b099a9174f670c46d0b98f8cdf5350bc3adb7c6d9db8fb3be79a3239f7f3c077

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
03/05/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Project-ALM.exe
Size 8.3MB
Sample260503-rf7leaet8p
SHA256 b099a9174f670c46d0b98f8cdf5350bc3adb7c6d9db8fb3be79a3239f7f3c077
MD5 f9e3242a1ebe2934ea49edd4559f022c
SHA1 ca141be4eb07d159e791b26b783a1ad35804b6cc
SHA512 b68309cc1ad7f412013d29c8efdeb3bf747da763dff1b76d1e2e6c8a47c2bf09ebd8adb49fa71ef73bed4c9f32db36757323f456f63276081e965a5f2c22e4cd
SSDEEP 196608:CxppppSsnppppRpk4Ac+M4nXmVMq2n11/6oju77WOpfNMW8WOK/4zBTNSc1EHd1Z:CzgZc+3nX+WSYEHm1UzkSe74Y
TLSH
T1D996AEF13809F4DAF13E427B8885FCB196193D526A00E46AF1EDBB4E97F63401715B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
13	raw.githubusercontent.com
70	raw.githubusercontent.com
71	raw.githubusercontent.com
77	raw.githubusercontent.com
210	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_2146631706\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\ro\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\en_US\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_1147905155\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_2146631706\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_1147905155\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_1147905155\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_486862780\_locales\sq\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1468	msedge.exe
1424	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222909881926230"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-262299150-3324607021-1566776428-1000\{B372E057-C016-46EC-B045-291182378FE2}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-262299150-3324607021-1566776428-1000\{6A3DC382-C853-4288-B84C-0D96F5AB08BD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3716	Project-ALM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 4788	3716	Project-ALM.exe	83
PID 4788 wrote to memory of 1200	4788	msedge.exe	84
PID 4788 wrote to memory of 1468	4788	msedge.exe	85
PID 4788 wrote to memory of 3656	4788	msedge.exe	86
PID 4788 wrote to memory of 3656	4788	msedge.exe	86
PID 4788 wrote to memory of 3656	4788	msedge.exe	86
PID 4788 wrote to memory of 1092	4788	msedge.exe	87
PID 4788 wrote to memory of 1092	4788	msedge.exe	87
PID 4788 wrote to memory of 3376	4788	msedge.exe	89
PID 4788 wrote to memory of 3376	4788	msedge.exe	89
PID 4788 wrote to memory of 3376	4788	msedge.exe	89
PID 4788 wrote to memory of 2980	4788	msedge.exe	90
PID 4788 wrote to memory of 2980	4788	msedge.exe	90
PID 4788 wrote to memory of 2980	4788	msedge.exe	90
PID 4788 wrote to memory of 3512	4788	msedge.exe	93
PID 4788 wrote to memory of 3512	4788	msedge.exe	93
PID 4788 wrote to memory of 3512	4788	msedge.exe	93
PID 4788 wrote to memory of 736	4788	msedge.exe	94
PID 4788 wrote to memory of 736	4788	msedge.exe	94
PID 4788 wrote to memory of 736	4788	msedge.exe	94
PID 4788 wrote to memory of 5724	4788	msedge.exe	95
PID 4788 wrote to memory of 5724	4788	msedge.exe	95
PID 4788 wrote to memory of 5724	4788	msedge.exe	95
PID 4788 wrote to memory of 5632	4788	msedge.exe	96
PID 4788 wrote to memory of 5632	4788	msedge.exe	96
PID 4788 wrote to memory of 5824	4788	msedge.exe	97
PID 4788 wrote to memory of 5824	4788	msedge.exe	97
PID 4788 wrote to memory of 2704	4788	msedge.exe	99
PID 4788 wrote to memory of 1028	4788	msedge.exe	108
PID 4788 wrote to memory of 1028	4788	msedge.exe	108
PID 4788 wrote to memory of 1028	4788	msedge.exe	108
PID 4788 wrote to memory of 1000	4788	msedge.exe	109
PID 4788 wrote to memory of 1000	4788	msedge.exe	109
PID 4788 wrote to memory of 1000	4788	msedge.exe	109
PID 4788 wrote to memory of 2812	4788	msedge.exe	111
PID 4788 wrote to memory of 2812	4788	msedge.exe	111
PID 4788 wrote to memory of 2812	4788	msedge.exe	111
PID 4788 wrote to memory of 4668	4788	msedge.exe	113
PID 4788 wrote to memory of 2040	4788	msedge.exe	114
PID 4788 wrote to memory of 3676	4788	msedge.exe	115
PID 4788 wrote to memory of 5140	4788	msedge.exe	116
PID 4788 wrote to memory of 5140	4788	msedge.exe	116
PID 4788 wrote to memory of 3608	4788	msedge.exe	117
PID 4788 wrote to memory of 3608	4788	msedge.exe	117
PID 4788 wrote to memory of 4164	4788	msedge.exe	118
PID 4164 wrote to memory of 4624	4164	msedge.exe	119
PID 4164 wrote to memory of 1424	4164	msedge.exe	120
PID 4164 wrote to memory of 4632	4164	msedge.exe	121
PID 4164 wrote to memory of 4632	4164	msedge.exe	121
PID 4164 wrote to memory of 4632	4164	msedge.exe	121
PID 4164 wrote to memory of 5332	4164	msedge.exe	122
PID 4164 wrote to memory of 5332	4164	msedge.exe	122
PID 4164 wrote to memory of 1072	4164	msedge.exe	125
PID 4164 wrote to memory of 448	4164	msedge.exe	126
PID 4164 wrote to memory of 2132	4164	msedge.exe	127
PID 4164 wrote to memory of 3188	4164	msedge.exe	128
PID 4164 wrote to memory of 2540	4164	msedge.exe	131
PID 4164 wrote to memory of 2540	4164	msedge.exe	131
PID 4164 wrote to memory of 2148	4164	msedge.exe	132
PID 4164 wrote to memory of 2148	4164	msedge.exe	132

C:\Users\Admin\AppData\Local\Temp\Project-ALM.exe
"C:\Users\Admin\AppData\Local\Temp\Project-ALM.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://insanux.com/local-mods/interior-addons
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ffe7d4bc188,0x7ffe7d4bc194,0x7ffe7d4bc1a0
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,5469569086264208681,3315843939036921222,524288 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,10094395350260029337,13810500899269011958,262144 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,12579682077958213319,8037409735974365222,524288 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,9304977934987425259,11544980871922580105,2097152 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,2407326527805636557,76083687035240363,2097152 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4900,i,16616652207989222482,1807420605983958493,2097152 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5208,i,6395318444230248161,3314866485816641660,2097152 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4932,i,2273270484204634134,2049808655378445656,2097152 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,11207905773423960737,8944856541581651435,524288 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,1131370998374814202,15726692061706832482,524288 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,9721076062455997021,17703399490308640507,524288 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
    3⤵
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,9721076062455997021,17703399490308640507,524288 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5280,i,16293971538237587611,13971281487940328869,2097152 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4952,i,12113016096950643885,16206503604517058332,2097152 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6324,i,10151487019925728215,14121967095222949675,2097152 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:2812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,3791961550254954813,10761188855276766155,524288 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:8
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,5094579459617403187,16071435987931974686,524288 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,15510780961377330633,13636225478634133989,524288 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3372,i,3655169354890605185,15917768368492941407,524288 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,2250462133468006396,15588292494984818508,524288 --field-trial-handle=2256,i,7425842331341089060,2493433563781404674,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe7d4bc188,0x7ffe7d4bc194,0x7ffe7d4bc1a0
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,14721447561548475434,7608997487286521010,524288 --field-trial-handle=1948,i,1991535741517471606,1125234514142509397,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
      4⤵
      System Time Discovery
      PID:1424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,10394196319568205323,15612401995851370777,262144 --field-trial-handle=1948,i,1991535741517471606,1125234514142509397,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,3278785671870894429,4204935785114619792,524288 --field-trial-handle=1948,i,1991535741517471606,1125234514142509397,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,16883031229871504300,14220359508431843543,524288 --field-trial-handle=1948,i,1991535741517471606,1125234514142509397,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,16883031229871504300,14220359508431843543,524288 --field-trial-handle=1948,i,1991535741517471606,1125234514142509397,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,9880942041384284277,4096987660594202956,524288 --field-trial-handle=1948,i,1991535741517471606,1125234514142509397,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
      4⤵
      PID:448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,17346272443078174097,3649282900045888298,524288 --field-trial-handle=1948,i,1991535741517471606,1125234514142509397,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:8
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,15728663903648724099,5280131299383553416,524288 --field-trial-handle=1948,i,1991535741517471606,1125234514142509397,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,9996963832075483105,14972664510666201308,524288 --field-trial-handle=1948,i,1991535741517471606,1125234514142509397,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,9964299768498534424,2037862479016967380,524288 --field-trial-handle=1948,i,1991535741517471606,1125234514142509397,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
      4⤵
      PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0dd682e82aa8cd6159af27b9fe9796b85ae32d8c3b7a54ca83c08e7258a7175
MD5 2ed58da04906706bb0da862e8e7185b5
SHA1 3c5218714f1830b95877032ae59a91505796d0f3
SHA512 c1694efeb33c2b30e89769d925a4ac7923301aa37e527971ebc442ad3c0800bfdbcade111c6abe3c94cf362ebe4febbfe65aa0c3ad7f46f25d381ebed28c5a41
TLSH
T197D0806817B17C31E085967015C57B05767DD46B5D474B15A4F2383C2C530409E560C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0ce3de864fc029de1185f15a333c36ccc857bab064d704c1c9cb74f2d49559c6
MD5 95e4fa06728773c204126766fa6a3f91
SHA1 b2b2ff6dd17d9d1fca4c1aa1d226d00b195749be
SHA512 11564019829fb23fd1b38faa2fb3c3298ba02394920b54be1169d3ca923ae73304fcdfa9ca88adaeddf4fa314022ecd93085a2ea4ef7973e86e12e5d7e562c19
TLSH
T10ED0806C17B17C31E099967015C57B05656DD46B5D474B15A4F2383C2C530409E560C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9bd0cd5643d3466debb56888052b840843e239f6c93105d08240c2480dd19ea1
MD5 8d8d2046e7df8464ecdc64f4f570b9c9
SHA1 3baea38b2b27c5c28229bd692499dccf41e0e6fe
SHA512 51327d5471dc8d37235171e70603bf82d6b8895f8befe981032e5abc59ac63e87731c66547870dfa7f27c1231468de2f874f075a4bcb05052d5f0c2746a84cc6
TLSH
T1E9D0237477A5F403E09A05715191819116DF544F34CF41C4E265500D7CB7558E7D71C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7794fcdc71d9b0d0784a546edb27de2273e14eb55b44cda98bd932028cbc4bb1
MD5 6050ac62e97b2c5274bdce0bb94b0bbc
SHA1 501fe8d9c9938304c3424a0c09235dd07ab5245b
SHA512 1bd93329ab97ffca2270c8ba77fce19fd0aa5b2a95554aaf332257ee00ad7c58af4c051bca41f7dabfcec0c6425300ea26e65b47553a0aea14e3a1c432db7d83
TLSH
T14ED0A7B87B687402D0C565B2A480818123D6604F358F42C5A1A6A40D68AB454A3E718B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 deeb8540f2c5eef81541ec8a5db623e31d40f39fbaf6510f32b44ff835ce692b
MD5 541d32a1b34de735a563cd6f24372df7
SHA1 891e857d36a7ad0daeeeba30d15dde1cdae55d4f
SHA512 517246ae6275493b59a41dc37ecdd00457a8713b782e060c66548ee5a7878f272bf1babba89356095aaf19284802acafbedefd90a36416ceb25db04b463443a1
TLSH
T155D0A7B87B647402D0C565B2A4C0818123D6604F358F42C5A1A6A40D78AB464A3E718B
MD5 SHA1 SHA512 TLSH

Submit Download

52306918-cda5-429e-a8e9-b8d641eca8a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\52306918-cda5-429e-a8e9-b8d641eca8a8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e62da9f74991fc0bf1d355c8a0dafb5ba5dc3bdf72d0fef4c47ddc4c8991d9b0
MD5 814a4d5de6446bc616493e0e4c1ce09f
SHA1 6cb7ba71bf23c4921ab20689f6220431d1507798
SHA512 c9ddb5e3f8aee58513e5d25f50adf2bf96c222d26e7ee391d9508a63efd8fe764ba440a64c4fe3a1e76a3f10707a2041054446accc6a8e29236b16acfeaa6535
TLSH
T11EE022AACC22AC370AFE5719A1504655EE60131B2791890F3F3D920A8FB063A56DAC6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 3af7e0b22fe5b7bbd886d6b69b2e3ee7f83378a85e3f842d0d78be4c33634ade
MD5 683418a3cf4c737078a3c2f21ae4f4a3
SHA1 573f43abea831bc4bcc4a5e570595d37f911d501
SHA512 457c6cce19463ca76340114b1fe6327e0bc505325b44368d79278e0bd32a2493786372f3f4d70f85dab16a228d6eafde5482ccb76a71536d81cf6efae8af67a8
SSDEEP 384:ySTlW7XuVTK5imJZpRrq3x5JM9yhoY+74h6+O4GWdejZpO7ZIqV:g+VTSd1cO9y5k4hC4GpalV
TLSH
T14413937D360E5E37DAC3853E2D0B8B3363349565E6895903A3B0360E0B6F74A794E179
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 3bc95e80315b6ba1bd37b02bcfe82a59d8111396bd286c6f8d04f3c146750a8b
MD5 c86db17dc1551a48dc76dc554bc5e864
SHA1 e241aa473091f2f86a5c3da6ce4c8b877c34f476
SHA512 cbe57a3672d8fbcce43f11c06fbafcfc508382e1e78ec691fbcedeef99c15e3cfe35460a598ed5d6d427e9875cbaebfaec979c5b1d966007e0c5256e7b30cfb6
SSDEEP 1536:gkrWTiYBT4Ee0mb1uRWAVB1Zk/3fKvA683Ay6qn2+fZQ94MQebvzCIu9UMUw0qQ:c4PP8TDYIExQ94MdiUMUwK
TLSH
T1C9B493F70951A01BCFA812FAD2037A3DD17B006D6DD1FCE9D6380C952865B31B6BDA98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 010ee1fe3960120b5370d6a940ab76bab59404784035a244b19697cede67bdef
MD5 49145eda0e28b962f61d096646baa91a
SHA1 ae3b60684f2d8252cfe7b16891a54935f794bd81
SHA512 47567314e034adacc924329404ef94cb1a132f7486331c9ab792ad3173e3bc16a9363ff8365249278c1f58aecae3c4dd0c6c0d72b675804decd001cdaf478e4c
SSDEEP 6144:25od3G7s2YyvoaoiSSzWQHnH9ZLRlRVLVRgrAC9cYR2Rq:25oq/YyvoaoiS6WQn9ZLtRgkCt2R
TLSH
T1B5257DDF4F342D82DEAB9D70F8E0EC267CB411C2BA9AE0D35804C96452863C56B9B5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 9c8524a708282a9cdfc6d6abe340f7f790bfa2607ae3a382c51fd4fd4a10a6fd
MD5 971ca1403156246923a21514a33255ea
SHA1 2bd9aedda9a2576a2fa49e7b8bde604c66696bfd
SHA512 8e7a096ef3a7a95914ba3497b8eadf87fb93396f222efd9e0053c7ee972fa1861f62d2d456ecb70f0885398b583a64ea23bdf1e11b8b524f856a72c6c63cd3d7
SSDEEP 49152:Ea1ynYxoVbkTHEHzc7D4ydU9564pC3NZwC:jyAOkTkE43CN
TLSH
T1FB868EEECA785C83CE678A30B4E0EC177C7413C3B995C1D38558C59806A77C5BBAA26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 217381bbb2fa0c0a4e54717c192e92cf6f5200a9969858449f94c8d75dc6141f
MD5 048f4aa9ff55be8da54417584a20b3af
SHA1 3bf70b983ce5098e9135cba28adf8e772d872df9
SHA512 21ad9f96f0a4454ae2f72a7b1626ba9880685a6af62a5ea95012b187d14e3523ad4b09de58390040389620ed2c4191a42fa94f0d9b8f908458da86327e4f7d7d
SSDEEP 96:SukOFBJBJiZYgFr3hIBriOYjCEgrh8poomZ:rJBJiTlRQrDRbypKZ
TLSH
T1A4915B28C592867ACBED48B05AD314717F3407B8AC4F1ED646B4923D990ABC7D052C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e886.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e886.TMP
Size 3KB
SHA256 fd0acbcbf6ac8f9c1bb48d0de981f99f47d11efde7a97c34de953d6bca71ea9e
MD5 737072e60f355a6acf9e2f6e911cf830
SHA1 3061fbd426ab554b88b1b8cd3c9805de24286f6e
SHA512 186a445a61e2309a49f29ea316f6faa6b2ac50d553cd218a592e555f366b8538abf437c2b2d417a732756f61bae6a06ef8ab667e924653b493b65d048cfbf3d8
TLSH
T1FE71085CD19284A9EBEC41706AE760757F758B780C4F2FDA02F4463C9A12BCBE04183D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 4aa90b10084e8ad116dfc6485da1b1c34fe66ab6d3da219d88590a65eeddd1dd
MD5 620e8a00090f5999cb0366c2b149f6a9
SHA1 3e1c8b98103fe0816876af272f79822816a2ba1d
SHA512 b5ee7b88d98c603c700b8e445fea9f3d28746f3d335996535fd15b2a00398212bcb4e1312a30218e4eec0de2df98bb8542dc8fdd508f7c58a59a952b6870dd89
TLSH
T1B3E0D89575C7C12E665034D243346B0AD1E03C52EAA56EC32705CCD07603451B7C9667
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 abdc75eaad4bdb71593eed8c3185b6b48a7bbae998271b0a0202c5b1d251b257
MD5 69458fab82fd7273804557e0ccf63861
SHA1 f1f25ce11643f334e2f86f1f84407983e75a14d1
SHA512 99ce2a6de0e2f7ea755ef050261bb4afb38e394ad82e64313d3eeb241431c0bcc4bc6dfc67afac03abf8c6c43eeaa40c2591f1c90d956b97d8d9e55780591433
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jgW5LJK5fKFtIGqYp3:Tyi+7f+UZD4jJ/BkWxJCKFOGTp3
TLSH
T17BE2DC8C3A12F511C4ED733EA0C2C5E05EBC692C864D757156389C7A8D62AA5F09F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 44c2a67efaa8f3a28158254cc947052ac2d331b71d28bdf2f8836c4819418202
MD5 986803f67d4c048ecc039dcda96dcaa7
SHA1 626029eeb2c3ebac3ffced2ccc6b2cce979aec05
SHA512 b191302f64afbc47901737b1e118e29d68c7a20229a26b22ff74b4e0058dbad7310ddbf4dd2c2f130178259fea43cb2c5fb48d4c78154e77d0c87d92bc42ff62
TLSH
T146E0268818CAC12AA0646CD7C3796709C2E03923A2883EC2270CCC44B143A42E3EA2D1
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 0d336e1b4ffdb21de62c47b9d9c4e11c132db3eb57e211c3d1d0ab85faa990ea
MD5 3ad412b2ac6bf824bb7ce82aaa909e23
SHA1 61dd0bce9dc502d12aafe2dbb9fd9bb6bdcddec1
SHA512 e175eaecd9a6a7e485f4612a9e2f9cc379c212093be63ffab6e181ee331d5deac53e9d8b60eaef51fd1697fe033c1ce334c445db6573e65d85bc47828b109b19
SSDEEP 96:3BCxy03X13dmqj5rdlllmyjQh5iwQsjiQC2UxIBQnUa:xay0H1tmuhIp6wQ6L08QD
TLSH
T1F2B209975776305BDF4029FE2EAF4034AD3BD07CAFA58C01706568212AF599768381AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 252b6329aa6ed05016e766261a45ccc6da11ad1959c7a297d95d4aba0092e0ad
MD5 34351b00cdd44098311ac097b2c26603
SHA1 57150979587a22e7d4f9208a653de329f75db2eb
SHA512 acc814d2de420df15c285ffe75cc485a5a1b142bf47aac30f26f10852c8acc5f4643e089bc817ca4e7fd97cdb4b7111479e1c21b4d87d026f7af8ddee2263100
SSDEEP 192:5sKMf+G83uy3Ct7XBBKEM9KQtWjH7DXspU3i3:xM/83uICtTBBQw7DXspU3i3
TLSH
T1CC14505F5B712312CE7C51BA6CEB40A36D6DF03ECB5256C668610460CEE2693A42C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 d97ba544c90c7c8fc5672c97f4068d6deb0c5e93485494ca8978aa41db4a8278
MD5 c29eed3a047f480646f5cbe1cc21e825
SHA1 459a946eb3a2309840155ba81c1a19981fa7a35a
SHA512 0a382f95279e275da88027baa560c167e71416df326338561c6766dd569af6aafd7aa44432d74e953df95b463fe4e025941579abc9a52286d9e94b21d6cda5bf
TLSH
T1593180F3A364C042EFA266FC58C9B65DFA13403D4ED6E2E9C06260195AD45F032875F9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 4da21c07977e6558330fb16e9bbad5a7bf7d0fa1c65f939bda9cf4df9f0150f0
MD5 1bd6bf141da2a76a746a1b71fa7e0a6d
SHA1 b5330bef7e57350918bdd87557b0e5808111ad0f
SHA512 1274e752c15fe4296105a8e1c7982ce85be003657b53e1f23875009afedeab8f054cc54046fa14bb5ba6d19e47b72ecbd8cc760233e630408894eeed2bc94b1a
TLSH
T142E0D8A564CEC12B6559208B8329B709D3F03A17E68D6F862B08D840B047484F6C52D2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 b2f8883459d0c8481bd087be523e5fbed1ce07734450fdee769691ac18d40a20
MD5 d6dbbe34b9cced0d016e9b2f4409bfdb
SHA1 9999a20694da00b7cf8ad26b6569e2c05ee28fcf
SHA512 c3e03b1fb8719c24f69f9ce830cfd9b74437b6fdc54ac03961736dda793a5fa170057474f2de44cb514e2e3c20d5dc6b842bbd972bfe35cb56f9e710915351b6
SSDEEP 192:D1w5QoJjyJk27suMeJFTYJqJ3eWM8qFDFw2W21kZPij6dirtiGl2JarBjrn9+kGG:D1w5QUjqk27suMGFTYJqJ3eWM8qFDFw4
TLSH
T1EB42ADE7C3E4873DD81166F4AA286E1FCD2D092843183D6BC9D99F4B93E2071E28565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 6d20b31ab832ed98527f2f71206df54e164fc047c3cd267bd52a3c8b95e686af
MD5 2829ac3dda7abe75bcd60849264e85e5
SHA1 1715ddcbda580f667e5e9317d460aaf3c296f4e2
SHA512 726e0a6673d99e053a17a837b0d940a1d32055336922a329ce4813cfc8cbd786e0eaff77872b1b959a8de456bf201753d33ec09da7cc76346156ee5cd9ce9dce
SSDEEP 192:D1w5QoJjyJk27suMeJFTYJqJ3ee8qFDFw2W21kZPqGj6dirtiGl2JarBjrn9+kGI:D1w5QUjqk27suMGFTYJqJ3ee8qFDFw2M
TLSH
T10132AEE7C3E4873DD81166F4BA286E1ECD2D092843183D6BC9DD9F4B93E2071E28565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 32b7d99aaf5a3bfd72f906b48cf70dad1170727814d81c6bed898f64f83531ec
MD5 2e6bdb8afc42700197a7925e965d096f
SHA1 61e3d691eb40d0c09f36f180edec9d672e374f8c
SHA512 a5e3d686f772b049ee9ea94efb8542f599855552ac1a26c3630b1ba8964498270b133f0f9a76523d547fb10addb90caf6875464e6efe974196b80b2675a12114
TLSH
T1D2219E93A97EB8AB10AD0C7B5D447C497AB5B8745185E0F4C962C1ACB0C74F36A12432
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 e35e93cc9f9cdc9d4ef65c792b3c5072dfe23d74f4b2d1357297d88b07b36451
MD5 73431db6d212cd2db0d486d021f0ae2e
SHA1 466cd4eae9cd2e983144a639bb82739ae43896a3
SHA512 9f5682a88e5adcc5e4edb63761b1e475a605f7d33960243a253fac7a4f4c1d54632b9fe38b8cf46cf08a490153d2377d1771e5a248d047518aca6d4d4f161e6b
SSDEEP 384:sxZvYm//fTsDWvsCf+C4YDHbdZGxMHesxz:sHh//foYsCfJHbzGxMHeA
TLSH
T15482D716A6385D7B8CEAD219F545BB63D6F5052792915E849AFCCA0C00E7AFD320382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0765a6f77a5eb808f7a83d8527512eb9ecfa3873960dca53cc812ad4343408e8
MD5 b35d3b7e55c9dbe309b4afe47fa35354
SHA1 33a10237ed9b119c33f3094809687074606b5a15
SHA512 7a9b7e7990913a92f64fd3a369f348d857f5d463c2b51d978eccbebeb5aed75616bc5f57f1a7c70e605e4f743344afc9798177a95cae70603ad57cfcfc6b857b
SSDEEP 192:sxZHRHyMqZ/K1Ml8Mi//fTsxi4oSKaBC4jzodpAlHW6+WNp2+/BF3hgmtUmbtCtV:sxZH4q//fTsxi4nC44UHbd/jxDGSjI
TLSH
T1AE72D757AA385D7B8CDAD219F645BB63D6F5052792904E849AFCCA0C00E7AED3103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b6f8a2a5ed8caad3b9f21785fdd934fe97ba41cb35eaddd798fa6f6d80d4bc7e
MD5 05f8d388815adfed4ee08869660eff05
SHA1 4b13f1cbf79b8ec31efec99f868e36a2cfb54488
SHA512 0da1637a5f754450bec6b4f56ec82c05c9dd39b280731428ad839a390775b82e0b6c1e437dc06607c8233e79d81ca4ce3fc9c5c58c2f8e720513fcae582f3762
SSDEEP 192:sxZvRHyMqZ/K1Ml8Mj//fTsdi4gEr+C4jzodpAlHW6+WNp7QXBF3hgJtutUmbtCm:sxZvY7//fTsdi4f+C44UHbeXjxMEvSpI
TLSH
T13872E856AA345D7B8CEAD219F545BB67D7F50526D2904E84AAFCCA0C00E7AED3103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 9d15bd45b35f1a9a82f8f49bc7c1c69354f81c65d295c791c5ef825559307933
MD5 b906f11c5ff3c29f97161cc819f3934f
SHA1 d87a16651c6c095b2486b7ad153db08183eba346
SHA512 c520725b0db378390f0ab182230239a0881d8d4dc2e3ea80c26a8809885867f476117b5e067f3e841c2000af0530b266d274be16f3cc6a380b6bc3df6d2ad08a
SSDEEP 768:z0sjWCv7pLuL/OmWvOKPC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4j+xLlx72BUro1:z0sjWCpE/OmWvOKPCu1jaxj+xLjyB/Ku
TLSH
T19EF2FA3B680CCB7F4F805E9CDC2A7E8E6DE8018B9698895447FA884C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 fa2c51618ffd0c3d48e28f2ed4d29edf087fc2e07422517178e1f24875839054
MD5 464b0b22066690ce7c8c072f0f98d08f
SHA1 d3603f578451ba8674c5a24315894b93ecc371cf
SHA512 fb769fa4a72fdfb753137aa2d3c2c1d3cea03984d2df0f39b4e729fd6aba720039826db20bff4e2bc611246886c7cc34116a15917e71b4c76740d87d4e602a08
SSDEEP 768:z0sjWMG7pLuLnFmWvOKPC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9j+xLlx72BUrot:z0sjWMmEnFmWvOKPCu1jaYj+xLjyB/Ki
TLSH
T1A7F2FA3B680CCB7F4F805E9CDC2A7E8E6DE8018B9698895447FA884C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 7401c31e91ea7e146803f0e73f7e89909010a8507ece52fc43d6055938fbde54
MD5 4f242ed6f48cecb1c092e297db5a8f04
SHA1 c73b9bbf70019982c36868f9a9bf9cbe2ba58665
SHA512 bc41524e7abff3e784b64eba67d4f2accf9133214695a967546f4f869fd99357f816705566e21bc15c73edcc617cf3e8468b62a2a15017af80435f07f4d5b02c
SSDEEP 768:zjsjWCv7pLuL/OmWvOKxC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4j+xLlx72BUrom:zjsjWCpE/OmWvOKxCu1jaxj+xLjyB/K5
TLSH
T10BF2093B2C0CCB7F4F845E9CDC2A7E8E6DE8018B9698895447FA884C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 a70bf37ed17673487431690e118c52ec2841b257ea82162b42d44ed43f9c2b89
MD5 0ff97b17da1852c50d0a1a78e4b971ac
SHA1 2d6e697259a09b522736e6b7586724311c94f26b
SHA512 43cd9146f9534fec677bc49d20b3253e9cdc5666bfa58bebf0020965cc53090575e9ed446269d650caaef171e5e20888291395b4a7f53f120a3f795ddd643e6f
TLSH
T143E0DF9815CAD1BF7015208343269309C3E87927D6C83F823F15CC816143A86B1B71A2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 22341d1ed059cd4d9be8c00a6be19fa79cab561a357bd39d10ecb9851c09429d
MD5 b4341c5f0d57239ac6f9461267761696
SHA1 ca2eee2aa348b5c1c36035e73e94b5fb56c109c2
SHA512 cf5a0477b445182d0c11c677cfe39b7d27f962a45490887b5080fc291701be3ad70fa0c3014acdddeea41a52716ab8929829a1d405549bf809c1a7c4c198c20d
TLSH
T1CCB012103F84E202C4D54C31076ACFD6A311E033214006038D19DF20CCC67F43F12C94
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 bfe6bd2b28e252daaddcd70da3c2dca11be412ef0223b90fbe5b97668f4f6076
MD5 513a522cb190c222fc04d816d8358ef5
SHA1 908730521517a5aa9de73a4a4e87baa6adc0d012
SHA512 fa12f048c8f2da46e4d75336a3f896d87200f7d48adf6442840b33b45942bc2c12f746b103d4bfd035a8616a7cec9c79c47b3bf42e20136a663a541004d5a509
TLSH
T155E0DFA426CAC7AF724520CB9339E309C2F27D13E6D82E923F09D480B207540B2A7292
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 4114040639686081094b1f37bbcf49f485c04c08a4ead7e5cc7561f6b6463d7b
MD5 8901b61425dc10cdccaf162879b2809e
SHA1 761ebb5f74a194145f393355961d04072a111124
SHA512 aea6639ffed78420844e9f9a649e321947de0c832109c388c1222df08d721e624a6279af95d18307c45bafdc57582adce65e35d7a7c7e59e70a300cbbf7b6631
TLSH
T192E04FB469CAD67A620460C3437AA70EC3F07D1797893E866B088450B103645B2BB591
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 20bc3f2db64ce011ca95d2d8ab2af17f91af9efda978b4ddd076f4a2721a7153
MD5 2cb0b59d598eeaf924d3a14c56f55367
SHA1 7469fe3324ec102ee91c26e8b2044339f361e335
SHA512 78450c56503959828f27e329f382c25a1ce5d90d8bf09abb05c2270ffd6640ae000c4d9318d94eaf203a8802d0781434a25dfc2fc3ad5b7e5f04b0034fa7a172
SSDEEP 96:KY5OKiwSKWkYKR2yCyMKLC4NiKWU6ezWKYMboAKt+6Ob2KwMnZWKSQiOzqKUEzzy:0BKLfyFpHbxpBJhZf4f7Kn3MPhe
TLSH
T181B23710713A02913A7EB9CA81E5B42E52C331737119E92B7BB944A64F67E21CDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 0bc48325f0eff59d2bf5995719b91bc29f00bc2e919c511156685ae99f2085c2
MD5 ce87c76acc273aee2a8c586e06cf3f2b
SHA1 7b9967d5b932744bdb75c0e2cbac07e5edf0103e
SHA512 edd17c1ab2f97b23f130f81c497329123e98164acc7e087dca287ca42326df0219efbf862860af6608ec9594100cb3606133646f5dd307a7d17948077dd6f86a
SSDEEP 96:KY5OKiwSKWkYKR2yCyMKLC4NiKWU6ezWKYMboAKt+6Ob2KwMnZWKSQiOzqKUEzzt:0BKLfyFpHbxpBJhZf4f7Kn3MPhFhnUvg
TLSH
T145C22714313A02913A7E79CA92E5B42E56C331733019E92B7BB944A64F67E21CDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 5d8384f4482ca2de181517bf094b30ec23cf84c52bc30218cad2cdf8d086264e
MD5 f7156b666704f583cee641c61b681b44
SHA1 f0e525bd93d80084f104f2afefc3a40d7ab8e762
SHA512 b4046a2b92a00106d2003b5921b6ff0131da0c569ddb19209dbc075e4f4a0fc771887575aa86a6fa0c39df11e1c87cf1102431a6034a6474812918e82dcc5730
SSDEEP 48:DEK3tjkSI5IUltGhp22iSBg/VFvZvRniW:DEtSyGhp22iS0VBr
TLSH
T1CD52BBDFAA762153EFE553F8CEC900E13E19403D8EC99A0318E550211AF935EA34E69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 90ad99947fbc1fd35e6fbe5df63e52a05aa716dcbcc6bf01644bd1caa66f7ccc
MD5 0970f21fdf99d0cde56f8791aba18440
SHA1 b8bd09be0fbbc91fee2b72f766730218211e52dc
SHA512 cfa66b3ade1187331bff9a227a5bb9d742d231aa2d4c51cb672e33daa25cbd60e4c98dfffe80dbac6225a64b965cfcf34d359829708c05cc1db57752080d6756
SSDEEP 384:u4Qyhxk7YisPGF2sPa8QcIIIDbzMIMSBp:UM+Vy8Qd
TLSH
T15452801926051F33C15E5F77162ACAA61BCBC9814572222EB561281F8DF3F93DBC52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 52a8fccd83bd21b92508b0977a0102a9ec4dc7818ca758c6cb73379fc20aa57f
MD5 941504d3193adc630a9da0731e03aa0e
SHA1 36ea54dcc0d8c4fd0c542054e1f5b7f0d777241b
SHA512 0171c9266d0085217ec6bbbf0b9496b860e2af11a4451fef35b9dd00ecd7841f9efbbb02171e4a14068fb8eec31a3b5f842f474f0c5234e7dfe453cb920975a0
TLSH
T118E08695B9CAD97FF0D560DB03759749D2E13E17FA882ECA2F04C458BA03584F2DA1D2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 63a40b01b907450bd63c4d7b256e8adf6829656f6abecf2aa678f933ceebd219
MD5 23081479eeed969fab3d70df257f2a49
SHA1 062bc9a2c517674d176f97d9e6f225e00faf15fa
SHA512 6f64cf2cf698f063c0320eeff08363dd2760bd34570357164e809bb0e36fae78a6d36cae37acc4ceda2ed24f06733f7a3b71d56b13e49816a2920d84c83434bc
TLSH
T125219D56F320C158E28A867D902B97391338E8169FFCEC0F517964752DB6E011E8BAE5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 a05b8c397c60614f86f47356057f4b1d2afed2a7f6c8377fffe6340d70bde795
MD5 431ff3c4a4921174295c3ddbaf21b19d
SHA1 bb671b87c1a20abf8c0644b9d3cda624fbb1f133
SHA512 52af79fd87c92133e73f5fd77226486099ebf109b2aa0ec979b3e69610daf1da0be06afb55d459b7ca934b1f994a78c96dc0c7313d0fc45d711364c2b8d359de
TLSH
T1C5E0DFA4B8CAC1AFA02024C70275A34AC2E53D2BEA982F823F00C844A143542B68A193
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 286ae7c5799fb3bb97f6b0cea8e4f923a81a3421770bbf99fe29e37c6dbc0ce9
MD5 40338c9f1e937aab76e6df2bb6eed418
SHA1 63c68b13bc8eda44f25fb5e66133b3851261bbfc
SHA512 60c5f2f67ad6bca56e59a7ed2a433f39941a4761da614304775380e011e37280ff083495e60eac6149c0042c40ba4afc18902d579455cdf0ae01fc2279eb16bb
SSDEEP 3:MsEllllkEthXllkl2zEelolQq:/M/xT02zNolQq
TLSH
T18F44040C7FC41515C514503440D3C3500370DC154511574374510C135CCF7400C00444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 24a88e8d43adf344b18f8f0762c7ad3711b1f690c1c21a35a0169134d3203302
MD5 11d72ac642c483652b1eda9ba544a014
SHA1 48659d589699b5ad67a3030a13d6114970c2e178
SHA512 db4ad449d9f24fe774be9648fa1c2b60b11f27baee919da464e265c74da3c15a8ca630a7a111cdbced6121fcaf0513c6f32d984fd737770a39d3d3c4eba2fcf1
SSDEEP 384:nuFiFhcXqnysNBH8TUNTUlI4k9bPN92Gl4fAYL9REaFQpc7P9VmAJTlqHEBZJZGH:uMFFyoHwg8YYLwaGp4P9VmAJjHw
TLSH
T182D25B39DC54DD7FE8EE5B84B34E36529EE051B7D99C9AD8D7C84F0C00A219DA30781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5ee2d32cfc5770d2be533e6a78e4bb98d388e5c2975f5985e64cff0494627842
MD5 1f5d41d1772566d9d24748e76ad308d0
SHA1 b41f730b06b68d1e578e8bcb45270b06ebfa1344
SHA512 422ac2ec6d46205f07afe0ef54e8aa5b326935f9c44cf1bfc56a768ac54361257fa5f50b47e1ed95f3116c3c6c8dddf10816d82322c4a6e34e75d7302e87c2ce
SSDEEP 384:nuHiFhcXqnysNX8TUNTUlI4k9bPN9lNGl4fAYL9REaFQ1XE03PpY9KBISg6zIJTK:uCFFyswgtYYLwaGVxREKBIl6zIJjHb+
TLSH
T1EEF23A3DDC94DD3FA8EE7B88A70E26225DE40277C5A89998D7D54F0D80B208DF747826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 66f9648a8c823faa2603c3131ab9c1765abbfe9bf75e9fbc7936d22297a6a6b5
MD5 1fe57aff0f0910307ff7c65d78d7e539
SHA1 40f4680cf481bbdea644312c5aeb3a160f41c6d4
SHA512 804552ff723ffca466cc7dfd8667c3078598c4f118b5d00c02c3447aef01d3c2af6ae87b6b4f983ae2da6787227fe61d1e227f07a7c3e1ceb1e272e90d03cdb4
SSDEEP 384:npHiFavqMg3sNP8TUNTUlImkrbPNm+cl4fAYL9REaFQIhRYV/Vw1mR97iurN1k+U:pCFayv3kwg7GYLwaGIhRYk1mD7jO
TLSH
T19DC25D36EC94DD6BEDEA4FC5E70A3A03EEE04167D98C5AD4D6D81E0D00D709E634B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c40af6384827bb490eee5b186237b2871756f6a1e7fd219a980c666b57927010
MD5 4b50ec6b4f31ce712c55ef2d2417ac3f
SHA1 0d894ecd016e3f6b574095b67f9cbce31a2b4639
SHA512 3c6c48980c3d98bf8adb2c3df0b31084ce8a8ac012fdc3bc44b61060c778cfb7ffa364007beedc052269716ea50623fec615e8da92299afd44e2c11e48d29475
SSDEEP 384:nRHiFavqMg3sNr8TUNTUlImkrbPNIVnl4fAYL9REaFQ1XE2TRYV/Vw1mR97iurN8:RCFayv38wgYDYLwaGV/TRYk1mD7jO
TLSH
T119C26D35E894DDABEDEB4FD9F74A7A03EEE011ABD98C49D4DAD40D0D009709E234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9c1225606c5e519771ca2255a023dcb0387c1d22bd21f5b9e6328e1bcd948e6a
MD5 83549b1ff0ae504bd706e56b2e919feb
SHA1 20bffdef5e46ae399552b00e8f71bcc5389e397f
SHA512 32fb9cc9a83f388996d1b7e329827d143e09260e07b0fa0445272e6ca7e7ab6380a6a0d11b7168f98e601e354b68bf21bd2b210a8e0e3fca4d89d78904b3828a
SSDEEP 384:nYHiFavqMg3sNX8TUNTUlI4kYbPNi5DGl4fAYL9REaFQ1XExTmcXrrN1k+5vI+n:YCFayv3swgpYYLwaGVmTmcfz
TLSH
T102B23B31ECA4DEABEDE78FD9F75A3603DEE011A7958C4AD4D9D41D0D009719E230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c81318c4aedd0e7f8945da518f1202052f2fa177f17859edd8a3a544eb419f0c
MD5 f87aad890bd1e7d9b68ae1bc2bb252b7
SHA1 130def6751c38194c2f48d64c3043ebef353afda
SHA512 b55b5d87202bc48577fba4ff03d019a2eb561f59b70d4f6162012c908f32374e52d1329396677ae036480ea5e46db89a7172265da42208d651d1ccc87b4ab553
SSDEEP 384:nYHiFrcXqn+3sNX8TUNTUlI4k9bPN95DGl4fAYL9REaFQ1XE0TIJTlqHEBZJZrNA:YCFz+3swgbYYLwaGVxTIJjHb+
TLSH
T1ADC25B31E8A4DDABFDE74FC5B35A3643AFE052A7858C5AD4DAD44D4C008719E134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 00c0b5308a499e1e0cc31442cb754b18aa356b98b331defa90d947365fe2ef8d
MD5 ffcd51550759da248344665a98d89f5c
SHA1 11d4101c43eb8856b5a54eeb45934a5733ee0047
SHA512 ed8aff89631f7294b2663f6ce6ec882edea64d79a26b0723aee2a8caca3e6280e27931cdf2624698fae3617521e273e5c596011fd5794f170bb6c54120c30a44
SSDEEP 384:nuHiFhcXqn+3sNX8TUNTUlI4k9bPN9aNGl4fAYL9REaFQ1XE03PpY9KBISg6zIJG:uCFF+3swgeYYLwaGVxREKBIl6zIJjHb+
TLSH
T198F23A3DDC94DD3FA8EE7B88A70E26225DE40277C5A89998D7D54F0D80B208DF747826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 980eb2c38a6f18e95af8b87729b24ce9a0f35db7d604db0b722259bb7b9fe300
MD5 1df0b6eb0e187f4740a4354c7979cfec
SHA1 8cd341e7cb6bb0fb79abcc38472e32115719f2ed
SHA512 700927952c4c6d2b9f6f17a75dd2cb38603be1587e870340748a6d518982683fbb520300799e41c6ce1a46abe9a5d83de9034254ce2769713b8a1a1c1ae20161
SSDEEP 384:nYHiFavqMR3sNX8TUNTUlI4kYbPNi5DGl4fAYL9REaFQ1XExTmcXrrN1k+5vI+n:YCFayG3swgpYYLwaGVmTmcfz
TLSH
T187B23B31ECA4DEABEDE78FDAF75A3603DEE011A7958C4AD4D9D41D0D009719E230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 a812b14722eacbb3e38de47d32827d995c6252ec5fde60407ee7362de011b470
MD5 013137e3fc8016ea396596196e19a745
SHA1 f196c91cba2132f8ba0009e9614f85a26de596c8
SHA512 0b9cf177e5712df2a64baa0cd0f983489c9a80c617e16b7b63cf0a96ef9203a1a9091108d84fad83ac03462e9e1cd6c760e88c6000b0b58efbc394d806fb5041
SSDEEP 3:MsEllllkEthXllkl2zEelZt:/M/xT02zNT
TLSH
T12344044C7FCC5D15C51410F04131C3500375DC105D51574334D10C775CCF5400C00440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9f724b073e6c5cfa71d66bad1fa8be62513784278cf7512d3432535fe433acfe
MD5 5662b7bf3a6af05ec9ed45712e928abb
SHA1 6183ad8b90181bdcff2dc2746f9cd0b724263138
SHA512 f001c7ddce25f0d504ce701c1d5b4e9729a581c48888474946efae4fac877e41437056463be2d36cc9adff78770dd15d00c050b07f9e188ed3e133134c21afa1
TLSH
T1D4414FE14C3E26D2D8BC0A3E708B78FC95D8C72AF4A4357D6824EA88463A51E644543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a8a77b8212fc9eb9a7a79f0e1f41c98107918d9dbe7adfacc3bb6e5aff920db9
MD5 e6d720fc8dff531b78f6322db1c69447
SHA1 027e8a39a44155b5dbb7706aabaa308616231313
SHA512 788ae4aae5c56c65f98b9f1ea9216f3108809e012e8756c2059db04fdd8c8fd9d1a23e0c0e52a1285f9da0f330e26bac6042aa2fe3effbae67d273cd67f0032d
TLSH
T14F4151E04C3E2AD1D4BD0A3E748B78FCD5DCCB2AF5A4347D6824DA880A3A50D248543F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3cb6c3fbc6412d16b61b72b9b5df71ddd1c5a631cdd9cb0ff8e6473e1dfb940a
MD5 f4a1d6239ec239b971787e7d42b9e5a8
SHA1 18bc38a72f977972e399614fe9853f0edf614dfd
SHA512 3d7856b56d4d92b1454936fde4e9578979b37387aec86b9fd05f00fc9ed4abf4b7c5348b2f0d2d590205b67aaf29faf84a9c5a37318ae462c74b6eeb423774dd
TLSH
T18E410958B6FA2144B3B77E16ABF6686D847F78772A06D55D10120E4E0A23B40C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1072-939-0x00000266ADC00000-0x00000266ADD2B000-memory.dmp

Download

memory/2704-337-0x000001CDB5200000-0x000001CDB532B000-memory.dmp

Download

memory/3716-8-0x00007FFEA0C70000-0x00007FFEA0D87000-memory.dmp

Download

memory/3716-5-0x00007FFEA0C70000-0x00007FFEA0D87000-memory.dmp

Download

memory/3716-4-0x000001995C670000-0x000001995C722000-memory.dmp

Download

memory/3716-3-0x00007FFEA0C70000-0x00007FFEA0D87000-memory.dmp

Download

memory/3716-2-0x00007FFEA0C70000-0x00007FFEA0D87000-memory.dmp

Download

memory/3716-6-0x000001995C7F0000-0x000001995C812000-memory.dmp

Download

memory/3716-9-0x00000199589A0000-0x0000019958ACB000-memory.dmp

Download

memory/3716-1-0x0000019958C00000-0x0000019958CC0000-memory.dmp

Download

memory/3716-10-0x0000019958AE0000-0x0000019958AEC000-memory.dmp

Download

memory/3716-0-0x000001993DE00000-0x000001993E656000-memory.dmp

Download