e2be9b685058c2d577615805b409eb70bf714f2ef4ace638935ed8995ab97896

Analysis

user interaction
yes
max time kernel
114s
max time network
114s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
06/05/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TermixPS-main/temas-y-fuentes.html
Size 11KB
Sample260506-apf2dacy3k
SHA256 e2be9b685058c2d577615805b409eb70bf714f2ef4ace638935ed8995ab97896
MD5 ddf6e2726df4d35b9e3eb23885492529
SHA1 bc36e1398a411b58f610ba7045c8a29783d7d860
SHA512 24caea56e78292dba7eff406263ceb2bf62a654b8148f25cec4718be2006a1ecdb4dfdbf1d41a82a5fe08ab63d9e364181191addf207948c54df455d8b9d0881
SSDEEP 192:ROPwn85iHg6Jd/TXhOLG7j5liAX1KLlfVV:1Hg6Jd/TXhYG7j5EAX1GV
TLSH
T11D32A862C1E122B60A73D0D6E674972EF1886527EC429245F1FE57089FD6EF32D1720D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\af\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3040_233194120\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4720_1410653566\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3040_233194120\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\fr_CA\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_664141761\_locales\ar\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225006056667800"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3534313381-4287935181-1066995225-1000\{D90E1F8F-3330-4118-B391-1CACAC06F854}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3534313381-4287935181-1066995225-1000\{434CEA0C-6FBD-4035-BE4A-5A0E1B919BAB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 4028	4720	msedge.exe	78
PID 4720 wrote to memory of 2148	4720	msedge.exe	79
PID 4720 wrote to memory of 6120	4720	msedge.exe	80
PID 4720 wrote to memory of 6120	4720	msedge.exe	80
PID 4720 wrote to memory of 6120	4720	msedge.exe	80
PID 4720 wrote to memory of 5148	4720	msedge.exe	81
PID 4720 wrote to memory of 5148	4720	msedge.exe	81
PID 4720 wrote to memory of 5076	4720	msedge.exe	84
PID 4720 wrote to memory of 5076	4720	msedge.exe	84
PID 4720 wrote to memory of 5076	4720	msedge.exe	84
PID 4720 wrote to memory of 4304	4720	msedge.exe	85
PID 4720 wrote to memory of 4304	4720	msedge.exe	85
PID 4720 wrote to memory of 4304	4720	msedge.exe	85
PID 4720 wrote to memory of 4540	4720	msedge.exe	86
PID 4720 wrote to memory of 3952	4720	msedge.exe	87
PID 4720 wrote to memory of 4540	4720	msedge.exe	86
PID 4720 wrote to memory of 3952	4720	msedge.exe	87
PID 4720 wrote to memory of 5784	4720	msedge.exe	88
PID 4720 wrote to memory of 3476	4720	msedge.exe	90
PID 4720 wrote to memory of 3476	4720	msedge.exe	90
PID 4720 wrote to memory of 2680	4720	msedge.exe	91
PID 5784 wrote to memory of 2436	5784	msedge.exe	92
PID 4720 wrote to memory of 1072	4720	msedge.exe	95
PID 4720 wrote to memory of 1072	4720	msedge.exe	95
PID 4720 wrote to memory of 3276	4720	msedge.exe	96
PID 4720 wrote to memory of 3276	4720	msedge.exe	96
PID 4720 wrote to memory of 1200	4720	msedge.exe	97
PID 4720 wrote to memory of 1420	4720	msedge.exe	98
PID 4720 wrote to memory of 1540	4720	msedge.exe	99
PID 4720 wrote to memory of 3040	4720	msedge.exe	100
PID 3040 wrote to memory of 2208	3040	msedge.exe	101
PID 3040 wrote to memory of 4676	3040	msedge.exe	102
PID 3040 wrote to memory of 1224	3040	msedge.exe	103
PID 3040 wrote to memory of 1224	3040	msedge.exe	103
PID 3040 wrote to memory of 1224	3040	msedge.exe	103
PID 3040 wrote to memory of 4156	3040	msedge.exe	104
PID 3040 wrote to memory of 4156	3040	msedge.exe	104
PID 3040 wrote to memory of 3736	3040	msedge.exe	107
PID 3040 wrote to memory of 1704	3040	msedge.exe	108
PID 3040 wrote to memory of 1704	3040	msedge.exe	108
PID 3040 wrote to memory of 5760	3040	msedge.exe	109
PID 3040 wrote to memory of 2728	3040	msedge.exe	110
PID 3040 wrote to memory of 2704	3040	msedge.exe	111
PID 3040 wrote to memory of 5964	3040	msedge.exe	113
PID 3040 wrote to memory of 5964	3040	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\TermixPS-main\temas-y-fuentes.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x254,0x7ffb2df1f208,0x7ffb2df1f214,0x7ffb2df1f220
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1824,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1972,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2440,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3436,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3444,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4812,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=4816,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5564,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5636,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5716,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5636,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5836,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6048,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5704,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5900,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6308,i,17198025995041111120,18099194996609187862,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x284,0x7ffb2df1f208,0x7ffb2df1f214,0x7ffb2df1f220
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1760,i,13468082404395396495,13638983083658084981,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:11
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2400,i,13468082404395396495,13638983083658084981,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2124,i,13468082404395396495,13638983083658084981,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:13
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=4296,i,13468082404395396495,13638983083658084981,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
    3⤵
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=4296,i,13468082404395396495,13638983083658084981,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4540,i,13468082404395396495,13638983083658084981,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4316,i,13468082404395396495,13638983083658084981,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4576,i,13468082404395396495,13638983083658084981,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4684,i,13468082404395396495,13638983083658084981,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4160,i,13468082404395396495,13638983083658084981,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
    3⤵
    PID:5964

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 1c02e2feba3b2af3c045d1ed01f8a67e0923f7e357b32c434e567eef6aac4138
MD5 f05b0294ae4949feed0706bc80fa6418
SHA1 346bb7d2d99251c193652ad4ae7ef2964565b98d
SHA512 348366e162f3a037e74d0e9ff422ba7ca3e14c2b170f50bab2a4b88b29a572028e56965c332bc63cbe89de1a3467c215893ecf3cac514d786ec7ea30c08bcc05
SSDEEP 12:bHiUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:blRqxosfxWMk8xVZ4YWI30otWn
TLSH
T139257D85B34494FFC8C35A7189BD17903774F6DE5F42835B6A377A0E2E671D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d42af73b53ac9ac969b2a7847dd50295d23541efbe3e7a201d570995913f736f
MD5 b0d76937840f1bf3341ad1a83cd7935a
SHA1 5eea9891f9df35b3b3aa69f1366b7c5b0def5f2b
SHA512 9021c5e31c1ec851307517c747c7f33c132c434fc1c18369c6bba2cee4993e2fe2635023f6f80f03a9f22bd3c4f7ed71548282f877baf476a6f52c215281702e
TLSH
T1C2D099A33F28A282E08A08B0A3320AC8AB008080300002E8CA020808280B2C22EF80EC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 caa6466256b75ae62b30fdfe241f77cad4eadabc9806260c243ac3a71d2eda9e
MD5 81f2cff11609cced1f72cb2adda41fb6
SHA1 180d05aaac5ccf29c318b84aced3f40e79e578ed
SHA512 b057ca98473c3d8c4ea1a610d26e7c51bf5ba40845727b1b75d635f012d11c3801e32e4d6bf23d759cb7e6bb5e6b60267663c99ed2ab9b551bdb92f1e4820367
TLSH
T1FFD0A7323F1D6182D59B01F2EA404AD0BB615182345E42D9D611884C695B1C12FE918B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11821bd855e889ed5b593d749ed9d55dccccf4ea512d4d199f006a77708853a8
MD5 577a7075c44b64073bbedc71b06a452b
SHA1 1e0b0347a07de84c7de5f344225d6b3963fe7ea6
SHA512 93629beba0e5ced9f67bc6d8b7a4dce45fc6c58adfdd5753e465f474918fbde86905f96e083fbfc9b4b31aed44d2943c2b94924e8c8829e7167961dbb420dea3
TLSH
T192D023343F1D7143D2CF8573EB104FC1AFA75451745F5285D515500C996B8C16FD6097
MD5 SHA1 SHA512 TLSH

Submit Download

020efc84-5d32-4fe5-a74c-e385239b4fe2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\020efc84-5d32-4fe5-a74c-e385239b4fe2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 b754e6e05c29db41797bf3e126cca4ad30bd383d2a555e9a410cdc5bb307c25b
MD5 b1ddb475b68b1eccb70b1e91063af864
SHA1 04a98f85142cad4d38b323e64453b497c881314e
SHA512 55d007ee7f543ba17a079968564492d014ebbfb2ee5d7a544d80cbde001c66f974653f50c34bbb3a68b5a770eaa81dc12770dc333b4fec2942ddb0b3aaf1df5f
SSDEEP 384:cALrc5O6l/mpUPyvVKt7Fo4ZnWJDjkB+bAC6UioXEwl:cALdWPKKFoSnUbg2
TLSH
T15E1307BD36012E45D6D7487C6BAFDBF46336D924D8C489438331F1122B2A3476E8F499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 1e55f126812db95784ca0f7f7da12bb01f64d82ba0b052c4750214f191d95cbb
MD5 3af146de89775b2e7eadb902813bcb59
SHA1 04f32f5b820254a7c110a0a785a9db40a7225949
SHA512 4f6d6719592049e68b93357280501699dec6e8b36b6c3abe2dd13499ac81f9451041a4d9ed6e33cd1cb8167d2ba3c4db201c5af4da62ba7202db94fc78d0b2f0
SSDEEP 1536:0kAJl4yJW19njfbH8ikpSe4StlWJYp8h68JWQGJjI:U09b4wdzJRhXJWQq
TLSH
T1E24471F71951A01BCBA802F9D2037A3ED177055D2CD1F9E9E67C4C812C26B31BABEA54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 e454e7a9fb46c776e575b01f5c6561fb6c9f381a0ceffb7c1413fa4dc37be9b8
MD5 088fe7d2dcd2fa7ac38f5926af9038b6
SHA1 6b9ab62a77b72bb894243c8ff7b5951c85f12b48
SHA512 ac7f40d1014e06c498f695353b00ede7dd7d7800b6047e028296ed8bb5e5cba7647a79b32664a3d84b5f7d19be56410e0300b5d39e094335e96147cac03fa9e2
SSDEEP 3072:h5mfXiH82NyQ5H6LK/eIxyODk9JR5rEuKeW7440/wrZ+r:h50XbuT6LK/euna5ouKewCAZ+r
TLSH
T110259DEEEB346C82DD2A8A70B8E0FC22BCB411837559F1D34C18C59087657C566DBADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 d3f8f3cee677aa3e4aa3a1c9ae13bc61505104d614896265d38eb61e9e348787
MD5 dacce046c31704d91be7dd3e19439478
SHA1 4d6d3913b213b1de43e4522867962aa66a2875fe
SHA512 e72cd20283393d8b3a1058564aaff2612dfb6b9619816526bdd42caf8dab6c0940d0ca7d9351e4168d788458e27b6173ccfe5a217033e09a81565383419c8893
SSDEEP 24576:bIMHaGe4AvYmSTENVGfJYqcYzPzAD+O+m2qmle7ouGfHy:bpe4lmAENVGfJYqh46O+m2qke7ojS
TLSH
T1BF868EEECB745C42DE668D70B1E0EC063DB11283B659D0D7896CC5889B8A3C17AED1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 188KB
SHA256 53cd744cde4a79d6931737dc6d388d36336fe94c415f2e816ae90f7eca9d3265
MD5 e7bb5584eb94692a1bd2c8e172654f20
SHA1 a251c150e10ed1d645a13455eb885ef954db9b82
SHA512 661e630596a5b98da3fc6c820a461f0293f964ac51dab84032e1582ba9a04f7d355df6aa07f43023ed62462f73d973e381f02a44ae7b2a0c0f79ff4ecd059c7c
SSDEEP 3072:IhMpMxr9/qhHLOglGQdEVeP5Ip4gJoK1mB8HHiWgu78WqpM77zdkOYBm92:I4ycJOuGQGVePXOmB8iW378WowtkM92
TLSH
T1FB1423610E7A6514C48BAEDF786DD59E060C4EF44EB6E1BF29E83396A4D695C0B38C03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 22KB
SHA256 37ae995a17f795bf5df82036c83d2fb8f94aa5479d24a527f7163927884064ba
MD5 d89500281177415a9060e9ef4e280f9a
SHA1 5b7b3b5769b569c607417f2026a8f3cf8fbb2439
SHA512 f4523e472c07a929eb1e228d35134167724e28e512d7d1888b660b572037953963e56601ec7a51efc5c8ff9d89e21d58fbe922850cd40a60f5b52d6e73cbfded
SSDEEP 384:Ppc1Qy1oDPvBszvgRSLNX7THESrLeQIMJwWOFJPEZZ:P6foDhszvgsLV7rr6QIMJnOFJPgZ
TLSH
T1BFA2D0A1C6E6B953FA5FC4888A7563D42B7C1CDA30D55316AEA35A14348F3D42788E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f3352212bcdbd378a225e21b0e8544630b7980cc66507412962e5e5c710dcbc2
MD5 8377c8ec1881d42da22762009c060b39
SHA1 acdaa734a11864e8973652ed0ba87fabd3072a28
SHA512 386373e9bcb833c5d63d2b71a81512c41aa5c6e5fd35530ff5b9350d5849aefd30b95401503577ff72e2169039d7eaa5914de3a4c5e9448b9963c67c6530319b
TLSH
T12B615F01F1BA4120CBC98C7DDBE8EB15B372697C51E7DC567889F0BD29A13A13924707
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 939efce40346c88ca4037a4d5dcb4102e748a79c31f7a5d1f01c0205f83b8d54
MD5 78a49783697d3165cc76b7a5a74030aa
SHA1 805ba620a47ba7cb8ff4d14b6c9ce93cb723f815
SHA512 3cb029d23f299bb040b8757db0446e7e7c88e39fbee0984308b3a0d1aa9cabc4cea0c8dec1f3522986bafe08c80be32c038ae571831eed1496814a7b8e1b129f
SSDEEP 3:MsEllllkEthXllkl2zEklkQTUK:/M/xT02znkQY
TLSH
T1824404147FD40C05CD0011304411C7500370F43005117743FCF10413DCC57D04D041C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 051f5a9b90daeed54fb45f6ab207a223166fa93553543b32f4e7c458a81ab7f5
MD5 15c702eb7d53ba4bfaf02657c1bca6ef
SHA1 62e29c4a07ac46967ae086ad0da48854efb0816d
SHA512 b7d81973f09b3856392c87cf857dc38bf92bea3e4653510913075ddaa098d3c00d773d06d43242fdd8c95ccd72c41b7c45dc286ee4254cb24016d350757567ee
TLSH
T1C9E0D8A764EBC11D7A5034C383747709C1C1358BD695AE871F04C8C47A42141FF49D66
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 451d89c23e87af227efcfbf1563839870dd0c28440597770d947f716b9b68d2c
MD5 7cb585c2da22d144a0889373f872478c
SHA1 fc9db7b80644964bd536eb59055bea62e6e8143e
SHA512 19ed849c26f0f750aafa84a4722a6af324a963b57b97ac429f77e2662363e4312f782436908ad99d9c02c397ba9793c872f2a32ec1927cd2ffdec845ad7bbcd1
SSDEEP 24:TLqUL2gVvb7OkIbzwDDNzWjJ0npnyX7y+jJckT+W5LYVFtIuqYpGK5fc:TuUL+lfwD4jJ/BtpT+WxWFOuTpGCc
TLSH
T1CBE2EE8D3B12F511C9ED733EB0C2C5E05EBC652C4A49B47191389CB68D62AA2F5DE14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 627B
SHA256 409d4c47e940688527d730b996e8991e010988c7671565467ed69d640d0947f3
MD5 9d7435ea49a80fdd66e4915f513017f9
SHA1 469f6c6e4b19b85cc1be497812b2f20864f4ff2c
SHA512 0561cd632d4219aef4686de40ec092921384ca89755d354801e0eaec8645a8630a180807af518ac8fcf01f71eb3d10faa9ce1e62c7a7226a274975bdcb7eeb4c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 2a8c790e3d701415f0647c03dbd5dd20a2aafc34fbd93d57bd2f65ecf8593659
MD5 6ebb85c2276493728a3054b623d4d290
SHA1 7a8197ebd2e924c9c3e1aa280b989da0d4a3fe56
SHA512 b76a1e2e94dd07ffa4e6c0930be19006639f9372a965900febcfd34efe52583917779544fad9758733a7996001bf05f2df4760dcccd47f43e5df6bd18e261c1a
TLSH
T176E0260855CEC129B95868E3C3AA770CC3D2B583AA883BC62F4BCC8471413C1A38E6B0
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 72ab589cbe494236735bfded3eba75adb0dbb6bae9694d12a0882fb062d08b3c
MD5 34a3eeb4ab9b4d5f83ec55c5d2d5b293
SHA1 162bfa4081927ef00f7b7258ea1aeb5891cda72b
SHA512 f3d7a2de31895b41e0c0ec41dcaf381fc67fd6ce0d26db56da71040d90cdbfcb2d97bf02c293cb448ac0f90b887394a06bc1a5a90f5141632317f9dcf442ed4b
SSDEEP 24:TLMJhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Twm+BE9ZW9v/3WOT/
TLSH
T140E23A2A5E7C7521CD66713ABC21A4665CB910DA977336F23EE000796F8268BC474CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 192KB
SHA256 3fc0296088c017cd8720cb2dbd874666ad5e28b33cefdb5a4e080b8b3905c2b4
MD5 6af7390ddb2cd7484497898fdf47d243
SHA1 6b468f9ed462b6a21358661681edb0c5f55bd138
SHA512 9507c9c03d7701157febf0367a6feaaecf3e9a8061351851c1c4a93d7ee81f950ca6bc7b7eef4b7f10b0e964c6fe0e669debcecd3ff33508647186ba28885185
SSDEEP 96:LeGmU+bGzVQLBE3up+UpV9ytRVjNtDLXjBHYUE2/A80jbgI8SKO8:Lea+GOBE3upbpLy3VjfXdHPf/A8jTv
TLSH
T1C714FC1E5F743712CDBD913628E645B3597DF03F8B236A866C6504B0CEE2652B02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 12e9cd1d77c6efaa13c23e5fba437bfb447a002c849ff7bd0b2278f158dd41c2
MD5 d31861c7f12db4387e73cb965ff789f9
SHA1 092387751595ab7bc278d4a93d3ea59045220335
SHA512 e08837effc86fe52fce16a1fbbd0f18d8c5501e9205079c3f364d007e7868bc9dce5ff1170d8e1f87fa62eec06a3f63a1917d54b79eef38e9550433c79fb069d
SSDEEP 1536:IfEEvnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BkHSRhPjU1
TLSH
T1FAB35327D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 2206dca433f7da10560af93d0566f4323945222a082749a0508a57ebd4ab44c2
MD5 d2c08b655e684972881abdf73ddbacf8
SHA1 196f8f242681f4d84ecc4afeeaa2afef988a37f9
SHA512 f376fe96e068e7c3cc3dad790f25e8933347ffb511b3e73713539517bc21d3ec619c43b33aa708df6605a716e04dd146707729972436e5a9096fd78200ae6804
TLSH
T120E0DF7186CEC12A765424CF93A87B48C3E1B44BEB882B861F08D844B801284A78A6F2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 53992fc7d00a9b1437ae1a7cd36122b659841ce76e8cf61a73b025da08c699f9
MD5 8bc01b27927546b27db1ff0857b45c49
SHA1 376f671bd89b7ed4ae73acc056b5611677a7421e
SHA512 65c490aa136cb79c9e758d33fa32e34d0fe63aa7c49589fb3ae17c4eb0c9d14fac13dc24c8a5f4e0e8211c8435afeb64472d8299a2baccf2d7b5620e11bf30d9
SSDEEP 24:TL6sLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfBLXmRZED7GwSA1m/:T2CLopFMatSaw/auUOt8BLXmjm77J1m/
TLSH
T12392FF0E5F346221C0F14B77EED189662E7C312CC3A3765AAE5810F38E9259FF5055AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d7d464a28f3f58d7cecef08e50a11cf2e4387c662de0324d5fdeca989128f926
MD5 4214fc41dd145d4c2459c5b3570463d9
SHA1 6e322517d69fe6625542c66d82cd586b50f7fe78
SHA512 a6a705b0e642baae3b8b11155d221ff973f4f952ec13c6ee4047f1a02f5d27087c058995a06e23e7a88c088a6f718d632091895311706de25dc2bd215ad039fd
TLSH
T1F241DDF383E8856ECA5195F42A28AF2FCE1D0615432C3D5A84D4AF5B93E2470D24195F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 b4d41709a25778b716f90a41c5def8edd27a7fd5109bf6f0d0b61a01f049da27
MD5 7c503d39ed78f25ac09f65b81883dc63
SHA1 bb51bd83b7af070b3aa7a1e8dd494167c3739882
SHA512 b4fb0d13553e52a00729ad3ba1243b10088c089799e0a7c6395beaf7d4f9e1ded2491faf359c36fa0db4c1010c16a9fce5e436b5663daa603aec3375e8274739
SSDEEP 96:+IEumQv8m1ccnvS6gU5nDAfFZeNStIswT840:+IEumQv8m1ccnvS6x1KZU/NS
TLSH
T1A9F2FFFA0737A206D99404B0A4049FDFAF17414B47B2A7EC66E443E2F3610E2B7B8785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 25b4902e3556d8589f128a13db32c4039173d9d9f74ae1dc81bd23fe5df88ea6
MD5 6fb16f58126a9fa292eccf857c781933
SHA1 0f4dde8150858f9575e80c4fe08a0ef490737466
SHA512 446b29c5a0903c1558f1f6f77a563b733c4a54fbc9e0e5dfcabfcad514d4b1237ce5ba518b9efccea9f0bd6151230eeddbf625a781c54fc66f5ec7ac4cd3eb86
TLSH
T182C022A180F8E472003A483AAD84B8C0B634D070204050A8CAA8827C60D58B7BA41039
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3a8adadf21a6991730560c57225e40688036262bbeede010a9279a05401a5381
MD5 2d49445a76e8543b9a446a810ee5a785
SHA1 aab06909a265ed07cf756fb6830c1ba5011a7f51
SHA512 43ecf8d8950f7c4089d6328089a026da4cba6b96d2b88aaf337e4e12df4a26557e30d14432bad29715720388dfb615a9788fba43d2ae375a90b96e4f6b23fe3f
SSDEEP 192:sVvRTyMqv/Ky0Ml8C3Pm9swWcdw02kXzhKjzoZ8p6J/Y+WNrY0HfbeeIIIm6+sIf:sVvyLrPm9swWcdhPs3A/Sr5SeIIIgw6
TLSH
T1D372E7196A68997FCCD7D618FA567F63D6F91163A2405E449AFCCE0C01E7AEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6e4b7ddff20521ce306ef62a5ed10fdf58b242bdf405f364ee09599c8ed6f7ff
MD5 f1ce36603115708f8e4618668e45b856
SHA1 8a10cb502154da3d41673fff3ccc227942bbe369
SHA512 c35edd19a4b77af7ff72cf940bbe19b62f6c7d4bb125b134c3f181f4a9f5db71fb55f58fb944f7de596641c38643dd1c01901807186de1b65f52c5fab3222007
SSDEEP 192:sVvRTyMqv/Ky0Ml8M3Pm9sTw52kXzhKwzoZ8p6J/Y+WNrY0H6SBXeeIIImaAsIgP:sVvyLPPm9sTgPs2A/Sr5aNeIIIGwP
TLSH
T1BA72F9196A68597BCCC7D618F9567F63D7F91163A2804E48A9FCCE0C01E7AEC211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 11615abb90ee0bdfe6e151fbc05c7ef4ab25c99cbfe891fe441765a8a81211b9
MD5 d3c7c44fd18dc6ff15c88fe40ee51376
SHA1 8dd3828202b0c8fbe1d4b4f57b527a94613faba7
SHA512 fff8d4efe23bfbd1ec301b206e1ce7e93aa5671ff686995ed9c508d5c7b536578b3a2ee02e4e22fde756e7b70a6d2511c24574e2aca042bcba909295c44aaa34
SSDEEP 768:sgnrwBw8rE2+U7pL/Ln3LWRWLFQn58F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KM1qK:sgnrwBw8rE2+YDn3LWRWLFQn5u1jaKKs
TLSH
T192031D3B284CCB7E4F804E9CDC2ABE9A5DE8018B66D8895447FE840C03D66EF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 e90b28891f815caeed2e7b14f62d57b52037c257af6badd5f1ce92042ce9eeea
MD5 08ea7817e5538fafd47bbf847019d2e1
SHA1 42773235dec1a643501c470ebcbb40dd735b0b2d
SHA512 e72bfc5af11f99afdd3927275dcc093d3ca81ed07f314cf29b1a1ec917c04ee6ad7a2be96bd089c288dfd4a86a7fe75cedaaa874006bcc6131d9310f343f7db5
TLSH
T185E0DF9156CAC179705520C383A4B30DC3E5B45BDAC83E862F84CC84A142A84B7AA5A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 acd20ef9d15cac8c0799e87dca95e0a0137b9644708d4627af590bd5938f9e4f
MD5 39270770a0f4895731031ecdef6c6954
SHA1 196e40d1c4c1fdab59285359c4bfa55661ce7bbf
SHA512 1f66efdf3382cbd1c9f7cb87e23cfc5cad69e3de07b1d3968d1d5a4e7a323e5893f7d2f991a09bea4cb992151ade219ee2a3bc5a7cc835912e44c4748abc7a07
TLSH
T1ECE0D8B56ACEC22BB18530CB8364F309C2F3F447DAD82BA53F09E8447247280774B561
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 99be494d45d28dd7d39eab32853799268e2c5f1d6cd9e42447eb98450adf579a
MD5 48fdd164794c4f87e00f219a6eed762f
SHA1 44b425219bf0d822f9ea84e719314ff5d6dc5f97
SHA512 9ca252473b6a979e6cd44f8f04916d1a0e13eec00d1c81e7d6af0355649cd608130fc1b62bb25c4618f5bc31d626cbc6c6bae1d1253318d10625aa0ecc74655e
TLSH
T1CFE048708ACEC239B48460D283B5B70DD2F1B85797847AC55F088844A101284777E5E0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 6ebe3cc43fdb2960a50d5d1829e7bd5abd258ead7fc5ae920ba8ffb349f466b0
MD5 73c58839a90a95774d11bf0c72245df1
SHA1 9ff65e0340cc4bf61263f57330faebde6b45862f
SHA512 783624f0d462d3c1ff4d22ada8dc0ad4ece42c172d3c52eb24e777a89c64811e693568112426b58870f601a2d7acd29e63340f003869571a3101d7fd32cb4cc7
SSDEEP 96:NNKL26KmxKDG+K6rKvuIKfQKNS9mZdTbL2lb8dd2Kjff90P04RAv7ZLvzwf+LTzS:kg6iS9mZdTbLQb8ddtff90P0ihShNu
TLSH
T1C0A22731703E225C387D295871B8926F925260A37050A4AB7AA930E6CF67E705DFDCFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 a57b49e084cc026f62f68630745a35f20feb0343afebacb6caa08ca8d106aff0
MD5 ef2f7cd99f0c9ed39cfaa81066964445
SHA1 5f7c0cfa6ca297bdf0e0d9f3b7e059a0710d07f9
SHA512 a189c8d09e1b6221f9ecfa4c934874290f2abbf6fbf6e585d9fb9fefb5323a84d35613d8fc58eef9fea7b28502f2939d23e9d99c3356b28ff37b2e2db63bc5b9
SSDEEP 192:kg6iS9mZdTbLQb8ddtff90P0ihShNyld1:ab1
TLSH
T189C25835703E2248387D2A5871B8916F965220A37050A5AB3AA930E6CF67E705DFDCFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Size 128KB
SHA256 8efc7f7606770bcc9db7dd62ce241b459c24d23691c40cb4c4d01fa71cf4da32
MD5 fa1d8ce5757292f42b3ecf8a9a7ad09d
SHA1 5277308d5ff1ca342d6456c9bf6303ab9730fb3d
SHA512 b9f34e38b5d6ecfbd2ec5176fcce8abb0226e230a19a3703dfec3be5b4bb23dad0b9a41694dcd315c4f87d41cb8ecd5f21acac9e32c8d3c9167d8f9af190dbcc
SSDEEP 6:IiVDw1Xl8y1gCmOlXwuGtSnbGuIaWYy/SD+tVl7:IAw118y1Nl6uhUtV1
TLSH
T1F1D322800CB2C326C414A0388A776C9AB238F00386807EA18163622787BCA004193448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 228KB
SHA256 af2b7d8c20f598a54fabcf66e5d6bd0a963d2c890bc0246448efa30f33eb2f42
MD5 e09a0834f436c364acfb086be97ff928
SHA1 15a4dba2a2e87e18ad3452ea2c6a01289bb6d96d
SHA512 0874d930f0fce93cf50f6dd743444a21236c8b788c7fa66acb924c518f039265cd34fd5357a9e47ac12206c26c42eea1ddd8da0a6910f5e69785317e829dcb34
SSDEEP 192:zCNXfT8aRJQnGqqrgenLfUK3NDivIz6DoNCPaWaVIdssXVydue2g2C0:uVfQuJQnPqrgWLfUK3hivmY4Cvp68C
TLSH
T1D134540A7B746101ECE7E9721CB080771A3C726DCF22A6916DB254694DF6853A33D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 e994719025b61fbc00202522ac06212b0142f8070dc6c8c6d14a61dd31200f1b
MD5 86f067928fa8b31b365fa989fca27372
SHA1 36ec6749fe37082e6c5420545bbf52d4100e7a79
SHA512 ebc91aa6ceeeea803dcbea7adbcaddd95080ed8e1710d8ccc091538d80bef18aa7a051a92fa19f31dade221b3826561504fc6a87f791ce6eea5e401ad4f6bb31
TLSH
T18E5150D0B3B9705DBFCDA881D36D6403E5A11E6B160E9CF2662E14F5DF888244E2ED36
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 d61dd586816c4e1bb00f12a783443558cfddc99819bb6dccd8e7238f337a4940
MD5 f10718266573116822ed3d4557c26d7b
SHA1 156b87d5e4f9fa7cbf4393bfdf206022b004f0f3
SHA512 b8edd87e1994fe36309f150f70370126abd6db8c99ab77fa1b5e26ab7541216b7898f86ea188e24359ecb1e0f9c7473866bd09763753aef4438c9b068f70c50a
SSDEEP 192:T0GHWQviiiixHOAKQPIII+buMIM0NYcYU:77OAKQPIII+buMIMeBP
TLSH
T1A822609E23152F33C1AE5B3B1266C3A95BCADC804974111D3922A84FDDF3D9386D25F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 c725224d5638ba54281bfe6816e1b849165c8b17f909e3cb65d3343fb4a13611
MD5 920ab579eaa330e260878ae57d815993
SHA1 00d4606eaeebd86c00477eea976574a34846b94f
SHA512 8fb9d7e9b84d444aa83018bbc1dfd60b88241244f2c350e97bc4e1ef12bebe14e038cab7646e6dea5df534ed6d18eff25732c86454c65e7b134fc3f7efd7c951
TLSH
T1FFE0D814A9C9C25EB56820D743756309C2D23443EE846F891F48C84860013447B5E5A1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 215d277a278c38fbc878bb09e079659d0dbc0fc96b3ff5be9176cba9e4206c1d
MD5 ec3451fcab81a1e6a4fdf20a1476c24d
SHA1 53dc2eb5a150a229624dbc054dcf41c519cbb872
SHA512 f394694ce1a3d616f8097415ec75af5b99100f688e1e54aa6f8573e5323ddb3d120ab6ea86b9f6fe2800fcd8db707802d8e6ba13061891c81541b58a393dc72d
TLSH
T13C21E585F320C149E14E9A3D906BA7351378E8528FFCDC0F8479242A2EB1B050E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 915a28748ec32637b84a722a8cf28bc6febb163f19b1bc7ba36d8b4ca8e25027
MD5 2d262a21f3e1ba5ab21fa91cf607ecea
SHA1 2bd05d1b4a59a0d20fe5b00284b2ef0145ba6956
SHA512 f1c06d3015bec012ea0e3f82b18e5274b8c8b8282c746f7389651e87b2e00ce7e3fe9d52516fa07dfe22ed3fb863a3f4d0869617c1af7507695053d1c57ef83c
TLSH
T17AE04854B9C9C25FB56420D343B5B349D2E37847EE856F851F48CC4855013857B5F5A1
MD5 SHA1 SHA512 TLSH

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 458B
SHA256 0db45026a037130b00dead0e3486a81d7f0bc81fee35897f12987d3943b45631
MD5 505fac28e0817a5373939c42a1acd898
SHA1 6f3c985a7733c27afcf70fdea120144ed1f60eae
SHA512 c38f711ca35d0fbf397cf0ec9cf77896d56e2eb8ad62365ccad4bad5d459e1f498d99c8d32cb5946efe1bff1187aa92d98548cbcccf91dd09868d94a8fac72df
TLSH
T17FF0AB5A950A3D7B08B222284C2616B0FE18031F4285508E3ABC004C1F7B83909DBEA6
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 8ca5b1735014d1c7e88073019c2b42e6d6e5bdd89692b60249468ea9423d585a
MD5 7cf6fe6970b62bf9e5f1e17f2aafba01
SHA1 8459d3773af1c47a23c4e56411be102fb7ca5837
SHA512 4570e26fae8e2a3a30140ddc61fc3fcb8d88e9f37cce436ae6faa4748d7934a0b0cfbdc882b2ece43a8abc6f374d6eef526af01306e209da539147079a804e49
SSDEEP 3:MsEllllkEthXllkl2zEelNTna:/M/xT02zNBna
TLSH
T12944041C7FC41D07DD1410305013C75013F1FD100511574374550453DCC77534C0004C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 13B
SHA256 01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd
MD5 3e45022839c8def44fd96e24f29a9f4b
SHA1 c798352b5a0860f8edfd5c1589cf6e5842c5c226
SHA512 2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 399ba455b3ea8076ba8404ec61eb2b52183d79927bb518f1afc9970d6ff6ff83
MD5 cca5351e74c7e9e813d069ce840097e8
SHA1 d6ce2a9a74c1cc8ffa1cddb37c3062b49d87bf12
SHA512 07b9708c0f145f6fa45b1da9b35470e71e810dd71439655545725b1f5147a142d236111db1c022e5b382cc81318c0babb71e0177dcce570f7b0b57257cc80269
SSDEEP 768:+FaTRMUVai1SKqvd/Cg0edllGQu5zuBCIK5EqtumGIovGqsW7iIKu8fqGodk:3T3oSvqvdoedlonUKWqtuQWGeiAhGt
TLSH
T18A038DB2E845D95B6AED4ED9E21B3113DFF09157D6C80BC8EECA1E4D0CCA59D034B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 8a38b05e64a0972372fed6c9ffd4ceb21f1f6da208b00a95f2085be0afcb7195
MD5 da38be418950250d875fa6390d856980
SHA1 16f1f8f2c86e370d993c16965196d6a7a1be6586
SHA512 7f5bdc284d6fe2622e0ce05f81df8ad9f33693a31ac4f80676b38856d493837c7dd75fcb6787a3f5da9e1aa6d27d8b2be3edf4e18a950b97497e17120334bfba
SSDEEP 768:oFETRMUVai1SKqvW3/Cg0edl8GQu5zuvSH2m3E11IovGqsW7iIKu8fqGodX:RT3oSvqvW3oedlTnKg2+E1KWGeiAhGi
TLSH
T10613AF36A854AE976CEE8F86E31A3157EEF01193D6CC0BC8CDC92E0E04C659D274BC65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 69e194afdb6497c319897db44ee5a464f47fb18131d9fb730dde9d63e47740d5
MD5 ed5971a43a5e2cf2dddb1da6cdaa9762
SHA1 0d58151d632335feb9061c60508939bcee21e20e
SHA512 db4e30cbf6a9501bef21a0757e6d6690a4e35d44621ebc74d996ee14022908c452cc9a0799055324f1c3a18e2051b45366278ad0076606ffce6cc4f3cd5e6ab2
SSDEEP 768:oFaTRMUVai1SKqvd/Cg0edlnGQu5zuvSDiV9wwf2m3E11IovGqsW7iIKu8fqGodX:9T3oSvqvdoedlGnKEDwf2+E1KWGeiAhl
TLSH
T1E0238DF19A459E973BD98AE9D32B3103EFF44153C68C0A88FDDA1ECE0C8949953CB855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 04d13834e74a78a5373ce9f6052918fc23f8ba8c45863f98b1f74cc7aa1f8e9a
MD5 752cfd83930e810ef36e60e881339c12
SHA1 fba40b5c9e6f5d65ab9643318861042b6a318f0c
SHA512 bce94e2b7f64f86e68c0edf66bb6ea2dee12398c44399eba35acaa387b1fdc7f57579ebcf26c196502edc9874b324c8003bcd07b595a144c0425f5c7cabf5c7b
SSDEEP 768:LFiE6esE8lDldUGz3UCg6lb7Qu5zuvFHZovGqsW7iIKu8fqGotE184r:CeB85d73nlXnKVZWGeiAhGiE1L
TLSH
T1ED039E36D884DEA36CEA8F89E71A3667AFF011A7C59C0BC4D9C95D0E108709E734BC65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7feb430cdf7010d2879933967d9bd56091fae8f840a7631dfe4a03548666716d
MD5 9200cac2db4c3416cf6067b7fc70ede7
SHA1 9a7a3eb6644263f4d1663073cdb0149eca4c3627
SHA512 984186a3bd606ce2dca12bac5f8170ae54b2d39e37fcd025240a2ee6c5f5ee3042cc8aefb75298a66a2f9c96af2ae03258a78949b925107acaeff9ec19f921a8
SSDEEP 768:oFiE6esE8lDldUGB3/Cg0edlIGQu5zuvFHZovGqsW7iIKu8fqGotE1Jg4r:ZeB85dZ3oedlnnKVZWGeiAhGiE1V
TLSH
T11E039E36D894EEA36DEA8F89E71A36676FF010A3859C0BC4D9C95D0E108709E334FC65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3fce148bc4ff539eab51ae4bf455cdcdbe028ea5872e9771fc3c7e201926ff5d
MD5 54eb928690aabcaedbc6d6c85142df6a
SHA1 b612939f6933c56a527d7e13c5e075af94ad26a8
SHA512 1455bbb0c066f02e67ae93ff9f58a808640d15e8ddbb628f0c91cda985581c8507165b37bc78bc535ea4014b86b83adff991bf5375c641faf49bd493a554d607
SSDEEP 768:+FiE6esE8lDldUGz3UCg6lcm/Qu5zugP6JCgEoZNovGqsW7iIKu8fqGotE184r:neB85d73nlcqn968gRTWGeiAhGiE1L
TLSH
T1BF037C3DDC84CDBB28DE9B48930E3667AEE011B7D5684BC8D7C84F0E10A6099F74B965
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 0e7479eb640c288325a5c3f07bf5d59af0889d5d19f0e750ca514262c841941e
MD5 13f336d184d88ba5380c365e4aed08c3
SHA1 7e67690c9c13af83dabb60726e223a5978024431
SHA512 72d0a783c4693a389a2d98999d3c0b57da45374bf60da463950bf9f576d6c89d8363a78964eb780e51b034b2271706d829e8a23e1bc6c35b40d22b73ee195c41
SSDEEP 768:oFLTRMUVai1SKqvW3/Cg0edlWGQu5zuvSH2m3E11IovGqsW7iIKu8fqGodX:kT3oSvqvW3oedl5nKg2+E1KWGeiAhGi
TLSH
T14213AF36A854AE9768EE8F86E31A3157EEF01193D6CC0BC8C9C96E0E04C659D274BC65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 d22908d927d5adc9c8b1a21a0b2a3c48565a435f08cbc9277aafdcffdc4fc6b6
MD5 2edc31275c7a68c947569d0a487a54e8
SHA1 a1b40fd617a500ab76b8f350e5cf048aeb2e6abe
SHA512 3284e8d58b252034ad62547fd3645ae304a238b81afb8df7989891d8302ee1a5f93b0a2ac72146ba20a8b7de8fd1976fbd8f27c88323734844054b24d2ea758a
SSDEEP 768:oFaTRMUVai1SKqvd/Cg0edloGQu5zuvSDiV9wwf2m3E11IovGqsW7iIKu8fqGodX:9T3oSvqvdoedlHnKEDwf2+E1KWGeiAhl
TLSH
T1BA238DF19A459E973BD98AE9D32B3103EFF44153C68C0A88FDDA1ECE0C8949953CB855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 c6ad9013697c10ef0c4788acbe2faf8044bba909313e7c787655673d4def4afd
MD5 ac0b873ef3591a5b7c967c6c84953c2c
SHA1 1135eecba727c7aaba863858abaad1df808079a0
SHA512 89af61e12df70602d702f5f3bd0ddc36498e75eaeb25406bf45c04abc884adfeecfc9a6131291630f0d344d16694ad647fd8672ce0ae28fd37f3203621811789
SSDEEP 3:MsEllllkEthXllkl2zEelmY5:/M/xT02zNP
TLSH
T19144041D7FC41C05CD3C30304011C7500770DC1005115743F45104135DC77414C00040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3040_233194120\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3040_233194120\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2436-58-0x00000213CF9B0000-0x00000213CFA9A000-memory.dmp

Download

memory/2680-435-0x000001C2079C0000-0x000001C207AAA000-memory.dmp

Download