e53d8af79885c576a48aad23f6558ead36b55356bf71b8836e26bb2ed01c4d18

Analysis

geolocation tags

asiadelhiinindia
max time kernel
299s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/06/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RexVolt/Monaco/index.html
Size 45KB
Sample260603-ehe8qaay2j
SHA256 e53d8af79885c576a48aad23f6558ead36b55356bf71b8836e26bb2ed01c4d18
MD5 c5d2c00fda2770389a99868701414508
SHA1 ee464b7858161d1b9eca2dc5fc46fc05708d0e76
SHA512 97f97fa00bd4b9f4966205ddc8df766dd4e0a6326ed5b07da10e2dd8fc6c156b5005e57e4c71896597266fd7644712ac168e1b645ed4dcc4ba4b4f7d3ca1aaa4
SSDEEP 384:eDNsfRXbeVuR1zJL+bcK2rCyegdzzGr+Lh88WiLeYY:eefRX4W+dAL1eYY
TLSH
T17023925DA60104396637A3AEBBE3930DFB361213AA0117597BECA2500FB179851F6FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-as.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-lt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-pa.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-te.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_733129764\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1307571760\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1307571760\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-de-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-ta.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-cs.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-en-us.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-nb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-und-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1473794320\auto_open_controller.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1588468023\surnames.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-bn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-sv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1322926424\Filtering Rules-CA	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1322926424\Part-FR	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1322926424\Part-RU	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1322926424\Part-ZH	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-be.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1473794320\shopping_iframe_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1322926424\Filtering Rules	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1588468023\english_wikipedia.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-ml.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-ka.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-la.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1322926424\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-el.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-hr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1473794320\shopping.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1588468023\ranked_dicts	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-da.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-sl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1061298652\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1588468023\model.markov	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-de-1996.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-it.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-bg.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4908	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134249326757860464"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{2531BAFC-D5C5-4A6C-BB1D-73E4FD33B9D6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5356	msedge.exe
5356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe
5332	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5332 wrote to memory of 4600	5332	msedge.exe	86
PID 5332 wrote to memory of 5456	5332	msedge.exe	87
PID 5332 wrote to memory of 4908	5332	msedge.exe	88
PID 5332 wrote to memory of 5456	5332	msedge.exe	87
PID 5332 wrote to memory of 5456	5332	msedge.exe	87
PID 5332 wrote to memory of 5136	5332	msedge.exe	90
PID 5332 wrote to memory of 5136	5332	msedge.exe	90
PID 5332 wrote to memory of 4440	5332	msedge.exe	91
PID 5332 wrote to memory of 4440	5332	msedge.exe	91
PID 5332 wrote to memory of 4164	5332	msedge.exe	92
PID 5332 wrote to memory of 4440	5332	msedge.exe	91
PID 5332 wrote to memory of 4164	5332	msedge.exe	92
PID 5332 wrote to memory of 4164	5332	msedge.exe	92
PID 5332 wrote to memory of 1064	5332	msedge.exe	99
PID 5332 wrote to memory of 3532	5332	msedge.exe	100
PID 5332 wrote to memory of 1064	5332	msedge.exe	99
PID 5332 wrote to memory of 3532	5332	msedge.exe	100
PID 5332 wrote to memory of 5076	5332	msedge.exe	102
PID 5332 wrote to memory of 4412	5332	msedge.exe	114
PID 5332 wrote to memory of 4036	5332	msedge.exe	115
PID 5332 wrote to memory of 4248	5332	msedge.exe	116
PID 5332 wrote to memory of 1512	5332	msedge.exe	117
PID 5332 wrote to memory of 1512	5332	msedge.exe	117
PID 5332 wrote to memory of 5576	5332	msedge.exe	118
PID 5332 wrote to memory of 5576	5332	msedge.exe	118
PID 5332 wrote to memory of 876	5332	msedge.exe	121
PID 5332 wrote to memory of 876	5332	msedge.exe	121
PID 5332 wrote to memory of 4408	5332	msedge.exe	124
PID 5332 wrote to memory of 4408	5332	msedge.exe	124
PID 5332 wrote to memory of 2236	5332	msedge.exe	127
PID 5332 wrote to memory of 2236	5332	msedge.exe	127
PID 5332 wrote to memory of 5356	5332	msedge.exe	129
PID 5332 wrote to memory of 1072	5332	msedge.exe	130
PID 5332 wrote to memory of 1072	5332	msedge.exe	130
PID 5332 wrote to memory of 5184	5332	msedge.exe	131
PID 5332 wrote to memory of 5184	5332	msedge.exe	131
PID 5332 wrote to memory of 4140	5332	msedge.exe	132
PID 5332 wrote to memory of 4140	5332	msedge.exe	132
PID 5332 wrote to memory of 4484	5332	msedge.exe	133
PID 5332 wrote to memory of 4484	5332	msedge.exe	133
PID 5332 wrote to memory of 2324	5332	msedge.exe	134
PID 5332 wrote to memory of 2324	5332	msedge.exe	134
PID 5332 wrote to memory of 116	5332	msedge.exe	135
PID 5332 wrote to memory of 116	5332	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\RexVolt\Monaco\index.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff8c95ec188,0x7ff8c95ec194,0x7ff8c95ec1a0
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,11982337059711471569,1085915475384893548,262144 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,250335353536238570,820166429531768930,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,8386430229826305604,11380124494003837629,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,3690313613876991276,11957174897976566437,2097152 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,6596595657626754597,18444880222020316193,2097152 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,3293803274346199377,10770309343098628380,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,9176144562607912610,5410236126805524715,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,1914991293321032810,6187578675562222533,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,1914991293321032810,6187578675562222533,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,3358103760020093722,9269083785927790719,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,1713094693258910216,6777336749729707218,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,2923818559882739668,13006213379359782369,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,7183317904632628706,10672160444968989367,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,2045387724193747876,4867655763560476606,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,12116006298874252839,3310115887036230302,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,2230305137766454198,15197009929148720402,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,16168361897525871164,16661923058968076006,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5756,i,15588986129609319275,4865866393566886723,262144 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,6653912558807311515,9607548724676058433,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1036,i,14856950719368693684,7307505142109526482,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3396,i,12588856375677232252,4896576197646919068,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,6583834849288661075,15372567828188538716,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,17447719037922159937,4125784520560457288,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,15560541124174974765,16390970304561993655,524288 --field-trial-handle=2288,i,15570146864165795573,820298254746661658,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5332_103504418\data.txt
Size 146KB
SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
MD5 7a8bee21ef52bf7f962551770605aace
SHA1 8f205bb793c0269f210f7e8cbfdf594f089c7d0f
SHA512 8a2706485d3408e09242d59cd72ad367eeeccc948d7c3a74b3c7f8c7a2b22ad44b94ba426a341da606dbc53c4d8c519df921e879347018ca809d1ee63d13e7fe
SSDEEP 3072:cPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYErqsZo+Eog7TAMy3nBt5rd:wX1aI5aZoKzMJ07NrpoTZ8My3nld
TLSH
T1A3E3F1218EC01FDDDFA8261C50BF0B1DA7D0878D443A6686EB63BD4EBF9B50856274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5332_103504418\manifest.json
Size 52B
SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
MD5 4fb639ca1de22fb121f954c14c414349
SHA1 a6a124dbf473075e287557494d3a0375e8d42c2a
SHA512 c5cf5e55ce9ce6c86d0d346afffee7ecabee609ff6c4303c3fcf21f3d46fe2f770636ecfac5fe165b777bc93ecc90e55992254fadefe8b8f2e5b17a2bab6a643
TLSH
T1C2900260442491171AC10E506670F8C59391661955850D1D04451548029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1307571760\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1322926424\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1473794320\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1473794320\manifest.json
Size 146B
SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
MD5 94e3a47681712a13578f122b3158c015
SHA1 376442061baa7018ee9e784d991798fc9f302b31
SHA512 6974139805e18959c2ad2a71727705f1c5268ee598b8864833732e042beffe2416db033180b8d01bf8bb3b2b901d4ccbb090dd677ecded939aa3d07797ba05b2
TLSH
T12FC09B73C931AC71157507D449F59745EB74574BF511B1563730018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1588468023\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5332_1656314710\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5332_733129764\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 1abd2ff93cbd1371d52112383f571c50240ff102de3ba9afd492cfe8d7555ede
MD5 a768ce136b32d3ffe309bbed98d74f27
SHA1 5596b672a0a93e62f4cd7643faa55a47e9854d9a
SHA512 38abacb0561432827c9cbb461c61aa2cfa03f8df207ddad4097b19d5dc5624bb9786c78f810b8a317e37e8e6a980f03d0a552f1ce787a3c846cc65ff8c0fca9c
SSDEEP 192:ljorMaagReePPPPPPPPPPCFLuuZm/UUV00qdFANSh:ljorMaagReePPPPPPPPPPCFLuuZm/UUq
TLSH
T167F18A6692D4F7DB9F0510CA49A4935C50B0BB0DEBDED50C138E89DD354F89BF8A2AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f9c7312f7c1bc6b014735923416f1d0839c8c214716adfa251e2965ddf0e4c4c
MD5 294005f3d1c295b190c6159cdcf435ea
SHA1 a5eca04ae95f4ccf35a5917703d6c5641153adc5
SHA512 2c92bf3fed709eb5427830eeeddad3dfff8f35c6568b9c367a44ec64a5c6f90614dc1e3868b3b087cb4a729e6f6a8bd57bd70ca992d810582f9934c18112ccd4
TLSH
T111F02D76CC21EC3718FD07687069474AE75413272780585F3B3D920C8FB463B4689C1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0d5b8c53f91093959a30ee186d808db9e9b5cffc6e699803586754bf35bddb3f
MD5 cde0a032c76b4317e2ece99af6661fee
SHA1 e6c5a73a14cfe762fe2eee70973f67f9469c84f9
SHA512 60915974229a742ecac92dc622a1fc38457773b58241d623ba2eec5d29c9732adfb346f564561b86d35ab47c15b19cc893befe15f926324f9fea28914b809837
TLSH
T18261CEF7C2E8826D895196F0AB247E2BCE2D0515432C3D5A89F4EF4FA3E2471D14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8d491a672c03ac12a52ab5c7c8f9f27f850c41a012957ad07b95a143e408da13
MD5 817c2ed3236fbcaf1564ba4818fb6172
SHA1 d6dcb28c6cfad07bb1ffd97ab689f7de3e057eb6
SHA512 ac0fc6d5d6cf1e812a14cce942bd03a0d46c33e8dcb56dfcd63702c27d8054ca531af7677c237ae97a5d577adbe12389f681e97f54db4bd23bb597d5ec2bce26
SSDEEP 192:sxZ3R6yMqZjK1Ml8Mkp/f/ss5NW1aZdIaRuvdzodpH7HW6+WNGegYvICcUhIgjKJ:sxZ3HMp/f/ssTW1azIKY2bHbGe04jG
TLSH
T16A62E8066A3499778DD7D219FA45BF53D7F95533A6904E44AAFC8B0C04E6AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0f64317c5f4b0a7411d24fe899552ff747ed21f278f05f99e137015dd621b992
MD5 7da79bf8fe6402d8bb1552c15b55a998
SHA1 de5801f56f9e9eaab5274419a814a060bc0b2fab
SHA512 ee4f7609f7502580a729b6aab34a4984b9f948f9dca52334115cd4848204934ef699b3f8f8c9cb962a03be59fa1b0dc67fe3731ee930469b3787317925c25ee3
SSDEEP 192:sxZ3R6yMqZjK1Ml8UQzkp/f/sqNWXZdIaRuvdzodpH7HW6+WNGegYvOcUhIg5LcF:sxZ3HqYp/f/siWXzIKY2bHbGeb4+f
TLSH
T17672E806AA7889778CD7D219F645BB53D7F85573A6904E44A9FC8F0C04E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 c4cdc17bdce90ba5fbad133cb480ca5725a5d9cfbb8010cfb7af492c9d286822
MD5 68e196a7b88c09bdd4458e95259d6eb1
SHA1 72aeecfd44d0b306e1c28ed65d55757f0c7924f3
SHA512 1b0ec19a98837e862d09ef3ad958ebeb00293744f7899691af33736db2e4ce3abbedc1716a5085dd8fbc1e166d78bd4e853850ad1cb893231ffc1490dd45a17c
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4ysy10Lln:eY8Od/HEnFhWvFvmXu1jakt10Lm2Nu1y
TLSH
T110F2FB3B6C0CCB7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8489aebe6ffc822c3739322801de04a8df773739d19f0ef4a626e26e63eee8bc
MD5 a34ee01a97ad400e26db2b9a497e937f
SHA1 87ac261300642346e01ffe164e7f2676dd335e19
SHA512 72dbfb504eafde660b7f9025bb2d2808c8243082399d70530a5c51290a29af44a0719582807610df91a42cb7a64f2c0ec6dde7f812defb31cd39807686c8fba3
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGX:05ppxnY753RNBvRJJdt7p5J9/nxp
TLSH
T1EAB29D5A703E0212397E298CB39696364F4135A33058E4AF7FB814A14F67E225DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1a14ae4dd2aff74484c3056ae565b3378e4fa7180d26be605cd0d8fcb1c31549
MD5 a77448e54825b6651f87cb94c4670b5a
SHA1 b6bfc0f9f12721247ba5217485b4ecbf63f5a01b
SHA512 29ff2797e3399c34e15e4f5055d8c7adb1fcb34348af751450284cb934ac6f05f9a8affbeaf5462c4603e33e290553d396cd9082da2acb74351dd56c4a32eab6
SSDEEP 768:pcFccps3GwgbkUfkDG045Zcd2ZZnI8p0MLC:Gs3oqyc2nI8p0MLC
TLSH
T115B25C36ECA8CAB7EDE74F99B74A7A07DEE0126785D859D4DADC0D0D009709D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 337f4230ae7ea535d45743a96263793450bc0fa39078f739699fd28ed0533464
MD5 63249b664294d5ee2da3c832f8ffc516
SHA1 606280cb966bdc3f28504ddd01accf02099eca2c
SHA512 f61193ccf91edc9da6b8c085bec4a8426d2c9fa375a1a1eb74bb215ed26a97ba7ffb682e0a105e5f8638a49c5d6c572c08b9a3ea552b12b5825ebe98ee6a0b78
SSDEEP 768:p6F1jZbG3BwgykKUBDG045Zcd2LZ9ok3UJOj:UC3yt4yc29oPOj
TLSH
T1DDD25B32D8A8D9A7EDE74F99B31A7647EFE41267C9C829D4D9DD4D0D008319D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 eb2ee5d8f02baeba8b9acdef813566309f326466f9522ebae45e2a316c30c356
MD5 f32597fb7ab8aebad0f9203a51fd1b97
SHA1 cc583b397164139a02e832b2ba15aed5eb0a0493
SHA512 9847f548ab953b1926bcf9b36bf3d02a84b34a0c68c997042e6515523fa76d93215bcff4da24bdbf62844e042ec0a7165d8e92ffe11406fbdad713448aa9c0f7
SSDEEP 768:VF1jZbY3BwgykMUBDG045Zcd2mZ9ok3UJOj:rU3yr4yc99oPOj
TLSH
T1F6D24A32D8A8D9ABEDE74F99B31A7647EFE41267C9C869D4D9D84D0D00C319D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 543e3d512bb27b265374020d32b5f7bf68bdda5a7e634c6359dc003d21194f9e
MD5 bf90e602957cd2614d83da869bda44f1
SHA1 ee25ce1fc0e7a0fe74b65542141c8bec278f5bca
SHA512 4b80dab14eb76cede70885cd1158281603532d68097d32d72fe111097b7b454f9832e5bbc82e7c10b42e5c3277fe7a00d5ec40198bbe1f874ff784bba93534ac
SSDEEP 768:oF1jZbG3BwgykMUBDG045Zcd2LZ9ok3UJOj:sC3yr4yc29oPOj
TLSH
T177D25B32D8A8D9ABEDE74F99B31A7607EFE41267C9C829D4D9DD4D0D008319D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5c4c48eef9dbc2635e22d18e70918e48cba2ce6c3a9e06be3aadd2f1b8e09458
MD5 e5617b65a8484b36fc43672700781958
SHA1 0c32509d9be5d95aebf23667a43a14800e3c0740
SHA512 28088005129d549131221a726a8c72868209f33271477d6df36e80c385031c01f0eba44eec741070982ee9ccdacaec65e002df5fde62ec5b67cb9f0585c0b664
SSDEEP 768:86F1jZbG3BwgykMUBDG045Zcd2LZ9ok3UJOj:LC3yr4yc29oPOj
TLSH
T1FCD25B32D8A8D9ABEDE74F99B31A7647EFE41267C9C829D4D9DD4D0D008319D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e80f5092f19ec56223953870bca3576a2e2f426c2a70213136cc34d852b76500
MD5 aec06723a7094de2c7a4d93f8824ec33
SHA1 e5742673ad3367cae8c1e2d26f6f46d94f739f53
SHA512 f024cebaa118d5ea5a234a9734a59e11bc6206e49e1587d685ebe087b3b0557ffb08eddebe182d75191361a940f146598f3a406c65969eb26cce93d99cc30567
TLSH
T18D3104E25D3C1AD1C4BD0ABEA48774FC54E8D326F1A470795854DE941729A4D644143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0033daa691809d34254e1934f90160cbecead1519ce562e930703aa7fad82ade
MD5 b587ce400b85edcba2dd4cdaba4fc7ca
SHA1 dfae26a2514c79928cec51210007746a0a6b7896
SHA512 e3e6b4c725bdcddd6e56dd71c7590b16ca3cd8fab728f435ba9805975a27399df25977474460e3ca5d2ed2047bc050f84a64301f6e3e416b78931aec79cc812d
TLSH
T12C3142E25D3C1AD1D4BD0ABFA48B38FC94E8D73AF1A430B92854DED50729A0D658143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1f085e8172469700f1177aa95a72280ef2d1335964e8afa6938089a216f5277f
MD5 bbe2be9c06615615f521d2d86496788e
SHA1 c1bad313390d52e37eaa058457bf11a1e81fce29
SHA512 d1caada50d8c808d9e02e327579833ebbeac3ac9bc6e2363db8c1244e96789ca4b2128da9190eeee2a8764c1156921b39ce4f00a377fdb0874c2f1bea9470d87
TLSH
T1664122E25C381AD1D4BE0A7EA49B78FC94E8D72AF5A470BD2858DA950728A0D644143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 40796bc0d09d6684d27d1bdc3928437e6850b0dc7d3def9d2b6fd28930fe1e3c
MD5 93f6ef23875ac5f74b0ee82356f5ccb9
SHA1 4638a99e5a51ace55bca98531e80faa9d2b4580d
SHA512 7f7ad157832cba2267601604813aefb4c763a50c69a8553dc343fd23569a50d22060669a0cb4af9bc0b41b524240a8014a0c60a89a896059e7de37936cfb71e4
TLSH
T1F24123E21C381AD1D4BD0A7EB48B38FC94DCD726F5A430BD6858DA940629A4D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 43f97e6eb7c84bde5c33060a765d8b91dff2220f67332c2bc903b6830468ef28
MD5 75cec7d417767c25127fde29ddfdf0e4
SHA1 bc29c823683e9500beb9ac460fb044562325448b
SHA512 acffb33a51a58872d479b8bff881ceacc10781d1931b7f17fbbed75a53bb42cf02c3b53faa4f2734ba7c7e7e558cbdcadd11338d191fb5aeed85f0d5a9aeae6b
TLSH
T1484122E11C381AD1D4BD0A7EB48B78FC85ECD72AF5A430BE6C58DA940A29A1D748543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7a0cfccf2e7cb45ade90b149177e7857099cf278e282eea8235a4cabbfbc60bf
MD5 8eff60160d63667f52f2317b5eb5022c
SHA1 0c1d50da15bf8aff8c55fe6b123a5062683251c4
SHA512 2f7d6fe8da70f7c43983b88f03324f2f742a612ebd0fe3c630fa44044bf9b2c24e59aad6edbb850f00b719b41151c7cd8cddac0bba94d309d13a2a92ff14389e
TLSH
T1A5413EE10C781AC1D4BD0A7EA08B78FC80ECC63AF5A030BE6858DA850A79A1D648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 45f083602752e9084e35b431a5a93156e1d2f14713d307acb0332b41e3bc1876
MD5 4f833d5727fc083c6734b47fda3d8284
SHA1 8021d6150976d852db114befbb998653e88d017b
SHA512 65398212193081b2ad16e59d0334c0ebf0955838812777f85e437202836c32b6521f9167c8a3bfea525053d730e70d2f3b6c76d7c94b7142f5e4270b2bd84605
TLSH
T157413FE10C781AC1D4BD1A7EA08B78FC81ECC62AF5A034BA6854DAC50A29A1D748543F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1a3aa94e1891df988f5ebc54a1159e9633571e1da1233ccf967b047d1d926079
MD5 aa454b883e2b4a7da92025849565008d
SHA1 c3401c1ca77b1b27a44d32694297a9e07a9b954c
SHA512 61d7cd9e3e5da6d06205ff8e6fe9890aa885c7928e8a8b751183d9f22b642bd0b25698cafa0e6ebc07de396c679ac584478d6df39e99bd6b1ca590bd94922d45
TLSH
T1F8412898B6FA1148B3B77E56AFF6A86E447EB8772F0BD55D00100D4F0A22A40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5076-181-0x00000291047B0000-0x00000291057B0000-memory.dmp

Download