hxxps://420-system--dk16071200[.]replit[.]app/

Analysis

user interaction
yes
max time kernel
899s
max time network
907s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/05/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://420-system--dk16071200.replit.app/
Sample260502-pntcmsbs5r

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2464	msedge.exe

Drops file in Windows directory 42 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_2041598232\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1328942162\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_725120797\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_783095662\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_2079199048\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_228323829\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1025223369\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1328942162\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_228323829\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_237861114\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1025223369\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_2079199048\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_237861114\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1084243283\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_779627082\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1025223369\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1182948341\deny_etld1_domains.list	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_2079199048\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_228323829\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_228323829\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_237861114\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_2099173995\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_222362650\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1025223369\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1084243283\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_2041598232\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_2041598232\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_779627082\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_779627082\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_237861114\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1182948341\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1182948341\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_779627082\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1182948341\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_2041598232\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_237861114\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_2099173995\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_725120797\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_783095662\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_237861114\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_2041598232\autofill_bypass_cache_forms.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1724	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134221985564400662"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1653660789-1211287304-2482568781-1000\{289C7F07-9D30-4EE1-B1C9-89D4E6BE3A1B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 3816	2464	msedge.exe	83
PID 2464 wrote to memory of 1724	2464	msedge.exe	84
PID 2464 wrote to memory of 2088	2464	msedge.exe	85
PID 2464 wrote to memory of 2088	2464	msedge.exe	85
PID 2464 wrote to memory of 2088	2464	msedge.exe	85
PID 2464 wrote to memory of 4708	2464	msedge.exe	86
PID 2464 wrote to memory of 4708	2464	msedge.exe	86
PID 2464 wrote to memory of 1608	2464	msedge.exe	87
PID 2464 wrote to memory of 1608	2464	msedge.exe	87
PID 2464 wrote to memory of 1608	2464	msedge.exe	87
PID 2464 wrote to memory of 2152	2464	msedge.exe	88
PID 2464 wrote to memory of 2152	2464	msedge.exe	88
PID 2464 wrote to memory of 2152	2464	msedge.exe	88
PID 2464 wrote to memory of 1088	2464	msedge.exe	90
PID 2464 wrote to memory of 1844	2464	msedge.exe	91
PID 2464 wrote to memory of 1088	2464	msedge.exe	90
PID 2464 wrote to memory of 1088	2464	msedge.exe	90
PID 2464 wrote to memory of 1844	2464	msedge.exe	91
PID 2464 wrote to memory of 1844	2464	msedge.exe	91
PID 2464 wrote to memory of 4704	2464	msedge.exe	94
PID 2464 wrote to memory of 4704	2464	msedge.exe	94
PID 2464 wrote to memory of 652	2464	msedge.exe	96
PID 2464 wrote to memory of 652	2464	msedge.exe	96
PID 2464 wrote to memory of 1040	2464	msedge.exe	97
PID 2464 wrote to memory of 1040	2464	msedge.exe	97
PID 2464 wrote to memory of 4568	2464	msedge.exe	98
PID 2464 wrote to memory of 4568	2464	msedge.exe	98
PID 2464 wrote to memory of 4340	2464	msedge.exe	100
PID 2464 wrote to memory of 4232	2464	msedge.exe	101
PID 2464 wrote to memory of 4232	2464	msedge.exe	101
PID 2464 wrote to memory of 1848	2464	msedge.exe	102
PID 2464 wrote to memory of 1848	2464	msedge.exe	102
PID 2464 wrote to memory of 656	2464	msedge.exe	103
PID 2464 wrote to memory of 4700	2464	msedge.exe	104
PID 2464 wrote to memory of 656	2464	msedge.exe	103
PID 2464 wrote to memory of 4700	2464	msedge.exe	104
PID 2464 wrote to memory of 4436	2464	msedge.exe	105
PID 2464 wrote to memory of 4436	2464	msedge.exe	105
PID 2464 wrote to memory of 3060	2464	msedge.exe	114
PID 2464 wrote to memory of 3060	2464	msedge.exe	114
PID 2464 wrote to memory of 1984	2464	msedge.exe	116
PID 2464 wrote to memory of 1996	2464	msedge.exe	117
PID 2464 wrote to memory of 1868	2464	msedge.exe	118
PID 2464 wrote to memory of 3340	2464	msedge.exe	119
PID 2464 wrote to memory of 3340	2464	msedge.exe	119
PID 2464 wrote to memory of 2764	2464	msedge.exe	122
PID 2464 wrote to memory of 2764	2464	msedge.exe	122
PID 2464 wrote to memory of 1488	2464	msedge.exe	123
PID 2464 wrote to memory of 932	2464	msedge.exe	124
PID 2464 wrote to memory of 932	2464	msedge.exe	124
PID 2464 wrote to memory of 3688	2464	msedge.exe	125
PID 2464 wrote to memory of 3688	2464	msedge.exe	125
PID 2464 wrote to memory of 2972	2464	msedge.exe	126
PID 2464 wrote to memory of 2972	2464	msedge.exe	126
PID 2464 wrote to memory of 4984	2464	msedge.exe	127
PID 2464 wrote to memory of 4984	2464	msedge.exe	127
PID 2464 wrote to memory of 1172	2464	msedge.exe	128
PID 2464 wrote to memory of 1172	2464	msedge.exe	128
PID 2464 wrote to memory of 5068	2464	msedge.exe	129
PID 2464 wrote to memory of 5068	2464	msedge.exe	129
PID 2464 wrote to memory of 1596	2464	msedge.exe	130
PID 2464 wrote to memory of 1596	2464	msedge.exe	130
PID 2464 wrote to memory of 1984	2464	msedge.exe	131
PID 2464 wrote to memory of 1984	2464	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://420-system--dk16071200.replit.app/
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x238,0x7ffab53bc188,0x7ffab53bc194,0x7ffab53bc1a0
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,15395197363362891993,14562024370957960473,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,17363558445216670189,13174240225993756419,262144 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,12869489882891163311,10851666351951186048,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,17121824254996249349,7921330295950203273,2097152 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,11211235859684609151,9633767019936064495,2097152 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,3030553710515619511,9234300097547432633,2097152 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,15713355671027682510,10929515060822073037,2097152 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,3867021130963824368,17923300566438923390,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,12542610908223291359,14520124697127895173,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,11864614121063546994,8355106981292913455,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,3253510767755753186,9083675367051577013,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,18025527052590025982,17637856470613594139,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,18025527052590025982,17637856470613594139,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,6395627767748963036,6863750114298992751,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,10262492549517409641,5638551972994677436,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,17274108819984232191,3806712106613244065,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,696160444688994329,13499722293637501605,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,1188054113426461375,6273615442008804518,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,11170476169649878386,2105181352930943208,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,1875646711312233121,8832385282358280004,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,1934240917130556732,8157522191123884437,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,3887744626366098527,8145475389473537762,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,3481831211107910150,9302500556759389461,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,8272547061271833594,4015749427967732638,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6444,i,6891008057460017273,2946349830088394550,262144 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,14771265811275138300,1770882126605925718,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,9453200668901185679,236875671111790067,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,821945023119937621,2525320675562557153,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,9798582539007590732,4585230587707403223,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,15651226375856489920,17461016216537602017,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,12043048249121211594,14819111035903831874,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,405402668377458920,3650893949671310625,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,5394362232193676404,17794731970594466516,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=1556 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,1712478601724847197,9332706968123693387,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,10848918312582390251,6514111060383903049,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,17781259655604002674,67901103835380567,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,3463595168197927274,1522469517625915743,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,4111411776666158392,10564951486664751865,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,12018880464092694636,16497572558119754658,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,10908585558767761999,365902049252550052,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,17086117477823245343,9759109322478101432,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,12448691243713310937,13975590232052136550,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,13307391982109312073,5992968461308202959,524288 --field-trial-handle=2392,i,820159247746695860,10501135148717660458,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 346ea60a0ae4d17c01949616e7832cf3b359983afcbb7e8912fe8a59321ed461
MD5 203e8ac15dc2fa01607dca121531cbf9
SHA1 6bb9e33e0eaaee142dcc669c175ec6b9508af90e
SHA512 9cbb9572308545c1a11487db03ac7301a81dad98c83fd39ad60fc0ba640dee016818808cbd7f5e840f2b2084982cd60ac725f84529aac2387baa86bafeb505f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68691b469b8cfab2e9457cd239c72560b35d42545d1ff342f6cf8924e5f386eb
MD5 4700e1e05ce5416771df4715ad0256f3
SHA1 5b5896a43e5349fce8db5a1e205373a14c95c271
SHA512 0c012aff078946960bc487d6c51098fee6541ce9aad7e8f05df959e9c4c24eb310bc9258313d6eb0426f426ecc7feed5fbc763746e5d57adbb0b9fd6e8526a4e
TLSH
T1C1D08050BDF02D41D042BDB12834B7D0555DD5D3C9865E650C11E7FB1C231D448D0DD7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c356d773d3464e78316eaa186caa1aafaa87c93e1653383673b0355156440fa0
MD5 2af5888e7b4620aca24a6a23d00033cd
SHA1 a5f2e46a235e132b4f8553458519bf41becceb5c
SHA512 6aba03f73a43a7ee06df6c9f8364158ba1a7d26322813270ddc4477244061cacd0323b9123f2f49c0d518dcd219d6b47292a79ed8e80d5aa54b97bf143398a22
TLSH
T191D0125079F02D41D442BDB12824B7D05559959389869A660811E6BA0C231D44890DD7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 c29b83604f0f44e0a8633ea7bbeacac37b122e6b19e8f2083d0ab464f587cdb6
MD5 0cc462a4e7791a58ec3dee022dbf5049
SHA1 d67b2f2f547b8f0021efcd132e22923154fcf2d0
SHA512 760977a564bbf55d6542c845cf2862e3c6222d0b2f3d4de80710bc72153cc2b4358f5bf34ecfde1a69e967ad6ae7d39e0ccac8a3874be81cee8b7d09020ad417
TLSH
T19EE0D84C5396D9A44546DF8AD35CE33FD2C03427A9CCA6DD3B04F1C85540142596D6AC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 ac3ddb9e84cd511125a6abc77d18e323ce0debda219635f2f3b112638d0e7039
MD5 2e74ede16b1a312d57140eecf46cbda1
SHA1 85e7d1c82a1e6a075fcee6c4b07b56fe5db54300
SHA512 771ba29e9dd44809764d112a7339fb2bc9df92b5c379dae1d7f40cf46d31e205b32e13f23763fa89411668a97328dfbe2200030b3781f0411345c8f06394a45f
SSDEEP 192:Wj2HUaCvNNHu7777ssssJJJBLLLeeedddMMtFGh:Wj2HUaCvNNO7777ssssJJJBLLLeeeddo
TLSH
T190E15C9B83E4C69AAB0510CFCAA4E35D54F13709EBDCD64C038CDDDD308E49BA5A96A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5ae375e1dfb5c3f91a218ac9a9671135a10859cc660508860d4b9e2a4f76f048
MD5 37eddc4374884202bc7016b2ad1aef98
SHA1 703b6eeba534bc4f666a38565f5c68fa2510c055
SHA512 9dc75d96dfe3ad9ec45c0cf02cac8cfe2b92c83448faae800539d76d45fbf8dd63babd9a8d3596570b17fafb50d7f85f3ea2d6a69edc48d179288ce40fffb6ee
TLSH
T1247127447D8E80E5EFE150B8F6CEFA523E76FD3483870E3A15E905BC8A0AB120084877
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588fc8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588fc8.TMP
Size 3KB
SHA256 e3214bcc06b0a39ad05583798aa709a90a71926294e303e5d9599bcd678e54dd
MD5 ba3fbc931ab6466c47e5b3ec33d0eded
SHA1 8ee3486bdf6d855e4cdd3280490000c994b5933f
SHA512 3b3a1ed4c3763ddf0b02759f115adfe471c596b54cd717e012a865130ec24e6e569663a9361abdcf718bfe82ed0b39064cd7d233d257a770747be3901039237d
TLSH
T1FF6127447D8E80E4EFE250B4F6DEFA927E76FD3483870E3A15E905BC490AB120080877
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1a5d703addf0f4963b97f11de9e01cd0956f336b37b2b2067b1894d394ed0c8c
MD5 bef444df6d2a394029a1fc0267b78d29
SHA1 7a886c438dc4e85ac34feca4ee126300e25ad971
SHA512 9929d1781a90fa5a3f957f04cccdaf908096ee89973c1a89113c1ba62806a5919ca9d03ab4f2677455d1e4d388e6616155c3395b19f1374b8f500066b86213b6
TLSH
T1E661ACF3C3E8865DCA5255F0A618FD2BCE1D0964432C3D5A89E49F5B93E2421E252A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6262982669ee63cf286d529d3afda2dd81b8cc745f35bea2cb85b3bd8fe0ea32
MD5 5f7ef8bc23e2363b468f858044607bbd
SHA1 35cfd8830db759caa02d09ce75219bf7105050d1
SHA512 8aed457893c2b9deeb6e597895d24c2c00a9eba59cf9bc3d0d92106b69cf3da7ffeba2a1221ec465f38068c2fcf17bdcc6e94a353f00badb00cb873302f5a682
TLSH
T103519EF783E4865DDA0155F0AA18FD2FCF1C0524436C3D6989E4AF5BA3F2422E152A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3327b01057103d1c4b3456ed33fa6bfb0cebe185e02e8f3b25f64049a614b64b
MD5 521dc10242aeeae84efcfb76f7966102
SHA1 607a022ec1d0ce27affd6eb548e7be2e9ec496c6
SHA512 af0f0ff1de960a9d298498c899e294af5141e5ec0922fd7e92aedd9803127caf07abfae7dfc07d88263551988a4850799983ca3caaf2d100255fa86319d9b62a
TLSH
T13661ADF3C3E8865DCA5255F0A618FD2BCE1D0964432C3D5989E49F5B93E2421E251A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3236bf399f05f932fcbc038038c93a6ee41c27d5e134bd7b188f59e975b8c052
MD5 85e26ce6226b4852d2d6b4c440386be8
SHA1 a170675c56decddf07f7c4132d5f2f8b215fa496
SHA512 c87649b22ad2a7f01b5fb67627c0f2cc5f7dac5efff6e1ebd51ca26dfec32a35ac964342a0d50cc82896ce9bde70d2fc4a437ac18da63156ab121b8dddcfe10e
SSDEEP 192:sxZoREyM//K1Ml8MkE2/f8stwzwqrCNIdpGmHW6+WNl4Ij/Y+fIQ3mHIg4J:sxZoiME2/f8stwzwYRHbh/Yc
TLSH
T192520B11AB386977CCDBD209FA55BF53D6F90472D2941D44A9FCDA0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8e8b2b44adf6f5b8ba87efcf2705d3dbf283505ac3c5f5627f36f57fd5490ee0
MD5 1ddeb534c097683d0d3105074c9ce139
SHA1 8aee9bb71231022644e285908179e8ce8d7800a8
SHA512 9a124dee0a2f423719fb3ea75c49cec8ef3eaaf9c780dff86a3d39f43fd3c37a035e8abbdb4a7d6e5543152d2f5b3144daf00782fef5842303673438a6bc6171
SSDEEP 192:sxZoREyM//K1Ml8UQ4r9E2/f8sqwOFwqrCNIdpkmHW6+WNlyG5XY+fiTmB3HIg59:sxZoiq4ZE2/f8sqwOFwYvHbVXhX3
TLSH
T19862FA12AA386977CCDBD20DF945BF53D6F5047292941E44AAFCDA0C05E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a0d9e89a65eda72e27efbc96cdb6458086c4ba06f2a2717b6f486c7749e46866
MD5 ebc6937181701f310a1752406b71d811
SHA1 4f5948d1b42d4083cb6fe69bd0d68a7bacdfa835
SHA512 a7a6748b6f080f1da61b6f0063c3ed9781561cd38d5789a2225c7ed8a1d7a153b6497443129ce016e899ac3b706eeae6118b77df8f92f968fd96d25e0fbe1ea2
SSDEEP 192:sxZoREyM//K1Ml8M9E2/f8sqwOFwqrCNIdpGmHW6+WNlyG5XY+fiY9mHIg5rJ:sxZoi1E2/f8sqwOFwYRHbVX23
TLSH
T1A052FB11AA386977CCDBD209F645BF53D6F9047292941E44AAFCDB0C05E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 ae4e0b1e15eebb545b8d7506d40cbbb9da7aeaf52f48ada1293148aa9e9c5eb5
MD5 fc6af0ccdc64a25709adf2b733ba6008
SHA1 7dd3c0116acebb9b70fa42d0b89b10a2d5741076
SHA512 c37e2075a25438b8ecdde0c00af4d7b8759573203b1b211c54595d75b73bec938302087a2ddabdcc25230c89719acc4a5219e311d1068ca3fa251a33ec664bf5
SSDEEP 384:sxZo5q4ZE2/f8sqwN66s8qMpRiYnazAW8pZS15posJWeT+2FwYvHbVXhz3:sAgSR/fawN4Mnc7WeT+iwqHbBB
TLSH
T18CD21805A924C877DFC35D18B47D7E3399EC40626284DEDA5AECCA0C01AD5FDAB4782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 efe8244b804e00ddf5eae726b96f701fed93155f6fcafb26ada7d5bdc9b5a7bc
MD5 ed68e30950a5239f65aeaac37a3d3f69
SHA1 aefd9ca3c7aab5f7b7f1d4c5cf857cab91a9591e
SHA512 0ac1e73d13f97f9254bf6d086564667691ea35b98890a35d5c40ed3d8149072dbc2210cf23ff377c51f985a694613e1ef83624e94639cf5d0ad617932708377f
SSDEEP 768:PFwk7VH7pLuLnDnWvDBot8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7mBWLloCbNMroW:PFwk7VBEnDnWvDBotu1jaGmBWLakNXVA
TLSH
T191F20C3B6C0CCB7E4F804E9CDC2ABE9A6DE8018B9698C95447FA844C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\19aca3c8-f6a7-40e6-ae84-9e0d0457c2e5\index-dir\temp-index
Size 2KB
SHA256 38299d01a7cd0cf22b166e088b06582ef8ed3bb7564aa6b4e2b428853a485632
MD5 c605bb79bfad5155dbafb855f34f56aa
SHA1 7d71d8aa8601752bd1eb2bc111c696c0b00029ed
SHA512 7d09ab801831653fc7320b3fc9215d27dde02f3ae2ed931fa335d0d3dda3af7f9488aa0f9341712de486f8c26f140ef696080bafbd63c5e587a764682ecfc5b3
TLSH
T1A551080DDC8E8F17CA7D06B158FA0469337C4CEF1A680A0B65FC423A6C876692D9320C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cd9ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\19aca3c8-f6a7-40e6-ae84-9e0d0457c2e5\index-dir\the-real-index~RFe5cd9ae.TMP
Size 2KB
SHA256 39eba9e1b58411fa11483d7e5b11f98afe2aeefc572599faec6428ad474d6b34
MD5 7634f334c4c93eac9dac2fda03e8897c
SHA1 22851a38a205a297157058e0f2db9c9476c8ddfd
SHA512 84d418e82c934d57d24c61d8d2cae878d69e33113c06b423de652cae4aea8e1a8e3d911153c48bebdf937f7b88df4a1b3d50ca89e5a68914dd2520b58a5162ec
TLSH
T10451D55EAC430A32C9A085B359CA6468333D68958A09BF0B35FC8A33ACC37AD3C56344
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5b535d28574e5e60f1f79e15a1761d649aa8b2711c922fa5c512e7ec3cb7cdf8
MD5 57bfc1b5e21190a15408581f81989303
SHA1 ea51e57f161e07c70b61305f68f07770666ef551
SHA512 3fbaee5206dd4dad2b3e87f73617ad8d2f46be0dd69618dcbe94e2dce75b28e42de1d37154902459f10379e77a6dd75c90d9504f5b1e4600e3008855922cfb17
TLSH
T1C1E0C0FB3DE33814B9AFB3D234315CA44006B880C909FD9F482E91C710F2310281BC22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 45319a46f9a4a62cd9bef32849d3cf40894a5945deadee70af74fcc25957e549
MD5 1c1fb68541f66dbadef87d0fd0f273fd
SHA1 4cc79b42282cbadb299ba889bd211971d8d2491c
SHA512 505b5662b433594df10a8d02e50030c25ee75d9d1abdb97d7fabb1a56129142bdfc8f9a0128b02040e8d2da91950088befa69b4f9b4d8825415537082f444cff
SSDEEP 96:KAh2K6QyGTWKAcyGhCKKEX0V+K0ueJXafE1SJKtA1EJxMEnC+697uKcoj:shRNRbZMm
TLSH
T14AE1589032360280397E268A8495B46E42C63173715DA43B3BF944BA9F77E26DDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5925ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5925ed.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c64f8cfb6cd4f55ddbea907f4da5e027b1e97dec316b2950d526e54326690fd5
MD5 57348beb5c2bc0800a859ab3f87303c8
SHA1 9fa4f2e9d81c2b23eb552b9551dc518e502b11cc
SHA512 a8f8a585a18b18c975a83a82e5592f31184e76ad8febbb4182db2881a617ac4f4345fb7969e3868afcd86504dbc38e501f4e1f8d4adcf86f436bddaa8d6f3270
SSDEEP 384:nQrniFrcXqnRyIsN98TUNTUlIlk4A+TgxUW3sXciDf0fYHOyZjVVeqFvvA:9FzbgwgZJgxoX4fYHOyZjVVeqVA
TLSH
T1E5D2C4F598E78936D9AE4B87A73E6E429EBCC167B5891880F7C40D0CCC825BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 31a72501b1fcce62752211c6d824b067e4eb1264f169d3437368bc851b8bc876
MD5 e8880f3d7c6a0337320dc9d2985677de
SHA1 92e5b37e78f46c9e01b0bdba9fed69f75237d68c
SHA512 27348ebb89eee2345d462bb930fdef3c5b8443ebeabf6f0bb8f671b69dd46a7e97cde142596a9fd122f7c1ec83686fb125ceb39afaf29410719a8b58c90caaf1
SSDEEP 192:/eONg6WlRCaQmiUy3+ReF/CJDEuyHOporZYUQ6U6:WONg6QNXI6tYHOyGUbU6
TLSH
T18602E8386C2C6CB78EF2AE48F98736175FA8113FE5862B44D6E85F1C00D769C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2376afcd41d1adf5bc654e93e6382bf2709226017c0a9207141a24c57630e6e0
MD5 7415b27b53ce489c097b0124e77c2615
SHA1 a6ce098a88d87ecf0220b2698b5edb0db70435b0
SHA512 d3f18f345206771b6b3ed362bb09c74b4e9466d079baf49f1f3834c99b0784a65649448cbcc3aa97fc093668cee71c81cb707e12224740629a57e4fd0e73813d
SSDEEP 384:nccXqn6sNjk4A+TgxUWrXciYHOyZjVeeqFvvA:+6EJgxHXBYHOyZjVeeqVA
TLSH
T1A2829F3558381C764EA6AF49F54B76136FF8517BD58A2E80E6D84F0C04C7ADC238393A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 412c1f8d7c93750c522eaa3d3b213ee0087a374343ee0ab88c5dfba3bd33b504
MD5 cabb3a287eb64d9a2f5098f6480866a9
SHA1 b623dea13e0d950423baf3e304de3562229455cf
SHA512 c49dcf8d16662c8b96d5f72dd23ccdbc206b9ae4a14208dba1b1341f2a5857dbd193297b815017caf32f94091656b400ddb20bf974ab70d3c30f381476061a41
SSDEEP 192:DONm6WlRCEQmiUyH+ReFMJDEuyHOpoZgEVmlLqqmU6:DONm6Q3xIMtYHOyZjVueU6
TLSH
T1411219357C3C6CB79EE2AD45F88B36175FA8107BD5862F81D6E40E1C04D7A9C234792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
MD5 a15cd0a1e68c6b9c3945d3192091dc4a
SHA1 5162188f19a245162594501e5febb31a7626aeb4
SHA512 a7ec103cf7c6fa801e1850205c4c06cadf96c21b1fd56db058a2980c472b1ff2f25c69a73f943de8dff815d69217995ad880e85ca7b8ced8cfa1c506315f7368
TLSH
T18DF0ACD29D7E35C2D5AA0F2ED44B25EC54D89606F49CB57A484CEAD4913940F248287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 46c96e720b20237d9768e9cb90aaa62c9c7b0c8f15fddee836a76d41dfa420cd
MD5 2a769156fb0cdd33783892c7340dd22e
SHA1 4b7d27850b335fc293c0ac5f52ed9cf1604cb52f
SHA512 3bb6cd746bada6a1370fd3186f3c8ded4319de162f80beb35ac87e73d46ede19407f4cb1d05ec658f6072f3e42a5681f64d8b69a136afadbc7534d3074670bac
TLSH
T1801114D25C6E26C2D57E0F6F904B75ED54C8C216F258707A0C58ED94413840E144287F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 692457b7a9a71da2f86a2d9c00ee5e439ede0bfca8d82ca033d6f592dbfa5469
MD5 91c80c5508982eaf5438e9211fb2a52a
SHA1 78c965a36a9f74d71dd94601ae92afdbc93f5f95
SHA512 7bc90c935ea510bef580cd0117ca240de86a2985549ab9e15e6f5b819635d81825fd42e6e9a251214ac4b6e9ec2411d9c4cdedde28bc5552970d614f0053e74f
TLSH
T1251112D25D6D2AC2D1BE0F6FD08779FD40D8C216F2A8707A1854ED54423890E144187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
MD5 0ad641099b286eebf58a290b5bde86c0
SHA1 922d3e17ccc238f1bf276051af3ad5cdffb20397
SHA512 8661612608382058967a1f2ef25c7fbee41a3c2c748838346c044a48058ba081e84750e4a0de424903813499876fa7f69beba345d8ebc396340d830f1a7c81e0
TLSH
T1220110D29D7E26C2C1AA0F6ED08B26EC40C8D106F19CB07A0C8CF9D4823880E188283F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9067b28ebe20c02c9953fff5b0594ef49080bdf69debedc37cf9eb19498d7c06
MD5 cf0a01f870cbb9aac9d73b85b1857124
SHA1 d77260d2898bad8d24895644cc9efee0a6ff8d6f
SHA512 92b9a08b2d05ada857c63e5430a884cf64273a4ebd9ec22a18c088810d22f01eb33c5b8c961a636133117b4b7c6779f5d96e8f65288a6da6f6140efedeca66a0
TLSH
T1932112E1697D2AC1D07E0EAFE08B39EC50D8C216F598747A2C58FD94923D51E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 45a6b06e48cb3eedac93a0d53aa71f535bd43cbf956b7e1b9214bb14d119b498
MD5 56cf56e9cc67243d663cfd4ecf04540b
SHA1 935011aae5347baf139e54939b63eb6948fbff75
SHA512 235e014ae905502afabb9947e1acdccf7d3b547474339930e156b494a4c3adb07cc0f2aa1f66d3a6fc8ba08f59ed38d32f4bc4183a723f8f01ae1f1fddac0617
TLSH
T11B3122E2596D2AC1D07E0DEFA48B39EC90E8C215F59870392858FD94563D51D258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5c220d43256d7b7c14b900fd4eebfd1eca6e209cfec86546e89032558d063e17
MD5 135e5db547c660f2f19466f8970ec0cc
SHA1 1de05a1783641320480abf7c4adf2270ec65353e
SHA512 3b630c74722d06764d15ffb884ed6144aa997a650c9d0fd76b12da2b3a1c24aae619e27fb79efe4f7ae547181b4b870258c3695224611790c9d20c066e7ad77c
TLSH
T1203120E1597D2AC1D07E0DAFA04B39FC84E8C216F5A8703A2858ED98563951E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 33b54581b3cd7004077c0a607bf56966799274b2c161a1665f98c099812af2dd
MD5 453d2d54f662fe69369f3218b6a4bbd4
SHA1 84cf6c3186ea8a253c25645b37c95e691fe92785
SHA512 792dad3f1799878688bff182f210f8e65747d611194a3920ff17d26eabe099c6e2155774fd8371a476ba05c5c04b33d13deacc32ef05e1a70812e03e6f03706f
TLSH
T1442111E26D6E2AC2D0BE0EAFE08739ED50D8C21AF1E8707A1858FD94523D51E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 453a08edb83095062ff59beb4f28403a177007ecdc5b93c88074cf8ae24c9b39
MD5 96814d4ed361ec8de1547566e582b0de
SHA1 f9588e0a74d9790991b254bfb0650af55810f778
SHA512 bebc0e98c4485bde4609e0a92f0a27ac1e621a63e154f220c2b8c3b11bfb2d4cc2443d6274f6046d42e28b28478f719f28917112090b3cb14fb6adab24770b93
TLSH
T12401C2D25D7D36C2D57E0FAED04B75EC54C4C11AF29C71BA0C58E994523890E244283F
MD5 SHA1 SHA512 TLSH

Submit Download

6bcabb86-5368-48fd-a5a0-7207e6a78a76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6bcabb86-5368-48fd-a5a0-7207e6a78a76.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f09f1885-f467-4a74-af47-1cd0260e328d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f09f1885-f467-4a74-af47-1cd0260e328d.tmp
Size 18KB
SHA256 925b77e4e31b2efb4700351fad0aa2d3ef7e3dca6e8764c8062ec02bd0b8be73
MD5 965d9730d5a029ff7642b1915b040b80
SHA1 caf32aa269eec3f68743c6edc48c65baa1ae4422
SHA512 544c18243dbbdc4c51ab083e1ae51794107299d9c8c1b2e017fb3bf92578662e9076dd6de4d87437e8de7b7a9b8de618c1477ac5ac1a686f3bf23ccce69fc641
SSDEEP 384:n1cXqn6sNjkPA+TgxUWrXciYHOyZjVeeqFvvA:J6zJgxHXBYHOyZjVeeqVA
TLSH
T1D9828E3559381C764EA65E49F94B76035FF8517BD58A2E80EAD84F0C04D76DC238393A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 17f3626e9574ccc076c08ef373a3d1774ad8518d0b850f794240e609dba4b3e1
MD5 da9440f0cd5c24e68c52f9345e2a6627
SHA1 adf2ab3b952bc8f2358f2fe1c8539959d10e4b38
SHA512 38f9895c682792e015d2475df8456a48b1268f6e283fbc7fc7ddbd7a8b813570cff25a2717ea20a40b63aa902429f358042bdef1519c01da16a68de2e17fc407
TLSH
T141410A5C7AFA1148B3B76F5A9BF6A96D487F78772A06C04D10110D4E0523B41CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download

3fbb65db-5ac5-4c42-8cd1-007f99e00413.tmp

Path C:\Users\Admin\AppData\Local\Temp\3fbb65db-5ac5-4c42-8cd1-007f99e00413.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2464_249692721\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2464_1025223369\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download