hxxps://cdn[.]discordapp[.]com/attachments/1475510646866186262/1500521486329315389/LoginApp[.]exe?ex=69f8bd08&is=69f76b88&hm=14a11a930897bb2888e4d75f4508bb7adce52e7d577f7da292f26cbb8096741d&

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1475510646866186262/1500521486329315389/LoginApp.exe?ex=69f8bd08&is=69f76b88&hm=14a11a930897bb2888e4d75f4508bb7adce52e7d577f7da292f26cbb8096741d&
Sample260503-s2ecescv7w

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
12	5044	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
2788	LoginApp.exe

Loads dropped DLL 1 IoCs

pid	Process
2912	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
57	discord.com
58	discord.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_2070171797\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1352039868\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_2070171797\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1786168489\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1352039868\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_2070171797\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1437210036\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1786168489\deny_full_domains.list	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1786168489\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1437210036\edge_autofill_global_block_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1887370729\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_2070171797\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1437210036\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1437210036\v1FieldTypes.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\LoginApp.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5044	msedge.exe
4764	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222962277533742"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{5C3A3C50-7EAB-4C33-9590-11D81DE3121A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{45C3CA36-98FD-474A-AECC-6E63CB5AFA27}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\LoginApp.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2912	msedge.exe
2912	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	LoginApp.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 5912	3240	msedge.exe	78
PID 3240 wrote to memory of 5044	3240	msedge.exe	79
PID 3240 wrote to memory of 5620	3240	msedge.exe	80
PID 3240 wrote to memory of 5620	3240	msedge.exe	80
PID 3240 wrote to memory of 5536	3240	msedge.exe	81
PID 3240 wrote to memory of 5536	3240	msedge.exe	81
PID 3240 wrote to memory of 5536	3240	msedge.exe	81
PID 3240 wrote to memory of 5228	3240	msedge.exe	83
PID 3240 wrote to memory of 3644	3240	msedge.exe	84
PID 3240 wrote to memory of 5228	3240	msedge.exe	83
PID 3240 wrote to memory of 5228	3240	msedge.exe	83
PID 3240 wrote to memory of 3644	3240	msedge.exe	84
PID 3240 wrote to memory of 3644	3240	msedge.exe	84
PID 3240 wrote to memory of 3988	3240	msedge.exe	86
PID 3240 wrote to memory of 2020	3240	msedge.exe	87
PID 3240 wrote to memory of 3988	3240	msedge.exe	86
PID 3240 wrote to memory of 2020	3240	msedge.exe	87
PID 3240 wrote to memory of 2256	3240	msedge.exe	88
PID 3240 wrote to memory of 2256	3240	msedge.exe	88
PID 3240 wrote to memory of 3852	3240	msedge.exe	89
PID 3240 wrote to memory of 3852	3240	msedge.exe	89
PID 3240 wrote to memory of 3852	3240	msedge.exe	89
PID 3240 wrote to memory of 2988	3240	msedge.exe	90
PID 3240 wrote to memory of 4784	3240	msedge.exe	91
PID 3240 wrote to memory of 3120	3240	msedge.exe	93
PID 4784 wrote to memory of 2244	4784	msedge.exe	94
PID 3240 wrote to memory of 2912	3240	msedge.exe	97
PID 2912 wrote to memory of 4316	2912	msedge.exe	98
PID 2912 wrote to memory of 4764	2912	msedge.exe	99
PID 2912 wrote to memory of 4432	2912	msedge.exe	100
PID 2912 wrote to memory of 4432	2912	msedge.exe	100
PID 2912 wrote to memory of 4432	2912	msedge.exe	100
PID 2912 wrote to memory of 5248	2912	msedge.exe	101
PID 2912 wrote to memory of 5248	2912	msedge.exe	101
PID 2912 wrote to memory of 604	2912	msedge.exe	104
PID 2912 wrote to memory of 2376	2912	msedge.exe	108
PID 2912 wrote to memory of 2408	2912	msedge.exe	109
PID 2912 wrote to memory of 2360	2912	msedge.exe	110
PID 2912 wrote to memory of 2384	2912	msedge.exe	111
PID 2912 wrote to memory of 2384	2912	msedge.exe	111
PID 2912 wrote to memory of 328	2912	msedge.exe	112
PID 2912 wrote to memory of 328	2912	msedge.exe	112
PID 2912 wrote to memory of 224	2912	msedge.exe	117
PID 2912 wrote to memory of 224	2912	msedge.exe	117
PID 2912 wrote to memory of 2972	2912	msedge.exe	118
PID 2912 wrote to memory of 2972	2912	msedge.exe	118
PID 2912 wrote to memory of 5528	2912	msedge.exe	119
PID 2912 wrote to memory of 5528	2912	msedge.exe	119
PID 2912 wrote to memory of 728	2912	msedge.exe	120
PID 2912 wrote to memory of 3680	2912	msedge.exe	121
PID 2912 wrote to memory of 3680	2912	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1475510646866186262/1500521486329315389/LoginApp.exe?ex=69f8bd08&is=69f76b88&hm=14a11a930897bb2888e4d75f4508bb7adce52e7d577f7da292f26cbb8096741d&
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x214,0x7ffe01b4c188,0x7ffe01b4c194,0x7ffe01b4c1a0
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,17314333039836631669,519305020405520341,524288 --field-trial-handle=2668,i,14488277048104572790,15993369746845341310,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,3089870635208089636,7599425265110092227,524288 --field-trial-handle=2668,i,14488277048104572790,15993369746845341310,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,11100226660108165119,12142325031643048926,262144 --field-trial-handle=2668,i,14488277048104572790,15993369746845341310,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:2
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,8100314601263454372,3538031063059240156,2097152 --field-trial-handle=2668,i,14488277048104572790,15993369746845341310,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,18414731149918707130,5732085182333153567,2097152 --field-trial-handle=2668,i,14488277048104572790,15993369746845341310,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,409602727143217456,3527039844925966536,524288 --field-trial-handle=2668,i,14488277048104572790,15993369746845341310,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,3008960457410179958,12632502872415097312,524288 --field-trial-handle=2668,i,14488277048104572790,15993369746845341310,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,305218945709996250,6868128629980596310,524288 --field-trial-handle=2668,i,14488277048104572790,15993369746845341310,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5484,i,12551910167910234326,13220199707023060921,2097152 --field-trial-handle=2668,i,14488277048104572790,15993369746845341310,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,9778286178957953972,11649015439574650505,524288 --field-trial-handle=2668,i,14488277048104572790,15993369746845341310,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,2824188403029625872,14362774080457411406,524288 --field-trial-handle=2668,i,14488277048104572790,15993369746845341310,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,16430942566989661735,7317318695681506262,524288 --field-trial-handle=2668,i,14488277048104572790,15993369746845341310,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,16430942566989661735,7317318695681506262,524288 --field-trial-handle=2668,i,14488277048104572790,15993369746845341310,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x28c,0x7ffe01b4c188,0x7ffe01b4c194,0x7ffe01b4c1a0
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,2071555705662693037,6632118186656847715,524288 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,3340420968604846442,7263383285443223749,262144 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,1768317554696294171,7545444119639088477,524288 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:13
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,3444339441690215898,1256863732701514258,524288 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,3444339441690215898,1256863732701514258,524288 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
    3⤵
    PID:604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,6825297456458250936,5524882646659325157,524288 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,2763132801444600964,2689579538649796064,524288 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,7471503475593732649,12282271748292112076,524288 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,16676969762258498455,12276485274071964752,524288 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:14
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,12178332989117715433,2900372657294618459,524288 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
    3⤵
    PID:328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,10311723025127778380,14696527344304442906,524288 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,5509772193666011913,9196197549519646328,524288 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=764,i,9157660222864053150,16761351003480836301,524288 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=1060 /prefetch:14
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5212,i,2719414724370785161,6272424077171697965,262144 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4088,i,10517237858294871578,124446827604117353,524288 --field-trial-handle=2116,i,13354772138454930548,642939802177891991,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:14
    3⤵
    PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5540

C:\Users\Admin\Downloads\LoginApp.exe
"C:\Users\Admin\Downloads\LoginApp.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
TLSH
T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 727b9c64de42b97b0c07edefd85353a32601f1f961d1e5f8df8766c0155d8d51
MD5 9b4e125867b60d02602f440395c98fac
SHA1 4eb2176db96d718ebc158d7c48224a615b75c178
SHA512 7726a6bbf9c459145bb3c953e571aaa388cd984d8db9a1bd56af3534abb19967036198f399d4110fec3a50b87549eafff6460f4a9a05564787a7ea48e14e0cb1
TLSH
T17BD0A7367756F822D17844B580115651256A948A288B9186E225404E44B99A8A3D62A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2c450fd38bcc819a5f89e7131381f8da62db0d94450ab959a2d96aa5895d3290
MD5 581697791a875281fccb7192b967ab24
SHA1 b7fcdf05dfffe5e1200c4b696d1e398a54a549c6
SHA512 38967ae961523577757d4065dc2f535872471287c55c086e2cf3af16e1134500a50a40d4eb9c15091ebc217205607a83b0bbd4be6adf565fb739b384b5c7c9af
TLSH
T1AFD097BA3B15B812C098A4F2D0041A4032A6A08E388A82826126900E04A9890A3E6397
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 36a5040ddcaa8eec0c5e92d3ff2389aec26ba6eb94935cf41356ccc5baf42873
MD5 cad75a16ffe25c2f33cd1a4335023c1c
SHA1 62a13061902cf9c6fbdc750f7e4aad8a4808ffcc
SHA512 57fd0121839c181d1991c0929ac157ecd263e33cd7c6ee342c97fbb295568c30a4d647481ec46790ffae7458656d181c4a8fe92c0b56eca81a6aef6852ce79bb
TLSH
T1F2D097BA3B11B812C084A4F2D0041A4032A6A08E388A82866126900E14A88A0A3E6397
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 524KB
SHA256 b88185c1f6d34944e5e8ac08c98d7be26ed3290ae7c92ba7354218db3ec9f711
MD5 2fe9f6a6bc842adcf775beab56c10430
SHA1 86c84f9951d80eee3ff9aca4d433666f36d5c4a5
SHA512 2be88b90152a31b4fefe5f7f72639b3a44b12fc7c0aaddaec59f15a36b89814627ba902a2bfe2427b51db2d000c79941fd55cc3a37c618a38447dd25caaba7ff
SSDEEP 12288:Z77rekCERotGOt4NU+jgt5b0KYhxrOkn7xQ6mvruD3RbTeG+AccX8WOO6cnRZc:xcEiGOGNUF5QKsdR7C6miD3Rbx8HYR
TLSH
T109B42344373C3035CB734B355E72AA918A36364BA963CF9962A91045EE0774A17B3FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7cd762c9ee9f3ec322285ab87c8e3d33efa18b29837130587ce463ea0ec79a60
MD5 1d273369e769f653b7d80940ab524341
SHA1 af85fafb87d6af00014defa6c487b21357227170
SHA512 8fd0af24fec4bd5994bd473d0aa6c21f76fe50c0f8225b4613bc8f6eee5a0f4b5bd76f38ba954017c556eb2c24bb297f9a2cb56975639e485ee4186edf17dfe8
TLSH
T10261E74B81EA9868E3E17BB94EEE17677230859801775F2717ED013F1A49B12B370433
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 c06cc6d0e6bb073b540fe337870f9079c4dbed7bc9d208329c1fbac0bcb0ecdc
MD5 bb3994c2e2f2a29f39363107ad3ae730
SHA1 692a1859e0cdc3cd682411a3be84eaf6d7e9d735
SHA512 258a8680e805e9dbdb071385996142f0f7d5366760fcf4177e62cfbccf6b7f8ae0b788cd57e42048da8b083e480bdf71bf062841a2b02b5b8d0fb5c95b9aed8c
TLSH
T1DEE0D8D875CBC55E791039C782246F18C5C034A2EB85AE836700C8C07643802B24565B
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 ea5be7954f049239d15debd0dd28c0c1090a5b21e3dfd14e2bf46d5d27fa262e
MD5 1d8b0fcde1cc48ab26456ac955f41e4d
SHA1 ac0612bd270dc2a9f5ea67ab9245b5dbc745428e
SHA512 3aecd8a92271b5f2b35131dfa2dbe2471c8d510bca50382262d8f4682af11b2db4f9b5f6776c6cffad1c1476847e2c126c3e6a5d88a6c844138ccc1107757eee
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jYZW5LpK5fKFtIWqYpv:Tyi+7f+UZD4jJ/BkWxpCKFOWTpv
TLSH
T19DE2F34D3B11F511C8ED733DB0C2C6F1AEBC692C4A5E7071A13C99728D526A1F49E15A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 322B
SHA256 0798d3bd7d4ae985901701f62fb1ea9be7774a37440ec3a9930d67b608089707
MD5 f50be96c65c4db9cbe6a5f83850a399c
SHA1 572e75e6b8c6faddeb8157e81c1cdec87922213d
SHA512 cfb6f0aac3927666ef7c1e82890dfa441968321003cc3015ed2777e9a6c4e92cb6a1c18f2c33e0179a916fe9e9139f745ba12307952c3d6b664a6e19d109fd7f
TLSH
T1F3E07D0835CEC93D601E76E7C3A49B0AC3D9342EF388FA82174CCC507001604B2CB396
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log
Size 190B
SHA256 46ed76c989fa492af602d813eaf61c17edd71251674807a443b8f9ccc988292a
MD5 bd4367115c311692e06b63f1793b0624
SHA1 cd807fef06588e7c56fdb1a3a2ce15ef04955a16
SHA512 98e63595b75951b719868396e11ca9153b7b987dd9737e3dec67e067c9a68ab706fe993bdb8db86d664d7353d9dc7d742d10430ddd0fe5f0847c687fcb257e52
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 326B
SHA256 9ef20466ad7bc3757f98cdd4cbe8e5a70f469f55e6321469de32fe8753b82aeb
MD5 765b89696aabb260eaa99c03f2e69e53
SHA1 81d48bc9928c1e00658af25b2e8c73afa96583c4
SHA512 5da4f6d2573b48a3b50b55d7e04ecf508db3f481e9718911eecb870b7577bd140bc3d8fc504d67e2f032d3058c6394fd97e9ad61b3d5749d618e91cf1fd66cf1
TLSH
T195E0260C39CAC93D601A6AE78374AB0EC2D8342AB388FA82170CCC506041700B2C7396
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 513B
SHA256 388c5c95f0f54f32b499c03a37aabfa5e0a31030ec70d0956a239942544b0eea
MD5 c92eabb217d45c77f8d52725ad3758f0
SHA1 43b422ac002bb445e2e9b2c27d74c27cd70c9975
SHA512 dfd5d1c614f0ebff97f354dfc23266655c336b9b7112781d7579057814b4503d4b63ab1263258bda3358e5ee9457429c1a2451b22261a1f1e2d8657f31240d3c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 e859ca30dde8c24c22dd4857447a70f700acc62bdcc66d23a34cf9cc90c33820
MD5 918a5e6f0ae20682ac05f37efb8c33ea
SHA1 35bef44bca4ae29b7b8b7c564dbe3d7d44b95dd1
SHA512 364610635eb07c0a299a7da54d42eeccbc5b64f9329c5032b2a8ebbc10ee7a37804822080e8f233d0a1557081f7c7211ef994d4375bdd75960a14ae82e7f443f
TLSH
T15CE07D8835CEC16D90147CD383687F08C7D0340AFB883EC21748D8E4B103A4BBA8A695
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 917eeded356bb4702501e8a4ff7705e60c6db08a8488e975da97812b3a36dadc
MD5 11dfa2435bc5bb52c42c07f61a3830fe
SHA1 7e05f15a0c6aeb61dda8219beb7b0221f06d24b6
SHA512 2d923d80f77d93473916de0a2ee3efd349db5eca6d164da8e80fa6bd90f14659517b1cc590f3adaafc0626ce7d5eb11343d1136f8892e42ddf676f4aea86876f
SSDEEP 192:x0DIX40+G83uxXBBK31GkSJYEJH7DNspU:x0DIX4a83uFBBQ1GkSH7DNspU
TLSH
T10914121F5F243722CDBD91762CE644A35D7DF03F8B53669A686104B4CEE3652A02C8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 7f0c8683b154a9ac862ca6f45d5c78288010c78bc51432fb228fc4a67f016cba
MD5 31a264932fbb5f632c0372ad737a296e
SHA1 cc7f327331436f0191540f532c5b23e9457da936
SHA512 837493d3a1f10d39fde20587771ff7617c534314f49808c8386d98432a9cdce2646a1a790a22931088c17dd59dd578d8c6e321fcaaed1c606c42e73276dcd0c1
TLSH
T180E0D8E566DEC16A561424CB4328BF08D3F13406E7886FC55B08D844B041004A2969EA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 aa77283bf9537b77d9e329fdab5bc36c60acd017892b09faae78e94d623a2c0d
MD5 aaa7d830170214a0fc5f006f835c9342
SHA1 b7694ab4a9dcc485d175cc857d546ade1efa7207
SHA512 3b7ea28c291791a637d90670e0c863636855d792e307285fe1c078ec9085fe454d7685214e559195067652587f0f89268a87512f988514ebb95ae5a7ff619d83
TLSH
T1C931BBF783F4856E8A1196F0AA18AE2FCE6D0511436C7C5A85E4AF1B93F3861E101A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 33b58957d485e973ca1b82effd97da028fc4884c6fd3001b448e5dd5560552ea
MD5 f5b1536338a5bb52d5b68399b801351d
SHA1 df65e71c56374f48235f863be8cf614e11197fac
SHA512 fe9021d113789762162047b9917f387404b083169e453dfa635ff7a1886f13a2747c020e8c8189dfa177b7d0b11834995415fb0b1ae0272638503653c12e36d1
SSDEEP 192:sxZgRryMqZ/K1Ml8Qog/fqsQWpV9DvGgeILcEzodpW/W6+WNGY0lMavwhIgZZeJ:sxZgkKg/fqsQWv9D+ge33W/bG5wZZq
TLSH
T18772D815AA24AD3B8CDBD319FA55BF53D6F9153392914E4499FCCB0C00E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 0e9dc3e3256b7d8cfbd732c585ea26790c08f0347839ea86cecd12321c84fd2a
MD5 4a3824a43b1bd1027fd5dbd2906f5159
SHA1 7b3835e183ec2ae60457f4aa93a0877b4e03f229
SHA512 abe48fc4baa923779a8f2bbe25074f83f35613daa60d1cf2d45311a55df7923a70613c2365ec804fd8c7f5edc895e394e11a1aabd52a2585c9bc98254921d3c9
SSDEEP 768:EZN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3i7yZLlk:EZN9b8PT24ZE/CuWRmCCQx6u1jaKi7yw
TLSH
T1A6031C3B280CCB7E4F804E9CDD26AE8E7DE801CB9698899447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 0b0d936f471384232f7bc5d8a7bb9132494cbdd5b3c90130e89f79a8fc24563c
MD5 36bed4f7b285af8898d3088150f003a9
SHA1 027feb4c19da4956597485a719a4405b5fa51a12
SHA512 575898354b72f1eca7121a5b3ce28a9ea5ff26a1c9eef8f686ad442457ca7c7dd4569b9e7692a0348f28b218fbe6295cd371bb54dbd1e214f4aca8e6db5a6317
TLSH
T13DE026EC3ACED57E603720C70324DB4CE2E47417FBCC3E822F80C840A142A09B1965D6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 cebe55fb2174a658b668352ecc4bcf1fade2de40b42606212c08a9d8cf5a2731
MD5 8eb04d7eddf61018a9cbcc147b0b3d2b
SHA1 ec3bfc452126e0ee9bc5f091fb6a929afb2aab98
SHA512 87a37aec0e64123009fa6200d7175c242df774000cea013a51f5bfb9d08ef7a05be03b2913ca8da3ff75d1571cf0ca90aaee63c72b568bb8dc49fdb992afb477
TLSH
T1C1E0D8B876CECA2BA15620CB5324EF08D1E27402E7D8AB923B48D48072063907247999
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 9a4285fb5f4757d9d7a0ca21e1358fa9ed99df6a8e21ad3a1feae0db3318581a
MD5 a46427464c17f5df0f78ea28fc4d5a30
SHA1 e92b39b08a8e7eb2ddd575180fd4f391b59d38cc
SHA512 68e14b6a24609fa5e83642d75e624cc014141fcd7744c21bff356853f8d3099237c3b618b3e9b239e309ae573677bc2f2a2dbd63db7b8342b3acda46539190fb
TLSH
T153E026FC76CEC63A542060C34364EB5DD2F07806B3CA3BC2A7089480B101202B2AA9D5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 c69f4ba76b15ac3089b079459b9a5df3a7f13dfdc3599f17e775610798193e6c
MD5 884813b7f1363ecc0ba54dc9ea3983af
SHA1 14985a300bb415f0304457c8a8179e4e0387d1e9
SHA512 7b16cd3488c98eb4ceebc0f662d959a23f974c1a919764588b4d20b91cd2eb5f4f00b53cb7ee04d3edcbe762feec7e33ced1fd6b583fb8ca3cc14e5358d9aa05
SSDEEP 768:cdOlNXJjSSjroduZNPqxYUaEA9YH0MyOPWrCKvo51U:cdOlNXJjSSjroduZNW31U
TLSH
T1FFC27D55713B13903ABE258A8594F8AF46C230733118E43B7BB954AA0F67E14DDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0d3a31b74ed3cfc7baace321cf0561eec3060881ab714dc077652cf74be76912
MD5 2317d3dd6b07675c46de8b19e6fd45d9
SHA1 9f11ecf232403cae44bbb359d575bbcb1e90a8f7
SHA512 68982acbe840310617325a86330ef4abb2c4c7cbd028c60785eb6ccee80da3f3552042d52c99ab085359a6bdf402670e3453a2c5d22d586884f8f203272d9caa
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZNPqxYUaEA9YH0MyOPWrCKvoi:cdOlNXJjSSjroduZNPqxYUaEA9YH0My5
TLSH
T1D7B27E55723B13903ABD298A8594B4AF42C231633018E43B7BB954AE0F67E54DDFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 1c1109c62fbc806e147973c58cd1209890294ce8dd8f1209679f509618e21d6d
MD5 692af17d663493345cf1ead0f88f9e03
SHA1 fd0107087ed4f7072cd9b813857d1f9d8f3873ad
SHA512 dae0eb397c737092f5d0e1518c61333b536c909cabc0f24f312b5b1493770564735a909bff0def7fc24629880d06e280bc43b28958752450d201e5e8ea4d3aa7
SSDEEP 192:FvoWsFfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aVfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T12624540A7B747001DDE7D9725CB080771A3CB16ECF22A6915DA254698DB3853A33D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad7f9aff-9a25-4d90-912d-838b74697821.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad7f9aff-9a25-4d90-912d-838b74697821.tmp
Size 414B
SHA256 80acb38392aa3c40ec75592b4ca5de228fc85ed26f1879e25907cf8ddc56ef0a
MD5 86e8349a85ecf9b777cf7101c0c589dc
SHA1 44ec24f5ec33f43f7c467966d6739c2076a16e6d
SHA512 f3c38ed1cf09fa2ff42d4ea3ae62bf8877b20702f3bbad2cd83025f2e7fefa05dc7860d74d242c293e98a6e6b936b61d261c4fb29389f85bfa5396aa5f16bce0
TLSH
T100E022AACC60EC3B49FD4B1820584786E75023672B81884F3A3DD2098FB1A3B4686C6C
MD5 SHA1 SHA512 TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9bcda08-1a4b-4b5d-978b-e273249a1a29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f9bcda08-1a4b-4b5d-978b-e273249a1a29.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 ac068bf966f1f0ef553e8d9946419ccbe9fe41b30e43fe65cc614e28531b95b9
MD5 f566f42dec7a73cd95ef5d01fff68932
SHA1 5a1af1a6a6c8594f866107be2dd0324f6c82bdcd
SHA512 c7ce1f01ef56ae68bc5749fbee58d7ca31a23450c84f1ad5b5d51bf61d70fa17a9642a6504779113de54ed3fb275bd65c5c77ad8c3667c857b2caa93345bc9ac
TLSH
T1965106C0A3A565D57FC9B982C21A781368E13E76370E69B1332E44F84F44C299F6FD25
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 17KB
SHA256 c0edf3b767a61bfbed169683328ba58067525953d8774503930ed61a0ec2a1c3
MD5 ae5cc1a1f31c863f325af0c362ac1eeb
SHA1 0cc5ae13f741b2117b281b279e9beec45f045d23
SHA512 0745447035248a3dc289c8ae31fa12ea0acaf585d70c7401968d33871fd5addd73bcb1f0228e007ee00db631d9d56315b599fe428cad3e919135960416cb1ffc
SSDEEP 384:wBjssus5hmBljmBlfmBlvmBlpQcIIIDbzMIMSBC:sAs/5hmBBmBJmBFmBrQW
TLSH
T10C72C66A3F891BB3C64F2FBB1769C65513E6D9410DA2271D3020588E9CF2B6787C06F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 9ecaf88bf6fd3cf72504a24f5852f3985785c66b3e5f3db67fe15f1953270d93
MD5 3ab490fdfb75a83b8ac949010d7acd9b
SHA1 39e5a149b1437428a1cd3c4aa768b546bdbb1847
SHA512 894cd38250703e41788c494b0ac4fe6de35f17eb4ad9e6ae46fef9dc4383408e4cc18523f49103fdf79b0e265dfe6ba39cd911decc3a31d934fd4c796960d633
TLSH
T11DE02694BACEC96EF01430D74224678CC3C03843FB882BC61F00C884A002102B28A592
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 7d9a93db6b298f7bea6a31ccc4a9ed8b320225f462ab7d6673cddc42117d764a
MD5 fd9c2df44f605f92b021c9082dc31f31
SHA1 1b1d2bd6c7147c739e6cb86c5fcad5148ddc0811
SHA512 6635e19f3f50769179ac4645826c87b7221d58008b0dbd52d27357f6a608189fa4df5364685c5d3dd60680eab250d781f97376142529c7b87c0c673bc87c0de0
TLSH
T1A221BF16F324C149E18E8A3EA06B97350378E9129FBCDC0F44B920356DA2E001E8F6E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 1b3902ea70e7520f2c80d2e833a8605b08e8a77ec98a6ed177938f8b0ecdc1c5
MD5 6d039d4b98af864269db70a10ef3996b
SHA1 4ec62f5fee68d6855fd398f72e938de5024a6e3b
SHA512 b93a976e695ade21ed11038d702d563dfe3152148e0b0b0155b3df111370480d1159ff1d1c9ffbc4a9ceeb6dee003106d2e95c677783f5500f61bb9d407fc1b1
TLSH
T10FE0DF94B9CAC1AFA01031C30274B78CC2D13812FB882F822F00CC84A106142B38A192
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 fa9fbf6f73cfdc109f821799199640a37dc21f475baa18a4264e794ac1aa7bc8
MD5 08a31b908d2c490791e4859221fb4966
SHA1 22ea4d030ed2786ac81110fafac772738015dc2d
SHA512 c9a6fc97291ee0770cc35c9806063179e2e66b15dc65e0434c3f100143a73a53a46def37d3be48df633625a1985c3e67238cd20cb640fb8210bce0e0b24f0953
SSDEEP 3:MsEllllkEthXllkl2zEflRu:/M/xT02zx
TLSH
T1E6440204AF84041AC54010304456C3641370E45005335B572491042A5CC6A421C04001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e77444e24470b853012aa84aef123eda6d9d0c37963014317f7e0373bf2e4b5d
MD5 cf11d4850a2c7ca7cf3f1c355191c38a
SHA1 54a89ab9f7f1a7203b39e3b9912ca320044775dc
SHA512 028cc44f6f91665d00a44b01b5b31e04205960fbb295fb1a78d2fee76c5caf33636610796b90c4310b8ebb7349ad5b685d98e82e9cbc83d099db54ffdfdc5abf
SSDEEP 384:nFiFAcXqnd8NV8TUNTUlIR14dsEh14fDKn/4UXv9SXO6DES7x545wiqFvvbkrN1T:MFidqwgseKr/9qO5Ix545wiqVET
TLSH
T186F2287ADC58DD7F989E6B88A34E7612A9E05133D67C49A4E7C80F0C90B389DF307825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 633e31d66ba8ecdc858697b71b513d5bf465e4fba72906561cd5369936f2e761
MD5 648901a60c117020db06daa5d9849ebc
SHA1 c55c3b1eed3871588fa4dc9bbca4dd17dea2c6b4
SHA512 59f40b8034f15ebdbb14d8feec6186e7ef2ba65945d022e6fe839406d1dba9113c2c8b878092fe40b30b054ef9f20cfecf9b5d4c584ef32f931bb787b00ca09d
SSDEEP 384:n4iFavqMg38Ns8TUNTUlIxB4d451QK14fDKn/4UXv03oa3Ra4yVrN1k+5vI+e:DFayv3TwgLDQzKr/03oa3Ra36
TLSH
T19CC23A75E858DEBBE9EA4FC9A70A7603EFE051A3A59C4ED4DAD81D0D00D319D2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 32c795e8023af6c84839f251da3fcd1e4adaf4657c5e9fb3cf8558780f859a0c
MD5 12f1065db261acc313ac746eefa19ed7
SHA1 3bb2bbb5b880c4900fd97fc626b64ae13bb29c0b
SHA512 8632e62c7eea8e4dca6ec419f446d850a496697df5960f7db4352c3ff6beb46ed8ce9dd48d6e20fcb7f58e9e792ef9f640001eb4397a989a29e1bae6e48180ef
SSDEEP 384:nkiFavqMg38Nx8TUNTUlIxB4dKtC14fDKn/4UXv9SXu303Ra4yVrN1k+5vI+e:/Fayv36wgXbKr/9qu303Ra36
TLSH
T112C25B76EC58DEABE9EA4FC9A70A7603EFE051A3954C4EE4DAD81D4D00C719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9674e673340e52eb7b680d23af1085987365a02c7753e0a99328d8db14e6557c
MD5 7ed294ce407559118a42d4a29bde94d3
SHA1 5dff541cf5b37630a56b72ced08ae4b2bf107bbd
SHA512 ff01eeeb4d5f3a1b791d4fa35c9c7eb9051443915bac49d1d10acb427d5aa7c9d74be05045c556103c0ace01f99a5378cd26e4044ed500dfb7e4734a17490cd6
SSDEEP 384:n1iFAcXqnd8NF8TUNTUlIR14dsRh14fDKn/4UXv9SXq+VqFvvbkGx/7IgK:8Fid2wgJeKr/9qq+VqVc
TLSH
T17FC24B76D868CE6BACEA4F89B64A7743EFE05163994C5ED4DAC84E4C00C35DD170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 3c4907eed9b775eed812d8cd8019e45a2db7fc40cf30f6fdbb053d548ef04485
MD5 e36e9b3997eadc5d634a718dd84fb46c
SHA1 88917f58cd7d56b05dc6ca7d46e8a0d6e73bfa1d
SHA512 3e078960e0f9180cdf6e04564ee1872e968c5258914044677bda7596b979b70c90d517d6adf3ccd629794f5e7993c5a8cd70ca68bbaeb01c77ea90784f0b6384
SSDEEP 384:noiFAcXqnd8NF8TUNTUlIR14dsRh14fDKn/4UXvwCSubx95jjFvvbkGx/7IgK:zFid2wgJeKr/wjMx95jjVc
TLSH
T11CD2393ADC58CD7F98EE6B89A24E7652AEE01273D56C4ED4DBC84F4C00A35DD6307829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d5bd24f139f26072e8924f5d986a0b833fc8ce61be57abbe700a7a02aaf4d5b8
MD5 9703cf0d01e1505d313290c20adf18dd
SHA1 f69f0ef1029aa3499a19cddd150ea38ef9a08f59
SHA512 cf7a8c7c94a85b9e6e486862d6d1adb66483cbf9d05f10e8ca0badf5693e65ea73da9b6d67011a0d12abf562d7e088c139646371f59abddee22955b5f70ba743
SSDEEP 384:nFiFavqMy38NV8TUNTUlIRM4d6bVh14fDKn/4UXv9SXO30qFvvbkrN1k+5vI+k:MFay93qwg6eKr/9qO30qVEY
TLSH
T14AC22A72D868DEA7EDEA8F89B70A7603EEE05153958C0EE4DAD90E1D00C75DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4a21afa907b1d0921c63df307681e288d10b782a77071f188cfcedba502bf888
MD5 2503148233fb5e03e47910ab199d988f
SHA1 5805b22fee74eb2eed5a08303cce05e923bc8558
SHA512 1301add5aa7f9b7a80bd3e0e9ae20a2c063e6e09fcb356bf6e4e5da72757a988c9b8b898995c832ddaf6bd72695da68fb3a7ddd6224f7fbfd037eda77652b11b
SSDEEP 384:nFiFAcXqnd8NV8TUNTUlIR14ds/h14fDKn/4UXv9SXO6DES7x545wiqFvvbkrN1T:MFidqwgHeKr/9qO5Ix545wiqVET
TLSH
T1F3F2287ADC58DD7F989E6B88A34E7612A9E05133C67C49A4E7C80F0C90B389DF307825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 7a17bce006cc200a99e0e465a7fb84734c9f43c8b9c64b01f2ac44178740cb09
MD5 08322b43dbc76031aec3b5b1dfcbd073
SHA1 688dc3964298a0b924f1a0a04e592d3ef062a7f1
SHA512 79161c2b86e5c57653d5d8710d95191b70547680fc5380db7cc4e442cc4b5be1cbfba7a2e01d13043d169ff0d102d37e1073b7901ecb8e95d6dec54752a54cdb
SSDEEP 3:MsEllllkEthXllkl2zEfl7Wl/:/M/xT02zRl/
TLSH
T16A4404047FD4040FC55010304055C3741374D4503531574334D104377CC7D405C15400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f933bdaa50c2bc0e0f30c8c71bddc797c8d8aeaff53245ee1c089e7deba0a210
MD5 763eddba443fc0fa792e1439f53cd18a
SHA1 c065b67ac1d80d9f88bd9597a4429c5df494f25d
SHA512 b6711b3f03e4181ce07e2f3ffc4491edb674503590c7ddbcd8626c34e386cfd7ad7d453d327078eed61e20926194dda570beeef11ef85c30c1a13c6295deb7ae
TLSH
T14F4160D04C3E1AD1D4BD1A3E649B38FC96DCDB2AF4A4347C2824EA980A7E61C648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 06d50bdae2e6b8befbc216ad21095d1acdbc350b62e28946fb438e4becba5128
MD5 ab31f9a1add62ebff3b2a155677908e4
SHA1 9366670e83b4b8c655f47d88fb461f5d4f4e9458
SHA512 c8f549e0a54f7a936200ee649ce265430cf949192798b0c5e5c4293f5c2232e2915fc1a69c27f55fabfaaccd1e7adc8bcbdacef62703ff42c47ae07b921cabff
TLSH
T1894140E04C3D2AC1E4BD1A7E748B38FC95DCCB2AF4A4353D2824E998067A61C748443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 265f973437a74550f0c30381751a4f0f7d213749a0f577bc45e283fb51a94f96
MD5 c2b390104a44982afef3bb0b6fe6d3e5
SHA1 b206a8bd4b4b75bc793c7ce1a0257ffb8ae39fc2
SHA512 c6a3b5eb814b9984b58fa60a0e3e8d3f2c81b23b6b417e8926cbd5ddae05a9fc3daad14c21be81330bcb5844e3b667843d800cdccd22c94670844fd67cd3b2ab
TLSH
T1AD4161D18C3D26D1D8BD1A3E648B38FC95DCD72AF4A4357D6824EAD8063A61CB08443F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 8KB
SHA256 858df4be066b4ce0054684cffc3844f2aaf873b3f38191447c3dcec583e3aadc
MD5 3153518c1655c6e657cca548c87e7229
SHA1 a30cb6f81efcfa4b0dfce8a42bdfaee2937c73f4
SHA512 526794e47b01841e0ee1f67477ad28834957ee482b3e0cac84419f513699cc3e20e56a76d8d33654bec176af22a66a042c66a3a85a102d9bb3612491a4e14649
SSDEEP 3:5kl43llQ/8QuQll/lZAOSl5eqJ/cSFYojpuyOV9RUIt/apqaq5AblGKQlaWJFuQ/:WW4/ZlaeyEGyyqaq695fOV
TLSH
T1650212831A51C877DD851B3E72CA80DAAFF32A0C4945FD018168CC230F45749A74857A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99e2ee05-6577-4d74-824a-6d494ad9773f.tmp

Path C:\Users\Admin\AppData\Local\Temp\99e2ee05-6577-4d74-824a-6d494ad9773f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 3646192f11505b7b752107e980191c48b15fa920e6a40aaf9f8cbaa1ce3d9065
MD5 7a239f886bdaa88eb265490b459ceb6f
SHA1 4490cc8c6701da2fb7f856239f7bb40f229ce8c1
SHA512 51b6cf9c8a274e5980349c2bdcafb3d04d7151f67ab5a3428a777ea008c1ee035d3cecd4626322be207a9ca829206666ebc58f5161aa28f9e4fce4101d5e67fb
TLSH
T1E5411CD13931B23F9BC78BC970760C846C71E181036E9A5CAE5A4476BD5CE91A31EBC6
MD5 SHA1 SHA512 TLSH

Submit Download

LoginApp.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\LoginApp.exe:Zone.Identifier
Size 220B
SHA256 9e1324d7a235d4b480d20641c54a7b56a3354176e0aff75bfbbeea5fbf85322d
MD5 c69da4359c653fe56c00b0543fd2a9bb
SHA1 44ceb977cf182271150927b0769176080c23273c
SHA512 c1d0d360cb915e79891eea6aaf431e44334935a935a0aff84f01d36441b50e84ce0ea49ff35ea3de2252bb977840fd4536f2309f6371084937d401b1d32f0928
TLSH
T1D6D02377F10C9DC50D4F3C595EDCF01B713F93844D83D10760808CE658480555094DD7
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1352039868\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1437210036\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_1786168489\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_2070171797\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2912_2070171797\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2244-65-0x000002EFFF8E0000-0x000002EFFF8E9000-memory.dmp

Download

memory/2788-418-0x0000021C7F7C0000-0x0000021C7F7C8000-memory.dmp

Download

memory/2788-725-0x0000021C18420000-0x0000021C18429000-memory.dmp

Download

memory/2788-724-0x0000021C791A0000-0x0000021C791AC000-memory.dmp

Download

memory/2788-451-0x0000021C185D0000-0x0000021C185E2000-memory.dmp

Download

memory/2788-440-0x0000021C18420000-0x0000021C18429000-memory.dmp

Download

memory/2788-439-0x0000021C791A0000-0x0000021C791AC000-memory.dmp

Download

memory/2788-420-0x0000021C7F7D0000-0x0000021C7F7DE000-memory.dmp

Download

memory/2788-419-0x0000021C7FC10000-0x0000021C7FC48000-memory.dmp

Download

memory/2788-417-0x0000021C78CF0000-0x0000021C78D78000-memory.dmp

Download

memory/5540-414-0x000002924AAA0000-0x000002924AAFD000-memory.dmp

Download