hxxp://ewyfgw8y3r yu3y3ygewygwygwyrg3wyewgyfgewyfwey gqyf3fgw e

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ewyfgw8y3r yu3y3ygewygwygwyrg3wyewgyfgewyfwey gqyf3fgw e
Sample260511-ym3dlac14p

Score

4^/10

discovery persistence

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1740_1798684572\manifest.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4716_1506869169\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_1155235595\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_1155235595\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1740_1798684572\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1740_1798684572\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_1155235595\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4716_681890986\_locales\vi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2256	msedge.exe
6024	msedge.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230029186304319"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-914486190-3969805341-592249730-1000\{F0290CD8-4D21-4E17-BF8B-C0DF82FE4F0C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-914486190-3969805341-592249730-1000\{576C8C52-FF7A-46B2-8457-C542FCC54521}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6032	firefox.exe
Token: SeDebugPrivilege	6032	firefox.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6032	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 4744	4716	msedge.exe	85
PID 4716 wrote to memory of 2256	4716	msedge.exe	87
PID 4716 wrote to memory of 5684	4716	msedge.exe	88
PID 4716 wrote to memory of 1052	4716	msedge.exe	89
PID 4716 wrote to memory of 5684	4716	msedge.exe	88
PID 4716 wrote to memory of 5684	4716	msedge.exe	88
PID 4716 wrote to memory of 1052	4716	msedge.exe	89
PID 4716 wrote to memory of 3512	4716	msedge.exe	90
PID 4716 wrote to memory of 3512	4716	msedge.exe	90
PID 4716 wrote to memory of 5672	4716	msedge.exe	91
PID 4716 wrote to memory of 3512	4716	msedge.exe	90
PID 4716 wrote to memory of 5672	4716	msedge.exe	91
PID 4716 wrote to memory of 5672	4716	msedge.exe	91
PID 4716 wrote to memory of 904	4716	msedge.exe	92
PID 4716 wrote to memory of 904	4716	msedge.exe	92
PID 4716 wrote to memory of 904	4716	msedge.exe	92
PID 4716 wrote to memory of 2108	4716	msedge.exe	96
PID 4716 wrote to memory of 2108	4716	msedge.exe	96
PID 4716 wrote to memory of 2108	4716	msedge.exe	96
PID 4716 wrote to memory of 6048	4716	msedge.exe	97
PID 4716 wrote to memory of 6048	4716	msedge.exe	97
PID 4716 wrote to memory of 5332	4716	msedge.exe	98
PID 4716 wrote to memory of 5332	4716	msedge.exe	98
PID 4716 wrote to memory of 5488	4716	msedge.exe	100
PID 4716 wrote to memory of 628	4716	msedge.exe	103
PID 4716 wrote to memory of 628	4716	msedge.exe	103
PID 4716 wrote to memory of 628	4716	msedge.exe	103
PID 4716 wrote to memory of 1144	4716	msedge.exe	121
PID 4716 wrote to memory of 2052	4716	msedge.exe	122
PID 4716 wrote to memory of 3060	4716	msedge.exe	123
PID 4716 wrote to memory of 3248	4716	msedge.exe	124
PID 4716 wrote to memory of 3248	4716	msedge.exe	124
PID 4716 wrote to memory of 4704	4716	msedge.exe	125
PID 4716 wrote to memory of 4704	4716	msedge.exe	125
PID 4716 wrote to memory of 2944	4716	msedge.exe	127
PID 4716 wrote to memory of 2944	4716	msedge.exe	127
PID 4716 wrote to memory of 1592	4716	msedge.exe	128
PID 4716 wrote to memory of 1592	4716	msedge.exe	128
PID 4716 wrote to memory of 1592	4716	msedge.exe	128
PID 4716 wrote to memory of 5332	4716	msedge.exe	129
PID 4716 wrote to memory of 5332	4716	msedge.exe	129
PID 4716 wrote to memory of 5332	4716	msedge.exe	129
PID 4716 wrote to memory of 2644	4716	msedge.exe	130
PID 4716 wrote to memory of 2644	4716	msedge.exe	130
PID 4716 wrote to memory of 3028	4716	msedge.exe	134
PID 4716 wrote to memory of 3028	4716	msedge.exe	134
PID 4716 wrote to memory of 3028	4716	msedge.exe	134
PID 4716 wrote to memory of 548	4716	msedge.exe	135
PID 4716 wrote to memory of 548	4716	msedge.exe	135
PID 4716 wrote to memory of 548	4716	msedge.exe	135
PID 4716 wrote to memory of 5488	4716	msedge.exe	136
PID 4716 wrote to memory of 5488	4716	msedge.exe	136
PID 4716 wrote to memory of 1740	4716	msedge.exe	137
PID 1740 wrote to memory of 4520	1740	msedge.exe	138
PID 1740 wrote to memory of 6024	1740	msedge.exe	139
PID 1740 wrote to memory of 3500	1740	msedge.exe	140
PID 1740 wrote to memory of 3500	1740	msedge.exe	140
PID 1740 wrote to memory of 3500	1740	msedge.exe	140
PID 1740 wrote to memory of 4736	1740	msedge.exe	141
PID 1740 wrote to memory of 4736	1740	msedge.exe	141
PID 1740 wrote to memory of 508	1740	msedge.exe	145
PID 1740 wrote to memory of 448	1740	msedge.exe	146
PID 1740 wrote to memory of 5248	1740	msedge.exe	147
PID 1740 wrote to memory of 2756	1740	msedge.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ewyfgw8y3r yu3y3ygewygwygwyrg3wyewgyfgewyfwey gqyf3fgw e
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x28c,0x7ff8f486c188,0x7ff8f486c194,0x7ff8f486c1a0
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,7908908276396261962,4529944586610236049,524288 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,2512371537220356182,4441514589863367002,262144 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:2
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,6964288916847390719,13074174246699843572,524288 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,2890087539051102636,16517590290934346742,2097152 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,351509974835988829,8369111207586890819,2097152 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4928,i,3036054520601911918,11739923411093095511,2097152 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5116,i,4119136482481786642,9188056150358550518,2097152 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,12265211366690937290,12590785169062721629,524288 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3400,i,9480932232362924093,1830272427237276052,524288 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,16874862526580100592,11048841424781738192,524288 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,16874862526580100592,11048841424781738192,524288 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6128,i,10848462230296247992,5061954952358396992,2097152 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,9542563286764337534,644587772852746063,524288 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,6997452620419438129,4939132962316965400,524288 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,13330425711860324744,1497499606121492649,524288 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,7337846131155103826,17513037914648198358,524288 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,114442395521277628,12199050737007609739,524288 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,12629762738955838820,9013114944705272755,524288 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5348,i,15440477064320092850,10972024439818308604,2097152 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4640,i,8310030557519304752,9495911571232605896,2097152 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,1118512143906727955,8669922983377248172,524288 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6704,i,14142106006372398906,3741768669060779297,2097152 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5132,i,16579361498853668896,8261558515264510367,2097152 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,2566233566426831243,1182759700772143930,524288 --field-trial-handle=2764,i,16775889357335578164,2118209809620785070,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff8f486c188,0x7ff8f486c194,0x7ff8f486c1a0
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,13788030399893757253,10865521985514273075,524288 --field-trial-handle=2028,i,16172688105800158865,12736638280331456146,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:3
    3⤵
    - System Time Discovery
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,4458220347553216088,14550138693767717363,262144 --field-trial-handle=2028,i,16172688105800158865,12736638280331456146,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,4908282024673608803,4946891922011217348,524288 --field-trial-handle=2028,i,16172688105800158865,12736638280331456146,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:8
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,5456055620169002828,9109548707745546103,524288 --field-trial-handle=2028,i,16172688105800158865,12736638280331456146,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,5456055620169002828,9109548707745546103,524288 --field-trial-handle=2028,i,16172688105800158865,12736638280331456146,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
    3⤵
    PID:508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,11670286580150972385,1580694267730317253,524288 --field-trial-handle=2028,i,16172688105800158865,12736638280331456146,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
    3⤵
    PID:448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,2107268070028693347,5192367635096756963,524288 --field-trial-handle=2028,i,16172688105800158865,12736638280331456146,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,10754664108917088794,6932450179207628215,524288 --field-trial-handle=2028,i,16172688105800158865,12736638280331456146,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,473708990464430862,9323823734498799749,524288 --field-trial-handle=2028,i,16172688105800158865,12736638280331456146,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:8
    3⤵
    PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4688
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2024 -prefsLen 27099 -prefMapHandle 2028 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {fb5a72ac-86a2-438b-a1eb-85d5e109200b} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {4d51d318-48c1-485b-a368-e74113488cf8} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3648 -prefsLen 27276 -prefMapHandle 3652 -prefMapSize 270279 -jsInitHandle 3656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3664 -initialChannelId {f937e55b-623b-4324-8cf4-70de2ad86309} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3812 -prefsLen 27276 -prefMapHandle 3816 -prefMapSize 270279 -ipcHandle 3916 -initialChannelId {3633ffef-793c-4396-baef-d0a3310267f1} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3532 -prefsLen 34775 -prefMapHandle 2708 -prefMapSize 270279 -jsInitHandle 2840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2712 -initialChannelId {a6ff0b81-6b7f-4ec2-b6d6-d1a8c377e1e5} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4952 -prefsLen 34905 -prefMapHandle 4948 -prefMapSize 270279 -ipcHandle 4404 -initialChannelId {3b1db2a0-fa18-4411-a259-4cad08a4c02b} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32845 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {c70c8209-ae3e-484c-8407-d2fda7e06437} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 32845 -prefMapHandle 5484 -prefMapSize 270279 -jsInitHandle 5488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5496 -initialChannelId {c5217bb6-9bbd-4a41-89c7-0f5cc53c4bf4} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5668 -prefsLen 32845 -prefMapHandle 5672 -prefMapSize 270279 -jsInitHandle 5676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5684 -initialChannelId {587d10bf-0b4d-48ee-9d0b-8aaeb5db803a} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6112 -prefsLen 33031 -prefMapHandle 6124 -prefMapSize 270279 -jsInitHandle 6128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6136 -initialChannelId {03b269b6-d66e-46cd-9cfb-870b8295cf88} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6676 -prefsLen 35143 -prefMapHandle 6680 -prefMapSize 270279 -ipcHandle 6688 -initialChannelId {1f9b5dca-584f-49d0-a4f1-1c9307def8bb} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:5516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3020 -prefsLen 33031 -prefMapHandle 3024 -prefMapSize 270279 -jsInitHandle 1644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6820 -initialChannelId {d6aec7a8-3ef8-43de-a5a4-f71fd9eb08f2} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6624 -prefsLen 33031 -prefMapHandle 6608 -prefMapSize 270279 -jsInitHandle 6612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4252 -initialChannelId {2dfb28e4-b15b-497b-ace8-fbf62b29fa68} -parentPid 6032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1740_1798684572\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1740_1798684572\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4716_1155235595\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4716_1155235595\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 948d68e795f58735315ff49ad4468d62d55ecf58355a3ca40434238003987886
MD5 c0dd1480c64b77b672502c1b5cfe0ae1
SHA1 15cb6cce709801c4e13d81e833ecef6382559694
SHA512 13bfc74f99bf85461cb61f3846784ef9b7944fcb4a5a0025ac47a38fc1880c04d21cea94c0aa9395552b769128e661f146ecb9a8b7c8c9e1711f8255dd029213
TLSH
T153D0A73A664EB41AE66E517082938742233E545234928A10FA1CD0AC88790D957D61C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b64ecdd7c3b2ef814e951e7ba0f8f6d86a51716d8c896394c9d7aa3b87474fec
MD5 380a4fb850ecc8063c21fac601e60f14
SHA1 c8247e24444b8eb9f9e4db63c6e3e3e5b124a410
SHA512 512fae4847acfc0c997698c91ea23bfa469ab406779a92d16a8cbf8239e572b4828968c7be4a0806967529e888e68173d493459259fc57b2c8821b431be5cc1d
TLSH
T1DED0A73A3A0D7845F79A71708493C701237EA45234E24B11F968D079C9654D896C7283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 426553953bad808ef78989a0342f288790310be1cab75609c171573c74ddfe82
MD5 e8629599c0eb79c7e04429db454e9acd
SHA1 d2b39e88681e6821fb266a699e2c2c8721ec9213
SHA512 e5c46844b57510ee46f39be84788310b97bed8e268d531a7ab6e95d4f83045f4c80d564f08c242162cd4caa5d80ce178205706c3b039cc037a39749f34174f51
TLSH
T1C5D0A73A3A0D7845F79A717084D3C701237EA05234E24B11F968D079D9654E896C7283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d68b8059d1fdfd8541892ccb136bddd7ec7601b55110e2cdd4c0e5ace97d9da8
MD5 531be76c0b4d3ce6131509c7d95980da
SHA1 8d06c8ade4d281ea8e43a1dd0a469db76987e5cf
SHA512 3f61844b74b97a902b9307c088590e72b7ad0e95c0f14948ae3780aa3e04b871d8e5c5cb6ca5f5fdf524ad8258178623c85c528a35deec8559c2d1d114436d1f
TLSH
T125D0C05C12B3BC35D4CB987004C13B03323ED893659187307C2234B80C0304048960C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b1e4ba6890ec60cfe9f6942acc1937ba6fdde042b45c0a2e0b7e13ade701cfd
MD5 642961cbd4f67f82b3038bc1275d24c3
SHA1 f1df4ba11ac13409c392147b2a9da411bc9cd6eb
SHA512 4f7f98f2ebf15c98a7f379a7975f6dff1c7086a1e3cf81d3daec8c9be6212ba05fb4eefc5fa2c0486a277860dc8b2aecdded5e174409117a0736b1cd3b8443d0
TLSH
T1CCD0805C52B3BC75D4C7997045C53B47373ED493659187317C6274B90C534504D961C7
MD5 SHA1 SHA512 TLSH

Submit Download

04c7884a-d350-41b9-8afe-b2b3a0f17e4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04c7884a-d350-41b9-8afe-b2b3a0f17e4c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 eabcc9837188205f21a6a9784842a5aaf2110eb3ad29b6fff42b5affd9ed6b08
MD5 a3a04f64ec6bf5d4c647d9388e34ea71
SHA1 edf0612d00d3badc26607a5a554f363fafbc4f02
SHA512 5226ccea628fd51b0a16d5f2683e1a2216fbf2927cb390383433b811e106208936d054df1391a1f6cc8ef9daeea44effd98e26b243a27ae62132df984dcec5be
TLSH
T125E02BAAC9319C2B1CF9071D60644745F78513472B80990F3A3C810C8FB0A36428A86C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 a97d9d206fdb51a2fa2797343190662a0be4ed5b70848a224f5d1a6f316862f6
MD5 682e1a8e0bba36aef35729f2246a5c2f
SHA1 1624cf5fe28eb35b685f143ed98a206b17dfdd38
SHA512 27dbf5bfcb7310694cd3c6d3f3d58a68902730442eb528a8555d5b33cf6bc59a9dc3d311c0edb6ce324a6e758fde72e25170d460a612928088cf4e28e57df207
SSDEEP 768:qZ2Qa4QkP78+kC21kz+iYu418MgtHHPnR3k3d2m7iJeF3Np:OfQ9+ktG4CPHp31m7iJA3/
TLSH
T138131AFEAA8D0D19CAD7607C1C1B0F3163658BB0CADE5E5B7725B16A927634E340F248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 f112d2deddc52e985600f4c9d411d4f548d76e935d3a7920026cda31761c747c
MD5 d758fee294a6280c49671af0db61ea55
SHA1 39ddaa4ec6cc4b03fbad89ef606097d4f26437c4
SHA512 297ff9dcb88b755dba682b10c955e9c66c4ee059c85f4075ca3ef2d02f9438e028cf886f947f37c5afbd2c76fb1250e9063c8753defe7df6717ef59c2e49c1c0
SSDEEP 6144:Hf9lf/EULdaL/ML/b2VL/OL/WPAytqFh6Ph:H7fsSML/ML/qL/OL/WPA7FGh
TLSH
T1C7B4A5F70955A01ACFA852F692163E3DD177011D7CD1F8EAE5380CD52929B33B2BAAC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 d5f580eb952a119ee1456d1d47c985895e169b5a3513fb46b9fbe5b11f509a7d
MD5 1ec6a0b278779dddced946688efaad31
SHA1 d26c1d6b60db317ea530ee099ab8f7077c86ae05
SHA512 32fe35b638250231a50c7414eba2ed4bb9874f06dc8ea3f590bf93200c782734c47b9d2a9daea238e642506fd9010daf8abfd14617e4f9a4b9e9d3c08f51f1f4
SSDEEP 6144:65uB+GqMEskr+WeylRs/NZDnFfiE6IOI4SOsu6Dgjf:65kMVr+WeyPs/NZD8E6y4Iu6Ejf
TLSH
T14725ADEE9F282C86CE6B4D70B4E0FC22BCB412D3B515E1D34818C994875A3C6679B6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 12.0MB
SHA256 23eb7fcf2e32a088d1f248911b80a6c85df56b2f3700e9329a942445905fe96d
MD5 02ac8fc34addd5de3a32b17cda547681
SHA1 3b8ec71960a387bcdcad7928195f2bf878f77493
SHA512 b7c8f28f3b475da5352d8b469e1455bdb5e5f4f828b1c302b9818922644cb42c0fd83a3107e2ec9030485ee204b16d45aafcfbdadabe4ed421b638c6704838ed
SSDEEP 49152:+uKl0h/c5vFrHUgsDNa8uXdWfJm85lJcJ33fWRhRN6EgkkH+aNW:cKhE5vFr0xR684eRhRjgkeNW
TLSH
T17DC66DEDCA685883CE679A30B4F0ED477C7413C3B595C1D68858C684026B7C1BBAE7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 55KB
SHA256 d8204a264efd7b1935aabbc7c85fc471bb88bbc9016808a165f8e063a2f5cdba
MD5 fe4db5c31e53c3e67838fd54a7b1dcd6
SHA1 390118a32d1739456db6f38fad9194ff8f808ff6
SHA512 f42bb0df63bf8438d121231ab46e5752de5c620d43689097edbb1ee6b212f290d5da34fed07d44b70cbbef7c206b58505355b8b200b6fa10a0a9d6797cdac448
SSDEEP 1536:chq9KMvJGt0Ze36MbYuE4xkG6OFQWQ+4Orj0xfEfdD:L9KkJ3nMo4t4WQ1Ff8dD
TLSH
T17B43F1C32F6D1474EF9BD17521A5CFA547AC247F843DD2B0121BED1F628658DCA8105A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 72KB
SHA256 193dc0e32aaeaed8373689a34903a7a869eeec406306b0e054513bbc229ae432
MD5 b3dbf823c6d17d8fe09de16dbe159b7f
SHA1 fe4a900e50856987bd05768499405cfb70e60575
SHA512 9b44b951d0b75af0d8d99b8c8071b805b881014baa7dfb5eb00240f933136ae68431ed67a2ea3556e027f947f82110d4a6b8289ae0b8d5b3829495d03b97cd09
SSDEEP 1536:EvoCSHkUIk+TW7n37v90+O2xgmRbfcX7gaXQ8zEl5f3CZ0L:IokRdC7nzfO2xXRIX7gag8zEl5fs0
TLSH
T105730241779E5F51BD730D41B3229C6B0EC012ECE7D2D6B8608641AF7C981BBBA8921C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 68KB
SHA256 4ad601c70ed7615e044931de2d0d9c24efdb78df38eeafb5b31128b73c608705
MD5 b5062c2c09682cdd63e4fda053acf12e
SHA1 7efe12fd7283fc6aae2cd1206f5f04d36ea6de6b
SHA512 86a64354cb92f4f507f1da0e3315b02d3cabdaca349121723cf4e01b480401062027ec5f9f53e94835e7b44a6e7de35b185c5e6fd49aca7f8c1a0e60070a0ee8
SSDEEP 1536:Rimoq0CZYVaNUf76Z+AGYguWv03e30iIiV43s6WFYlXx:8rmyV8X9GjuW83BUV43sTFYlXx
TLSH
T174630223FBFB076A70E95438F13D632146E1BC5AF00B57061A77AAC67D32E62248430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3
Size 38KB
SHA256 afd6ed6501f0e9c02a23aba559a8c64e2d3280f3c630834618da3c0c2b0e1a28
MD5 f52adc3d8222820d7bfa4486494eac97
SHA1 e829c54377987c82c305501722e809a59c2e3804
SHA512 f55bc5181400e51aa950e733614add3ca7898847c88a628ee903362daf300f7ea45067f6c291f57b842a07bf679dd2a848c6f4ea585599f466b0d738d5c81de7
SSDEEP 768:EclScUPPhajylJPWlFuCJ+rOGod93BRnskCE6HIOtTryKHPIKTadU:16RQ1J+rRodRZCIOdryKvIiau
TLSH
T19D03F1D22133479EB229F601D11021923CDA7CF462A73D385B9F4FE214916397B95BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c4
Size 37KB
SHA256 346ea97ec5aa47587d93e6347417ac2f9f9e7c85adf447c627a04af5926d08fe
MD5 336366f1121f7cedc056a917bf0f2fc1
SHA1 1d79799f95cdae8946042d09c056c5075e3babf9
SHA512 e730cd5de6b898ad719f905cc8d488945393206baabd17cd1e0902e55b46f71c2de9fea9e1b72981697f979ba084596dc09687e31cfe89c2ad1184e37f0d13b0
SSDEEP 768:zo30e1yjwXoHp8WOPEyD2l5QYnCmqimlrL+78O+fktopf:G0LjwYJgP1DY5VValrL+78O+fktKf
TLSH
T1F103F11C0F934D4984A3DBEAFD5C2B0068191E0F687C4666F3DD67EC3469DA6203B0AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 998e2c65066530c942d94021facfd4c31fb1a29021761fd2e16c87a6e6cc2216
MD5 443ba56a23c304a2a1703b229b71a8b4
SHA1 e54584a734245f2272763f2b9830546f64d2e760
SHA512 09aadf65186b6661e54c40291d6b44a925ae5eb9b69aaef64d1e8760f46e8e68c81801c61a81cbca915c46f78d399e5f114bac1fefdcdab38e56eee855af0b48
SSDEEP 192:lxYQU6c/yIZzhxHcfcWue8o0FxPcMy3ErUUHHClv7rMK1mBjo5v9zg7KA1DrQEr0:lxYQm/yIZhx8UWue8o0FxEx0rHHCB7r3
TLSH
T17EF1DCF6BB9DC82BEBD5117108D91846713C4BA4644F4F2733FF297D29EAB966030858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 dd57a6c90f15082a33414f5e35d8b9199965d794ed8d58c99d62bdf91e34ea9d
MD5 9c3522ee1f44c4c19a19c032f5ec2ab2
SHA1 8f87c13678a901b3c5e4ef8df327ff9fafde8b53
SHA512 f685a538c8fde2b1b8d9cfb66e92dc6c6364e5dc3f96d7839451a680eb32a998e94c92f12c9da14caad593d5b6677386dda8fef82501e512b2b280aa5bdf86f8
SSDEEP 96:mkuozrcz7c3fNfQDYOOnbTj6c3F/Il8cn1QMnOrcZmmqHcGcpcPzqUOxNGqJfV50:mfucHc3fNhOOnb6c3F/Il8c15nOrcZmP
TLSH
T13EA15F7A7FA9CC6BEFD1647109992919623C4B5885864F2633FF1C3C0AFEB963171818
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a207.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a207.TMP
Size 3KB
SHA256 dbad3d05813686e59a8a94bafe1b8579226bbb2494f46b7a717ffbd0078eacb4
MD5 47c8a3063e9279f00f0195bee5d738bb
SHA1 7163ddbace6a8ffcc49c7b41249ec60535a986fa
SHA512 c3e66cc88a752a4d44f5a7e968e452ed38f3fe875af6b4d50f7a7038db02302e3d1518f84ca0fc6f72fc0716fa1bba581884cc2f062c3e699205b43299c98a43
TLSH
T180611BB97D45CC27EBE4A17049AD1125B23D4F580A879E2133FF5C3C4AEEB613071851
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 5adbbe56f7e7c339a8095853feaee26e993a7633dd7431d6662698c4dbf96fcf
MD5 d20a4d1cbc64254e2f5820586a361dd3
SHA1 e460c897ce92d8c0f22be8e32aa07a5eb9d17473
SHA512 1671a704619a7e8eb75bcd3558e244dda06ba48540e722399164b53cdd4e7d3c1c6dcc132e5276461ccc9704a5ff461d5b6b0341833a03478703d5d52a0f442e
TLSH
T1F5E0266805CAC729915479D7C36D6B0CD2E134A3A2C83D426B88D844A141A42E29F79C
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 af6aa6dccd043d855771625cca41e6021d913e9611a3050febb75063dfcf2944
MD5 f58614ce2e9587be8d20714942da934b
SHA1 21d65134e621f5b85c68a6a0375938748d1f9fad
SHA512 acd06209a1c9420581dacc9c7a85d810d9c59316254bb33f253d7d0459d9a59c661b9185f862bb00491a45ba38bb6a302a45ea106033c492b6ed3823ef59917e
SSDEEP 96:kBCH8dfs+Wu8t3SVcOMfsq8O8XphwtHE7rRC4w4Hea/ik8vwiZD:2Ndwti2wPXgthkea/yZD
TLSH
T129B21B775E7A7801C79519FA14AE1CB2CF37E0884FEADE883A282122087C43B45312E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 6228ecbfb8a1dc3101bd5186bfa5584b06d800a17c41f3102d2d19b9f7cc4cdc
MD5 9bbc76a25034526e1b7d7a94d59a415d
SHA1 91a5a8e1d97580d796fef74bfcb596246e6b8f6f
SHA512 b44cdf2d6cec4f3da90f2ff9181a7399b14beca152dd92d2b0f1fd2b4cdd1e1928865937b01302972f2825102e98f1ccb96435927f5a4bc7ddf5f45f42c8d97f
SSDEEP 3:MsEllllkEthXllkl2zE/l6CPE1:/M/xT02zrCs1
TLSH
T1244404047FC01417C701133150D1C3713370D4D007575F433C5104375CC57400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 c4431a3b27a6852183ac9ca6d0173a1e863f26847682df923d30357097fbed03
MD5 c32edb444c4c7ec411f3c6122e08acc1
SHA1 f0cbb60f83726ca9df587d42e0e6739e10ab7fab
SHA512 6335bc1e1ea6748a5fc416613f7067bbd8fd209af5bba5e4986ca5828d1a16e8fa14596101aea8d6926f4c5fc4038a0d5ff8b3e533e9c2d60823039faf4d138a
SSDEEP 384:QRBfcZjB5/83uICtTBBHpwRGYBNij/dRt7DXspU3i3:+BcddptTBBHpkEsU3g
TLSH
T1CE14B62F0A363711CD7C90B568EB18D39E7EF42B874356DA686114B2CDE2A27D00C5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 34KB
SHA256 fcdedbeb9ae57a284a3a2677d7babc94e4812d7d1575abfa46bfb0101d21eb89
MD5 eab246cd30ca8ccc8af43074d37201da
SHA1 8a22ab87d8dd7c0c47016a03d68de2298df9c2ae
SHA512 92dc401bb8f572e2ffb70e2b30a3ab0611f635bf6a5bf925875d660b4d4f1adf32c4e15e627dc02b8918df7793141b67d41b24650413079887a02b6e747896f1
SSDEEP 768:aWNcwv3tV3GkVod5B15Vbm+Dv2QzovZ6WIs99djJIRncl:CwvOkVod5B15VbPlzovZ6WIs99djJIR8
TLSH
T16DF2646E6AEE0524F3FF9B7B667B685C8E7B7D553858C94D80701C0E0829E447920A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 2d582863418e2dcb2e62f32948a5c90f48820813a2e80d8b6b2307655134a40a
MD5 da6c785007c6fec715d7cc02a721e78e
SHA1 199c691f24273625b95ea9d4fa4c7fc4b8156fa0
SHA512 1ccd664d3631608affea619d51d2248ba22134d6b1ff84ea2f19437e3fd4a95e008f2b84eb4105e41e3928b2c20f7060848bf88876ca92e558fe5850b8688cfd
TLSH
T1F8E0D8B458CED16A5355B1C7C3297F08D3E03657D7D82E417F48E845B401404E28B6D9
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 44KB
SHA256 e520a9b31d6694004c82fbdb5eb802aa6f84d703eecd4202faebb3e55e2d68d8
MD5 7ea65d5720b4633bbdb1b695c6301b00
SHA1 0d7298323000fe109a067382c76c4c786725c40d
SHA512 76c60054e74d64f4b601feebea193f068a9476be7de6b56eb3c2d640ced8d4e1fc7f44885beaf25fb0163724779e93c8a8c25ce08004e92beaa4a68244589fa4
SSDEEP 384:bvTalxuvIBvz9IpHkjmW4uCFs288w//cv+CFTLCxnIn0ugCe2Ca:9hpkWssWELFb0ZF
TLSH
T120133A7F45012831CACF2932FB6D9D25E1A444529643D1EB34FEC5504E35B63FD1A2A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 7c61bc5e55e3ffea90a9f2fba35e0575681b0e722b473e5d556c97fcb3a32526
MD5 ec343f54eb70a8b1abd182436bba76f6
SHA1 c3413507294089cd44b3ccf60975fd94511fb4e8
SHA512 33cf80670336f887b6e3ef5eeacd261fc79604b6bf46b5345191eb736fa612f85d47a2f361ed443819d2c01692447904b9ecec709989bab2758bbe4d6d3a692c
SSDEEP 96:D8O3gasP+arzBj6qi7g5GO8OxFwkWaL1GHzntjAbNU2EBBss4X:D33zsP+ar1j6qi7g5T8OxFJWaRGTntjU
TLSH
T162B1ADF383E5866DDE1191F0AA186F1FCE1C045243AC3D5A85E4AF0B93F2471E151B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 9342a8e720c7fd1e84ea25f96df71e0ca025532700cc4c9be517090d7a02b844
MD5 596f759350780b3dc66cfc6b0c1206e4
SHA1 730cdfce175ecfccd4806d0994edb66147015fb7
SHA512 0aef2b724e174c09e7a8b34f7b721ab476e85572f1cb0a9df7fe97c6203965e6260e421e9ec49563f1162448386ec10b66204d6508033600792db1028cb7f952
TLSH
T15ED02353130470FAD77D1EA18165FC4FC32631605453EDE550E0AC59493946C070B145
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 28057a71cea926f0d20619dd26410f005598d49224f9f572941c8b6367718a2e
MD5 9c8d132a0906ccd1a2caac9f63260420
SHA1 35ebd9c29c2706303dff75b4cd42bed0e2764f3a
SHA512 badf486b80b8daa6f46d928245cddf1492d1ee788a4b83d9903303adbe3a3b88e0fb9553f738b0a4cb11d23a544fa40334f67ac79e8ba2da355ef63cf2e5e070
SSDEEP 384:sxZKzuOh/fHs6UY9eN33AU0ZrlHnvTHb3/oiuhl:sSNh/fBUieN33AU0ZrlnbHbvXU
TLSH
T1F5821A06AA3449378DD7D219FA45BB93D7F81163D6545D88A9FCCE0C08EAADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 43af24d341a2db90cc3ebe5f0722cb1252d8ef1aa319c6a4968f05abcd82a15c
MD5 dcfa69447d7ca7cb062a2e9d759af629
SHA1 7af4854da8df635da13191afc429a645dad62602
SHA512 4e92493a114afd77d81d7f31a7a182c054b9d7652ebddff84bba383d4855ea2f3b4a629ceddcf87915821f72cf831cf6822118d9e1ca7fe3e4a820c2735e2744
SSDEEP 384:sxZKz3m1h/fHsEWvkUYIeN33AU0ZrlHnf7HbMY/oAcPyMW:sS7m1h/f3YkUDeN33AU0ZrlnDHbnBsW
TLSH
T1C5A22A46662489778DD7C619F915BF53C7F80463DA519E8C99FCCE0C04EAAED2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 01180def15ff8b2334389eed1b84a757f26243d715d6aeaffeb2628de325b0c7
MD5 cac116ad05a35f814491d04dcfd85c03
SHA1 39c80e9f10fc3124a5ab0206a24ff3fd4df040a7
SHA512 79191344d27b9081d93ed292b952c7a125e7c1a88a1b82078f4a70230bf1c7caadc52e7dbb1b052d9dc592e950f1660b5d27d9be58dca655f6570cb2f6ed1a65
SSDEEP 384:sxZzzuOh/fHsouY9eN34AU5pliTHb3/omujC:srNh/fDuieN34AU5p8Hbv/7
TLSH
T144822B066A3459378DD7D219FA45BB93D7F80563D5505E88A9FCCE0C04E6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1f2dd2d1ddc00287fe133b37aebd214a348b9fc224206a910443d0a351bb129a
MD5 d917892793b484e993c23d4c1685ecc8
SHA1 e71fb8c32a54d0f5a6ce052ab0712700b7d72bff
SHA512 376d014ff9b1bd20adc789251aebdad6774a56fecc2f8ed1005bb4b4cd0d7aba32538852ec447a7b4ca0ef8f0680a4e3139e23590d5bf6ffdc513ad819760b2e
SSDEEP 768:Jdc+tx27pLuL/VRWvV/qH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcDFkLlMeNtFrom:Jdc+txWE/VRWvV/qHu1ja5DFkLO6t+Op
TLSH
T1D8F20C3B2C0CCB7E4F844E9CEC2A7E9E6EE401CB96988D5447F9885C02C66EB55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1cc84282b2fdaa934897b6bffd6bde3dcb43e2af2781ac94c08091714fefaa59
MD5 9a023bc04a060a3cb110cf8496cd124e
SHA1 5bb03f8bd2565e6dd66e810d8d2cbdc241c39df2
SHA512 5cd192e286c37f9b26832802bbd945ae525a7040637026f6e9065e920f683ca97f0d69e09c20b9fccdd4fa1e09ac5c0ca679fb6fe0952340b96038e08fd316bd
SSDEEP 768:Jdc+tZz7pLuLnmRWvV/qH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3DFkLlMeNtFron:Jdc+tZlEnmRWvV/qHu1ja+DFkLO6t+UW
TLSH
T12EF21B3B2C0CCB7E4F844E9CEC2A7E9E6EE401CB96988D4447F9885C02C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\91d73940-0d21-4161-b459-1da74c6e5c7d\index-dir\the-real-index
Size 72B
SHA256 c5dd48dceb1bf984900f2dce7f9cb97353d0393be5408733242813ee0714b3f4
MD5 765019abcbfc03786fc1cff91dce3fd2
SHA1 37de699c195aa34c71132efa4771224f89e25c6a
SHA512 5943477dbdf8205c0badeb8b2ce2be21949ef9dab340c9d7ca556df90f8b45b72f0eabe4722b916a984b7e69eba1ab62c4f64e27919588d50d687c8d592e3243
TLSH
T1D1A002700389048DC02B99F1199223D162008ED05192224650920045DE604C057490EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\91d73940-0d21-4161-b459-1da74c6e5c7d\index-dir\the-real-index
Size 72B
SHA256 b2869c05bb70a3e7e6acfc5964141cc6459620ae3e49b7401efe2a9c6de6a2fc
MD5 de958a1e9cba920cbbc99769a795890d
SHA1 1bfb0d140954aa6c74d8e420e30e73432d9fb53a
SHA512 1e594962109dfa15dc659ca995dbc4cc644135fc64055ade1414d6dd2e0996a346c1743f7754cd1fa565c7ab731809b126ae640e1531a2c7540d71462b815929
TLSH
T1D8A002149A900041C10716B935AF03563350CDD04207134782D11546CE905468E6560C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ee838dd-a441-435f-b78f-4a16a5581428\index-dir\the-real-index
Size 2KB
SHA256 b0f90df5a2db1937c8f4fc3854097b846cd4bd98460aab923f40591591d887b3
MD5 eadf31672ac958c47f180d32b1058efe
SHA1 95b0e26df601b0dd792995f6c596e3f3f9225360
SHA512 cdb532c56a50f7dd33d1236c113a40acd4e441356d2f6bdf7d0b12d9df240ad6a866f93fce3d0edcde782397b81a58efccf0ce50428f69b534d74bc4451fcd19
TLSH
T1FC51A38D9D8A6F6AD9AC61F218BA289433B459DC17644A031CAC67397C5323E2D4B2C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ee838dd-a441-435f-b78f-4a16a5581428\index-dir\the-real-index
Size 2KB
SHA256 2d1d5a379f10a7486868e4c064646f22db1d69e70ce2fa7eff7c44717c04ae4b
MD5 b27b41b157e63dccce3561781d684c9d
SHA1 baa0f50a977387cf2922948a097a08885600f21c
SHA512 2008ad7cd5462191be989aaa2890d6e205378b7f47f6b08a4dcdb6561f38baadb2904c1be595e649a4f2cc290c1565aef0dd9c4d9c139d5309e43ebdb7eb6a9d
TLSH
T10351E84D9C4A5F17CA7D12F1A8FA046A33394CFE1A58470B2DFD5A3C6C8725A2DD7218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5844c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ee838dd-a441-435f-b78f-4a16a5581428\index-dir\the-real-index~RFe5844c4.TMP
Size 2KB
SHA256 1be2d56c89c1427b561cebb580aaee54c5f9ab3a9dd77f213f7b24c567ad6791
MD5 2e5fc5ba6fab45c1f2138b2972057729
SHA1 9315b0838478cd92a91ef958ebddec36cdbc8c0d
SHA512 a53a7862ba5364d3d711e735525a9ea96fe06ba486684417101199e69c3f4df135b32156f69236724131a7d94e92734fd84f0fb4db7fe43ff8486c229cc535b2
TLSH
T1FC51A55A9C424A22C99095B359CA6469333D68954A49AB0B34EC8A33ACC37AE3D57344
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ba6f5be4cb7f52d4eaf8aad26c576c02ded01522240ff009786f2dac14daeab6
MD5 eb3c12c5940495028acd61e0ad1495e2
SHA1 4f0648243fef3e4b67bc52d94bf42b2f512b06b7
SHA512 6c72850a001b85b09ff62534cb513d04723397ce92fda9c7095b8eb1e5dca93417f9c60f566e01dc2335f89555fee006d9f5cc13ff38eafb99eac66050a437de
TLSH
T10AE020B73DF71914EDDF87D5547284F04455B444CE54BC8E502556D738A231124CEC77
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 6ddfa16677610ab60cc852ba90caff1932726deb9970b8a368c2fcbaf389db1b
MD5 431005ebd5c913afe3c6b9de25c7da4a
SHA1 d558be54d79ce70c366c63e4a90143af98339d0d
SHA512 b6811856a9a3328cd76197f6f428f8c739163e804ba5c349f97d9e300102cb114de6cf3c4a5b6239a521245bc7282e38eaea82d6868c5fceba80eebac629fb88
TLSH
T1A6E0DFB63DF71810EDAE87D6687284A00855B5488E94AC8E642696D728A2315248EC7B
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 a2c7fe73533d2a3231e850160ca701ef355375708beb817d18e56069d43cbb3a
MD5 defbb99bb6fd2f7ba23fbd6d8802257c
SHA1 de1e814efa1d8e512b11d434e3238616b36c8209
SHA512 9189cfab6047820ef8dead80c5d36afc025a36c98468ae63c3b9a6462c08d792a0d03c2034ca9179c6a45ef7b6712334b8e8bbcd43c37d9351b23170b9cb41e4
SSDEEP 48:F2em5HdYlvSfjJp6Ff5WOHoXpI/9slwp6I5WOnpi5WOV:F1m5HeajJp6FoXp2sOp6cpC
TLSH
T1BC91BDE38B145043C9C966FB2039F6D8652DCA066FFF87A651BD8F6E52442D63328B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 2a737ddb724ab7db1b1a07549c3356c25b28a8cd34f9fdfde0ac73e513b27d1d
MD5 f2dd9d341c41e04d5207536a44cef94c
SHA1 6f30237264df6d8038226fbd5e8e18c2ea85425f
SHA512 66e62f3a378b087fad3a0fa9c5de218f63c722c03985eb1d3b760014ffd83697d0d16c50e087f514c59c3d712972723a2265ddf5bd167e111fbc2e13b7f2fd8e
TLSH
T189E0262805CAC27DA15532C7C3289B09E2E4B447D2C83D437FC0DC447186904F19B698
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 769bbe60f0c02290a25c8dc07572094fc5269902c47aced6f9408c17570aca09
MD5 ae69a2fd981f255cd67ccc8a8e2ab685
SHA1 33e931f9c1fb6535aef7c23dacb539a878407cd5
SHA512 65105e31aadf24dbe8d7ba5a668ab8e65c2a3b48dc4f2aba9c61909d0221a4cc00d15b253db4280242d00fdf00cd1b62c575ab86aa9219ace86e0e404ead1bf4
TLSH
T1C2A002139156904DC7041272A08702A5331488EC0B4677A155A48058EC5134085B210D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5914f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5914f5.TMP
Size 48B
SHA256 b28afd8fe6a42a668e7c26d3bad709bced156c91a5c66f8072ef7045359ba1ea
MD5 6f93abc457ec9460bfca24ca9873c06d
SHA1 66517520104a3239d9ba3a0520a5b2c67a25ec5f
SHA512 0aebe4d88de419884d63c3b497441456b7ebb70fc0d46bba96c53a56d88d202817e5f307c62ab62d172a5137111cbe35f36a2ae26c1cd78d886a7b7e7d461802
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 256B
SHA256 307aca1f833a88ea0f1fbc845aa981f135e1692c3d3cb364622d874649e01bf6
MD5 7f649465c16b4df4008dc4ae23340f7d
SHA1 5afbccc0616821cb013d292f27df12e2761135d1
SHA512 7fc8e325a3458b117f88a9b72e73d3156d3e4ebfe442b432b42942bf6bf8fc53e34ceebd425682499bb8904f516d6afc23c5b7c7a2abdd181c6ccc0c55f63bc7
TLSH
T16AD0A714B354596BCC0F62301394876DEF65FA068000480FCE2CB5731E03A757D0A2A6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 3866898acf14579145bb73ec896489b02e01656d38e6b33c29fe50b2edf80a03
MD5 afd3efc0702462d3e936f2ff78d61b8e
SHA1 083464518c1e2f18e19a3b8404ec52cca41a151d
SHA512 99bb0d95fbc250c8eefaf2edd05d50e1c56680c3930f2b8afa0c4916f19a3c14e5371839321bdb9f1f7e475cf39523947432a610e87aab3da4797e9e3153c159
TLSH
T156E0203815CAC72FA18531DBC328FB0DD1E2B443D6D82D537F48E844724A540F25B754
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 fee3fab28958a2307c2322e5bf860fa9934e7bc4e250682fbe9db2fc02aff6cf
MD5 e80793f0dff707eb92fae510d4b8d534
SHA1 e2d20c53b5d74903252f4c7e4fb0a4f4bf937edc
SHA512 6a473bf340e020573152fc765fd357bdcad08a47eafe76cc54403090301af45aaf4f8951f616d95a356d43589b5324233978b27a76c4afcbb4c2b8fc92b44085
TLSH
T148E0867845CAC739914471C7C368AF0ED2F0B84797D83E87AB489844B145544F2AFA98
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 965f960ec9940dd67c4957d50bd822da674bf59a9064467532e5bafc02ba03d2
MD5 d5e5961952f47c637d5bd62e7a01e873
SHA1 a14b74101a313472b7d7824b52cff227f3fe3486
SHA512 ffd181641ee873b700338b31b1510eec1623f60fdc396bb46cb26bc8acf8f6eb42d2bd4851d449e791774bb7eb97a8ece47f401c4111669d13ce66a3212c5c07
SSDEEP 384:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BD30LK4xf6jB:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BDN
TLSH
T17DB24D10313B02C13A7E699E95A5B86F62C270733458A83B7BB800A54F6BE14DDFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 595eb9174fd5f49080fea017cb8e23da8fce7205ee8113a18647f1aab32de3f7
MD5 b7c507c2b0675026860907a4bbbd1948
SHA1 d9830098039c7f3c9c8c4cbbfe8c0e3bd7ddb5e3
SHA512 5242c8b42f7438a498df1168a88928dd4d9c5283b1c2fb06e41b2e88d2e272e7476f831cb22007e4eef94337338fcdb66138cc442da248a02f796bd328c70392
SSDEEP 192:P+xOHdttfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx2fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T15724630A7B747001EDE6D9725CB080771A3CB16DCF22A6D16DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 c58e48c7382f5a8effe29235a56efec091c38500af90e0af40ba961d108e63c0
MD5 0a6f32b49c2af730dff40555192a4ec4
SHA1 c55d57a6639e7cdf7e6b0af7a431af4a83ddada2
SHA512 51b05348fd605c89a72e2395ef53cb223fa4e5bb8f8c485470b01dbea81487b72308406fc0774e6b89b343fe8466ebeede8a7e81748cb5596190b7a1d6354771
SSDEEP 192:krkKgOpf7x7AsHRl9HNusH+HnlQlvQkIIIrbrMIMBgYcYM:cVSsTCswaQkIIIrbrMIMCBR
TLSH
T12552931A26051B37C19E5F77226BCB521BCAC8810976222E3161981FCDF3F679BC52F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 a05921a84b90c451541549df5bbb4120a23cfc41165bf07cfb2dfb89b90d0ae3
MD5 53b3add77b79bbb421ffbb9c7ef58748
SHA1 a543fc07a1a6bb40e7189b11abb202701405e707
SHA512 c801f6bcbeb83bae9b149fff7b7879a03f60794a7141369afe984c0f165778aa3a6c7e0fef2eba902e23ead07834c950ef5df6df05648fa1e33cc3c880349094
TLSH
T13BE02624AACAC26EA15431CB82295B09E2E03863EAD82D87BF40C848A045500F28F69D
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 d2099344f350befee18418ff31c1738d7f80e470913d56530f1ff7e2c941e183
MD5 a85c16bf10f68f42540abb4a48173519
SHA1 a36168e5af033696d15e8e049b1d91339a75bcf7
SHA512 1f8769c2c3afdaee09161b33f289c7bf98e382ffab11eb79b6270affc0daa05c519cef945780dceb9e459ad098021ae6b3773e94da11ca5e14c9c577f71a0e8b
TLSH
T12D216056F320C158D18E8A3EA46E97251738E8169FBCEC0F447924756D72E041E8B7E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 4eea4fd7fd415cc52cf159f5f9daf8ff618c84cb6fb99ae6f8d0c96e3ec042ba
MD5 17387ba64d4d51595f87676ec3dc3431
SHA1 ed962f5141ca68e1d8fcf9f0dc4cc988b84429a8
SHA512 2b85ecc64fc84c5ae9a9dc9040e5d67d4ed2d990998aa07283298abac0b2aad4f368b77041723f56a3cd03220a5ab16ec7f9f6ef895c51f30abfcaa43faf5539
TLSH
T15FE020E464CDC65F515031CB82689B48D2E23853EAD42E41AF44CC4C5185542F24FA5E
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 36c0f35576d7c0e8e62cf516d2ca5be141f0b5524544c70c72fcd2e81a919f18
MD5 784f5820990bc0de7ab338aaf211627a
SHA1 bd96e0b2f1b28256bd3482d27492c10e9c2571de
SHA512 acc67dc5dd84dc96934d310ba23a06aacada687ef106b1c0b548ae3f5a4e9239867995353cfe674544d711a4c3236c3bf9df30dcc064f8b8102c9fc6739c08a6
SSDEEP 3:MsEllllkEthXllkl2zEKVat:/M/xT02zVe
TLSH
T1954404047FC4051FC700103050F1C3711374D4510513574737710413FCC55705D00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 cd4ea1f67eea62f10312a3f53272b6b33d393ea7be8c657807de8c98f6662f19
MD5 dcbbddf7ea2c1efd2350bcfc037ecde3
SHA1 97aa634c9e619154ae0b7f12b394e73cdf819e2b
SHA512 ebe4dc2a125391bd8e17209877a6da27886434c02013a8f466c28f17209f6f9179df8e1c0f902ac0d58cfdbb8c08a1ca5ea840108724071e360f3a549cd14de8
SSDEEP 768:6F1cppLwgG8ITOkPLSYhAFSVuXKqb6F2LErS:Bpk8C/uXK+6F2p
TLSH
T17E036EF194D78DB6E49D87C7936DAD0269BCC173B4888948B3E8692DEC8B0BFD306415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7a57de77b619f3a0fb7997e9e1945dbda53452151aaf9e3bd3e0854b336e2de3
MD5 2bdc42d581c9a3054aa1812394621e8e
SHA1 32570dbe631aa5a2623a97367629279097a7953b
SHA512 9e5b4e3ec8c6200a8bca7cf5d642b86a46e62bc57627e959763e83122a528f699b23dc1664073d353191fa426c64466157f9a53fe90b7c74bd1a0ac6db840303
SSDEEP 384:n9iF2CcmyWCpsN28TUNTUlI4b8mT3JvJFO2RwfYPLIPYK+kzDaAl4hKAqHw1RLPq:0F1cpphwgG8I/OkPLSYWHrlIKAqHOLbG
TLSH
T1EDF291F198D78976E89E4B87637D6D0259FCC167B5885988F3E86C1CDC8A0BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 187f60bb70296f9ac762eca3a052f7f068711aed4375faa6a7e3bcd95367b19b
MD5 95a5a8a44ccfe924c4f8b94c05b7e361
SHA1 6f332ab8404ef663d2f1ced8a065122f3679131a
SHA512 d4c37a978f145968539af5367a99f5ab34d6cb046ea3ac2696bacbeb9277d6a16d36bd267edf9066f6491f768b025b32b37e312d22afb3174a4600abe88925d0
SSDEEP 768:6F1cppLwgG8IIOkPLSYhAFSVuXKqb6F2LErS:Bpk8j/uXK+6F2p
TLSH
T1F4036EF194D78DB6E49D87C7936DAD0269BCC173B4888948B3E8692DEC8B0BFD306415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0af62df5079b15734d75b3dac3e5b921a57754be0e21bce85b2680b64c7b0b89
MD5 71894c2340d566bc4ba184a46203dda0
SHA1 c86d011bfd74373a95c85fb08d197f8de52ecbe7
SHA512 decf23aec695fc9f3f24bc552069529e3de4977322f3819d472bc6269f6d28c28a84a52119b206976858f7a5af9d5a8201ffb5e97b3b713601dc67625ba2d356
SSDEEP 384:n0iFavqMg3sNKn8TUNTUlIm29JC5svRvfYPLIPYK+hMdnS4mtmOirNlk+5vI+i:PFayv3xnwgqs6PLSY/MdS4smOi2
TLSH
T1C1C23A75EC98DABBE8E78FC9A7497A07DEE041D7958C4AC4CAC82D0E009719E134BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 05229ef2ca4c7d0cccb1ce48d0e90294873860f7cb5ea02d24a9893c1b8b8d32
MD5 9dcc040824a9fb2d43075dae841420c6
SHA1 5f74133fde4fe66ddfe40d5f09c952ce89448e98
SHA512 1e7ed6d257617535d2ee521e640aaa77a97fd800f2e9ac279c7d66090ce8946210cd9c3ef078b9440e41c88d338fcbbb7e12149018b01b09a272f2d5fae54cd2
SSDEEP 384:nGiFavqMg3sNg8TUNTUlIm29J+fsGRvfYPLIPYK+edc/tLdnS4mtmOirNlk+5vIj:tFayv3bwgesvPLSYh/1dS4smOi2
TLSH
T142C23A75E858DAABFDE68FD9A7457B03EEE041E7958C4AC4CAC82D0E00971DE134B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3980700ff43a7bfea4250883149a83b3dd84833b8dc322d0e44843cb9f6e2300
MD5 3e7a6bd091e44395ca13fe9cc0bdff98
SHA1 f4dc4a91aa1d74d6cc723508214ba044b3a752b4
SHA512 d117f1f8499b72d88ca2dac1ec4672340b4670afd756d0d716a6d92b5e7d19253bffcef64a5fe5d0ab0143d11377655e3ca5063e217454e44af6914bc8b13580
SSDEEP 384:nFiF9CcmyWCvsNU8TUNTUlI4b8mT3JvJLO2RvfYPLIPYK+edcztLyRLPP8rNlk+A:MFccpvLwgG8IhOfPLSYhz12LErS
TLSH
T181C24A32E858DA6BBDE68FD9F34A7603AEE005A785C899D8DACC5D1D00CB1DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e63cda59d2cdf1ded3d502479c8c457da6ae7b92a3b6a8745ab694123d02a3e3
MD5 57e17ee6d6a719d17c0bd9f08d51f9e1
SHA1 0cb0a1e2bc945ffc1104a30c57b42656335a6b6b
SHA512 778177f9b60109c842fa66f0647d8423339d34dde35c3c0af36f0ee1c38e51ffee22ca822e53c3d91373f91f9d77bb678f46766e50062c5da4ecc4d76d911f88
SSDEEP 384:nBiF9CcmyWCvsNU8TUNTUlI4b8mT3JvJLO2RvfYPLIPYK+edcztLyRLPP8rNlk+A:oFccpvLwgG8IhOfPLSYhz12LErS
TLSH
T1DBC24A32E858DA6BBDE68FD9F34A7603AEE005A785C899D8DACC5D1D00CB1DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1a00a196cc8a68912581d86e2dc2b32795d8cc2c475f0b4d3ea19b9d3b87b860
MD5 841b1f326d6042cf240c3aa3b8a0afa8
SHA1 978a1ff8b147081806c1fb189b572f9362ec6f51
SHA512 ea69539ccb75519f0b7fe80a0fae486e287339f3c11eeb914041419db974627645a86014036b39aeb160f04623c1625a530e258ff91c4c844a25a4f25a8d2aa4
SSDEEP 384:nviF9CcmyWCpsNU8TUNTUlI4b8mT3JvJOO2RvfYPLIPYK+edcbtLyRLPP8rNlk+A:6FccppLwgG8IYOfPLSYhb12LErS
TLSH
T178C24A32E858DA6BBDE68FD9F34A7603AEE005A785C899D8DACC5D0D00CB1DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6152b157f488a0e84caaf9328c7d4ce317250b644dff2b6c9c35b02dfdf38037
MD5 036da4add113280d562f232b54a6338b
SHA1 8e6fbd0d3cf7dfd96ff822654ef959763c9558b1
SHA512 b0f3dafa2b6ea4d15560a5bf41147230f26aacff3ff22eddf9d444ad9247afd6618fa34b378b9e4d04939538b07c319e53c64fdf8520f669c3771f690e85f801
SSDEEP 384:nFiFavqMB3sNU8TUNTUlI4bSgx9Jk3lRvfYPLIPYK+edcFtLcNrNlk+5vI+Q:MFayi3LwgGSLEPLSYhF160
TLSH
T1A6B22A76E858DAABFDE68FC5A7497B03EEE0019789C85AD4DAD81E0E00871DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 dccc5fd426d0c5c95d1bf9b6a31c766f5bbdc21b979cf57081606ea690ef583d
MD5 57993394edc428a0c29479c356b7e05e
SHA1 9a34a235dff26560bacec09e1e7acf45c7f6ca62
SHA512 3dba5f61a3e5edd54d07c80ac88105bf01198f5c779c3af5e49bf8a7a857a25641e5c3dd0fd36506a43d857bc818c712fe178c85ed9a37383787e2d484441e2f
SSDEEP 24:TLmj5UOl0afDdWec9sJDJnIcvWgx4choXkGDB5fc:TA5UUDbg3ynha0oXLjc
TLSH
T1DD92CF32B9312067E99B0BB6FC834C500DFC12AF8DAB7444DAA00D925862AC67B954FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 16a6ca8cfc710460ad356e7e8575c47ff995c4208a8b2f2ae374c7c38f9b73c6
MD5 7d0be6b8f6d25e91db2f23c6542bb99b
SHA1 4c3b751808b0f652f4dc68a688c3de789b5d6277
SHA512 8a9dada3ba42a4f4488ede0db37e2f8ea273850ead4b01c624aa9a49c6b948dfab62bfc9ff45ccf62f17b0e4be4b9212dfddcd0659ac09679054091932da43b3
TLSH
T112E00447D30141FDC53403340047573115D34071017101443D10015D7C133141F30FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5940c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5940c8.TMP
Size 392B
SHA256 b98d1cc9704230a422053a7d7ce778a1c4d44c09becd351962d1cf8a58388215
MD5 6468fd49a7a15c0131ade560c2aae687
SHA1 9ea750db74c2e81dc100b3616c8a8ac2819a911a
SHA512 dfc4d29b671bd97629163dcaf3417159d4d2819955f037662217432ea40d4c7abb91c09eac8e8707925ce020d0adaa825724a0731233f7c1a9c22f6433baec42
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 628afb8edf1e67bb231fbafe58b65a08447ee9b79db4102e2559169618a719df
MD5 e845f5a58128a4cc0c1de0062cef03e8
SHA1 9f6e72fbb8660b4cc6888107770bc0afec8dbbe8
SHA512 64df82384e2e055a21cb56420d92db6250fc9becba27c74f10b0d2cc6421705b4563486f41eec1945b4503da4df3b483ee07f501b51f47ae6cd92ae1795f547f
SSDEEP 3:MsEllllkEthXllkl2zEE4glt:/M/xT02zv1
TLSH
T10D44040C7FC40705C70110705451C35113F1D4510515574734D504737DC5F701C05110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a6e5c147df87646381b79f0b7edcc41c892177eb4e0b66d251c69d8b37830f66
MD5 e8c7b693473af0aaaa3c43349070687a
SHA1 21868678e933a4974a6183302f06ff70978d139b
SHA512 3a3fb474854ce325bc9a391a1c35d4da995d889961bdf7a30a4104afa4b9520b7bef6c95ebdbaefe2255112bc756dc43a0a94334de3b45b3f54ac8beb3b16741
TLSH
T1243100E1593D1AE0C4FD0A6EB49B78FC41D8D326F568757D6854E9980B3EA0E644043F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f0d7ad24d114ed4dfedcb8511ad1f82b16b940234a338fe8e5096e924d89ff48
MD5 20991ff79e216d72985fcff566f5def3
SHA1 a4ae29682cdb629e3b7a831ce3d68dd9e3644a10
SHA512 7ba5dc564077f1fd63d97c2039974cbbd9684be0381fb4bea78c376f72a8bda7e44cb4a54a8c2a656ef847bbc0aa7aeb1c840a781ef3db2e532ae2cce3cc6c31
TLSH
T1DF412758A6F91154B7776E1AAFF7A86E487F79672F07D45E10100E8F0722A40C9A1733
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 8KB
SHA256 0fc4e9d0542634b5d10ac7b0bc2a6956187b19d2f95d744c7778404ed9016520
MD5 76c9ffc74a0fd7c08e0f2fcd85d5058b
SHA1 b0b39e17b2b53ba018e4dd1ee8febe37ae10d796
SHA512 4f8e50d12521156f193486c0025066bf7500d7eabd86c7f33efb7462b1a1525ad035058f0b67dc8455f0827aba0367a9764a87f1ce92f9f328b1c74b57646815
SSDEEP 96:BG1EJDvwAmvs1CJtwuYyT1CJru0RG1CJnIu6:kEDC8wC5uCBIX
TLSH
T1F502EF40ABE5265AF2F3D972A5BB3321AF76F90559185E4D418086090CA3F08DE7FB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\AlternateServices.bin
Size 10KB
SHA256 e01747e1ec84f9be47c7f92d57552d73aa8c3088d4292cbf072babc28496d44b
MD5 61b3d2fcff1599fc88f99f9c936619e1
SHA1 1023121f091472b90e8d83f452de8629846e346f
SHA512 c160bcd0204be67c610467d45fc225e57ab4699f2512f393ce66ccbf49ce78369d7894271fcc3c6238442dd738cab7da7ad4731f0534bcbb1ed6d6f4e11752d5
SSDEEP 96:rebOJwb9ebUbJgbgz7b3b7bTbPbvbzbYbwb:
TLSH
T14D22A4FB4B76E465F1628FF49058B88C8C23422E59A8C1F8CA04D0D716BA7D1D13FB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 6f04cb0413150b75e1f91c01232373b7d65d571503b76b1f04cceced7141d698
MD5 95d1fbfb9c3028f3e882503467106920
SHA1 c0db330961bd4036fd2ecb703e966f385e6c2d0e
SHA512 3a7bf315f5041493f97018a11b83e9cad87a477728b17fea1569c5f4cfd4c41a28cc7cef7083c0ad737cc8edc2312b4ec793028e9ff8fb41bddcf5a0ccd2d214
SSDEEP 768:sASRi1ZZGcmhu4RpRZ3Cvz2b4bMbbbYL9eE/:sASRiqRpQd
TLSH
T14DD2EF44EB2A913FD41912BADCA50B002F79F88959192FA73B4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 a8010b0f7fa4f9bebe4e7ab78f716dfb401bf846b2b900194a55401279f68d52
MD5 005ae17cddc871a2426705cdd3c11964
SHA1 571c2e98c7f0c37d5bb595916590bae76286cb86
SHA512 05d3699ff04a0b7078e07e9bca975262ebb8076d3f29a250a56dcd146dd9bb6b6f2a30ab475ae4ff7c06120a291d7d70200f0c85ad8a252e73edbac76d7bb117
SSDEEP 768:BE5MNASRi1ZZGcmhu4RpRZ3Cvz2b4bMbbbY:jASRiqRpQ
TLSH
T181D2FF44EB2A913FD41912BBDCA50B002F79F88959192FA73A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\events\events
Size 1KB
SHA256 cacff8e48c572956d6f03cbca5059ca246d94d793b4a82a8ed5ed296fddf1be3
MD5 d56f7b4c91d0cc492d6ae58e638744d5
SHA1 38d589238134977c082206af52db19fa67fe87aa
SHA512 11d882e0bd33864f666bb24925009230bef0a08d4d2d7953b7858eec9edfcb08b67e92e863976f707ab3df348b03032bd43aa834d642c8ebed5622e0adad61c8
TLSH
T162213DDC3ABD8D9A5ACBE29CB450018E53564A0604C71E430D62DF8ECDADAD9326A47D
MD5 SHA1 SHA512 TLSH

Submit Download

5d230fcb-67be-42e8-b9c7-563147c4b642

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\5d230fcb-67be-42e8-b9c7-563147c4b642
Size 871B
SHA256 59e326a25d24cbef13fdb0cdab7f405e2d8267f595a40997778ea74e3f5f25fe
MD5 3ace429cc8f308a4ff685b812eea9f9d
SHA1 67fc9b09608e0a0cb5d639ee4d2938a03db603c0
SHA512 eaab3dd4730f8a70407a537d6383456123d24f12c5be5eb9d2f9e878262ea63a6d606841fda0feabdbc699228e1bd59084ceb53c1ad032f92143004f9a5b4774
TLSH
T1FA112382DB3479B3CD28E217C59537018BF8762380C644043EA11E0C4DBDA1AA36670B
MD5 SHA1 SHA512 TLSH

Submit Download

793b5647-5d48-4319-9c53-1cb2349ac312

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\793b5647-5d48-4319-9c53-1cb2349ac312
Size 235B
SHA256 bb9e0dd29568b7b9de5078cebbc7e5aa410ddd4b440d213013b0dae1bddeb718
MD5 5c8e6b072dd117cb94cf500e31ea5d89
SHA1 d3ddeb995269b48552c04de4ce8130d660b04015
SHA512 c80be7ff553d0b7f48d5bc28102c275802029f143a0fdb1034c03e035263e21f314eda5a28f34f546479a2fd37402c967305bb876ca2441ae74b118a2f8e64ff
TLSH
T199D097C02888A39C98080F1BF4B06CC6B0958C3338B05810D96001B89AB8AC801A282B
MD5 SHA1 SHA512 TLSH

Submit Download

965586ab-3d0a-4d20-9552-9e633abdf048

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\965586ab-3d0a-4d20-9552-9e633abdf048
Size 886B
SHA256 a24ca5f64f17012de2f7da57be3de440a705622f266a164ed7566a7963333973
MD5 456115758c8859712f7e95b21efd97b7
SHA1 bed6d90783acefd301591342bd33096921b2b525
SHA512 c6bbdf8c45f8d13a1cdf8cf56dfc33ffbf818b3174fcd595f7b5955d38d7838a0bef0431063e68e3379ead21f229fab2cad88d31dfc148416f6c91d3ce2a31dc
TLSH
T1F21100929A64B9B3CD28A2A795D177524FF4722380C609047EA05A085DFA91AA357B0B
MD5 SHA1 SHA512 TLSH

Submit Download

aa978641-e104-4bc6-a70b-712d63b5b4b8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\aa978641-e104-4bc6-a70b-712d63b5b4b8
Size 2KB
SHA256 201e3d8f0cdf186da2750ba01cd9eba69a026710be8ed800c1845555806f5017
MD5 ba581c18b6e7f04eb75960eebb4f2486
SHA1 a6c2e2c166e1ca39750f69a372bc4721e9b59b9e
SHA512 a5ad3b39018ce2bb98aca915a3b7252b41a9988eb88c52f82162c366a9ef383ecc074eb953e2dffb6ed60f7955a7ff9454a19631513cb126bbf8cdd9faa677a6
TLSH
T12F41315C36789CBB8CCAF15DE482338E57618A5340C61C932E51DE4CCCD66EA336A42B
MD5 SHA1 SHA512 TLSH

Submit Download

b750b417-8ba3-4317-8291-d47f3a662e93

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\b750b417-8ba3-4317-8291-d47f3a662e93
Size 235B
SHA256 75746b84c362f996988de063e9eb30349fb0ed0ce68cb7734bc3f016f3c0ba24
MD5 ceca722bc151344d373ba7579b4d5891
SHA1 36f4a839fd31af9bdbf1a16158f383c19188e430
SHA512 f19321b597bd8f9605ab593e717ce9c2ce1fb7c15b80a207f662ccbb39f916b65c5fd2515f8f30182600b00ee495de94dd6a788af3a21d38a2275380c875514a
TLSH
T109D09785A8ECAB1C09000F07F0A068C230498C332470E810CA604238CABEEC44361857
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs-1.js
Size 6KB
SHA256 424173c014088e1c5d3b189ba6c795e2d877923f2a03db55aac1cdd9a1d3e80b
MD5 4c1e36144b77cb158f78474fd7cb7029
SHA1 58b0c0943fa997a107bf3b3bfefc7d91ace7c903
SHA512 f00fc7d3b74f1469ed5d3a20e11eb044e58d063bff8115694ba684346dc2b2af1f677ce198484af8f78af3d47af3bb731ca51044f97d0f1ef4c61818fc7cb5d0
SSDEEP 96:xH89UTUfqGq8fCqVjP1zSASSl8pdv9janFIH6OBw88n8L4cnoV81FHn:2CR8fCqVjPZSSGH6OBw885y3H
TLSH
T1F5E11F789508CB7F74B677ACAC6888715AB2413B77BF68D350B54484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 6KB
SHA256 4657bd2216c3fc2e908223663379fa949144d2d61a80ecd889637a2ab945c4be
MD5 b0fe6782ddbff824d4a68c1a514d7fa7
SHA1 9780efb0ec4f786e8a4f696270281809609cfff5
SHA512 b06e71ce04ddcbe24b3023a4cc4cafc1222dd64a1e94933053adec04ddd77b7e9e24f872561d875c79c333c82850b75100edec4e64ca0f6c0daa7cd8df53435e
SSDEEP 96:xH89UTUfqGq8fCqVKjfnjz1zSp88SSl8pdv9jDwnFIH6OBw88n8L4cnoV81FHn:2CR8fCqVYvo88SSGB6OBw885y3H
TLSH
T1DEE11E789508CBBF74B6766CAC688C315AB2413BB7BF68D750B94484051CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{98828dc2-a42e-4960-849a-25631f7a18ba}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\storage\default\https+++www.youtube.com\cache\morgue\186\{98828dc2-a42e-4960-849a-25631f7a18ba}.final
Size 192B
SHA256 04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee
MD5 2a252393b98be6348c4ba18003cc3471
SHA1 40f75302fcbe4a8ac2e33a8d9daf801abc2a9598
SHA512 07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198
TLSH
T113C0225846A8EE3620A3CB3CC827E2820A3B831000498484E6F94A540C8BE850129A01
MD5 SHA1 SHA512 TLSH

Submit Download

82502241yCt7-%iCd7b%-ap2rfebf.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\storage\default\https+++www.youtube.com\idb\82502241yCt7-%iCd7b%-ap2rfebf.sqlite
Size 48KB
SHA256 a058250f2aed6c36f846920f737d0d89e5d3269d464e9f64a7662ab082d1011b
MD5 35e72cabe544769979182b5447772591
SHA1 a5cb4052b4e54994a3b24ade9c818b4ea92fee65
SHA512 179ff4ab7e9658e5ed17a28cbc74d1a6e02a9e5e4f7695e4bbca9536caf465adcc22df2d243a443e250389cf7da2ff300d3bc99908f333c83ae735341e8d70ea
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE6a:Oa16S6CKnqlizbxV+2xVeU7X2B06
TLSH
T18F23708E3F07F511C53AF0B178A08D51BC5E321D17222AD57990DAE4C8F251AEE1F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 c9a784be25d04550ce256cfdd0409d4d56b423b1f13a19bdaeca9b271d8ce6a0
MD5 336c9b740d3d3fc49b4c6631fd4e632d
SHA1 f4ff8f9cb443b8014b5189e12b0843b332653781
SHA512 670860a32a46fad3e0e16d8d7b5ad7db4a00b86f465e03baa55be19a879b31054b169c4b9f5b9c5d475f3b095addb44e1ea2bf29717b13f2bfb7136edf64ba34
SSDEEP 24576:2YSr+tIUJlBITP6N/rZbr20eOVR7cm2hHMg2sJ:2J8/Bu6BZbr2zOVRAm2hsg2s
TLSH
T11DF52AF820D2B357F3414033A64593EB21AFD00CA467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.3MB
SHA256 5759f94ca30bcf34e796892682fc8d98eb7ba4bd6feaaa1ea58a1c1872ca3bea
MD5 0783f73cb02166c3d7d38664955532e0
SHA1 671171acf58dd3796bc4ff441e7537917029c9fe
SHA512 fd8295947f8de9ccf5b5d06e7a59e16b6a07ccfb329d507284857a3dd596cee44c53b7384f7c724be391f7497e19fc0f2e696d2201782074fb04feabdb457daa
SSDEEP 24576:1YS3+tIdSWaRTz6N/rZbr20eOV97pmifHMg2vJ:1JB3aF6BZbr2zOV9lmifsg2v
TLSH
T1DBF53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download