5084 wrote to memory of 5864	5084	msedge.exe	86
PID 5084 wrote to memory of 2808	5084	msedge.exe	87
PID 5084 wrote to memory of 2808	5084	msedge.exe	87
PID 5084 wrote to memory of 2808	5084	msedge.exe	87
PID 5084 wrote to memory of 848	5084	msedge.exe	89
PID 5084 wrote to memory of 848	5084	msedge.exe	89
PID 5084 wrote to memory of 5188	5084	msedge.exe	90
PID 5084 wrote to memory of 5188	5084	msedge.exe	90
PID 5084 wrote to memory of 4052	5084	msedge.exe	92
PID 5084 wrote to memory of 2348	5084	msedge.exe	93
PID 2348 wrote to memory of 5524	2348	msedge.exe	94
PID 5084 wrote to memory of 6124	5084	msedge.exe	97
PID 5084 wrote to memory of 6124	5084	msedge.exe	97
PID 5084 wrote to memory of 6124	5084	msedge.exe	97
PID 5084 wrote to memory of 4360	5084	msedge.exe	98
PID 5084 wrote to memory of 2324	5084	msedge.exe	99
PID 5084 wrote to memory of 5892	5084	msedge.exe	100
PID 5084 wrote to memory of 5896	5084	msedge.exe	101
PID 5084 wrote to memory of 5896	5084	msedge.exe	101
PID 5084 wrote to memory of 5056	5084	msedge.exe	102
PID 5084 wrote to memory of 5056	5084	msedge.exe	102
PID 5084 wrote to memory of 5920	5084	msedge.exe	103
PID 5084 wrote to memory of 5920	5084	msedge.exe	103
PID 5084 wrote to memory of 4812	5084	msedge.exe	106
PID 5084 wrote to memory of 4812	5084	msedge.exe	106
PID 5084 wrote to memory of 3652	5084	msedge.exe	107
PID 5084 wrote to memory of 3652	5084	msedge.exe	107
PID 5084 wrote to memory of 1004	5084	msedge.exe	108
PID 5084 wrote to memory of 5168	5084	msedge.exe	109
PID 5084 wrote to memory of 5168	5084	msedge.exe	109
PID 5084 wrote to memory of 876	5084	msedge.exe	110
PID 5084 wrote to memory of 876	5084	msedge.exe	110
PID 5084 wrote to memory of 3504	5084	msedge.exe	111
PID 5084 wrote to memory of 3504	5084	msedge.exe	111
PID 5084 wrote to memory of 3868	5084	msedge.exe	112
PID 5084 wrote to memory of 3868	5084	msedge.exe	112
PID 5084 wrote to memory of 2652	5084	msedge.exe	113
PID 5084 wrote to memory of 2652	5084	msedge.exe	113
PID 5084 wrote to memory of 4664	5084	msedge.exe	114
PID 5084 wrote to memory of 4664	5084	msedge.exe	114
PID 5084 wrote to memory of 1612	5084	msedge.exe	115
PID 5084 wrote to memory of 1612	5084	msedge.exe	115
PID 5084 wrote to memory of 1268	5084	msedge.exe	116
PID 5084 wrote to memory of 1268	5084	msedge.exe	116
PID 5084 wrote to memory of 1112	5084	msedge.exe	117
PID 5084 wrote to memory of 1112	5084	msedge.exe	117
PID 5084 wrote to memory of 2144	5084	msedge.exe	118
PID 5084 wrote to memory of 2144	5084	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://outlook.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffefb2fc188,0x7ffefb2fc194,0x7ffefb2fc1a0
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,18176582488662582917,18145771605751423461,262144 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,12019586210229537947,6247136009638263149,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,9708034804879804614,8542406643631289291,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:13
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,525250979289025725,7463208910243216384,2097152 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,5349613780379338212,6361739816745739092,2097152 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4896,i,1366061434823865022,1004170328457800253,2097152 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3580,i,12533696098630548518,12950869384469269753,2097152 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,16894151991110310798,3641056540079338700,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,8227658588434245766,18196905462276351497,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,1172252490644772136,6386714297699227728,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,1172252490644772136,6386714297699227728,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,14741246084671272933,13170151212607671903,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4916,i,10461015611934387984,1585691584267758503,2097152 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,14069756016083958537,7418583936210351794,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,9676291357244324033,1534275333899422851,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,2756013160965362396,7245609848905872303,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,13406949747116612663,6818370930429524832,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,14496767403510964098,3916757454439203140,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:14
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,7478838821170705261,10672054140371505696,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,14278541865143551064,12231934775655573676,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,4397124708956045622,12409791586416070701,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6100,i,13969606707069950914,6766804726904437280,262144 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,7800735367136009249,11903288018067877533,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2896,i,81352102248082854,17930870916615352313,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,9734260762861335806,15231195085022046912,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:14
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,3543539197888963154,9482967873588670585,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:14
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3296,i,17634073080599180151,4927345324939754484,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,16253184525232490908,9489688355751040580,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:14
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,13237340778537118188,11185030641141346201,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,10486865344448803731,17495088351566692836,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,11188436917900477449,434360913337305272,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,16921842892060866158,1404338750779879548,524288 --field-trial-handle=2180,i,12908136449916340223,18055147509020011992,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
MD5 c6c88b3fb919f1f75228e4aff327fe5c
SHA1 70428f4ae69437730ef237674398113e1a3f3017
SHA512 1cda50c8b022751e3d3a7c73ffc9350fe02786e3000fa887544b774366bd092e165982f8e834c7eb67dc7a078a4dd76c0d5370912b7c3c7b95fc731b504ce5e8
TLSH
T19FD0803D1572BCB4C499DA714456372B6E1DCCE24DC65F116462356D4D9700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

1c1a374e-dfa0-4468-a869-ae9d8625dd11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c1a374e-dfa0-4468-a869-ae9d8625dd11.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 c6335969e359a2ac5565f6f13bb69d5d3d4510845392a8ef4dbe9f6208869510
MD5 fffdd1135d2405df86c14f805180bd44
SHA1 7c720a17b2e44236131aecdd71a01ef3358df3db
SHA512 357092f0520899138f2b4743f543f99dc82f809a88bb1962040345ce629037f628a9fe3d636f731afa66452b0dd80c6da79f11b82f41a80d992d627d20e87fc0
TLSH
T18FE0D86846C6DDD9410AB8CB909DAF5600CE788993DC5D6D32486AC4EA00820DB154B8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 0910e30c067d738d274f40659aa4ded34306049c2d5194d4324318b8d0d63bb7
MD5 79a040f43f5475ca60191f4b9aa580b6
SHA1 b0cb1aeb3b650919dd5ac80ba15d99f6e1188076
SHA512 c8815a9f522e2082f0470c8ab81fe41937da3077d95e90743f5662b77d1b28aa4d9f4a8d1964755abdbefbe0680ac49244b5d841e2738f5c8b5485b1ee0c858d
TLSH
T122E0260F0AA3C6E95201B4C7C67C7B9F00C2300BE7FC4BAE324AA6CAE48C840C50D8A0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 385B
SHA256 2a8d8ac05f630d5209804bbdc42b0226512c7b8839fb45c55febf874e894b246
MD5 5e86088c3fed5739aca6c9b9dcd7b556
SHA1 581fbabc2b8ca5c39f6118ddd6e7fda04b7992b2
SHA512 740f5aeb80fe4731859894b0d6d77aa599d1c4e3c85fbf37a8b4f032266e7e1e57cca636583f801a6ee5554ff49a8cbd73112d55e9f013168281bc25e57150a5
TLSH
T1C7E092AEFAAC9E8ED7E4097E97B6B4400BC802A2D80F9B1305347EC035956B02E35424
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bacd0fa7093d0a002532d0438723295ca9cb92d3c5ff6cdbf1d0176c1773e815
MD5 72bdd1176e2d5302c85c8aaec2b77776
SHA1 6d321034381335ee8e5fb636cbff1fec7922e07f
SHA512 2dca888be0a36ca143dbcee7e5d82493ee1dcd518154adfb830a35e158213396ec9e0d7e45d0cbba1e392b0b0ce4712b94832e150ce36e3e0604022e1fb6dc60
TLSH
T11CE02BBAC821996B18FD072A50914606EA1117171B50C55F3B3D820C8FF5A37569586C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e9abef32a81cdb243dd4a33a00c6af37958bc4968718bb0a4736fc722ceac39e
MD5 72bac15cbedc1c46fe394b9ab2ac4130
SHA1 286f05fcb0413ba54a8858add33482fdc3a24ddd
SHA512 50808a54cd6520f3c7db2d2f88de2078f62c0a028ef0e2475cac5aade07c889ffd3a5ff2064c7b46f6b3f1f864897af2e818bd428906fd598735c9717e72eaa4
TLSH
T18D81B453C0B1BC26EBF002B0C5E55BB97774C1C48D671E764BD88A3E9A0FB5EA088E05
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 74613dd0f7d3074223c7bc4a345e1bfb53bcc524a34a541f53af83f84625ef36
MD5 845aaeea969b40efa2dfb965ff2cfe9c
SHA1 a0cd876472541db34534f8281957149e9c099729
SHA512 951227accb0bd9de2dc1a86949c4c116064df5fa9858e5278c4bf0b070f161d26e8b5e96b1f6a046c7be6c9326aa53da88035650628d51958b8db6dcd9614346
SSDEEP 96:D1aOWnnBzYu5qPscGj6wy51YDBG9tYiPBMUNBMBwrovw:D1JUnBMPdGj6wy5GFsYi5MUL4eoY
TLSH
T1CB91BDF7C3E4852EC91196F0AA18AE2FCE2C0A55831C7D1AC5D4EE2BA3E3471E14195F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f5ec9850e21fac1397502d056afd381304660fda68a613a0e09537b0e5bd26d5
MD5 0fad666ee3a0c64cf97dae515f73def2
SHA1 075d70e3c6d3cc390138fe6b86d9d684949ded30
SHA512 d7a340a2b8b680275887ea9251621bf1d748a6561030fe4cfa0a669303aab5ae553d02ad40eefdca6ebaac54b34c8b69ca3a18f7714035f4f587dfad63ca9da4
SSDEEP 96:D1/O5nqfazYu5qPs5j6wiQ1YDBG9tYiPBMUNBMroawRGj4/Rw:D1WpqfaMPkj6wiQGFsYi5MULKoa0Gj4u
TLSH
T11B91EFF783B4856EDE1196F0EA18AE2FCE2C0555431C7C5A85D4EE1BD3E3071E141A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 9b60a73980839df22a89529daa642fee589ec04422aebc4419be3e6c7676440a
MD5 2a183b5d56ef24d1454d16947a0d21e2
SHA1 f06cb87252922da38da2f9f43471432d95e44bfc
SHA512 f29c5a92cf877b2c897821e253c0fc64526d81db226ed54aec42d06be245af0225dd4a7bceb92a551f915acadba8273292967768c73286ec450a0f40332f64be
SSDEEP 384:sxZAfqi4/fysD9/0QDQNtLu8/Ku/5wcOLag:s4ii4/fJ98Qu1/KU5wcOJ
TLSH
T14572E91A66389977CCDBD219F645BB97D2F9652391808D489AFCCA0C00D7BED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8ca75ee2bb710803748f7401354349912f2a74ce8537a5e2a7b1cc011fd3273c
MD5 1deb41b86d46dd62b9eae77295926cee
SHA1 85b457b62cc8f13601781429eff039d0dccedeb4
SHA512 25197e8f892fc76d42e0b6f803f739267b95ac233b157b2e0d46279cdbe7815b5fe74968c24ba3fac8a97ff5352647a979ab9058ae2a111d5a8d0a2d75954eae
SSDEEP 384:sxZAfd4/fysA9/0UDQNtL4Z/Kl/5w/OLjQ:s4F4/fa98Uuu/KZ5w/OQ
TLSH
T10B72F91A6A3899778CDBD219F645BB57D3F96523D1804D489EFCCA0C00D7ADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 84a62c7028a6543d9b0c3c7707df6e52da6445f7f349e76c632402ee7e600f21
MD5 492607fb4e267ac048deb3b41f8ac880
SHA1 539544db8c3bf7da27e36bc6fecf100d87c2caba
SHA512 8661bf3704a4d521e8a6d2d97ee2fd22a0054ede34aaecb2c88175bdece7d387a4d34e9a991198f74896c1d8c4dd2931234a2337f288d076a005a5c44981249e
SSDEEP 768:UnjXV8Zp2+m7pLuL/AAWRmAoQ7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3ADwvLlm:UnjXV8Zp2+GE/AAWRmAoQ7ku1jaKADws
TLSH
T1D4030B3B280CCB7E4F844E9CEC27BE9E6DE8018B9698895447FA454C03C66EF551B1DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0fb5ef40-558d-48c2-a3a3-30db6f2b1f3e\index-dir\the-real-index
Size 2KB
SHA256 7b37b13644487799f56e2ccdf73795eee8312f423401181d1ebcc14b65a36b1b
MD5 04136f41ce67395fb8c745533abda6db
SHA1 1cb345128f9bc9772faac132cdd5e3f3cd3da7b5
SHA512 c12a1900deb9d6f686296ba5be066ed0ebfbf3a0eb53fdbb90f7b8e3639ff418370398989973da97dbb7b78cde2fec0d383a1d01329d15728db66bec2d01b2f8
TLSH
T13F4107CC5C4A4F17CD7D90B058B5002E33349CFE2E494B0B38BD2A791DAB26A29D3128
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cbb39.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0fb5ef40-558d-48c2-a3a3-30db6f2b1f3e\index-dir\the-real-index~RFe5cbb39.TMP
Size 2KB
SHA256 0c9a6829f8380ed18109c456f26b5b74dea55f1139341f3f18c54d6a002c5592
MD5 36d0d2e31a27c0dd8609dea6bdf3c8bd
SHA1 e50a14adb041b5becc59aa6002634b13bce56c51
SHA512 d1418488b633e06ea7531160e6431b8ea97a6a020c73db9395995a056449309083f8dba077fadba6797b8adc6c96d3897ab9c147620e378cab2b2a595186134c
TLSH
T14841B9AA5C864A23CD3180B299C9606D333DAC9509449F0F75FCC633ACD76BC3DA2294
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 f5eee05361297da94b90c3432775e9cbfe224ccdee1ce7516d3233df124b2ccf
MD5 4ea0555734e9b9e423b088ad395bad5f
SHA1 ffad96836d052e89244eff995080e1c4be80a1b0
SHA512 f5cf483009a1237bc0ea39b03c2ad496684b7a1db2cdf037b832b485013bc360e05741885fc4e01cd5bf4bd72d7e2785e7d64250f7b427fc39156f9110488abf
TLSH
T1BBF020F73FF30814FDAAD3D520B182B50146BC188586EC8F296EB29784B1359388AC62
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9a6c68dd32d06a58562c6e5b2d872e6d0b36e66e2a636ede0c72b1f77313d21a
MD5 a41df1c22945f25d9b2a151f1b2c4c79
SHA1 447cb205bb2014278eb53473c91461b2d1a96d03
SHA512 1e7ad251cc705e633d24024bd7ae0fd881ed4021800cbefc09a6b29bb73d560f1777033346c8877f250106657077a986f3ae55455d53370347b76279ee567932
SSDEEP 96:KUQAK926Wh+KiQRYAKJq+2xWKqgZ8gKRuiqsQKJyy1aKGg/qQYKxqqvOKMMaa208:ardVTNBbfw8nM9fgzNJ9dvz9dTfe
TLSH
T146B22C51357B03C03ABE359A81A1B5AF46C230633118E42B7BF851EA4F66E25DDFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.2\data.txt
Size 144KB
SHA256 2cc37920ca3076ca35e6c0137db7f2ddb8ae9571b9450421cb3e6cc05e9a6876
MD5 640fdd5f6bcab8153a35f27d52dc24c0
SHA1 320d366ccbb572091046c8503dcd892ab0a7ebad
SHA512 6fbc0f35d34cbb8dcdfa5fb48f97f36b6d8ede033d56eb7ed94f70db2cd310bf9ea3df9cc576021c1e3e94625560589c3b520bf3d07f7df112c02deab374e0c3
SSDEEP 3072:UjPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEQXy4wjD4N5P1Zmz:wX1aI5aZoKzMJ07NiJ59Zmz
TLSH
T18EE3F22186C45FECDF58162CA0FE0F19A3E2879D85267986D763FD0E5F97A0862370C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 38d8747c8e917a77672d56729304d2e94f9ca10a4efccf051ca7c46247bdcfb1
MD5 a312ae79e2fe062dbc76d26c0f2c7fc9
SHA1 b35c63c5f66e9a21cb284b92aa664156aa199c34
SHA512 dd22f7b1e6ea6f10b583f2d656d00173fe2e3795653cb560d956bacf35ff3d09d4401ffecf2f24106c87480397a00a7a3564d17db10255a73b301960ed84d799
SSDEEP 768:XFJccQQgwg6B++eIoSEKOoQ1jb5o4+mw/:bccQQREowoX/
TLSH
T152E2A2F194E79977E8AE8B97A33D6E029AFCC053B4485994FB844D0CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0715b21ea8439a84c973551c889730852aa76938232ec91b05ea072a6efce9a0
MD5 4e042bedcf16fd5176413ec44f257937
SHA1 dffc119332e2b5e1ef0c1f4ff1e2f1e724a65b3d
SHA512 afb443f61a4f3164edf747bad6475d5f4721d5c3e3e91a682113095b4d62bf6b00a9cdf7a6191737cc5ed0cf7a24bb76e4059979f8c0334564fd57ceef41c999
SSDEEP 384:nHiFJjccCs+Bt0S3n8N78TUNTUlIRYUvHnGcBrfPKMrCuogXFrcb5otFA+jLiDrm:CFJccQHgwg6bEKOoQ1cb5o4+mw/
TLSH
T123D24A35D8A8DEBBFDE68FD9A34A7A03EFE00057958C9AD8D9C94D0D00971DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6b26b88490148031639205b712e1891a3ef07463af35e29b67a70dd765bf62bd
MD5 235983a9b3041a87092c946991003c9a
SHA1 133f3159e045349abf2c9442a5925cd48bc87d4b
SHA512 9f934b73b2c61034809732af26b7ea12890756c6239fb49dd2cc9baae8536f541bf1a63525c27c5e42d19c166d1baeee6e95e096c8420c3826ca8ef002b3680f
SSDEEP 384:n7iFavqMP38N78TUNTUlIRYUvH6GcBrfPKMrCuogXFrib5vl9k4SrNlk+5vI+JO:WFayc3gwg6eEKOoQ1ib5Nq71O
TLSH
T114C23935E868DEA7ECE68FD9B30A7603DEE01167D58C4AD8DAD91D0D00D71DE130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1a148a9f925a28817ed68242c351bf1390fec7c8c0dc886d23668678dbc0cf44
MD5 2fe4298d2fe67000941d29d054d2a4b6
SHA1 4136ee6e07970928ef8fbee3b91bc23d93fe8294
SHA512 3fcdb4f4ff1a195eebf175d62e3caa1862d7a6533708237c073d5644f3fc3a0331480764755f3e36451ae5a76b31af1e2490d981b20c264af21954b1fbe3fa00
SSDEEP 384:n7iFJjccCs+Bt0S3n8N78TUNTUlIRYUvHnGcBrfPKMrCuogXFrcb5otFA+jLiDrm:WFJccQHgwg6bEKOoQ1cb5o4+mw/
TLSH
T1A8D24A35D8A8DEBBFDE68FD9A34A7A03EFE01057958C9AD8D9C94D0D00971DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c044bd2b8e3d578bda4a5dcc0400ad6359a28c7c4fcdb3bff7c409a4b83f3ed1
MD5 e9d809b2b2c1932f8793782c32ff2e91
SHA1 a1b87a2d890298ac47ffd1f4b793d4891396b46c
SHA512 d8b6444ffbf63229b01295c25a31ed6219aa6a975fd254ce5205dcc1c8b6e175dad2753929fa57bc32b88c05dec3a305dd2c5a2b3f1394680fda8375c7b1ac05
SSDEEP 384:nAiFavqMg38ND8TUNTUlIxBvHTCvGBrfPKMrCuB8dnS4mtmF1rNlk+5vI+0Z:bFayv3owg2viKOB8dS4smFhIZ
TLSH
T1B5C23B35E898DAB7ECE68F99E7497A16EEE001A7D48C4AC4C9D81D0E00D719E234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bc2bd8feaf0d6d4bb80a3d5b33e5fb6d2713c966e67c19aea3e8d527b2812566
MD5 354f316ba3d3c9ab8885f0fdc63a91a4
SHA1 af938c274a17c921611a578baa48a40d9fa248f7
SHA512 d8060d2e22bd154889da92b21d0f9bedaa603e58d101373b824ec3b894941708a26dd2fdad84990c785f35ada2162ef6285c527f85231c4147f1ea33a1907e17
SSDEEP 384:nAiFavqMg38NH8TUNTUlIxBvHt8ZBrfPKMrCuogXFrvb5dnS4mtmF1rNlk+5vI+m:bFayv3wwg23KOoQ1vb5dS4smFhIZ
TLSH
T17CC24B75E898DAA7FDE68FD9E7497A03DEE011A7D58C4AC4CAC81D0D00971DE174BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.3.4.1\typosquatting_list.pb
Size 1.6MB
SHA256 72aa7742dbc03dc4fa7a0a6719aba9fcaf7dc3cb5f3250d14cd8dbc83d7b4aea
MD5 844528b3019b73b587a49542bd544a34
SHA1 f35b8ef5e9289e111ce699ea3e5b296124745d7c
SHA512 334329ccd92c7a2d27e5a49fa4e546632b0541f1d300c105b311d1a3b7707babf0590c4f2135cea37bfeaae1bfcec87fcd469ebb1458a67ae052a1da36b1def9
SSDEEP 12288:JPgRKbF63Ji3Qyd2DNBclST9kXYXHX0WEbENbtvBOJfWQV10ySzqnkl3Sm:JPxlAA2DNxT9kXYXHX0WiAt8JvSV
TLSH
T14585C6F9DFC00194DAB8112D20BE71D8081412A540E5EFEAFE7C855F2BC6AC977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2dc0781a4a706321ed8661ddfa20525c17566ed4b22f8370f92c5e635e054010
MD5 8a08fda466d40847c637a9a0de5a82bb
SHA1 f15740dfaa0cad58a0db187530b84a91c84e935f
SHA512 09b37d02b7820a94efc55d76ac02ebb585f6f40b48c5b6140a54b17e204577d679726d7dd1e5472c719364b1829c1149a265ec4e8bd9b0d6ac34510f8bb7041c
TLSH
T1945130E04C3D26C1E4BD0A2EB44B38FC85D8CB26F49035396868EE98467A61D608043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9ab984842f0baa832b53bd8d3a1d42dfdf7ad335609e65722cecc3b0b729b8c3
MD5 68f0102840dd2af75c4920c248cf24e0
SHA1 4cd4135cc4367d2153affc5057f9e9513f0f4d3f
SHA512 55e03402b24f0c78e1836893ae365b98d3ece05b011eab45bd1478f59e7ae18e279bb066a1de6e5e96b54cbc5ead89758334b677eb0f824c7aed9c9a75c22b46
TLSH
T1865140D18C3D2AD1D4BD0A2EA48B38FC95ECC62AF4A4347D6828E998063A61D608043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 db393ff82aef84ce474c2a50a0af0cdd1a5387a01ac2a809516d8a0304d3ba5f
MD5 1824848c3e414bdb96f4a054280e453d
SHA1 18cec4add89233a03c2e7c7841588655ca28eade
SHA512 427e71174a916b99f31cd4fa8a3182eac098a97d8b6fbb400405a998d44a778ba6ae4fcb898cdb32ef905aede5260e6c778b50cc2d5bb012018b661ccadb10e3
TLSH
T16F5151E05C3D2AC1E0BD1A7EB48B38FC95ECC72AF4A4347D2814E998467A60C648447F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e154632afc397357eee62f255fdc2a85484fa63c1f500597d98edd1e7adf3113
MD5 63e74da6212adc68845cdae9efb2300d
SHA1 910bbfbd80c7f0399bfa1d44fc16d91023081600
SHA512 21749002866b064d0bbee7a222c24c6001cad84d539afe6eab34db318348d3fd0d5e0de84bde849173f41473dcc9e93d2c3c224461b6d1b0529b677314962f85
TLSH
T1645140E04C3D26D1E0BD1A2EB44B38FC91ECCB26F49435396868ED98567A61D608047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bee95520a6b5f3e628f3d00d879ca3571b3971c35abb580be2f448b52470707b
MD5 24b5f513078f65870d0ac29a479d81fd
SHA1 4081d0b8f59987d0130379fee05324b6d8c395dd
SHA512 1a20170f0ea89deaa7dc83216fef110a5a12d1b3a0dcf37a37e36af2c6e7f65bf2d238c1190db8847515b0973cbe7e0eb645a529915a9b9cf32608c0588069c2
TLSH
T1B25150D15C3D1AD1D4BD1A3EA48B38FC95ECC72AF4A4347D6824EA980A7E61C608443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 58b700298152650f57e774afaf8551d7385ff539147451da39c7a5490a023b5b
MD5 c8f43e1c0175ada6ef49a8bdca37763c
SHA1 f916ea92b353daf10b6ac5946e34f78cee3151f3
SHA512 50e069e99bb5063f326ca78841423471a983c0d0d933e5ec012c760e3b65a1f92736a3253e74ac4436abd4c2935eebdad5c8eec7178fc40bb0099449d54c4275
TLSH
T156513FE04C3D26C0E0BD0A2E744B38FC85E8C725F4A0357D2858EE984ABA619A48487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 70b9cb8bea1bf5f6cc9bb4f3f4de14b75d36e5d6e488c6f01e0a44a97daa60fd
MD5 c56d591212bfa611d395ce1c2947bce7
SHA1 8cf0c390307ffbdbfa7a31a330d03cd95b224c73
SHA512 95e43b0f8ec49780931bbd752516120febe29f189d014548366bb8baf42f60473e1a39e4dfbc6e50c8aa6098290333c4ae647163f4211614b4b8244fbc8a8c7e
TLSH
T1435151E04C3D2AC1E0BD1A3EB48B38FC95ECCB26F4A4343D2864ED98467A60D608443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bda557544be43cf028b21a82f9e60110d6b4b75bf8de1613602e4cfba658d3b0
MD5 e700bfef53bff6890cba709da628ca14
SHA1 ccb7f3841750f4a1d0ac5ddda5788a47fd563ed6
SHA512 035eaf6eb4e449e14a32e2567768272c838ecc72a4cc1f5b710370288cfb0f74cf43908c7c4bc0878ba7fc51d0cca152373d01c6fd4d95c00cc928a6e5655467
TLSH
T1B25132E04C3D26D1E0BD1A2E744B38FC85E8C725F4A4357D6858ED584ABA61D648087F
MD5 SHA1 SHA512 TLSH

Submit Download

ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
Size 146KB
SHA256 ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
MD5 fa032a5db34ff20ecbcb6654b02cd7c7
SHA1 3a0c7141dc03421536419c33cb5f9ebd5a4e0289
SHA512 3a3d99e5b9794db882760f754b9b58bebf77e88ce8d0bef61f3ae82c4d3c9631e524a98389f74f7f9215674d60a6d06c10b9e5d0760c908dc19412955ea8522e
SSDEEP 3072:Hl6RntNhz5AkVuPmNptLSZPunVlkDS6it9TyZpd21+PIpGE8aK5KyTmBpw:HM3z5A41L+gXkDS624Xwp1XKgyKzw
TLSH
T170E3E16C6EEAC81AD10F60BA795DB08FC8068F16C107645FB2558418CA64B8D57E2FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 49dee4519296cfe64f14418c408fb1e26710c833bfdd59a67e61c6f0c8461eca
MD5 4253fdd629204a9f147b4a12aaf2b5fd
SHA1 1048580ca1f0a5a753787848b82bc8c165fd4d8f
SHA512 67a37d1b7f80d171c80e8e8ada648bc184f7dc4e44c8ace55a38fd45c368efc17ee3f0838d824e1cb0507033f5a43c5808dd629c852a03551216d1b122603c37
TLSH
T18BC09B47695E1EC54E58067D45054D368AD6574563655175380B7904047431D435145F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_1075455899\manifest.json
Size 52B
SHA256 76ff008f386ed6800e43c2ad36eaedbf63740d90fea4463c6bc04f41777866ac
MD5 37d17cd14ec4f4f13a439d02baf4ecbd
SHA1 c042a80b93a6faf811b8e5c7a024821996387b9e
SHA512 053be133e4668d03930d020defa0898103cb1ca5bf8d9172301fd485c1e2daf3357df6f12c6ffb4a3bc242778a211251f7afbb762798efa7c506e903dcc33606
TLSH
T177900260042492171AC10E906570F885A391761955850D1D04451548029586CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_1398225307\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_1688586384\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_2095856165\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_2095856165\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_230018018\manifest.json
Size 117B
SHA256 39150ae100dd2eb2db8b0fa5a088e914110d872e36c959401ed0c490e72160b8
MD5 ac57313a478dbf89884edd1a33b99fdb
SHA1 a042b69993424222daa8f5a81c7411d54d295209
SHA512 28f508868e6ec2e93ab99950b3aeab51cc50ac54ba8b4d49296eec9066a5e30b90e29b4be539e5e16c8c8b405b7467f342c990155f569fb83546d84b5452dd0b
TLSH
T147B092B00C1AA43B26809320ECA0A68683F80218E8021B1E08803A491F8827881363B2
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_522407089\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_76468610\edge_checkout_page_validator.js
Size 988KB
SHA256 6b10679765e9a91b493a0cfbaad0d1290f14f270efa5506cdd0195f40afe0fe3
MD5 ddd4e7976c859219a8d12cf9ec8e32f6
SHA1 76a1ef584a6b24f0f1c01a459a75abd1a54e8f23
SHA512 8e474f793d555f59f2afb921fd85411d6ecc376717a4ee1c8bf2af16a411341a4da4d8919b1c22f65a675a6eb4c4a1be2cf21591a30ce97230e54aae1a0633ac
SSDEEP 24576:cs4+mRApsqvGXkJUAKjKQmwzErloiWbt3LPAfiMvBerpiU8LRKLRzMEiJsfaGx1R:cs4+mRAqqvGXkJUAKjKQmwzErloiQt3N
TLSH
T1C0253C84E1E2253466D74CB960B7D2C4B9DC04583399F1E4FA6C588ADB0FD4723F6A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_76468610\manifest.json
Size 146B
SHA256 ac81c068a6cfdde92b5ba4fa61c55e24ede74ee032cf096e02c3244193884957
MD5 26a72e0105edd93c58efe9f9c17a6b19
SHA1 ad79d1f28c4cb94adedc6cf5089c3cff652ae56a
SHA512 78006587c8ecd4e72064e9d02e555d5721974808764942dd48d2a583ec0300ae9845d0cc61234799dd5d47139b689656bd81fba3dc393961af6170971afa356d
TLSH
T179C02B33C831AC30053007D408F08701EB34134FF500B0163730008E0B3C47050207D0
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5084_781028774\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download