241404f06e9e597751d679391a1a7e0d76a28a8cc923a5c0de402b78ffc0ad2f

Analysis

user interaction
yes
max time kernel
299s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Astra.zip
Size 1.6MB
Sample260507-1tgftabs21
SHA256 241404f06e9e597751d679391a1a7e0d76a28a8cc923a5c0de402b78ffc0ad2f
MD5 4426d25b2b28ba3662d7c8aaf8d3d8f5
SHA1 6bf7021b893ebdc87d2a58d11de6120b64d8fc4c
SHA512 d39b2fe81fea4ec004eaa04790adc5ef03c2e9b08e4f74dfa979d8ee90a05d859bd3d9fe903c85815bdfa88fc78339dab0e83292517f24e6f44de7b670b430f8
SSDEEP 49152:KWUgAqVdbx9mZ1IhYGXw2I9BTgWEG3Cg93lqJr1f9:KsAqVd3mEhYdTcWEGt3lkl9
TLSH
T1E585336AB46AD50A00432A7E6EF8353E790C6574E85DCF451A39C1CFBC46D93D8AA0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2636	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_662302579\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1616474938\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_598193760\keys.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\zu\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1074902373\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_598193760\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1631843063\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1616474938\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1074902373\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1074902373\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_662302579\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1616474938\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1631843063\deny_domains.list	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1175191285\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1647721903\data.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5424	msedge.exe
4436	msedge.exe
4144	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226646524834560"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650218026-1419908266-2856590055-1000\{F0674E45-93D7-437E-BFAF-9FB5E76AB4C3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5684	chrome.exe
5684	chrome.exe
2636	msedge.exe
2636	msedge.exe
5684	chrome.exe
5684	chrome.exe
3000	msedge.exe
3000	msedge.exe
4824	chrome.exe
4824	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1916	helppane.exe
1988	msedge.exe
1988	msedge.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1916	helppane.exe
1916	helppane.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1988	1916	helppane.exe	79
PID 1988 wrote to memory of 3728	1988	msedge.exe	80
PID 1988 wrote to memory of 5424	1988	msedge.exe	81
PID 1988 wrote to memory of 2896	1988	msedge.exe	82
PID 1988 wrote to memory of 2896	1988	msedge.exe	82
PID 1988 wrote to memory of 2896	1988	msedge.exe	82
PID 1988 wrote to memory of 5504	1988	msedge.exe	83
PID 1988 wrote to memory of 5504	1988	msedge.exe	83
PID 1988 wrote to memory of 1068	1988	msedge.exe	85
PID 1988 wrote to memory of 1068	1988	msedge.exe	85
PID 1988 wrote to memory of 1068	1988	msedge.exe	85
PID 1988 wrote to memory of 5700	1988	msedge.exe	86
PID 1988 wrote to memory of 5700	1988	msedge.exe	86
PID 1988 wrote to memory of 5700	1988	msedge.exe	86
PID 1988 wrote to memory of 392	1988	msedge.exe	88
PID 1988 wrote to memory of 392	1988	msedge.exe	88
PID 1988 wrote to memory of 392	1988	msedge.exe	88
PID 2636 wrote to memory of 5188	2636	msedge.exe	93
PID 2636 wrote to memory of 4436	2636	msedge.exe	94
PID 2636 wrote to memory of 4444	2636	msedge.exe	95
PID 2636 wrote to memory of 4444	2636	msedge.exe	95
PID 2636 wrote to memory of 4444	2636	msedge.exe	95
PID 2636 wrote to memory of 1044	2636	msedge.exe	96
PID 2636 wrote to memory of 1044	2636	msedge.exe	96
PID 2636 wrote to memory of 1004	2636	msedge.exe	99
PID 5684 wrote to memory of 240	5684	chrome.exe	101
PID 5684 wrote to memory of 5392	5684	chrome.exe	102
PID 5684 wrote to memory of 5392	5684	chrome.exe	102
PID 5684 wrote to memory of 4144	5684	chrome.exe	103
PID 5684 wrote to memory of 952	5684	chrome.exe	104
PID 5684 wrote to memory of 952	5684	chrome.exe	104
PID 5684 wrote to memory of 5468	5684	chrome.exe	105
PID 5684 wrote to memory of 6052	5684	chrome.exe	106
PID 5684 wrote to memory of 5468	5684	chrome.exe	105
PID 5684 wrote to memory of 6052	5684	chrome.exe	106
PID 5684 wrote to memory of 2800	5684	chrome.exe	107
PID 5684 wrote to memory of 2800	5684	chrome.exe	107
PID 5684 wrote to memory of 5400	5684	chrome.exe	109
PID 5684 wrote to memory of 5400	5684	chrome.exe	109
PID 5684 wrote to memory of 5784	5684	chrome.exe	110
PID 2636 wrote to memory of 4496	2636	msedge.exe	112
PID 2636 wrote to memory of 2196	2636	msedge.exe	113
PID 2636 wrote to memory of 4372	2636	msedge.exe	114
PID 2636 wrote to memory of 4696	2636	msedge.exe	115
PID 2636 wrote to memory of 4696	2636	msedge.exe	115
PID 2636 wrote to memory of 5616	2636	msedge.exe	116
PID 2636 wrote to memory of 5616	2636	msedge.exe	116
PID 5684 wrote to memory of 6100	5684	chrome.exe	117
PID 5684 wrote to memory of 2432	5684	chrome.exe	118
PID 5684 wrote to memory of 3000	5684	chrome.exe	119
PID 2636 wrote to memory of 5200	2636	msedge.exe	121
PID 2636 wrote to memory of 5200	2636	msedge.exe	121
PID 2636 wrote to memory of 2592	2636	msedge.exe	122
PID 2636 wrote to memory of 2592	2636	msedge.exe	122
PID 2636 wrote to memory of 3000	2636	msedge.exe	123
PID 2636 wrote to memory of 3344	2636	msedge.exe	124
PID 2636 wrote to memory of 3344	2636	msedge.exe	124
PID 5684 wrote to memory of 4824	5684	chrome.exe	125
PID 2636 wrote to memory of 5508	2636	msedge.exe	126
PID 2636 wrote to memory of 5508	2636	msedge.exe	126
PID 2636 wrote to memory of 4396	2636	msedge.exe	127
PID 2636 wrote to memory of 4396	2636	msedge.exe	127
PID 2636 wrote to memory of 5748	2636	msedge.exe	128
PID 2636 wrote to memory of 5748	2636	msedge.exe	128

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Astra.zip
1⤵
PID:5768

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528882
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ff95dfac188,0x7ff95dfac194,0x7ff95dfac1a0
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,12061161467592018904,7432289046489266734,524288 --field-trial-handle=2268,i,11688920378629402663,355967746238615003,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,8198466637409863738,8966241914310819325,262144 --field-trial-handle=2268,i,11688920378629402663,355967746238615003,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,13833053076553898694,10137499162416809263,524288 --field-trial-handle=2268,i,11688920378629402663,355967746238615003,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,1238827603656429378,8959760133404831730,2097152 --field-trial-handle=2268,i,11688920378629402663,355967746238615003,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,9637068927862703552,13345212358298256421,2097152 --field-trial-handle=2268,i,11688920378629402663,355967746238615003,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4804,i,881958657357641255,2464763606681157073,2097152 --field-trial-handle=2268,i,11688920378629402663,355967746238615003,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
    3⤵
    PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff95dfac188,0x7ff95dfac194,0x7ff95dfac1a0
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,5915421688940419568,597234589383699332,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,12072926876502706396,16387616744798277191,262144 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,6060690635265916678,3529266471235128599,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:13
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,16576460743317069450,9673055316315468011,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,16576460743317069450,9673055316315468011,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,6658032712532212696,2714018492013992375,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,1828574606544063603,10640257332134210440,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,1720294328283466521,705173960723779902,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,15214685842092174010,2300136828848834957,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:14
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2916,i,15648060545343210142,13824257946032051721,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,12851974607575682284,7205074604186170363,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,5052869758891392949,8797938775986236989,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4240,i,7215638370683494979,14508741153125360827,262144 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,18163912277244157425,15426120932619614660,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:14
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,4744195971295738757,9925411548066175113,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4108,i,6853360637195243935,2310513936425956207,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,16892873362999342615,8903817490641815299,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,5628945272263897923,15733376146597140311,524288 --field-trial-handle=2052,i,11053108353967168155,9402951509386508839,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
  2⤵
  PID:5360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff949dfc728,0x7ff949dfc734,0x7ff949dfc740
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,2641942946694556959,235895244330579644,262144 --field-trial-handle=1904,i,2808118140462891537,10355397638174821638,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,14708777594272544328,15651227171083089488,524288 --field-trial-handle=1904,i,2808118140462891537,10355397638174821638,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,18437021161124123669,5402556917170343883,524288 --field-trial-handle=1904,i,2808118140462891537,10355397638174821638,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,566486333942482658,17175185589411852723,2097152 --field-trial-handle=1904,i,2808118140462891537,10355397638174821638,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,6352256867124720993,11640846024703808327,2097152 --field-trial-handle=1904,i,2808118140462891537,10355397638174821638,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4184,i,15658788084202950836,9245158934425201678,2097152 --field-trial-handle=1904,i,2808118140462891537,10355397638174821638,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4196 /prefetch:9
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4608,i,12972947391917030434,205458634619389124,2097152 --field-trial-handle=1904,i,2808118140462891537,10355397638174821638,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,557769270609304233,16671577255300405331,524288 --field-trial-handle=1904,i,2808118140462891537,10355397638174821638,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,7677240463786141947,8984015409353422056,524288 --field-trial-handle=1904,i,2808118140462891537,10355397638174821638,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,2955178250582050671,11462109333083105593,524288 --field-trial-handle=1904,i,2808118140462891537,10355397638174821638,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,16256397030169780284,18411535792611405213,524288 --field-trial-handle=1904,i,2808118140462891537,10355397638174821638,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5292,i,3704737306347396498,13449128554302543826,262144 --field-trial-handle=1904,i,2808118140462891537,10355397638174821638,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5552 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,8331488378845335551,4970907669043289524,524288 --field-trial-handle=1904,i,2808118140462891537,10355397638174821638,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a5ea4927a60e006e9b8012f88bf4b4980c4324d61e512108bd9eb5689b3afc74
MD5 a6f408bae8d3b464da138d69a7ca3c59
SHA1 5ec19219f716af19636a722be12e4a91fa2134b9
SHA512 34cdd523ed22de45b5bad5ad5a9d64d6ecca57587392357ecbf2479d2790fd7426234135e8b9b372688b4bc33cc3db36f3da820d56d4b4c7106e7111fed4da4f
TLSH
T10AE022A6CE26DC370AFC0F3960404701E748171A2B41891F7B3E9A0E8FB563E429A82C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 13505ebc79ab35595864a7e1a23d4887027554bd1c15b6fff14273f1085d368a
MD5 d00f631402a6e517e68f1128cc0823f5
SHA1 f1c3a0016c4f388cbe98215e9f89e647c54e7cdb
SHA512 255b20d6f99d26a709db23978358e03faa08a9ae6864891dbb5cc30e1d8b33aa68561d02b8f0d784b5157485c2cc830f531eb5e4ba24524efc4ad4675df9c6f2
TLSH
T1BA518CF793E4857D851192E4EA206E2FCD6D0A14531C3C66C8D8AE4B53E28B3E20179E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6abe8af7aae86ed3408f2597d5be59845db9996643be65764d057502081a4db6
MD5 f3b6d53cf142a97987090d4df3353512
SHA1 d17fdf3b71895e2c178c2d2f16fb9c7c578fac01
SHA512 63e203206cfcdd0bfbfe33c825c89f9b90ca6b12a1ce09019e063c3ff4e582a7960764ee88a7c7e4ac8f043ba780c7f1ac278a4da5e424f9a564f8dd00f36593
SSDEEP 192:fRh6UHRU6sv7gpAPRp2B99Hsb+WNnOM0rWenqVDaqldVyIsnAUgtaJ:fRh6Y4sUXq/w90yxaqlr8
TLSH
T11A42D62EA914753B5CDBD21AFA25B703D7F5102621C92E88EBFC8A2C19D75CD7227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 47d6710c5c16eb7e519592e14be3c44fd9bc6965fe7de436d96ffe7d72684093
MD5 53ad489fea93f4eb1e87f9f4697dea1b
SHA1 91c8a039b570613e7b70acf2634bdbf5275622d8
SHA512 c1f05aa58e2c8e4d08435ee52bf893e7d06caef141bd75e9d3d74071d4f77e97b4c5a227d95a7f0db325e4ee3f1627eddec37de30025e93ce2463886b729d969
SSDEEP 192:fRh6UHRU6Uv7gpAPRp2B99Hsb+WNnOM0TWenqVDawldVyIsnAUgraJ:fRh6YQsUXq/w906xawlre
TLSH
T16242C62EA91475375CDBD21AFA26BB03E7F5102621C52E88EBFC8A2C19D75CD7217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82085f58435b7b7a260780dca3ee69a48427de11b3ece82d53af0d56f36fd555
MD5 92547e8f34c99d1b69c0e1d957604d80
SHA1 4ca5a2d93853b96b7fc565a0e16045bbcee47e58
SHA512 aee9857bb3f81b98b9310e49ebca2773ad80f91201f0efac2260b404123571baef569acba1d144b7aa20664020dd07820f3547f4604d3bc6c7d155025f48eb07
SSDEEP 384:V3jBM7KxkXqKf/pUZNCgVLH2HfgslQwl7pLuLcifTuXODBU+ErU3bwxHGak5Je0o:VTBM7KxkXqKf/pUZNCgVLH2Hfgsi87pL
TLSH
T1DE72FA67AC4CAA370F94D6CCD827BE4FADB5020B65DD886883FA581903D5ADF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e7ace6dfe39a2d98ceba9a678d606aa60c873258594ec5176c8cb73bdcfc0429
MD5 55a4cfba2496e66afc0878c1bd5ac430
SHA1 11eaf1f725ea0ec32355bd93b950f7c2af2debbd
SHA512 17aec144323e9c5f0c0fd77153a52d4231b86d4dab4442a2f3e9ed3e1a62b9a5b044eb0894f662f7663d5c2e1a27c9ea0c8ac66ea218e07228f5329e58536650
TLSH
T138B0122180015741C04343B023D7048831146F108B09130153E469B1D8266E24038170
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595181.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595181.TMP
Size 96B
SHA256 313d6ee423bb04193459cf66a9b2610fb35a81f3f9b97a70870d8c930bb383ca
MD5 e5d279e03928c24b8e8d973c2b71e00b
SHA1 7a4e87cb4d1e822219773d18c813d73152565e27
SHA512 66621eb05f4d4251b61e889d6048bd40ba89d92064e21d7707eee1be6630711a367e067184141bd4b3844015a4635f4ddd256625a7c687fc682d27bafaaff5ea
TLSH
T1B4B02220C0032382C002C3B02A80CACAB0B0EF20C203030283E08B32EC38AB000202F8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 97d7762d1eb9f2a1fc2671770d5af52e58facffd8152aff45562f74f2eb31b93
MD5 e99931a48223e7de796f7440b5171872
SHA1 3eec93873aa726de1bc394f154a2fce475b127c1
SHA512 a0774ae6c0656a7d450a211203309658642d94e938dd8b535d63b898a68ae923840bebb7d00955a5fd3ccb6578916221c6731a76b2baf66e7c3b2086714aeec8
SSDEEP 6144:KlRUhDlUtHJhjkeM4CI++JjcMW2VcVLjL:KAhhUtjOaOMWtL
TLSH
T16E1412BB480F6F7D6B2AC2B6B00B4D6C8DE388DD147060741096BF4E35AA753A71B436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 3522634282094fdc54bb7b11993f03a9551b65cfbae8bfd86c6cc160be30b99e
MD5 da1ee73f2e1ca71bed805fc66efa6d7b
SHA1 9e6fa151b5f626fbe4c2952e9e0671363d18a901
SHA512 b711083da1517743f7a506c1db730dec1d689ac253dd2aa1a362f839240db1efc308adcb43f7305946e5ce01ed42da57b108292426492307331b0172e28ae91d
SSDEEP 6144:PBlRUhDlUtHJhjkeM4CI++JjcMW2VcVLjL:pAhhUtjOaOMWtL
TLSH
T1351412B7180F2FBD5B2AC1B5A00B5D6C8DD388DE587074782092BF4E359A753A71B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 bfc3ba724fb78e50027e965baf75a600e7dd7d5c45d7be30fe7fe14a7a10db37
MD5 73a3531e420832f243ca806f1edc893b
SHA1 ad6a009e9c104cb5ea7ed58218423a564ac53eb5
SHA512 3e006671df4742b1f4b30073e70c2cc1cee1e3db2e13ee45f87627c2fec1184cf5b459ff984824404796a98662a14615d2d737bcd6de9b565150c1197083889f
SSDEEP 6144:LBlRUhDlUtHJhjkeM4CI++JjcMW2VcVLjL:dAhhUtjOaOMWtL
TLSH
T1781412B7580F2FBD6B2AC1B5A00B4D6C8DD388DE587074782092BF4E359A753A717836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 afadfa0bda9a4a645594361d801901eddeecb2974286e06736c4c935595268c8
MD5 5fea8203c3292e06fa37d132137666ca
SHA1 5ce1b2dc2dfd3ed24b8607a310b61f3cfa48035e
SHA512 2eaf6c20a1450f1e055114532aa680a01020b4f83bf243ecce0cc8948fa9957cf70935c3f9c89a042e90a1351ccdb365e2dd8c04eab9fec953719ef66831f4a2
SSDEEP 1536:ubEP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNJm:v++J3qUQm08KMWF0bFTcVHr6zqm
TLSH
T13A9312B9991E7D79636BC296A0079CAC8CD3DCCE111055BC30C76F1E18BA392E31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 c55e5522f8df43d43389f3cdbbd070550dd5f540e5013c0c3911d7deef825479
MD5 13172628aa79ded46f842868633849b7
SHA1 372d0bfd54991d31055f05e67a9e597ca4eaa97a
SHA512 8705f5b8b020056c61eae26df5e1dd415dacd3f0b15e7508b5c93c75cfd429b3bec6eee843916d7b407479416f569631153ce9f146a54b9dcdb54b501a6be256
SSDEEP 6144:TlRUhDlUtHJhjkeM4CI++JjcMW2VcVLjL:TAhhUtjOaOMWtL
TLSH
T1281412BB480F6F7D6B2AC2B6B00B4D6C8DE388DD147060741196BF4E35AA753A71B436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 109e3ab263f6254e9810fe0de7be989fdc7ec6568bc35127853e12e581335a18
MD5 feab566294be46d9da9ce25724c79093
SHA1 9b30f47841483661c2b0818ff7bffaa7e7a86f58
SHA512 871d63a8e6eb8fb298b871a9525908f384e09d4f3edf55ea2b96eccee4920c091243ca69a380544295d0956bcb5214887ad872d6cb65a64d6d8f825ebbf31e2a
TLSH
T187D0233073E5F430C81800305810F3143F2EC985FC83C222F21844BCCE9504583C00C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 09d43745b7beb0d2574056dfdacdb3449b786708a0b1a5f978e5c9d69f81a1ce
MD5 c5c86d9c5f7c32a8c4fd09d6ffda4aa8
SHA1 8d3978b900d523ba08075019d6235c1e176294cb
SHA512 e14f89cb3354fd6d7a68e1c291c8723a5bfd3d28140a150bf75ef42a2ef8212eddaed6f6db92cd69e603806f0897ef93b8761a51acd8b8db67878c4cf26ee23d
TLSH
T10AD0C040DAF02820D8046471242CF3C00E09CCA1CC43DA2124E0EF798D820C644C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4f20f916a46d879220b75412e974c6df37fba8f0e80e78f071a3124fdb665aee
MD5 aaac91ebbf67dbbc392d45b8ba21b7af
SHA1 c12b368a2d9e5d86e38c050c8c991930b00b017a
SHA512 d7492a4c51ec39a37fa7e0e893db326eb2afa4a19ccab42d34d8b2aa7279aedca2f5868970e4513c37d26caa55dce67a9dccd146446e47298a0c41e59869c2b9
TLSH
T145D08050DEF05960D8046571242CF7D45F59D9A1DD47DA2125E5EF799DC20C648C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 39579032da4a372408c548e3255c06772dd254dad197ddddfc55631d0c60ec3a
MD5 1ca156fc7b9efd8cd3b749a8432462e4
SHA1 5895aeeafffcfb89010ec405fc876a633c090ed2
SHA512 4ee49442ce10e058c07e43bce17433abe3d0ae863e7bd831ee1931ee7624a329e373f7477aabd014fed1af71f0cca3ee64d66229d528f2b353f51819a14f42e1
TLSH
T180E02BF6C861DC2B08FC172861240741F76053572641884B3A3C860CCFB4E3B5586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 a1dd63e50a77bccad88cb72e473627973f7a259658898e07bfeaa26b4d616656
MD5 225e08c4b6e06ed801a2966f321c04c7
SHA1 72cf0c47918ffe87c539c4b162868224e3166b57
SHA512 3e71c9a7f6c38c7d6b97d12e0be0c21462f0cfb93685013549a6a2159bddf39ef586b48aef5a9006211d16082520411c100140d323348447271edd6193b4e85a
SSDEEP 384:rCaGGnqlOhdX0bEMoKbfZ1Tu/4tBoQnLprCXKuDICB51:rLDnqlOdX0bEabfZ1TG4tBl6xB51
TLSH
T11313D63DB5685CE7EAD3D53E4F0B4A34236CC821FA8E19530278345E8B9EB8E394E515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 e6b741eda4166e4ee4b2d7f20c2f8f81ab4e5fc1eeb598c8728ab527e2db5820
MD5 93b7e98c1daabfc2dc5b9faab1850daf
SHA1 91e29d44c30573fc1ede7c46cbf23418516a3d45
SHA512 3e6c0564cb1932b28ab8ee9694f43eaaff9e46f1e11f39adac63b58bed02fbe41f2bf328d81b11f9bc3451f366f59b1d21a4e4ff91cf1eff8a57b680a11cf415
SSDEEP 3072:I7dq3pPl15WedxBAB5cXKCL9+8t+3vYje:I7dq3h37dMKKv8tyn
TLSH
T1C9B4C5F70951A01ACFA842F697163E3DD17B011D3DD1F9FAD5380C952929B33B2BAA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 5a9f4c3ed22d9f3b7b18c4228571ba3ca306b9616066eeee869bb8a7cff2036b
MD5 708ff41c2bed1a6eac6429cfd4bf9401
SHA1 d602bfd2805774550fbd00af875f910b74c720e8
SHA512 b0304da2a9f3c3d0fb0a0d6d5b91c10385057b2a0de53f6138c12cbd88b9d09c4c901797640ae0bf012eb8cd9b4ea6b3f92aa39ac46cc264f14d185fab3b92fd
SSDEEP 6144:Xw5LwGhXmZDwL/4yLJfIQ8EY0TqT3rkLNiF:g5LcZD+/4yLJfIQ8EYx3rkLN
TLSH
T18E259DEE8B342C87DD6B4D70B4E0EC22BCB411D2B51AE1D34818C990979A3C667DB6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 12.0MB
SHA256 542818fe705b9c8b98fd77b807769a60adf5a67490112b370158233c6e38d5a2
MD5 a20d58c44ec9dc6699ece7cbc162af0b
SHA1 6ea977cf38e6046901d9fc87bd38b28215263686
SHA512 4e9eecc49d49813e873bd54a581cef2472c43c577ed446a469db2dfbe204ce014fabba4d90d620275c4cf74f9724d987af1c9c745bd11b4edf259e04d8f89aeb
SSDEEP 49152:3LEULC28fPiE2gjS52QflyPSYgJJmB+ENAJwz8f9CgEO:7lV8fKEluV/2nIEO
TLSH
T174C68DDE89745C87CE269A7075E8FD677CB413C3B859C2D3845CC24402AB3C5B7AA2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 dc97ee50c5bedb8c95e97bd715ecec530f0b7e4120f7cd91c29525e6ddfcfe3e
MD5 13caefa3bcc1f9a6b6c869b5e90a3add
SHA1 2de6b3f41ebd421866d9860808069e4cef68a452
SHA512 dc57fbfd59022013bf54f54b77402e4797336050e78bfa58e7d51d5cbdaa1798b07303604449b68864f77c9dc5c4be87f086699dbf9f97c8112437a8440bf2c2
SSDEEP 96:QJ22X0G8oDk4IXZ8f5MviFoTbj6aBzF+y:Q0dGlCZi5MqF4XfBzwy
TLSH
T1CE912AC4998480CBE7E5C47107FE2758367E484BB03FEF070AF405BD998EB215A91A58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588d76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588d76.TMP
Size 2KB
SHA256 830540f96396bdb2be073c166d3595fdf40e3f4f7d2be583f90c2041240e8008
MD5 08ecc8dfa6920293292d08be59fae15e
SHA1 62d812a8967d2884a84cdccf902ef95ce364a625
SHA512 bf2c5bee630fc3ebb726be64db83dcaf79358f070375f7c82658f1452a1147319083be558ee37b783b07f77dd7fd4308784dd42fb503a5f7194de956acd24efc
TLSH
T1CB41A604CC88C00BE7E0C1B549BF294876BC4E9EF2375F170EE902BDA95EE115751864
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 65050c2460d24110c18c3e3ac398e234f8c48366f3449f5160844e90b14e905a
MD5 78ccc287a838ae2567f94956623c6599
SHA1 df3884e68a250e46cec93a5c6a0b475de507a7f3
SHA512 b11a22e0444f46b8274c8a4932ad17134b91aeebdabb6d9eac02080f0eaec90fbd5b97fdc7e7bf21eae9fa1a195fc17cc1ae850b6d0a566c98ce8af2e1c22b99
TLSH
T192E0D8D456C7C26E557038C642246F4DC1C93446E7867F431700C8C07647402F7DE56A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 21c35ba25a20d998087a7f0196852e463988f079556aca0ef87723d35579c3f8
MD5 cbe3a4bb1e16711931aaf2759c00812d
SHA1 039913c85262d8a950161efc9759b1fb9aca2851
SHA512 16cca71813bf9a574721bbe91db61ecd76e410f1938579402a05c34490e01156473ca66a8776e63218ab0f37a04746eee07b7f79e4dfdac566465ed6cf4d236b
TLSH
T1DBE0809409C9D32FD53468D3476C5708C7D5344FA7853E43170DC8C1718374663DA164
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 c0ba5cde2cd45f3701a2f4513b483309a250fc15dec68a44cf579a9d49941599
MD5 1b8ca37b9d7f116ad81a715d51c2f4c0
SHA1 db3a33f05acafb2daddefe991adddb8e91bc3549
SHA512 38ae004bb39f88eba4c2652681a52e7cb3422c1ece2bfb51265cd453efafe4e1c0729263f044ce669c86e5175d98e77d2a3259f7e5255dc4df3b8850f7d6db4f
SSDEEP 48:uzBmw6QU1Pz3yxqnH+NNILRNdGNe4V6KdceqnHwK:6BCxikHhRV4w4cXH5
TLSH
T11E9281AB4F74B812D7961DBA296E2C31CE3BE04C5FE6CCAA386554221DB884394311EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 a363f5604ff1a6e72e78620c03271d20514a39451f909515a2b5ba7bf41c3c3c
MD5 30866f9bca45406c309aa132915399c6
SHA1 4c6a773d615c95e99181a60bd6a7d801cbd8c505
SHA512 b76c442440f3feaaa0145e9349ba3081fb97c14905c48903d1b4f07257cac4d7513a9dc376964b90594142f940960d93e49edb856868e5a1f1dd2be9ed2d9315
SSDEEP 192:nsdHjmoFWZ0+G83uxXBBK31GkSJ2/7HvzgwkwwMwYjyK8HG/HAEJH7DNspUc:nCfFCa83uFBBQ1GkSMrBIGvV7DNspUc
TLSH
T11A14305F1F713311CDBD81B66CEB59A29D6EF03F8B5259DA68610470CEE2A43A01C4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 8KB
SHA256 2107bab393df72efb3d291ed351a74c4c259f9c75b5041f00a58649a692922e9
MD5 05b8177978959399db0f8dfba6b8a37c
SHA1 189961bae916e8e11915066ad97e4a2fd607b630
SHA512 8dc84eae81baf24b1bac9bdd47306e5d4f5d15fec31beee8de254960ced3c6fc92195c68b87539d51f8530a2697e7037208a38cc401b7ef864aed02a302a9c48
SSDEEP 3:wl/W//lFlljq7A/mhWJFuQ3uGWUNil/n4dwenqFtjE9SFcTpJWaV1vGrV9RUI8+:wl/WHE7lGn24d4FS99pJB1eB9
TLSH
T1220212804AA099B3F8099B3DA28A40E81FB26A0C88A1C8218048CD110A44AE8938885E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 867B
SHA256 6966923b177f345819a1b4d912c334256254817910574bbc3f179811d08bb2c4
MD5 07812c0556dd3e94809878f14483fccb
SHA1 f2bd27717a3d5a8d1eca0ca8feb817e515634059
SHA512 ce5660c92487fadbe818b40777760b14759d7ed0691780cfd7238b00a249d77e6a5694a7439ee090985e07984d20cfce0ce5b39d0f33729218732b057f0bc66e
TLSH
T1DF11BD331A156918D2479CF47A25BF98D32BA01A58C0DBFBC0856D080FB44FA3275D95
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 17e70abab174861e9989164a6a5b52cf2d293b019cd8e3e04743a5876657c1b1
MD5 3c4ff88feb0c677cd31dcadde74d3573
SHA1 1f399049ac6e6a86fc0dd919246277a62c869e3b
SHA512 0e2b443188cb82e84fe78f6f8dc3e49fb49d6d7b06866cebeeb4b366dd6fe9b67e83373daaaca3e960e60371b659fb94ba1441a9500f7fa2ffeb880b021622ed
TLSH
T1AAE0D8A044CED21F551420D74368BB4DCBE1380AE7893B415B05D840B146804A7D66E5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 47c0b3e6cffd85f7af69a626d9988fa3e90e2ca6320d9d0655d4f97142e698a9
MD5 ba97f1d393bcb4ffb1845369c30d864c
SHA1 dc8245c0e062756d51ae0cf5dd9d9087699a79c8
SHA512 b0654942c2b4b1cfc153068af0cb071a6d9ebb0b790e94e39202f35843332c5a146a62e42d31491c19032a93930c04fe8c1315694183580b6ef201b9d76c2567
SSDEEP 96:iSeMatUaAClMJHay417uuI9xnq09KhyZghsVsflOA0hxu:iSLaSatlMlayGUxq09Kgg3azu
TLSH
T1A692F81D1E222500C2CF2776ADED8C915D08916AB253E37ED58380739E79AD3B95B0E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6f0ffcd2cea3538364cc5bfa0b2b26a68aa989fba5149421fc289eb24c428a23
MD5 0ebee821acea0732ae2ce9fcac915765
SHA1 9490ed4349e54d7af6664a309f72b5fdc803224e
SHA512 66775c62171a0bd40fd09755896d1962fbef567296a3d4ff31694c0a7220ddc271d055bb640cd42cc758d5a960775abced7ea118045c0e4a4353d9e0c21d1deb
TLSH
T1A941BFF783F4866E9A1191F0EA186F2FCE1C0511435C7D9A85E09E1793F2470E081EAF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 97683105b0a9b6880f95afd04aa313fa749745d4da8bf5a2c62f3a9fedb611fd
MD5 ab1c34e06ba0416ad1a8b57ddec4116c
SHA1 a3de485d8d6bb0abd5f3c28eeb018ddbe52d1e61
SHA512 f6869602a8f0463beb3d895348dfc5ef114835e8f31fe6385cd77d5ab7821ecdfea2030b33519db9058fc6784621934da636f4eedb84191b5aeb25b49e2cd133
TLSH
T1D951C2F783F8856ECA1191F0EA186F1FCE5C0551436C7D9A85E09E1B93E2471E181D9F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 e3c86dcc30452c152ad8668bcb3f99cc8319b12c1e6ab49416adbfee1aabee58
MD5 86f6f201651ad385b08467a774075c0d
SHA1 d9d5ca7368fcfd8a7dc63e1dc380327322802010
SHA512 daf6ae4b829d2705414307c823385544c9d1e0259a51cff054b4c1b287e1b3090782da8f0f819c65e25e6a8bec2f8e43b1c51544eb8302ddf429d72be17c55df
SSDEEP 96:uIEumQv8m1ccnvS69sxSbsIsNZWEsp+cIsf9fFsCYnF9sXL0jo0rgSsx84g:uIEumQv8m1ccnvS6aNATfzL0sqee
TLSH
T124F2BFF707776106D55404B0E0446F8E9F06044B82B6F6EDB2C487E3E3E20E1B6E9BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL-journal
Size 8KB
SHA256 4666d0f968e26c1cd650d61d690d475ac56c92378e3807ea699ffebc5792d648
MD5 178856e326c8067a4004b22d7108f3a1
SHA1 560692349579520ba57b10823d4023532c0c912a
SHA512 25747c3f76e8628d9105f153480642dcedaa14a825f9a23d841721ddb2d0ad2eee43cee8389e644ff5c9f9f1073b8cbfff81808904e7128f049b511630bd9ae1
SSDEEP 48:IgTA+sxgms4m1srmvDxl5lY/lIl4SlkZzCLqaIopKWurJNVr1GJmA8pv82pfurJM:NsxSbsIsNZWLbIEumQv8m1ccnvt
TLSH
T16F02ADFE0B2B7301D4D444B0E5845ECBBE29010E87AAABDD5AD842E2F7D62A1B478615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 689B
SHA256 d15a5c5341ae3438ed4edc6c7896836ca49ced57834002049819d882589e1b2d
MD5 5484820d372f72736a2e80c7b7b34a75
SHA1 b275d5d2ddf64999010c03eb5ad382d9f61947b9
SHA512 2c422eac2232ac32c81a538e9ff114bce9b4fa9da64a2c1428920323ac6da7c5a9dafb18a503b7a66b0700c92f090521127d1b938ab135654564180ced1d9a31
TLSH
T1BF012057C2BBF47B503C5D6A2E497A452D79AC3101D1B0F6D6FAC16C90914F75B06035
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 018c791fb55a5dc02f484aa7fdbd1ea03e676b61ac6fb952d98d71aae0b9ae21
MD5 5dedeefaaaa17c664754081321f69141
SHA1 e25ec30ad010437ac2e1b50c0361488fd59c4875
SHA512 6cc8d2ef8299414b27dce7eaf72b534febed4ac5dd578653c5548b3b5fb91b5ee63eea4489e5fce8ac30e691f0b28b49f6aa34cb5f8d023e754b34245af17b67
SSDEEP 384:sxZmd6m1W/fes+WvXEudQpi/bX/5RZn1X:seMm1W/fIYXEU/bP5f1X
TLSH
T1F482E716A5249977CCD6D608FE65BF62D7F8142396914E589AFCCA0C04EB6FD320382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 d6ba3efda2f711c9f6f4fd29dda6c3b9c9dfc9af56f315c10b76d8f0c43360a6
MD5 77aa6a1b98417cdb483fa8649fdf02cf
SHA1 2a5ae6ca0fce05998847c423151bf2e0685ad5ac
SHA512 29f3911f6124baa4fd8ce7df0248f28cde5c614f783c20f83c0eb59641f0fe8b7959464b22549f53131ae0b6a62fbc78dce0e8dd7d810861121c43233c105c76
SSDEEP 768:24hVP8b320P7pLuL/mKWRmmeQRe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3eWWlLlM:24hVP8b320JE/mKWRmmeQReu1jaKeWWU
TLSH
T120031B3B280CCB7F4F844E9CEC27BE9A6DE8018B9698899447FA444C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 f3301a52d478b3d6d600ea013e38663d9b8e23f5e58f757009be50af15a7842d
MD5 5684590a757b3d8e412606a9ddffc205
SHA1 3bf65ab3edac7412b033a789fa8abc76a0b8d4b7
SHA512 dc262043b34a43dd8cefa8718a63a762983bf21541ad08ec9a59f55b6aa91625d2f272ff4c933673461330698dc66788b53d26c30f60e55a8151b0be9c3f7eca
TLSH
T17DE0269015CAD27F6837308703389F09C2EAB80BD3C83E432F01C8406583D85B3E69A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 ffaea49aa72e44c7d21b8e935e9041a937ec1e7609be9dc34f3cf75e8311e5d5
MD5 3b73f3a5c5b47fb244330cfd2464eafb
SHA1 e8d85f115e2ebd960864ec5a266523c0b23d71f1
SHA512 196c12a6f4446e55852a85f8307747520c0bd516d1745451890fe19d0cfa431cdc51b60a9840b9e1e46bbf50f285a12e31970487e86d9f687303fb29279609f8
TLSH
T18CE0D86015CAC36F719770CB5318EF0CD1E3B40FD7C93A912F09D84462479407397561
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 922bfbc53f34f3c3b5e2bf4b13a188924cad46e7ac780efa057729fabe2d9d2c
MD5 9b768feda86e0c795d2f51e81ab957aa
SHA1 9a3193b87b00bb9e5ddb2ec569d64b2eb37ce9e1
SHA512 f9fad34512d445a55b97ba891ac3e20e998f658618da1a8cfa25ffe0923f8e269f252f217f60ce0828946dee716f1e6dec7a5fb5a052b073bc72c5ebd7b4a910
TLSH
T115E04FB085CAD33F951470C24368EB59C6E5781F97893E86570C8480B143B45B3BA5A4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 2cee9ef12faa5989ec3b0c0263c73ec66cac25613021206d779d08cd03947e73
MD5 23111aaa4a34d52ccade1b43512436cf
SHA1 1129a4f3380c74b6ee865740bb57a6417c61d2a4
SHA512 610461c068e4be6a2212d05a88d80684aca7406240d30fdb2e4f4f5de190c6a4bee7fbbfaf8296650774ce4ffebdab65b7656a9292e76d016a2a025a176a41e0
SSDEEP 192:qD1rjvYZ5V8fO9ddTXkrno9BLPTSjjKPg:qRr7YzViOzdTkbo3L7SPKY
TLSH
T116C24111713B17903ABD354E8195B8AF51C271633158E83B3BB900AA4F67E24DDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 a11d5b277d69ad70dbadda19bc07da8f625d2eea18bdfb29ac4d1b4fa31456ce
MD5 b07c0c71b6c35a7b0d99e16fc53d2f13
SHA1 433300899226289d95f71f8b251ed83aa1389473
SHA512 59dab87dbbfa76f40cb74cf329fa30f67f5be61e069f54568043c3a4a444e05a8e055c6157942f8e5f789de4ff85cfffe72ede2af8df4bd2fac186d0d2a65e2d
SSDEEP 192:FvoxYE5fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:ahfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1E624640A7B747001EDE7D9725CB080771A3CB16DCF22A6915DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 f41afeb514df3a891b49783add814e8d9c306b5a561079a2a5cca9bb3a1f50d2
MD5 3b1113417c90c5067dd76c20e65bbcd5
SHA1 72c36ceae1720c5e73fd89752ae5890c9d5f038b
SHA512 4d6aecfb42395274751b99be26c014ca0bf476941c75f1cc7de59d54b76cdf9504e1207b9c27bcd29638002fa61ef9ec9ca861b750c100041a60bcc0c1bf28d7
SSDEEP 192:lAONXAszlrhNCsiV3HPBlQvIIIebOMIMUbZYcY1:ZNwsZqsKvQvIIIebOMIMeBi
TLSH
T1105252392B891B37C15F5FB7126ACBA41FCA88814976226E34301C5F9CF2A5B87C51F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 1a57674199ce3491a2a685d789bef190537cab13c0db2f5a64e020cb5362f1dd
MD5 781ed73f8d295fcaf9b861cf20e3fb6e
SHA1 42e3401653f6a1199fab2324c0b3f49fd994188f
SHA512 c72824c647e1df8083cc87e5d328fdf05880a0d5013a063c584495c02e5507dff33d96d489a1b7f63d2bb25940c4e07bc16925d1cdb4060e0a32f1a861720697
TLSH
T117E048945DC5D25F643420C7125C5B88D6D6790BEBC53E463B09C484758358573D9166
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 6618706399d401b8c22dafcf0497c439987118f0f4662c99ea0adebdf1309582
MD5 f2a13afd2832a5c1abf22c69a77a6d7c
SHA1 67a977ab735f079185ae3c97d7640a270d0c1aa2
SHA512 51c90204bb2d6fb72d76fccdbfed771b661d36c667a5ffb6ddb471c76298c6da67e2f39b71d217eba61e95ebf8fcfcaa5b6762dde0f179bc122e23db83389278
TLSH
T16F219065F320C108E58E963E902BAB351338D8029FFCEC0F447924752E72A411E8BAE5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 00c6c0d3a2b7c31407f83f0e630b6db73d6930622a2626c0e35507e1d8d6d9a2
MD5 033ddb47bedbc8eebabeadda50356687
SHA1 b21c14067f5c06b98c9bbed09a96e8989abe55f0
SHA512 4da5d5f3c5f3a1e079b2999788ba4d44e45e30477567d3bd05c15c55cd0135b0aecb47bfa71e9e4bf4a8a76145894efafb50774cb23c2d704b99299749b775e6
TLSH
T118E04854BDC9D26F943420D3026C974CD6D7784BEB853F452F09C885654258673DA166
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.6\data.txt
Size 145KB
SHA256 44dda6faa8220666a11a09301932b82c5d89ba5cf60227ae3b5c3a0a7518bbac
MD5 370210ebc9e63f6f39a4185846435533
SHA1 17b63f65390d236465b6952953a7df4cbc6fce1e
SHA512 e594ebf58d19f6d9e7024f98107c738142c6cc2504a0ba89e13f8f771c6a600427e75951ccbfe105983c21b735dcde6e6e173f4da37745c4de51bb9f5e86b989
SSDEEP 3072:7PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEI/tLZjUd6mG:LX1aI5aZoKzMJ07NI/leBG
TLSH
T105E3F1108EC41FACDFA8291C70BE0B1D63E1C79D84676585E773FE0AAFAB90462275C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 957fe499cf80d0cc67e8e832dbd527aa09afc54c2e9a9698e2df083f10308fac
MD5 aaa05553c592c986f237f31b7877bfac
SHA1 c2a250e488c17cf24f0baa2b4f0efcf80cc4705b
SHA512 d46f93609a69ebab90f4ca82a0b3e63824a9e4cc7ba713d0e261cf044d3cda589f06e35a979c77bb5dd3c813f52117dde615a44da2de5492adba4892962571d5
SSDEEP 3:MsEllllkEthXllkl2zEflV:/M/xT02z
TLSH
T14E4404047FC40405C5401031C05DC3705770D5500571574334D104375CC7F401F14400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1f3658006b76db7492f2ccaf28e12664a8cf1971f3fdc619899219d44e825651
MD5 e8604cef8a5ffb878adbd955a5adc03c
SHA1 7d80adbdacf651685e7d69c685232cd844792673
SHA512 b67a50a0e1d610c96ffc8373e023154ea848527fb73135f7c89ab4e58464bab5fc1d475e75090421dd45af06dabed5b8523611ce37d9863dcef7afdacacaeb68
SSDEEP 384:n5iFyvqMM8NG8TUNTUlIRNzJO2+4Or4L+vM/OrfpYauhDq984YXHz+jysSugcIsE:QFyyxlwg3zw2ZXiYTDq24YHzMrSpKli3
TLSH
T176B23972DC64CA6BECEA5F95B64A7613CEF04153968C4AE4DAD81E0D00DB1EE530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fbad09975d58415c281a253ad3799999616fe0e2defa1db70a17e7425642ced4
MD5 9488b3c245ff8aee5d571b19e2be373b
SHA1 92cefe7a9de58759155d250110f2c422c66c2ae0
SHA512 08fef7b7ff3d3d86d685541afbe931378ca14d1475f8fd3f86f37293775030f4e662127643964bff252445137f89fdbc87a57da146bcd9b48b3f62f0152fbd2e
SSDEEP 768:rFyyxlwg3zw2ZXiYTDq24+DCx95jYKli3:IyxTzw2ZJq2Ry99YKY3
TLSH
T1A0C23A36DC54CD7FE8EE6F85A64DB6138DE04163D69C4AE4DBD81E0C00AB09DA30BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 02f36563a573db5de45ce3a17783f4ec4e59fbc0776a784b34294195fc2e5048
MD5 f8be12f0fe4830310d0877bc896cc749
SHA1 9c46ce5a2e726c8245373bd366af49560a960d5b
SHA512 c2d07763bc5fc517e8e808cff63fd55b3739db038473442941e015471b6cfde20f514c6fa03aec5ea6c1aabdc64694c6f1b3fc3b137435ae974a1f52b15f2110
SSDEEP 768:PFyyxpwg3zw2ZJiYTDq24YHzMlvP6K/ez+pKPw:cyxvzw2ZDq2fz8P6Kmz+pK4
TLSH
T1A0E20779DC54C97F98EE7F89A70D6A229DE40237C1A88998D7D40F0D807749EF34B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 a456cea944d87ef4d2185af835b4910a8a3f7561f8f39f63bf1678e2049126b9
MD5 6e6fec44d5f76947c78adf619e60f03e
SHA1 306b7f4ac97f5b5caf075b714b8c1ac0d317e3e5
SHA512 bf52792c8b2361a32775c01956c5c5a6a95164be8e1519a4d9f89abdb5c7d55d72b15d93c0012f37b431a36f1a244828d3dcf450bc0a0e44f227ace6c57f41b3
SSDEEP 768:PFyyxpwg3zw2ZAiYTDq24YHzMlvP6K/ez+pKPw:cyxvzw2ZQq2fz8P6Kmz+pK4
TLSH
T1B2E20779DC54C97F98EE7F89A70D6A229DE40237C1A88998D7D40F0D807749EF34B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 68f0ec1f33c294ff34498b3008f61605cf3404b527e11d23ce8f5afbda279c7c
MD5 1ef8b971768b337d858baedf65e3dcde
SHA1 b894b74682ecef74a8142b2b22155c1c8929b8ba
SHA512 dfa091f0be31615c2740af4c8298dc62ca1c5fe8ebaff5456d4ad600bed603cb8703f736d72c426349dbc6cafaab922ddea3b6477e89074a6d8d0b1eefc58a30
SSDEEP 768:FFayv3PwgO2ZhdHYTDq24Ty5RYk1mA7Ch:uyv3E2ZhOq2v5mkEA7y
TLSH
T1CBC26B35E854CDB7EDEA4FD9A709BA07DEF001A7D59C4AD4D6D81E0E009719E230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 40c1cdf120fb66f89a61bd1756ac40d9fc3a59e70826a1c03121b1ceec8f4d9f
MD5 6f25431dd40d0f5d3188b4cfcca9dd13
SHA1 72b1a37bec80b6ea25ea3cffc2db17eb3dbd4ba2
SHA512 5abafff0751393dcef34de54f92c4e8ef830b2074932e94372aab24932008af87ba6e920ae41c7b8450370c69f1fc8792a01b090b64f90191a6d1b9c2d7f5771
SSDEEP 768:oFayv35wgO2ZddYTDq24YHzMiy5RYk1mA7Ch:jyv322Z8q2fzA5mkEA7y
TLSH
T1E7C26A71E854CD67ECDA8FD9F74A7A52DEE001A7C98C8AE4D6D40E0E009B19E274FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 f2416f4799e400088170758ac7cdfec64d0e8e13809f0faffc62aa535d715972
MD5 f7ca06110e12687e2af77e20c9290e7d
SHA1 033901e5d379c0231c3209caaac03bd1f5603df3
SHA512 2e298144c0e64ececb38343c36463e960f46ef3742b15887e258a046a43a95ffebff63df876944a04121998dba514b9bf12d15785a212d3a5caf25532dc9ad0d
SSDEEP 3:MsEllllkEthXllkl2zEflFRNa:/M/xT02zMNa
TLSH
T1B54404157FCC0505C5C01070C155C3701370D5110531574334D10437DCD75401C07004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b09a9f90449c3cc7d87de3663b00bae6ab22f6cf78ae4ae494d835983b71c375
MD5 4641fe32acf32048ca9d65b3ee95e0da
SHA1 be0be0b48c76c30fa060ba10e1665dec2ede42ad
SHA512 d1ba9a5e41657a0338f414a5dde21aa6c5dd6047048715e90efad3e8e97a89b9415ae0cd906b449e9808fecaf302822ef0054e2ae58a3bb1619a0def01049c26
TLSH
T1164140E04C3D2AD1D0BD0A7EB48B38FCD5ECC729F4A4347D6864EA98467A20D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 080d0b06642e51a609241f8fa79673ccfff972a854bf32e085ec1f95800ba29d
MD5 95becfeaeab7f150a12bc96d7f2ce1e8
SHA1 0182374a8865dd6d2abe4b9e775a7708c31362e8
SHA512 1ad285ce6766c117c1261ed6404e7f8998732f68bdb88bbfd8e981ba4bc02994fdacb2d97f782ffcb45e98610b9de3d6173136ccedd11b4eb5cf6295dd8bcfe0
TLSH
T18F413FE14C3C2AD1D0BD0A7EB48B38FC95ECC729F4A4347D6C58EA98467A64D248583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b3fdf12599ea9e1232aea05abd2e1edeb4e1df668067d04db991a8b8be2b4fe4
MD5 fa79ca63271b66ae3c4d8d222ccc1233
SHA1 654d122064eb87edabcd1daeb5dc6ded0a7160a8
SHA512 69b2637402dc4d4baeb56744e9ae27bdbfafbf162c7b99f3be9ec9070654d1290fcf78dafa7834329567b2138d9b1578f7847abcdc03983fc604e8b8f6296036
TLSH
T1AC413FE15C3D26D1D4FD0E3EB09B78FC85D8C72AF4A4347D6828EA88463A61E644083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 afc7d883ff5e0762699bf487d8a61192b2fb35a41541a70d578ac3c5ea607eba
MD5 ae337877632e039d735ee94d8d4e8d27
SHA1 f43153ba60651c494c57d0501747d0603ce596a8
SHA512 e01d35521fe2b73efd31c16a8be009089b4a9133e52fb68d2212ee6d39a91865ee50fb5232d64698d636f3547ba9d03e52d20a77fd8787a78cc7954f2e473813
TLSH
T1534140E05C3D2AD1D0BD0A7EB49B38FCD5DCC72AF8A4347D6814EA98463A60D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 410440f84a20c037f8a3f636db97445af3aa0530b232f76de0aefe26205b994d
MD5 348cffe5ef29299ca47524c482d49c88
SHA1 803aac33c0ada475af5d9a8794b55bf3f9ccd842
SHA512 6cf52d0a9046a4a0d176c000dd6a274da7426b53910050151dfc526928d2de0c25ed5cb835550d17de7901a28c2899ef7309380eaa493a6d4aee4487608daac8
TLSH
T1514131E15C3D2AD1D4BD0A7EB49B34FC95ECC719F8A4347D6824EA884A7A64D248083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7dec53cabe36ba7bcdc2e038687b78a5b0520c36ce959c2304e4dc4db104af6b
MD5 21a021452ed1e3b6ba00eecb2bf1e8f7
SHA1 f8a6ac88fe4a28b673f986641098095a74eb8feb
SHA512 1f1c19015c5dd5721d1351237c5fad64c9f55e920f2f7bfe125650bc1d06943937799cf9ac67c6552ed799424fa063dab2ffce7d03c9b909af1bda2ea1fa6b6d
TLSH
T147413FE15C3D1AD1D0FD0A3EB49B38FC81DCC72AF4A4347D6824EA884A3A60D644483F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

e9f0ff9e-fbc8-4ad8-9b9c-d8eb7735dbb1.tmp

Path C:\Users\Admin\AppData\Local\Temp\e9f0ff9e-fbc8-4ad8-9b9c-d8eb7735dbb1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1074902373\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1616474938\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1631843063\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1647721903\manifest.json
Size 52B
SHA256 38bee4120e8eb37975dd2f6a2a3b23f9cea6e6c4f0335ad80270dc22b9990fc9
MD5 50ba36034cb8b97ce52eb941d76e9103
SHA1 a8757a3700f2af777ce5efc382010d2619f51491
SHA512 001110c3e45514a09cf6f60ca14855524e83ac15cf56776cf3005e016464dc6584b107c63842328a7c1738cc7f2154d8689f84d913b9b8199367699c3f9085aa
TLSH
T1FC900260082491171AC10E506570F8859391661A95851D1D0445154802A646CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_598193760\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_598193760\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_662302579\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1916-285-0x0000020489890000-0x000002048989C000-memory.dmp

Download