hxxps://us-east-2[.]protection[.]sophos[.]com/?d=bi55f246ceed2210a7a885213e02e4f720t[.]ly

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/05/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://us-east-2.protection.sophos.com/?d=bi55f246ceed2210a7a885213e02e4f720t.ly
Sample260529-ppvxvscv7l

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5700_537247123\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5700_2123551635\female_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5700_2123551635\passwords.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5700_2123551635\ranked_dicts	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5700_2123551635\test.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5700_2123551635\us_tv_and_film.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5700_944656695\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5700_944656695\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5700_2123551635\english_wikipedia.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5700_2123551635\male_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5700_2123551635\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5700_2123551635\model.markov	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5700_2123551635\surnames.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5700_537247123\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1180	msedge.exe
1288	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245314984342038"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{ABB07821-A82C-47E7-89BB-169F59FA5599}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{FADCB467-086B-4A77-A8C4-DE470378B72C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5700	msedge.exe
5700	msedge.exe
5920	msedge.exe
5920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1612	1548	msedge.exe	88
PID 1548 wrote to memory of 1180	1548	msedge.exe	89
PID 1548 wrote to memory of 1144	1548	msedge.exe	90
PID 1548 wrote to memory of 1144	1548	msedge.exe	90
PID 1548 wrote to memory of 1144	1548	msedge.exe	90
PID 1548 wrote to memory of 5896	1548	msedge.exe	91
PID 1548 wrote to memory of 5896	1548	msedge.exe	91
PID 1548 wrote to memory of 1696	1548	msedge.exe	93
PID 1548 wrote to memory of 2828	1548	msedge.exe	94
PID 1548 wrote to memory of 1696	1548	msedge.exe	93
PID 1548 wrote to memory of 1696	1548	msedge.exe	93
PID 1548 wrote to memory of 2828	1548	msedge.exe	94
PID 1548 wrote to memory of 2828	1548	msedge.exe	94
PID 1548 wrote to memory of 3200	1548	msedge.exe	98
PID 1548 wrote to memory of 3332	1548	msedge.exe	97
PID 1548 wrote to memory of 3200	1548	msedge.exe	98
PID 1548 wrote to memory of 3332	1548	msedge.exe	97
PID 1548 wrote to memory of 4024	1548	msedge.exe	100
PID 1548 wrote to memory of 5700	1548	msedge.exe	104
PID 5700 wrote to memory of 4248	5700	msedge.exe	105
PID 5700 wrote to memory of 1288	5700	msedge.exe	106
PID 5700 wrote to memory of 5056	5700	msedge.exe	107
PID 5700 wrote to memory of 5056	5700	msedge.exe	107
PID 5700 wrote to memory of 5056	5700	msedge.exe	107
PID 5700 wrote to memory of 3328	5700	msedge.exe	108
PID 5700 wrote to memory of 3328	5700	msedge.exe	108
PID 5700 wrote to memory of 5140	5700	msedge.exe	111
PID 5700 wrote to memory of 6132	5700	msedge.exe	127
PID 5700 wrote to memory of 1936	5700	msedge.exe	128
PID 5700 wrote to memory of 3992	5700	msedge.exe	129
PID 5700 wrote to memory of 3176	5700	msedge.exe	135
PID 5700 wrote to memory of 3176	5700	msedge.exe	135
PID 5700 wrote to memory of 2572	5700	msedge.exe	138
PID 5700 wrote to memory of 2572	5700	msedge.exe	138
PID 5700 wrote to memory of 5920	5700	msedge.exe	142
PID 5700 wrote to memory of 4440	5700	msedge.exe	143
PID 5700 wrote to memory of 4440	5700	msedge.exe	143

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://us-east-2.protection.sophos.com/?d=bi55f246ceed2210a7a885213e02e4f720t.ly
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8da57c188,0x7ff8da57c194,0x7ff8da57c1a0
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,15368018063772684636,644940387645906186,524288 --field-trial-handle=2232,i,2326506294673712311,16843912573024278832,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,3551834604187849086,8325690380875286012,262144 --field-trial-handle=2232,i,2326506294673712311,16843912573024278832,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,17638378885219081871,1875485555215172846,524288 --field-trial-handle=2232,i,2326506294673712311,16843912573024278832,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,3266105967964767240,14284487830196431293,2097152 --field-trial-handle=2232,i,2326506294673712311,16843912573024278832,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,116018553564600002,4569299848347706932,2097152 --field-trial-handle=2232,i,2326506294673712311,16843912573024278832,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,58568884102802736,7831547326597498760,524288 --field-trial-handle=2232,i,2326506294673712311,16843912573024278832,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,10423762502094801197,1193749391283374247,524288 --field-trial-handle=2232,i,2326506294673712311,16843912573024278832,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,10551232377402863661,9572507366958150766,524288 --field-trial-handle=2232,i,2326506294673712311,16843912573024278832,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,10551232377402863661,9572507366958150766,524288 --field-trial-handle=2232,i,2326506294673712311,16843912573024278832,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff8da57c188,0x7ff8da57c194,0x7ff8da57c1a0
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2144,i,12943230516234591677,7977843247125271923,524288 --field-trial-handle=1980,i,7126793941902140947,8008218825826390176,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,13116555536277983207,13272793236204339318,262144 --field-trial-handle=1980,i,7126793941902140947,8008218825826390176,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2480,i,2784261119040653476,13970334513040139566,524288 --field-trial-handle=1980,i,7126793941902140947,8008218825826390176,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4436,i,1224160147462846098,2899344834587196203,524288 --field-trial-handle=1980,i,7126793941902140947,8008218825826390176,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4436,i,1224160147462846098,2899344834587196203,524288 --field-trial-handle=1980,i,7126793941902140947,8008218825826390176,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4768,i,18326570795744119295,693908475526910447,524288 --field-trial-handle=1980,i,7126793941902140947,8008218825826390176,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1876,i,1890260663333024509,15540771617243573577,524288 --field-trial-handle=1980,i,7126793941902140947,8008218825826390176,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4780,i,4262773539937721050,109704025766834124,524288 --field-trial-handle=1980,i,7126793941902140947,8008218825826390176,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4464,i,14076170220633295157,8553007536104638231,524288 --field-trial-handle=1980,i,7126793941902140947,8008218825826390176,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:8
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1784,i,16760054559622836191,1604481653194716219,524288 --field-trial-handle=1980,i,7126793941902140947,8008218825826390176,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4620,i,12787374270553244741,12986450859472583134,262144 --field-trial-handle=1980,i,7126793941902140947,8008218825826390176,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5072,i,16254707068975059849,13183230912191949627,524288 --field-trial-handle=1980,i,7126793941902140947,8008218825826390176,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5700_2123551635\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5700_537247123\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5700_944656695\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5700_944656695\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46e2703b2c15e61bbea538b21548ef3a8d7fb10dba46025f24e652e6fee18776
MD5 db8db1eead9856150561256e2557fe09
SHA1 e2c346af72ef5eeff2095bcc9cde2e7fe00d6ae9
SHA512 ad7198df0d59886e6e2e0aaa5345ae7310527b2bec320662790b4eeb070967504cfabb75001ede548cd3d66f835deb0321b9e109799190fefe3c53950f49c332
TLSH
T19ED0A7AC1E66B8D1F2B81D3A24948A007B8C5AC25A01771987591C058CEA07714C5AC9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1a97d4f60bf9b001b71db3392b0dd5947b3f92d9e346b27fd4a6516a929b173
MD5 8447810db1c8938923ad3ec3cad8e959
SHA1 f23bb8d8b9c23f2e5e619dfb42a3faf09ba60d04
SHA512 db81c1ad83036b89a40296294b92cf19e791e57719021ab59afe00a99326acbd83d1af869109739fdc4f32cbce2fbafe22711b9482e23ada072dae8c8098b156
TLSH
T1FAD0A7EC1A562481F2E81D362848CA457F8C6DC19951BA64475A28018DE647754895C9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 43abe63362689b846db8b787c0237d825e9294fa500897c9c1d69a3743c93f46
MD5 1912fe661ea7be4678d9cf664aa939db
SHA1 bb44e480988a7c4cc18f486f8c41160ad7ae15ac
SHA512 48706f79d6570c08e2117f1eba0105eca04598912604571d6deecc9e5e302d7015a9809f42927a330b13a2d59a0a9d83500869d3f1ab8ab9ba5055ca3e3ee036
TLSH
T1E4D0A7EC1A562481F2E81D362888CA457F8C69C19951BA64475A28019DE647754895C9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

6156bb52-6647-40be-a2d6-a4b5c46c3c3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6156bb52-6647-40be-a2d6-a4b5c46c3c3d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6ddbaab2-95e1-49b7-ad0d-eadaeef01fa3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ddbaab2-95e1-49b7-ad0d-eadaeef01fa3.tmp
Size 35KB
SHA256 c9d1e5b3acc325cd34958fdbfa8bbb3ee8c77b5f210175bcfdafe1134f38d83b
MD5 0218ffe442f06ade734e268e598ac91b
SHA1 e4517ef47cf412e7fb0c4477a3b6de21ce19cb63
SHA512 680f3b2f39a0726738f18c03a3ddbeace98d694081bdddf76f2a0cc5a97b96af0e95bb94cb5e5522358c63f1b76b45dcbd133d2d056455afe00a84cab5ce0521
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUysy10LlL:eY8Od/HEnFhWvFvmXu1jaQt10Lm2Nu1u
TLSH
T10FF2EB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 9e3f6f5871e8825f27b4a16ce3c8e9e5ff4380c4beeda6f66b9afe6476e25b7d
MD5 dc0b205aa5fed438b649578e2b00090a
SHA1 7deb5c83319ace819b47c539ff442a3b0fc42946
SHA512 3e38fc22db8a46f7a230d806c4931bd7c6473d63f4ae31859f15ec337906ea72b91f295d3a826c8c19855630773be8f7464f23f4ecd32e8174749c641b01407c
TLSH
T194F0F4B6C821EC3719FD0B6874598B4BE75113272781989F3B3C920C8FB463B468585C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 9edd84e5895a01ab1e30e3943e7fde861ebd51459960c33eb6949ba2b4fe2972
MD5 6ab8e3b530aaef3d2cd57f1d824013f0
SHA1 082e263b9587afedf752edfcbe8008f3ecaa3762
SHA512 ac6be56901f8545a92d5ef2d0d85ba5a3717b69858bff812e27116a7abcb9b9fd9c03e1089aa9d21fb3afd8ac6bad03891751c12d4c6169076c6d9d2cb9dfc6a
SSDEEP 384:bfqpgojOh2HNxEbL7PnMlVxrJ/7jjfYWVLf2nQ9Cs9UB:mpgoOhs0bPPnoVxrJ/njfDr2Q9CK
TLSH
T18E134B7D3E890DC6DEE6103D420B8A362768E532FFD3A29B76B074055374B825B1EA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 6d6d24a0631ea5547b0cb9b24eaa4e4cc25fe54072f8381c843f77dd23222017
MD5 e9f31af732d7dbc6bdc12c748a9691fd
SHA1 7859ba50b8388804d40aefe4c9b25524547d4467
SHA512 33f4edd06f1625c407219d7e4b1ac443d9aab52b79c8249c6c81845bf003d5c4a1184923f714298e677d6025fab39ac3f87f7d8d788dedea44046dafc6f3f3a3
SSDEEP 1536:XbL/cl5L/+1KeMDSf9riMEL/C8L/ikKPO8Vy9ht6ArGA/G21z:LL/uL/GMDS0fL/PL/plZh1z
TLSH
T1C24460F70940A05BCFA812F5D2133A3DD17B056D7DE1E8EAE6784CC52825B22B6BDE44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 9e14c0dac88cacaa1fecfe20fc78fd66d58c8e52c2d42db644ad0f48f6cdfd4a
MD5 96d8febd72707985508e9e885d535ce7
SHA1 f0f0ac9bb7bcf7d791cdb3a38d303da0458905c9
SHA512 bacce3aa29afc1754528c1135861fe6355aa19a92f1a8b75c70f9607a1718161917dfe43724c5de737dae0384d8b2f24e0a555cfc6b8d0e11e12e74ab5710b28
SSDEEP 24576:FYIollXlYmkVoA59F7LlPygYWAM9PJhe49JVs6uYYKcWTGL5Of9sGFTpxWdy:FY1qmkpLlPTY+Py493sIYKZi5Ktn
TLSH
T1EE867EEDCA6898C3CD639970B0F0ED477C7413C3F995C1D68898C684026B7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8b4ff6dd97b1b4249082b748b4282f9684bbf50bfcc7e664f1121f97945dc584
MD5 4a40cbdc1630e9759ccb0f23a569aaf1
SHA1 9cba06d8432a54fe170d47ab99d369363776c2ad
SHA512 c9c6975b8fa8304278be7a0ebc868be9f7033bb2c0034212c4267e6bf1b3724a2c33ce46828255cce3c99cd8ca838d6d8e71be6d80f29772a763bae285843aff
TLSH
T18C617D3A6F7D08F1E71C0031AAE622613CB24DEAFD13DEC38110F4BC2A797528389600
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 c0688d379b375fa70ea46bd4a131d6f165881a138dc66160415d2196a330df57
MD5 ed172bd3bc972fe0a0a603d2f14dd336
SHA1 c960cae88cf4f9cdabdb6b9f1aa7ad859c62d830
SHA512 677ad8512598c9e2394e414ad32b40e00c70f51694dfc321927ec73707bc47118aa76683bd999f652411c0ec87c618c703e732448f33b0f930a880b2dc7089e6
TLSH
T156E0D8DC55DBC61D691038F342386B4CC3D23457F6C5AD475B04C8C17643025B7C958E
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 8bdde5d5deccc6427d9545354fcfea24c8e87e7e60afb1a936614bba9f20f260
MD5 233615d2879dd8be27f5cc36c28b27ca
SHA1 9d9f0be72003405f4c227d9a6d63f844c32ccba7
SHA512 e8f10e71110ae076a3092b7b35eb8ab5a1e12dc9627cca9283512119f5f5dbbce2d7eea684e117a22712111e1f501ebfc692ee6d6d25b98d636afd04e88137f3
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jtpW5L1hL7K5fKFtIBoXqYpO:Tyi+7f+UZD4jJ/BHWxPCKFOmTpO
TLSH
T12CE2E08D3B11F612C4ED733DB0C2C6E09EBC687C864DB170613898768D62A61F4AE54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 eb73b3cc550e14b82bc7699a19e6a30222e73e6a282d8e5035afef9c8decef08
MD5 4022b2438feb1a0ec7b618035d82fc16
SHA1 6e684da0f2a1181970d0b099470f0634fc5965c2
SHA512 896e74c5f89e4a3f69cb37f003171648f6a0865f940f39d0a2af732729620ff5807377d2bb9f4c0cc0a03387ba327223703a82dc7295f5554480f5544ecaaa7d
TLSH
T11DE0268808CCC16D94677CE3837D634CE3D2389BA3C8394A5B0CD8647142641F7CE295
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 9d08e5b8d59b77d0fc03f2e868706727178a1976bc62fea5cd36f2130d6995b6
MD5 2a665a2e025497138177bfaa5b73031e
SHA1 ccde81ceba78a7f0682b6fa39b92e61d882a9572
SHA512 434300ca8ee1c8cdc00b9983c467bd794551dd2fdd32e5f621fe0f71c69458b3b1e50693759a6d947a6d4dc0bf741fd7775825e55e11c7e6374df64fd08bbc33
SSDEEP 48:LzBmw6QU1Pze//Cr0ux530togyWWc8xC4d96kTDh65T/slNCfcf//nbr0ux530ti:3BCxxXtc8xkkTDh65TUlN/HX
TLSH
T19AB2E62BAF3DBC11DB251C3D226F89398C7AE06E2F695C84B428B4321DF454590792BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 38fbc3175142fe5782c5035c03f95bdff0dd5ecdb7f344be72925b4510a875e4
MD5 58d07cae54334046256a503011be90b7
SHA1 636a05779d325060851bc0a1f6f89b371ab43e80
SHA512 44ccb0e33d3d9f7e76fbe12a2fcf73cbcbb379d1c835fc0aaf493d61aff6abea42b5281fc549a52bf9f309950ec96030b759dfa10832a4dcaa0fbc369f68049d
SSDEEP 96:nvIU+bGz83uy3+u4tgp4DLjGQLBze9z3djBHMsDEuspU0wbtqrOQpPfR4J+MCXkW:nvf+G83uy3Ct7XBBKjH7DXspU3iV
TLSH
T11A14101E5F343721CDBD817629E744B35D7CF03F8B5266DA686114B4CEE2A42A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 8KB
SHA256 66387d747857cd73efb393b4ed0bc8fb439aff50288dd36d0306c8bdc567037a
MD5 fae8ed9aefa4fbd8a2fda425bd7417c5
SHA1 36fb4bafffee3bbd78af2697bad1f74995780e1a
SHA512 ecb408807bacca38b59c534ed907216055b8ce8b24e9f44508d37fc83924952f7d1683172ab5d959f4615edfd56e766aa3823a3f6215b0c15869723a6f17d768
SSDEEP 3:b+lFlljq7A/mhWJFuQ3sVkWUBs/dwenqFtjE9SFcTpz0WWaV1vGrV9RUINq:6E7nVkrs/d4FS99pzTB1eBDq
TLSH
T1F90212804A60EA73EC08AA3DA2C742EC5F723A0D88B1EC02C1188C121B119C8928845E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 f537f65c8395499488533c63aa9ea98fb99a3b1af0db4a73933f0082573d17bd
MD5 658fa071d71bd1514d38cb00572cbe19
SHA1 ecfbf09017eec5a25fdb7c5d27e3f546129b77e3
SHA512 dbbcef905955aca630c7ad47f5fa947f0f16ebea2f374cb93dacd89c25eae63005fafb6522d43fe589377c9259619535652c201ffa4843a65078040d1fa01464
TLSH
T17EE0D86455DDC15D9915349B53287748D3E1345BD7C9EB459F04D842B042448B7C91C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 d3a8de73b16fe34c0d48db8546d5501cebe14d402b34765cfaaa6e15d6cceba8
MD5 dd3a757bf9787f1fdf1ded65ad1ca1c4
SHA1 f2feda5c9f207247676c5743a6ec5c5a5c2bfc10
SHA512 f8c12c28b52bf676c7b5e99f4aae1ad61de5d57129163d99e98057fa2f4176cdc3fa53e8c93ed3aa9fa2657b05a2221008bf336f792f2b0ca55dcc3a068a9608
SSDEEP 48:T2SLopFMatSaw/auUOt8BMoHwU+KP6cU1AwH:iSeMatUaAKFJtyJAA
TLSH
T10A92418E5F306121D1B05FB2EED085172E7C112CC3636A899D1420F3CEA259FF60606A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a82f6e0b23b81fc5ad7491ebec5124bbd91aca700e66d56bf53ae742017568d0
MD5 82d2023372f1e1064b5ac76eaf77686e
SHA1 530e3c272e32aa48e2a5ef48d3a5a37804227f9e
SHA512 0610979a847772f4f7859d6ede8aaacdbc814a017f52d01a0dc7950719e7004cfadbe5f098d95f3fcc99a7f0336c03fb6548b85e3548afd41f13ce3b35f23e83
TLSH
T1A441B0F383E8856E8A1196F0BA18BE2FCE1D0514432C3D5AC5E4EF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a873948ba06fe59d79fc4b5eeca781463972dd72a0641b820d136f8a7a8f0d98
MD5 b1de7023d79ed15dfaeb62ce95e092f1
SHA1 7976468223dd6088e581b269bdae8e99fbf9ed32
SHA512 c7e84a579361c6b20d6b8ab8bfb4b83503319851a3e6be9af932b7bed34fd88e9ca9c53fd94604c064793aed6283e2135879c59d70cd82cff0a949cc0507485e
TLSH
T1685190F383E8856ECA1196F0AA187E1FDE1D0914436C3D5AC5E4EF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 f01444ed9f8f4e54f08baa8fea77bb9f592a0f52faaa23978e0aefe9b705334e
MD5 5ab8230b04cb07603afa86f483848ed1
SHA1 152f757e691d34b9cad82e50adc901c92f5014b2
SHA512 0a946afa5c1816fb464e3a8e728ac3914e1b215a762bf3ea260f41f1e0b5babbf1dd03457db301c68d0e1096262245f0094e8aee1c313c1cc93b15e8b9edd627
SSDEEP 96:OIEumQv8m1ccnvSkAIHNGgH2hf5nFXfsr04g:OIEumQv8m1ccnvSccYm
TLSH
T1D6F2CCFA07276205C98444B0E4049F8EAF16010B47B6B7EC76D447E3F7A21E2B2B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 186B
SHA256 8adf5fcd7dd53d0a963e78992a62ff63812519a83f9b6b89bd93cfd7b0359248
MD5 19029cc1af99980fe23ebc4b51378a5e
SHA1 924c15ec812ca2043e706002c8ffb1ff07ffb9a8
SHA512 914d3d628f865a35270d336d49fbcc57b01dc99f138bb09e950d9ffbc5558a2fb6e043b8719f9443d28346d1e3e71f25cf68082190bf5d6ccfe3c3fe95cf5b6d
TLSH
T163C022A2A4FAE57200649A3919847C8A6735F0310100A4A0C9A8833CA1910F76A1202A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a5edda2864cb5ce09e1bfc13028b71da9fba3100bf613c138e9fd5eaa2f41f22
MD5 9606eb3137f599b65aa774a3a08f6afb
SHA1 7407101a59011b7b8f858c5edc4801c815a7bad8
SHA512 c0a5e2cb16782e5b484fd32adb69a28133a4ab189f3ff335366846e059ca5d37900dd36a098e5a9d691a6f84862c7f4d3f5e0cb88ec8cce89a96ee826c75f4f7
SSDEEP 384:sxZIeKc/f4ssVtWvMCazIKY1IHbA/ptpbLZW:swzc/fALYMCaz/Hbiptpbc
TLSH
T16A72D7066A34597B8DD7D619FA457F53D7F81523A2945E44A9FC8B0C00EABED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 417337512a8853f1f2485a7535875b5da3ad3abb06d59532c4dd2ffb5ad6db9b
MD5 73049d5858c8d8272617561738a9ca51
SHA1 9ca53bfc7aea3b71d2b83ea805312ab51c561c35
SHA512 1c51446ff56e7ec31e9751dfe34d04fc8e6abec25f482bd6fe60ca35d3d45b4a776785eecc904701fd45dfa53b3f0bec6cd550aabf0b8d7c80bc6a83f19f65cd
SSDEEP 384:sxZIeMc/f4ssVvCazIKY1IHbs/qtpQLjW:swrc/fAhCaz/HbOqtpQW
TLSH
T12272E8066A34597B8DD7D619FA457F53D7F91163A2944E44A9FCCB0C04E6BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 2b6e6951d684fa144f58f0cb01e4f251c8ab814b23b0b18ead2afde91a5a09ce
MD5 10ea3e64086bbcf8ae9e686004454957
SHA1 3984e3a792a41a3a004e5a6b3d8cf1ae35b68bdb
SHA512 b30bde564122f722d96d3c2eb2f3f82f9fe7e46c20c12b1c301aa88ef563187fa8010dfbf872c00d356f8a440d1e5135c93a8a313926fd0386388c2f6425c371
TLSH
T133E0269415E8C1BD6C673497033C9708F3E6B56BF2CC3D466F00C84B7187504B2DA192
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 99de91f82b758b41887543cae5964445bd1073b48acbc68ebd37458274ba102d
MD5 df271a9887981c9458e0d35afcd5f684
SHA1 3b3fdb655109c32e3d8e86fa44c8bf67ae517938
SHA512 daea397e744f33ed9bd4fc48ce51bd704e450a53ac8144ea2b050639ecad9cf7aac5f49a69d4a7178ded496b594934133184b7e620c5ccfa33c28c79c1bbe6c5
TLSH
T1E7B012893704F301CCE6093307A89BC0A300F41654401D83CC48FF101CBD5782F00C88
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 335859afadfb5149139a4bcea0f9c28667dd2f37b19c58989eab0421654015e7
MD5 24eaf5c5ffcb4ca371ec69e6d9f6e071
SHA1 8306a94698b1fa760fa65d9c32dc12eb234b7468
SHA512 bd38498f83489a2a9d6736e78f2ca1b9bf25d52861decc0db274ef2f3f564265ff0479a1871c062e282eb7b8a4cdbfafcfede9b9cde5cb669d1aec56ef5e1f8a
TLSH
T14BE0926415D9C36E659774EB532CEB08D2E3B81FE6C869996F08D844B24614472CA142
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 c85ebe4da002340732be380b97ff54109bc695e47580e602f3b41f12443e8210
MD5 259d6160de9d28c689cad0f15da54485
SHA1 142046c0112c4c60f13d148a872c0efbdd0dd479
SHA512 f496169e18e7a0b9c2d8a7c0546b9e2afcbd180a53b99196126478932186972fb4f4abe4ab202fc0dfb5e29976de3209daacc4634dc2b46fb315197c0a9753d3
TLSH
T182E026F885C8C27E540278D34378E70CC3F27C1B97C83A8ADB089840B582108BBEE590
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 63b99ed4bb428368c588c0b7a728398ff0255b1227df1a65837840bc6e62d576
MD5 32bb5e5e02ac68b12287eb8dd8771bc9
SHA1 3818920f7a9c18246aa15302d9786113faed8be7
SHA512 8ffdb98bcf2cd0d7d6a87a537cf1179cdd17a7c142b500544fa760291a70e101bd01836a0f9b2e48e88b95c594ee35b6a33f5cf734a63d81c90174a88ecd774b
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG+:05ppxnY753RNBvRJJdt7p5J9E5N3Bfh
TLSH
T183C2865A713A0212397E2948B3A596365F4235A33058E4BF7FB810A14F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a8386e95417a5a97fc9d9dd4c4f8727ab8a29c34b4a61a6f4db3976909d175dc
MD5 afa0d4d650d0b54865d7f67469f26a02
SHA1 e5db91bf3d66433233b13217506f0ff750ebb14e
SHA512 d400bc3fb52a3ae7d861024b4f9dc40dbaa2aa27208a4096afc5406b0aea2cf0d4feaa3067b0ac473b3881b103c810448ceed8c6b4224da0f000e0617f349681
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGd:05ppxnY753RNBvRJJdt7p5J9E5Na
TLSH
T144B29B5A713A0212397E2948B39696364F4235A37058E4BF7FB810A14F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 06a8bf2ece397906bc2e923971ddade1b9397330d80d41c5acd8c6451051c302
MD5 e0801c6a344ad09a979671b261976cb1
SHA1 a4e0bb025d9da88b2028a2f6c25e04650644f570
SHA512 abd6e80ed4174da01d7968045e3a95bd88178241d2f79fd53dbc9390c091fd2b897f0674432dfa596baf00979aeccd37a9f2e00d0acb90111362b8ce9d1bc443
SSDEEP 192:P+xWp7i8MfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxYibfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1EA24730A7B747001EDE6D9725CB080771E3C716ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 d64f5fc5ca4a2a6b8c3c4155f6837386de49f72e903549e888b3d5e86a857960
MD5 86d0859cda115ae363afecf6292e767f
SHA1 946952e8082ad8402405586bf29190ba55e47c56
SHA512 86b43265691e767067cdf7d09e47f39407151725ae9a5f2f0ac7b435fc843aa6660daf9f9879afab220a4dc4843d5539908ab6fd25a48e67c20fc30655ccc0d4
TLSH
T1FF51C4C1D3E954997F8AB981D31D5413ADE13E6B234E98B2232D80F54F48C250E6FE76
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 19dd2755583e72c919bf1b51b33476b9479cc46a1684471740a9995f610a17ea
MD5 9d465aa12c3e0198c3e83729f5e811cb
SHA1 4023253a9437e41a8d1fd87d63e696ddc2298fb1
SHA512 1deb961c39851a157c7b38fe5aea48788fbf3eb55ea78f7de0b8ec1332eecfd36a87949d105951ab3d30d0174844e2ddca85b2dff0224850edbee5e05e8f9f4b
SSDEEP 192:mQOA4AsBDl9HNCsMFP4fliQGIIIxbJMIMrFQYcYsK:GAhsBJGscRQGIIIxbJMIMxQBjK
TLSH
T17A52622D6705BB7BC01E6F771256CA959BD5E88346B9222D3030184F8EF2A5387C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 83019d51e2ba138b8bf2f3c6b3f2d8de0295c365ca80ca2377e8a4c6a07ba06e
MD5 de84476903b84ee8141b574058cdd412
SHA1 6852898f24694d44c7ffc0dda8ac98456a668bc5
SHA512 f141216b79c9a1ceede3ce9973ad39599eaf544bfe25cbcdfe4f4f214b453b36c900dc8dfcc9d21399c5f216a7c8dad5e2f71a40e9c8a58998c496b01254794d
TLSH
T1DAE0205454C5C19EE52734D74339530CD3C13C27EAC46D4B6F00C84470432007BCF152
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9e72a48b3bb2f1ba346703a2f29a6e0cd440630caa078ef9bbe2e36b2bfeb664
MD5 9902aecfb8c02490e757eae2dfc7bc94
SHA1 3431d0b700243264392ea8624dedecf95716c8fb
SHA512 8c5e0431b8f2b63b3cf35aebf7e479cbcc056328c9158472240e7a0ab071eaa332a7ea2e23c15633f96dc78955b28917cd948442d526ba0ebfb82aff117d51b7
TLSH
T1EA219D55F320C159E18E863AA46B9B261378E8129FBCEC0F847D24352D72E045E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 506c4691acc8d79327f21fb4b7cbe0d3bdbc33703e1729d38ab197e65e140696
MD5 071929e1e874a226f0ab229cfd06338d
SHA1 b52d2acc85eeaea4550338d58ab1d6d82a69a9e1
SHA512 935880d37b6e806e8b707e51cc389ae967f4a5844dadad1d347033090c1e9f10078ca7523bf231d06e9540866404d434350156710972187c00670c529b9b3479
TLSH
T139E092546485C19E912334D34379A34893923C27AA846E476F00CC4471432417ACF152
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 e0f8343911299757bc37bb7e063326864d1be5d8dfc2c5d8179c64e1637e0bd0
MD5 09d9b1a0c502f352e3a22582234c1df2
SHA1 2e80ef1fc104437f0a91ee245cf79422d9557ce8
SHA512 98deed7087860f926d5e97e69fe6de27d2967be82f5a943329ec5c7034934e1435e12af32a09465f2ac1c6decc893f6c20513e8eed981e1fbe9a51aece927d54
SSDEEP 3:MsEllllkEthXllkl2zEflzglll:/M/xT02zt/
TLSH
T1C0440415FFC04505C50010307051C3D13770DD5055115FC33CD11437DCC75400C41000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 3db29155f1a3f892d0fa0faa53f8a81226ea076cd2db060891a72b943b2a506a
MD5 6b39f06e9848f026f4d940747a4882d2
SHA1 0e4dd8b6fb88e9f716b37e3dff172457a151b476
SHA512 c125cf64519d7e289fcc88ba320f07bfc9d86caafeafb42117bb3a0776940cfb11603b7d50b6341495b2e73154aa366accc62d4565cf60fd380099bcf753583d
SSDEEP 384:np3iF9CcmyWCs3sNq8TUNTUlIm2QckCr9lNKpvBfxGoVY7kLzBypme4KV8p03HHl:pyFccps3nwgbkULkDGoukLzBhI8p0XF
TLSH
T1D4B24B36EC58CDBBECE74F89B74A6A07DEE0122785D85AE4DAD81E0D109719D130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 84c9e2ce8c29d61de266731a9657b0ccf23692822df530900fbbe72cde04c8c3
MD5 63bc59a07f4e6c320a212e03dd55b15a
SHA1 fa66fa1f64debff9bac3aca7369c588b553dc905
SHA512 8d241f4bff3945dc05f78560486c90702edec07875cfa885a56dc0312ce6c2799a6e8323339110d31fa1130bd0f80ec17ddfdd47cd758a28f607fd6c8dbb5149
SSDEEP 768:AFYjZbn0wgLkcjDGoukLz4AKWvCsG41+SbQAEGH6:B7An9ukXoWKsz1+SH6
TLSH
T1D9D25B36D895CEEBACE75EC9A74A7643AFE4027384CC5ED8D6EC6E1D108B1AC0707815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 882dc146ad3b680dce21d4487f3b256fce68787db0fe20badb144a2ba96c9aff
MD5 a1e226087d8911c43968927725a943e6
SHA1 e6e927842fadc518324b348b75b90bf929866d61
SHA512 5bea8f32b964a498ccf56613fe426ce7d0c54846cbcc0cbaa204bca5fed7b6a93f721c33ecf2d202f41086d137f1916e46d2b90ef9be03c4527fa25e08b6043a
SSDEEP 384:ysiFYtNnNnb9NsNJ8TUNTUlI4j4QckCrkktpvBfxGoVY7kLzj9W5JUSbQmXEGOFD:KFYjZbn0wgLkcjDGoukLzYHUSbQAEGH6
TLSH
T18AD24B36D865CEABADE75B89B75A3743AFE4016788CC5ED4DADC4E0D00C71AD130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 83ac07e8e9414a4519d388f3e47bb760d0de06498b1558befe4affbf5cc5efbd
MD5 034bd6e47f6c8948d07f0a6b2e5c31a4
SHA1 0b0e1cbbb03249d2f8272ebbca0b359b27d16e92
SHA512 395da98d4018313d695af77ddbaf2a8209d535eb87b5592c280ed38b378685b7485b6a805d160f98630a3859b19088732bcfb8301e67a7448ac921b33d773653
SSDEEP 768:pXFYjZbncwgLkGjDGoukLzshSAlCK4GHlmUSbQAEGR+:I74F9ukXgMjgoUSR+
TLSH
T1BBF25B32D8959DEB9CD69AC9574AB603AEE44233858C5ADCD6FC7E2D309F1BC0307825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 194d3aa27192a2fe1d06ee569d36e2f2151602a0cd7f1ca081aad63d12af93c8
MD5 8c3cba4f442460f29f6607c881124d41
SHA1 f93ac399012bf35227d4056057e66c0b0d214b98
SHA512 b5cf3e0d773c72b010d4a960d3bd8df7372ac3a4108fd231b9a964d41d7fb8841d74902d954d86776b7bb3adb2fc0baf8ad0973c229c43375627b49c4c71554e
SSDEEP 768:8XFYjZbn0wgLkcjDGoukLzYHUSbQAEGH6:h7An9ukX4USH6
TLSH
T18CD24B36D865CEABADE75B89B75A3743AFE4016788CC5ED4D9DC4E0D00C71AD130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e44afab92c83c0088e7e5602d81ba6582af7e351556a6048a4299e58d022a842
MD5 6859db40707877bf27ba4c9f9a819bfe
SHA1 9a66e5b058e914a288d46ca6269aa0af43da8d17
SHA512 532497ad1517c8c77842530c0b6c7c62b40d2dba9fde34c3f4566f8c36464c0f7b281ec477eea99568f6a5ef11d99fd00f96cc8d9dd101402efb0940c9ee44ab
SSDEEP 384:npsiF9CcmyWCs3sNR8TUNTUlI4j4QckCrSOtpvBfxGoVY7kLzj9OmpFUSbQmXEGj:pXFccps3cwgLkgjDGoukLzs6USbQAEGj
TLSH
T150D24B36D8A89EBBEDE71F89A75A3743DFE4015785CC5AE4DAD94E0D00871AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 35be44a685fd2808da7f0ac90f5f517a07245a554e6f71cae6d9b8077adaa75e
MD5 60a296f5c9093a2397a2df5345580ac8
SHA1 37dc86014bb99ec749ac0be7f1ae092548921d7b
SHA512 84fcd2ba37207669ae21a478b773b166ba86884c97d338d7aa96bc83ec1b9f8d86e89381959bbd453b23f20994e0fe7bb151af8d1ad9c61d8de901e2c6d291fc
SSDEEP 768:pXFYjZbncwgLkBjDGoukLzshSAlCK4GHlmUSbQAEGR+:I74I9ukXgMjgoUSR+
TLSH
T1EFF25B32D8959DEB9CD69AC9574AB603AEE44233858C5ADCD6FC7E2D309F1BC0307815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 933947a8df394cf252ff478102f0127a572b4b03eaa1cd724ada4dbb6575e9fb
MD5 cedd51064c32fb7b2888523f07cd9a52
SHA1 f569c8d8eefa498474000fcbc17e548aa237aa15
SHA512 dfea5736fd908df6c52464128d952f697418b29846cc23fee3cee723c521e505692b377607d10234c2e4f2196dfb692ce386e836f5bf07423f932ec2ebf46c30
SSDEEP 3:MsEllllkEthXllkl2zEflrRfull:/M/xT02zQfu/
TLSH
T14B4402186F80040AC6401031505193602370D851F5115743349108225CCA5404C84000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ce378644da42e67098e2e69aba521035a39953d6f968d08c6757cb2ef0371e88
MD5 1ae6df420d46300cab72f10b4b801b7a
SHA1 ec8d540193b8e2037353c1f6aa45741dde2dc8eb
SHA512 1aa1d81ad6c47753b4d1603adc85d376dc513342d7cacc528a1ffb831619049cfc9cf9408230009036aeade5a28437969c56ed1adc688aedc1df41b69b317084
TLSH
T1E03114E25C781AD1C4BE0ABEA48774FC84E8D32AF1A8707D5C58E9D44739A4E644143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 4df0806b4b5120518a2500efff8878042900b47bf99a16a6629a4f5e27e46d8e
MD5 9efcfd5f5693a21d9f06831749639351
SHA1 dec231cef874c421ab3ebfc3c7f9b432b11f3c3d
SHA512 9b48e454ab4921130901eb294191f32aea561d4388af358adacf1a3bd29aa4c7ada4e3cf4e62d95a4e7b8b4c85916f999712dc9bcc713366a9b80eb0bb8363ad
TLSH
T1144144E15C381AD1D4BE0ABEA49778FC84D8D32AF5A470BE2C58D994473CA0D644143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 21e086b32fe0474f38679e082806f5f1ab4294e2578fd8dc57f0041445f94d9d
MD5 37c8d027b4457cd52392adb65753c502
SHA1 43dc5e67ac72315e6df0b6d7664fb73d63679f17
SHA512 a582c7ed83f26259566ba760c4ff765c756590a1b241ece1ac7669a1ed6a4cfbfeaeb64fc3893dbd2f9a059490bb2fa321454730adc59a55630d56c87c97c9c6
TLSH
T1D23142E25D381AD1D4BD0ABFA48738FC84E8D32AF5A830BE2858D9D44739A0D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 8df621738b5b7dec7194353057892c2b5180cc714fa7b1aeb8eb65a633715297
MD5 7ec85301878ee7522e0de3cf3d3968d7
SHA1 0a1e042a5fe2b162ad1639e5694fc8fcf7818bae
SHA512 491d42ceb06c52a1f95cac3f9d6bc7f5ede0f2d515b7d44d87442853a786bbdca2a31fed81099c99f9314cb2fff4d8d7368d618a0f2d35747c607ae2a03ae01b
SSDEEP 24:X4hC5fZhqLo4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uw0:dpnqp/IHRH34kWqB1kQnjhHmr6ITmUT
TLSH
T1DF42766EDA2CAAA2FEE00B3ED7D1D0127B36A60EC2E4D9F1096B505747C440405DB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6618d4243d7e1699cf0045b7e78d865c48bb49728b21187177155b1ffbc39346
MD5 c36b6955256efd3b944f6a4fc952e3db
SHA1 8b0022bb06a2defef1b4092c37cc7d97182dea78
SHA512 c68e4adca0fb339f6460198b41611d1810b1e55127ce5346d129f9221b437ffc56c4ff955f6f128f64f23c0b50d3e0217676c46086ce65a6333ad0b3b09c5c95
TLSH
T1D041188CB6E92108B3B7AF6AABF6686D047FBD772F06949D00110D8F0762A44D971733
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 337ac3c6d29293d9fe63acc46bbf4646ebf2a1e2c94f88bb9a0fcdce75b5ff22
MD5 af3da4ddd3e438a7fb0de560f1d27c6c
SHA1 9eaef0803bf17801524cb490a750a58dfbaef7f3
SHA512 a2728b03f0f533f58e7edbe5e552ba451538eba07f71d9521f62d8e780b4e7b96dcc9adb9aebe28f93a17df40cbdb2acb2af53d7fdd466ebbcef1cbd2aa6aa6c
TLSH
T123514D5C6AFA1149B373BE5A9BF6B86D847F79232E06D45D10110E4F0627A0198A2B3B
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 c8e030eec73fb876a94adaf425930da25d83b44ad79dc0395c0a91c2f617cc59
MD5 67348a81102d5f2c9fe91901c3acb139
SHA1 337c63c5de388a835300094176984c2a827e12cb
SHA512 6dfff71d132f1737a9fc6526eddde0497542c7fa0e62b65a6c7638c8c6a729a3967d25c59f7c2c1072c1cc3d931fc4fc4a388ede56df9eeb9a95c8bf5db3344d
TLSH
T17D5149E53925A22F6BC387C560754C84A571F290032E9A5CEE5AC034BD6CEE2671F7C9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4024-251-0x000001A4EB4E0000-0x000001A4EC4E0000-memory.dmp

Download

memory/5140-403-0x0000020600000000-0x0000020601000000-memory.dmp

Download