e98668df11978ed3d5aae5ba3ace52423809d426eb1a6a12017f877baadad858

Analysis

max time kernel
397s
max time network
395s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fnwXWS5C.html
Size 2KB
Sample260418-mphanady5w
SHA256 e98668df11978ed3d5aae5ba3ace52423809d426eb1a6a12017f877baadad858
MD5 3598098cc3b86003e5bfbcfa8ab917d9
SHA1 d40bf467432fb3d46008bbf25f30cf1c28d4b374
SHA512 1e7e9c02d82a5c621a7b0707c8c0fbd09832cb88ba23628205d9ab520622834847c7e35956ce34272d9919bbcad17b615d82db4fb2052f673edbede563db4073
TLSH
T1DA416123D50480158661E285F1F9B75C8063978FDB324C51A7F8B1EBA0D7FE1C2B62E9
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1110012385\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-bn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-nb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-pt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-sk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_720823315\edge_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-es.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-it.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-lt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1463573794\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1327150102\us_tv_and_film.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-cs.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-de-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-el.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-uk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-cy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-da.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_983413930\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1463573794\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_983413930\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_983413930\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-ml.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-mr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1516387430\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1901173038\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-bg.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-en-gb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-pa.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-tk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_720823315\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_720823315\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_983413930\v1FieldTypes.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1283499300\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1327150102\female_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1327150102\male_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1327150102\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-as.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-be.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-hr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1283499300\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1110012385\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1327150102\english_wikipedia.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1327150102\model.markov	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-la.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-lv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-sl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_720823315\product_page.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1051704550\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1463573794\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1110012385\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1327150102\test.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-fr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-or.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-ru.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-hy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_720823315\shopping_fre.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_983413930\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1516387430\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-cu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-en-us.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-gu.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3028	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209823168931606"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{E5AF58E6-2273-488E-92A2-93C640A3BCD3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
116	msedge.exe
116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 4140	4288	msedge.exe	85
PID 4288 wrote to memory of 3028	4288	msedge.exe	86
PID 4288 wrote to memory of 5796	4288	msedge.exe	87
PID 4288 wrote to memory of 5796	4288	msedge.exe	87
PID 4288 wrote to memory of 5796	4288	msedge.exe	87
PID 4288 wrote to memory of 5948	4288	msedge.exe	88
PID 4288 wrote to memory of 5948	4288	msedge.exe	88
PID 4288 wrote to memory of 3524	4288	msedge.exe	91
PID 4288 wrote to memory of 2300	4288	msedge.exe	90
PID 4288 wrote to memory of 3524	4288	msedge.exe	91
PID 4288 wrote to memory of 3524	4288	msedge.exe	91
PID 4288 wrote to memory of 2300	4288	msedge.exe	90
PID 4288 wrote to memory of 2300	4288	msedge.exe	90
PID 4288 wrote to memory of 2416	4288	msedge.exe	93
PID 4288 wrote to memory of 2592	4288	msedge.exe	94
PID 4288 wrote to memory of 2416	4288	msedge.exe	93
PID 4288 wrote to memory of 2592	4288	msedge.exe	94
PID 4288 wrote to memory of 3644	4288	msedge.exe	96
PID 4288 wrote to memory of 3780	4288	msedge.exe	108
PID 4288 wrote to memory of 4868	4288	msedge.exe	109
PID 4288 wrote to memory of 2384	4288	msedge.exe	110
PID 4288 wrote to memory of 3856	4288	msedge.exe	111
PID 4288 wrote to memory of 3856	4288	msedge.exe	111
PID 4288 wrote to memory of 3920	4288	msedge.exe	113
PID 4288 wrote to memory of 3920	4288	msedge.exe	113
PID 4288 wrote to memory of 2976	4288	msedge.exe	114
PID 4288 wrote to memory of 2976	4288	msedge.exe	114
PID 4288 wrote to memory of 116	4288	msedge.exe	116
PID 4288 wrote to memory of 2852	4288	msedge.exe	117
PID 4288 wrote to memory of 2852	4288	msedge.exe	117
PID 4288 wrote to memory of 3000	4288	msedge.exe	118
PID 4288 wrote to memory of 3000	4288	msedge.exe	118
PID 4288 wrote to memory of 2840	4288	msedge.exe	119
PID 4288 wrote to memory of 2840	4288	msedge.exe	119
PID 4288 wrote to memory of 4500	4288	msedge.exe	120
PID 4288 wrote to memory of 4500	4288	msedge.exe	120
PID 4288 wrote to memory of 892	4288	msedge.exe	121
PID 4288 wrote to memory of 892	4288	msedge.exe	121
PID 4288 wrote to memory of 3824	4288	msedge.exe	122
PID 4288 wrote to memory of 3824	4288	msedge.exe	122
PID 4288 wrote to memory of 2168	4288	msedge.exe	123
PID 4288 wrote to memory of 2168	4288	msedge.exe	123
PID 4288 wrote to memory of 4928	4288	msedge.exe	124
PID 4288 wrote to memory of 4928	4288	msedge.exe	124
PID 4288 wrote to memory of 4400	4288	msedge.exe	125
PID 4288 wrote to memory of 4400	4288	msedge.exe	125
PID 4288 wrote to memory of 5540	4288	msedge.exe	126
PID 4288 wrote to memory of 5540	4288	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\fnwXWS5C.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffd8e50c188,0x7ffd8e50c194,0x7ffd8e50c1a0
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1720,i,11654049381450238371,6854968153085929245,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,8919424306270775503,5815840558805661259,262144 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,2352668479801632102,5061754156927129008,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,15100044740905239401,2930611835485109874,2097152 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,7319418445502091096,6542537518574930554,2097152 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,11966985097663735066,8760906714345215380,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,3504004709770552276,16989982267201814709,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,13482007079246865726,15931141257477668068,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,13482007079246865726,15931141257477668068,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,602802834997023784,10919612446472834454,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,15883680708862269942,1053736825816820089,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,12504803984523106657,1071470305440708660,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1012,i,7347929404654155039,6726790357675269124,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,10160791269256326566,4264152936756845948,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,2238028607937871937,9482117714490731515,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5716,i,13010444833433308060,14371329298192728361,262144 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,10596713369909417993,7446473137952031707,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,4549129507774432104,14339242282235237275,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,3623107972559716452,17510223806852272831,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,13215468263123084131,10414322963051139493,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4012,i,14030487744765094110,15842584386876957081,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,15977775536912806267,11620988109996151109,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,14359679277136379651,7773366021704897511,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,13481835871734159236,7320390276946295092,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3372,i,9598761924053324229,1718128699368295492,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,7214268702890779783,5863859721507258542,524288 --field-trial-handle=2268,i,5532901281220835990,4528290473244080050,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:5540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1051704550\manifest.json
Size 118B
SHA256 69e4e1c13d13f15e8066d6d7e984a96a08d3b2a2ae33fbb218b1e0de5b8d1aed
MD5 4687681b420a5c580fe40870ed6af32c
SHA1 1aa40f91b2ed8c5ea38cb30b81c87a9ac7e21e6f
SHA512 5ced299552785894df9aa86f0cb5d9c057cf73753f81112ef91a8b8dbc6147913e39c27b6327613bc41c447ed230fbbc74881db79853d38e365685132e618762
TLSH
T170B092B00C1AA43B22C09320ECA0668683F84218E8421B1A098036481F882B880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1110012385\manifest.json
Size 102B
SHA256 0b11bc370854bd2e625deb04fdfc53ba444e4af63ba831f9de785b44464b59b9
MD5 271bc950e4220b8345b16f5906fb1c9b
SHA1 8b35e3d7ac8aae625e65f3b37d7362b1d2e958d2
SHA512 43412498abc311473210735232214d8272a4e637cd5c1cc234e79f2636f1a3c7260c6c9e6035efca68dc30c6c3f50de479fff69f527b773b17548dfff9cd0107
TLSH
T180B01224EC10F8B3040503BC086CC3D063272F032C4079180DE19F84E80DDDBE071528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1283499300\manifest.json
Size 52B
SHA256 36565d2ebd6c48537cb3e6fe24ac74ca68dda18b3f0f8be13f47d01aec181d62
MD5 152537f005b8875f68b1af4ac41c46f1
SHA1 70f529940adc1404721cbc1542c65eee289216ff
SHA512 bfcf5e9523b9268e1b0a546b5786498b1decc624ab1ba4fdd89e2e92edacd20800d731fef37c98aef45c64268d267b97d09f78124167685dd152bacd620dc9d0
TLSH
T1D0900260053491171AC10E546570F8859391661955850D1D0545154806A546CE051298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1327150102\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1463573794\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1463573794\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1516387430\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1901173038\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_300764891\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_720823315\edge_checkout_page_validator.js
Size 990KB
SHA256 217a62797b59bdfc667227a422876ccd0f782b2ea41d33fc93c36a6a0db35b09
MD5 80cc733f42616192c044a04fc5abcf81
SHA1 1bf191a0a41ffbe64d3d92c4100421282edb02bb
SHA512 8b521e98dbb71462a19e6c783aaf62dca949befa830bacff12d0c13b3edc38e676b8cc70cd5af98dcd06fb50191747e37cde6e0779bc27515d65751af1487b42
SSDEEP 24576:cs4emRApsqvGzkJUAKjKQmwzErmdJt3LPafik0BwrpiU8LRKLRzMEiJsfaGx1huq:cs4emRAqqvGzkJUAKjKQmwzErmdJt3LC
TLSH
T128253C84E1E2253466D74CB960B7D2C4B9DC04583399F1E4FA6C588ADB0FD4723F6A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_720823315\manifest.json
Size 146B
SHA256 d864d826358b5a17c17818c4beb06143f6059377079f0a576764e29f92635145
MD5 154bf0b4087ebebf71107f7c67bdf6aa
SHA1 85886e83753ef9a232bc6a85ecdd90daef3ccb07
SHA512 a388593c464894b76fa730bca7fd4f27246883174f12ef4d53648efccbe9fed6d570ff6217106618cbdd2a35ca9ef260301bc476abf18213a29e973b5e6837d7
TLSH
T1BCC09B73C931AC7115750BD849F59B45EB74574BF511B0563B34018D0B3D5B550607D1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4288_983413930\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

074914c0-8b3d-49b3-9256-c7c4519d6afd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\074914c0-8b3d-49b3-9256-c7c4519d6afd.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

81d0d7a3-aa39-4878-8efb-a15e385985ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\81d0d7a3-aa39-4878-8efb-a15e385985ac.tmp
Size 35KB
SHA256 28681541abb4509f8eac09ca7c29740baecdc2707c30c4220e95628636af5f18
MD5 516c73e388535eec7f3f8565f6dcb465
SHA1 d6dcaf94f84586f1df65ec78841e76cf6f5e15af
SHA512 1dbeffe34258dc0df3290b5ebf06abf2278f8b1653830b5eb2ccc72405da544bcd3245560c16032415fc24298cc24dd48bc4301b2204e02fdf6e3ea3c28bee58
SSDEEP 768:DcgLiAo7pLuL/aeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjMKJLlhzCpUroI:DcgLiAUE/aeWvaShqu1jaaMKJLDOp/I
TLSH
T15AF20C3B2C0CCB7E4F844E9CDC2ABE8E6DE8028B9698895447FA445C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 80057da7368d65e6cb16a47a859e05201765c8ed96b9019700800f9c169ac243
MD5 c0a6de181236ce98a4f33dc4fd6fe7f0
SHA1 72b199bd3f6491741f0a0142eba5bb99e14387c0
SHA512 1579c9a44e4151ededfe0b0efd9ce30db3aee737cb915d3dd489a2c952521425f0edd5e53990f23930fa64122f454bd725354f26e3d2d914130ac6e0a7c88388
TLSH
T15EE0DF19A788C5F802C3B75B907DA214C0902A0BEBBCFEF9328460AB3403E08621B4F0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 385B
SHA256 ce2e2cdf4d92800a953174a75192f1aaa8ddf06d6d1acf16e84687dcbcdb67dd
MD5 6a3e1c9dfa0ab775efb048de37315463
SHA1 504d02b6432cba16bd54fb5254f8044ccff655b6
SHA512 d2480dd306db081433f76b996fc549ef254d85e8cc1d9f140225ab8b9360ab44892ee6c4a0362f531bdfab12ffe96a0aef63d0d430135a843d0a72d305a4b1b8
TLSH
T1AAE092AEFEACAB8DD3E4597E97B6B0410B8903A2D80F5B1308347DC035D6AF01E35424
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0938bfa5223e556db8a038c64a4deacca4c479533dc1775630750f58526a94ca
MD5 ee65d3fc4bafe193091124afb48eaca8
SHA1 8917c11d4fa571ceb3fe3a49ad6f8e5a10149cac
SHA512 f74a5d3c68e703cc6f020a327499dc6d09f6d9387e3691c2cc06fe31407622a56165600eb3b813a3cc000e2bfa4ed3d273d72ee65582214cbc58c7a3b4ac15f5
TLSH
T1F9E02BA6C862AC2B08FD172950600742EB5413572BC1898B3E3C930C8FB5937458AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 538a13fd9ddeecfc938e1c45aeb3bea90557c8b311c021835b470ea048a27d57
MD5 cd8822e7a8a12fb51ebabf746f3f9207
SHA1 aa8f7348dff2b39917ca93535ab0170c8f24cc2d
SHA512 6922d1a1f862d91ff6151040a5206c7d02d98aebbd9f9df235610203e2cc5cbc2550c86dbcea63e3d150a70b6957e8428893785364196135202f6f0d6dc33256
TLSH
T11B31C0F783E4856E8A1196F0AA18BE2BCE1D0510432C7D9A89E4EF1BD3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1ef9bd79305f4da2e5ad4adf77310fcdceb19a926133820cb999eab0b2e9d25d
MD5 cd0506b46169c2afd79e1d630b2a8589
SHA1 c19c915e4a23ad7006b9887e12252eee25cba216
SHA512 88e25dd327e6a07fc80d3662131e361fa18042cb1a7214cd95bb255cafdb2ea47e422c5a4f009b835f1dbbd2d029039299b82230b8661466626edfd2f6ad103a
TLSH
T14E31FEF3C3E8856D8A0185F0AA187E2BCE6D0550932C3D9AC5E49E1B93E2474D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 573c100b2faf6542b44483d0a158449ba97f0173ca06502b16bbeeb96de807a7
MD5 98d18a863be5171e710aeb351cfae942
SHA1 570366562e989aa0d4c88f2f961f5ebc43fb3681
SHA512 56c20279f7e951b752f96b24eaf6c92baa200b1479158646fb77c0607adb3286fd180a1a59f4666f869cb2c885e1492374cd90b7e48aaea223e170aadfa8c388
TLSH
T1E9418DF7C3E8856E8A1196F0AA187E2BCE2D0514432C7D9A89E4EF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 5da4662693cbf3f587ea95772eefde23add87517e93d18c5900c6d9ec3f62c3a
MD5 1f0760fa5d14f75beee9f55cb1ec39c7
SHA1 e780dfa5576c4c2c022eb55cd99cccefa518b259
SHA512 45a8a56ff1c8679791b79cc4da31cc642433ddf40f0c831e8ea9c4f663a46736e6788d824deb9fe15d97af7b8b03b9fa8d9772b8332b05cf4d2cdc353c4c5a02
SSDEEP 192:sxZKRvyMqZ/K1Ml8UQtka/f+s+x20atrqrjzNzodpH+HW6+WNGYKAaZmnPolEIgG:sxZKUqGa/f+s+x208riGeHbGfmQlo7i
TLSH
T12872F8166A389977CCDBD219FA557B93DBF8013391905E44AAFC8A0C04E7ADD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 92540b365a39acd08cb25525c4816fe6e8e08f8c0697a3eae11882e541d87605
MD5 8e47ed726636f5ef741c956a4744e282
SHA1 afc998427d5e8c574535e07ff06c15a0a4e36eae
SHA512 fc29538dc7222b5c6ea378a8e3fc94bf545bb5fa85449fae69c54a6ce069a3c9d2c503ed0d2520c1dd032b6bd1a13a6c5b7fdc3d8ed1cb82bcf29ab9941336d3
SSDEEP 192:sxZKRvyMqZ/K1Ml8Mka/f+swx23atrqrjzNzodpH+HW6+WNGYKma1mnPolEIgjaJ:sxZKUMa/f+swx238riGeHbGJmQlojW
TLSH
T15862F8156A38997BCCDBD209FA557B93DBF9152391804E44AAFC8A0C04E7ADD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 f68693994aa17c5069c8310d33bff2651c687f4a90c640b8f841989cd943ab40
MD5 6b6c74ad3088ab3b5f5bcbada0235b52
SHA1 c770dd2fee4ed01c515026ae0cdd9bb07ab0b9c5
SHA512 39e17bf6b9dd5a9e0fa0e4c10a158de6f403774112d2c07ed2cfed097ba492b70b6c0eda3a9e7c5be020d0d00468c32ae90810dad9756d06772ff88955dad516
TLSH
T169F0DC773FE70814FCFFC7D2247140A900007D198554ED8F14266A87A4F03142059C72
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c6e5d03a52457f2cdf02868074b2f0c78be4bf4749b47dbd3258ceaca7f4be5e
MD5 95d76e369e21c0e4f7d924f8ba2d7b2c
SHA1 16892d893db96a2d133dca13349c21dca36231dd
SHA512 1fea60b98b166914dcda5000cf59ff9ebf9b7362a34e6a162841df024b919054a4391fc83e2191c892cb1e22e4000f5571ee00f421d026158252907b43dd012e
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BF/Fw:krN/INhx+kcxKBzxFdw
TLSH
T1E1B24B11727A02C13A7E398A8595B42F66C2306371D8B53B7BB914A60F6BE20DDFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.4\data.txt
Size 145KB
SHA256 7dd75cb36b4cc7c5f2df67bac823b9d9d2c3653172ff73ce6cccd39683970a08
MD5 79f8327a9cd094a4edb1fd159e289e95
SHA1 4d3615906d16d8a807e1bd394bef139507ce12ff
SHA512 9ab212871ccbe15c062da9898a782d75d208a2591b4c804df3e32581751801889f8cad8fae53dc0307cb89172c4536d35e44c06d63df6928ec4c4446a55a1343
SSDEEP 3072:tPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEEY6lCuZY:9X1aI5aZoKzMJ07NtxoY
TLSH
T1C7E3F110CDC51FA8CEAC362C60FE0F1A63D1C69D4867A5C9DB63FD0A6F97A0492275C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 373528209909bdb4f86d35169989b5dd8cc4a7b4bbe9f83ecdb158b87e473390
MD5 ec40cd8198ba02e678b6b0a782fe7f5a
SHA1 79281fbbc8f7c909153c9c372bf24839df32fbe3
SHA512 759543d568f3c10cc08fd70aa37b5862711803c3006f02df5032dffcbf9e1e48f769d720387d3182e9e9b73d20471654a021b2ff326d645cb1c5bf8d2bd9b090
SSDEEP 384:nriFJjccCs+Bt0S3+3sNk8TUNTUlI4TZTPkNiOwfjYRvXm8FhzgBy1SBFfz+rN1b:GFJccQe31wgcAmYJXtbiy1SXOT3
TLSH
T17FC23B32D8A4DEBBEDF78ED5A75A7A43DFE001A786885AD4D9C85E1D00871DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6f33b09acb68895f511f657a28aecf5289562b2a7e49903ee7f71dafc00bbfc6
MD5 ce9c23432e7881c52e10e002b23350a3
SHA1 770467cd790d5edfc39dda3020b08f8bba22d852
SHA512 7c97f8f9cae6139b4bd0434b16a6f29858f17cb875517b38b7df8ba7da32b29adb7e37a1cabfe9e91cc4cdd46cf68445827d3f56cbfc6b9f089c0fb714721049
SSDEEP 384:nJiFavqMg3sNA8TUNTUlIm2ZTPENz6OwfjYRvXm8Fhs0SQRYV/Vw1mRS7iOrN1ku:gFayv3FwgHQuYJXtbsERYk1mg7ff
TLSH
T101C24B35E864DEABEDE65FC5EB4A7A03EEE001ABC58846D4D6D81E1D00D71DE130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6ed100a111780da4c6c460a0b05ce5f8b50b8c4b5822380d675b8db422555441
MD5 7fcba8267d2e3c32d703b055bf89f4f1
SHA1 b2f734c8cd22b6c7763dbd97b6b59a5b474a4e8c
SHA512 8fe879fcadbd790dd9ee4de5b31faa50c14eb742f94b339a2136006f0eeba0c5747d8f8cea670dfc7570770558fd930d557ba3efacaa5be3133897dec4720f10
SSDEEP 384:nsiFJjccCs+Bt0S3+3sNk8TUNTUlI4TZTPkNiOwfjYRvXm8FhzgBy1SBFfz+rN1b:XFJccQe31wgcAmYJXtbiy1SXOT3
TLSH
T1B4C24B32D8A4DEBBEDF78ED5A75A7A43DFE0019786885AD4D9C85E1D00871DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ed5a80a84fa0eec07fb7b7fb28930ca07abf966e56657b578314bc9207debc47
MD5 e3f4161e474f49a90add17971575c945
SHA1 aa215c8873997f5bf29c7f2533146e4dea950cba
SHA512 8d643028f68daea695b9ceb8cd825f70899187933165c6873f1bfc55a5b64e5edcceb6b0da12e98923d023f167b372f9b774f8b6dedc4a65292694d2f80bbe6e
SSDEEP 384:nsiFavqMy3sNk8TUNTUlI4zZTPONiOwfjYRvXm8FhzgBy1BSrN1k+5vI+f:XFay531wg2mmYJXtbiy1Bub
TLSH
T19AC23B31E8A4DAABEDF79FC6F70A7A43DEE0019785884AD4DAD81E0D00971DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e0f806af4b3cf9762ddbc70e293a3586da45a26990d79e599cf04f1497c02b91
MD5 8db71a45ca37a46b4f484760bd92b4ce
SHA1 d2802f724bbce763dc8b8c41d12a6ea2433502e2
SHA512 00be431a53fc6b95f964de363aae949fd1eee2993e21c9d4d19c6edd3f3e56679979af34b099f8f98ae106ee0237b13ecd6ce758c7c53dcd30d94cd066e906d1
SSDEEP 384:nuiFavqMg3sNI8TUNTUlIm2ZTPGGTOwfjYRvXm8FhzgBl1RYV/Vw1mRS7iOrN1ku:FFayv3FwgHpZYJXtbil1RYk1mg7ff
TLSH
T1F1C25B32E864DDABEDE68FD5E70A7A43DEE041A7C58C49D4DAD81E1D00971DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2ad100bc932caa35031b5821ee32799a0bc4744f183a20507cacdb615a602ce1
MD5 1a8d138edc6cacd8ff897b29183decde
SHA1 292e57b2e7ee3191abfd1ba5983e9ed682ceda5f
SHA512 4279ce3087eebde9a4dfa1328bb189dedd6d2fad32e962396f163f1e89bea7db594ef9dcaca2a85fb28ffccc47a9a8c918d0a1b80eec9fd488947d3b3949596e
SSDEEP 384:nuiFJjccCs+Bt0S3O63sNk8TUNTUlI4TZTPkNil3EfaY+4SfRvXm8FhzgBG1SBFu:FFJccQ931wgcAsY+VJXtbiG1SXOT3
TLSH
T150D24A32D894DEBBEDF78ED6B61A7A43DEF0019796885AD4DAC81E0D04871DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\29.0.0.0\crs.pb
Size 251KB
SHA256 576d77d3085ff9156298e60dee868364cabab7911edf6f9a4d3ad5f351d5059f
MD5 3ef7a7be0ecfef355a5d5d6e77ebddfd
SHA1 5c6e47340a710019b97b1fd58624f714420b79f1
SHA512 812f5a4e1f572b7a012add71bc210281fd362f48ba5a863b2e5a7d7b6405dd08632dc39ce650a0d032f926d1e41acd8f1c84d5b60552ad9ac98ad6d2abb7f265
SSDEEP 6144:q6ik4li77VpRldVW+J2i/P66k8LyST+uUX:q6XnVpRN2GZQz
TLSH
T13C44AE9A0F3C3E11BFD2DEA466C8D9377D79B3E066A928172111C4E169927F07D8C42E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\29.0.0.0\ct_config.pb
Size 16KB
SHA256 dfc86083d2fa2463f12d1d096db6084c860cb8bfddc3d2cf8e818f65353241d6
MD5 85f3a17e7255717d8e9508b8081fd5fb
SHA1 9e24a4cfc81bb9f5fef0a4b69c5e6060930a076c
SHA512 5869837a49799d06e81d7406999b4d297eb6f759c556366e39a29b383a0f0ebfb1d15ada95c34c131dbc225ed1abeb695b08fd1c77e28d2ef5564d46ee9019f2
SSDEEP 384:BtomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:Bl5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T10172C8BFA1169F000383E558D6E157AAA12363DACCF3763DB1E1C005F5423E6A1A967B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\29.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 9314218dc6642ea1980d504ec45e23aa2b4e7775ef13f7c7121271dbd60b1df4
MD5 eb5319aebea02b8c51c77a2a2b981614
SHA1 64b3fed053dcd2c33c3eed422d8e4ac7eec5d77d
SHA512 f56990428a679d56bdb9d7957ede9d6365d585f0c74f548b1fce439e835580210628a21a7704aea53e1f2bc75de6c845100a5c7801f0b03e9299671f539b5c0f
SSDEEP 96:Jxk+yBjecaikDBwrBnzowGbMAy5z5tBT6c5MUfFwnIXq6g/8yy:A1IDCrBngQ5jlMUfFwnIl3/
TLSH
T1502204B37904F99390E7E0BE1041F59AE933436540ADF98A528C4A7635F1F0729BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.4.17.1\typosquatting_list.pb
Size 1.6MB
SHA256 805d8d74e6a3b6b2fe689e200868d7fa4781089d5f6fc830487ed1b5a9017049
MD5 acc4a11e2e7ba213daa0f5e73300f694
SHA1 979463888ec0a9931499a9b1bf6cdedd9bee0872
SHA512 cd81ae9130a4df9ff95932ab57a6f8410aaf6fc0df0979f0d54c2d8332f0c15dc860d0e59d3d6b32e2b14c47a89179c79f935f75498634fe7cb904f3374db907
SSDEEP 12288:1Po6kw86Bm53N/m9hb0dleifKXYXHX0Wi5QIQ6E7JOPo1oQSc9paunY:1PZq9+9hbHifKXYXHX0WwQIw7VSj
TLSH
T1C985B5F9DFC00194DAB8112D20BE71D8081412A540E5EFEAFE7C855F2BC6AC977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 991b9f93117701e57e14915af3d800c21ab5c8b22bca75c0cf6c3657bc746cad
MD5 9f84164a2f788947be2197708128730a
SHA1 b650f3952145efef5b953a44e6b3c7e7f063864a
SHA512 d92709570bec91940d799ebc02c78fc35c206bad0a7f326c2a454134c386b049c0d5b051acfc7b5a415abd4f458b614d260e89aa993b6353e648b3461783c655
TLSH
T19E4162E15C3D1AD1D0BE0A6FA04B38FC84C8D32AF168347D6868EE984B3E94D240143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 85e5ee5dd4dd577e465a4f4f0c077955b35905f43d3352ccfc096071a6b13884
MD5 de3a575c97e6f8d603235e2ef3b60a3e
SHA1 a4a22b8ce5a615e613617aae145b3ef9ffc83b11
SHA512 f7a06462bf7fcfa2d58f9c3b430a3c1aae7033fb1a5c94f650a2eaf456e62ab0044be75f09dfc81903d5e21fb5193a82d7cc6d08a2537689a8ccaf41373d1473
TLSH
T127415EE05C3C66D1E1BD0E6FB08B78FCC1D8C626F564357D6828EA980A3A60E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 551b5d45674e685ce42bfad9fff59c2b88013f6b55f022edbc16b0f3c5331515
MD5 dfadd3bbcae128d4205fcb6c178f3aaf
SHA1 005be079c2cf9d7cc57b17192391298786f0cd6e
SHA512 ccca0bb1a5dda3e846892598fcdd5961f95b6b76e8677699fb846d206cef5b8a3a9e3dad59b6d18bcf83adc115474e843a457865545a24a5e42003b77e227ce1
TLSH
T15F4120E1983D2AE1D4BD0E6EA04B78FC84D8D326F178747D6868EE98463A95E640143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d4d3d367dbed92af02a9e922ff69c96f99ab9e97faf22c0c87626cbed108aa29
MD5 46827a1af8036ffe4592dca134cc6a7c
SHA1 fbbc69c584eedda43d64fb1acb1475265acfc1eb
SHA512 7c55a965e5d045447e40031c86e59d5f28d6eddabab63758427a789caea0398a3ad28171b0718c4481abd574eb37f124010a74a4623cb91c0df1912a57eaad33
TLSH
T173412EE05C3D2AD1E0BE0AAFB04B38FC84D8D726F568747D6858EA98473A54E254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 db0431de74eb75e1a4f0980c01068e0ea4123d8c63938e970a12213e99bee9ff
MD5 61ac6000bd27c8afc8995500c980f1ce
SHA1 3959c33af89f48aebecc62dffea0ce047aa7a349
SHA512 ec7f77f03c2b8f2a4788461fd4e0c0ce6d0aa8d10487ef595fd3e774505a108e219a6c1827af91cf88e8265c3572a4594ac543024c348494c4654346996c4839
TLSH
T11C4140E05C3D2AE0E0BE096FB04B38FC84DCD226F568757D6868EEA8463A50E644143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3ed6f50540d6c45dc80f62c6377bf82022a2843cd3529f8e99d5fb2238cf73b4
MD5 1616d8ff48e6198516653f55b8eb4efd
SHA1 74918a6713f33d78a577606ca3a481f45a36919c
SHA512 fefe9a1553040ace88106048301a5aca587886782f840a84a016b3dfc4ec612b2542873c7b66d09d9ffd3e9a6e8a76beac887c240384328da1574961a4ca995e
TLSH
T1BB4162E09C3D2AD1E1BE0E6FB05B38FC81C8D626F564757D6858ED68063A50E644143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bed8294fd8d756477bca30acb655cc1964302d3e9e3f25432244efc281dbb290
MD5 07001f5a331642825d9854a063f99b75
SHA1 eb6ac88eb22f000fa25c6d4f421c318d0ef27428
SHA512 3b8f9727eca2441ba6130d1fe2d79e10e3aee7da773dcc752ca50a9927ad6c9bf7f7d87ce76cf0ad2eb56d9d5c98be76eb6bf74f02f96ff1028271837e3fcb29
TLSH
T12D4161E05C3C66D1E1BD0E6FB09B38FC81CCD626F564747D6868EE98063A50E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0cf814074c5b5359159901ca2e2497ea5693bce173ab918f7b7cb80257593e83
MD5 ab2b55d1cd38d850c925c0bb244426cf
SHA1 b542e8bda219f46675bcab99042215040f202602
SHA512 8d83f5982d5f1238b3bef5b6680c46afdba0117bfe620da22aab458d7d6c9d92ba6eed1c61bfd05cd482766e258f17465437c766f25156bbf789f87027c7dc75
TLSH
T10C4142E05C3C26D1E1BE09AFB04B78FC84DCD226F568717D2858EEA8463A50E654147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7ebd878933a10d1729f9abe55956c1ba000f2464e514b7ecff3f37ee4d90b45e
MD5 16e61528b60663d770f0c8729dcbb250
SHA1 4b9c55b915a83635596c5f04438714cbff9888e4
SHA512 6f35f562e0d3f8d82f98cce2483a2cc6a5c561ac3149cb00cbc01e863cf7edd1e086a7449e410d542612a6879b5bf1adc12012337ed59cda51abc855f3c91878
TLSH
T1B04161E09C3C26D1E0BD0DAFB04B38FC81C8D626F168717D6858EDA8063A50E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5f01080b8f383937ae5a85edcfd205ac0bb4d0e044b5b1a5ce0182117bdf6162
MD5 add7cc0a0493099c9a394046503457dd
SHA1 2d7b01d3730664715088395b76e115e07299ec97
SHA512 b332b08c499a9019fa6e40cf223c16115e7eac84647eef88ca93ecbd2e22b107c658faa53ac800c217b78417cb80e6f9a06422a7bc400fbd6e2f1c97996b825d
TLSH
T1AC413B58B6EA114CB3B76F5A9BF2786D447ABC731E06D49E10010D4F0722A40C9A1733
MD5 SHA1 SHA512 TLSH

Submit Download