1bc4bfd72b3b21e446266e65a55b2ba0857d0ad37280696e7b147adfa3706d22

Analysis

user interaction
yes
max time kernel
190s
max time network
192s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52f5o3tf.exe
Size 276KB
Sample260622-kwpbfaa18y
SHA256 1bc4bfd72b3b21e446266e65a55b2ba0857d0ad37280696e7b147adfa3706d22
MD5 e49835aaf0e4fb90e667996257d9cb3b
SHA1 ae27b380f903c76c951367ae5d4a84e4710d6754
SHA512 79bc6b32dfe18991378728dc399efa8e3cf4c426c3815821508aa71fc4b65c1171be1c4d3e3202202a124c214817f5678ead6fa065a084bdd05b6801ee02264e
SSDEEP 6144:pxhixu3VMA5F/GkUTmS4SXPY1pP3+b5YFYABS5:p/ixUZjGk4BS1JK5r
TLSH
T17654AE09F6A908FAF577C575C9520902EB737C8647B0D7EF0B9049968E136E09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Executes dropped EXE 53 IoCs

pid	Process
792	01v1y37e.exe
2092	WinSystemUpdate.exe
7112	WinSystemUpdate.exe
5964	3dccg0w2.exe
1196	WinSystemUpdate.exe
1912	WinSystemUpdate.exe
3424	9ikrh5tg.exe
2744	WinSystemUpdate.exe
3036	pw17mbv4.exe
7000	WinSystemUpdate.exe
4792	th9e5ecs.exe
2356	WinSystemUpdate.exe
4832	WinSystemUpdate.exe
7076	WinSystemUpdate.exe
5416	WinSystemUpdate.exe
1676	wt9mnhsh.exe
1480	WinSystemUpdate.exe
1124	WinSystemUpdate.exe
5928	WinSystemUpdate.exe
2908	zdi1yj96.exe
1388	WinSystemUpdate.exe
5212	WinSystemUpdate.exe
4396	3yi8gmpu.exe
6864	WinSystemUpdate.exe
616	WinSystemUpdate.exe
6620	9vqn9rm8.exe
2704	WinSystemUpdate.exe
6848	WinSystemUpdate.exe
5100	WinSystemUpdate.exe
6624	cfy2sm2x.exe
4336	WinSystemUpdate.exe
2636	WinSystemUpdate.exe
6828	mw7o4u87.exe
1668	WinSystemUpdate.exe
6632	ttfbx05k.exe
6500	WinSystemUpdate.exe
6664	zqoyy52y.exe
1992	WinSystemUpdate.exe
1288	6vwcr3zb.exe
4276	WinSystemUpdate.exe
2256	m9dl4g1r.exe
2948	WinSystemUpdate.exe
1628	9s2g2s8s.exe
6564	WinSystemUpdate.exe
248	j9iae0du.exe
6732	WinSystemUpdate.exe
2536	ii0z7ms6.exe
6760	WinSystemUpdate.exe
6160	51pudxz7.exe
2264	WinSystemUpdate.exe
5496	iv6w70ly.exe
2848	WinSystemUpdate.exe
5556	zhn4cdvm.exe

Loads dropped DLL 1 IoCs

pid	Process
6064	msedge.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_1882158925\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_1882158925\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_1882158925\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_114617922\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_114617922\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6064_1882158925\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2192	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134265922993069673"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3730367222-316663987-825798519-1000\{FD4B9552-B873-4F71-85B7-5F84BAAAD9FC}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6624	msedge.exe
6624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 792	5764	52f5o3tf.exe	89
PID 6064 wrote to memory of 6672	6064	msedge.exe	94
PID 6064 wrote to memory of 2192	6064	msedge.exe	95
PID 6064 wrote to memory of 6612	6064	msedge.exe	96
PID 6064 wrote to memory of 6612	6064	msedge.exe	96
PID 6064 wrote to memory of 6612	6064	msedge.exe	96
PID 6064 wrote to memory of 5380	6064	msedge.exe	98
PID 6064 wrote to memory of 5380	6064	msedge.exe	98
PID 6064 wrote to memory of 6000	6064	msedge.exe	99
PID 6064 wrote to memory of 6696	6064	msedge.exe	100
PID 6064 wrote to memory of 6000	6064	msedge.exe	99
PID 6064 wrote to memory of 6000	6064	msedge.exe	99
PID 6064 wrote to memory of 6696	6064	msedge.exe	100
PID 6064 wrote to memory of 6696	6064	msedge.exe	100
PID 6064 wrote to memory of 4880	6064	msedge.exe	102
PID 6064 wrote to memory of 5492	6064	msedge.exe	103
PID 6064 wrote to memory of 4880	6064	msedge.exe	102
PID 6064 wrote to memory of 5492	6064	msedge.exe	103
PID 6064 wrote to memory of 6332	6064	msedge.exe	105
PID 6064 wrote to memory of 3296	6064	msedge.exe	108
PID 6064 wrote to memory of 3296	6064	msedge.exe	108
PID 6064 wrote to memory of 3180	6064	msedge.exe	109
PID 6064 wrote to memory of 3180	6064	msedge.exe	109
PID 6064 wrote to memory of 3180	6064	msedge.exe	109
PID 6064 wrote to memory of 6896	6064	msedge.exe	110
PID 6064 wrote to memory of 6896	6064	msedge.exe	110
PID 6064 wrote to memory of 2596	6064	msedge.exe	112
PID 6064 wrote to memory of 2364	6064	msedge.exe	113
PID 6064 wrote to memory of 1344	6064	msedge.exe	114
PID 6064 wrote to memory of 3788	6064	msedge.exe	115
PID 6064 wrote to memory of 3788	6064	msedge.exe	115
PID 6064 wrote to memory of 3788	6064	msedge.exe	115
PID 6064 wrote to memory of 356	6064	msedge.exe	116
PID 6064 wrote to memory of 356	6064	msedge.exe	116
PID 6064 wrote to memory of 356	6064	msedge.exe	116
PID 6064 wrote to memory of 1148	6064	msedge.exe	117
PID 6064 wrote to memory of 1148	6064	msedge.exe	117
PID 6064 wrote to memory of 1148	6064	msedge.exe	117
PID 6064 wrote to memory of 7124	6064	msedge.exe	118
PID 6064 wrote to memory of 7124	6064	msedge.exe	118
PID 6064 wrote to memory of 7124	6064	msedge.exe	118
PID 6064 wrote to memory of 1128	6064	msedge.exe	119
PID 6064 wrote to memory of 1128	6064	msedge.exe	119
PID 6064 wrote to memory of 2264	6064	msedge.exe	122
PID 6064 wrote to memory of 2264	6064	msedge.exe	122
PID 6064 wrote to memory of 2264	6064	msedge.exe	122
PID 6064 wrote to memory of 5788	6064	msedge.exe	123
PID 6064 wrote to memory of 5788	6064	msedge.exe	123
PID 6064 wrote to memory of 5788	6064	msedge.exe	123
PID 6064 wrote to memory of 5000	6064	msedge.exe	124
PID 6064 wrote to memory of 5000	6064	msedge.exe	124
PID 6064 wrote to memory of 5000	6064	msedge.exe	124
PID 6064 wrote to memory of 5520	6064	msedge.exe	125
PID 6064 wrote to memory of 6116	6064	msedge.exe	126
PID 6064 wrote to memory of 5520	6064	msedge.exe	125
PID 6064 wrote to memory of 6116	6064	msedge.exe	126
PID 6064 wrote to memory of 6116	6064	msedge.exe	126
PID 6064 wrote to memory of 2096	6064	msedge.exe	127
PID 6064 wrote to memory of 2092	6064	msedge.exe	128
PID 6064 wrote to memory of 7112	6064	msedge.exe	129
PID 2092 wrote to memory of 5964	2092	WinSystemUpdate.exe	132
PID 6064 wrote to memory of 1196	6064	msedge.exe	135
PID 6064 wrote to memory of 1912	6064	msedge.exe	136
PID 1196 wrote to memory of 3424	1196	WinSystemUpdate.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\52f5o3tf.exe
"C:\Users\Admin\AppData\Local\Temp\52f5o3tf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Users\Admin\AppData\Roaming\Microsoft\01v1y37e.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\01v1y37e.exe"
  2⤵
  - Executes dropped EXE
  PID:792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\TraceFormat.xml
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9a34ac188,0x7ff9a34ac194,0x7ff9a34ac1a0
  2⤵
  PID:6672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,13078115178879226273,17834788311531900463,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1992,i,14175540969088447804,10176346019238297647,262144 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:6612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2772,i,3174756933197910273,15371526658176106262,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:13
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,14195869451051270149,1240767945439351343,2097152 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,15108983498845146400,10899075365065980005,2097152 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:6696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,15705497664387303319,8085668455833454559,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,3641689680546718324,14637491327627555042,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,2847470682023309287,10227522285095951183,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,2847470682023309287,10227522285095951183,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:6332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,2502687386598941850,5424627095191022143,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6560,i,18299248275934739029,1513930245390655759,2097152 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,6294162833793943433,13380141495978366432,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:12
  2⤵
  PID:6896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,3962905040102945760,5238572601653516069,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,15791362934512787778,16962823589369739141,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:14
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,792357786121541161,11095884929668366636,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5224,i,3330992412763948298,13389539111632257338,2097152 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5316,i,6916112465580370001,2473761561463115500,2097152 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3868,i,17661579849938309674,6679832824341828194,2097152 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5348,i,7415588141064313175,1848188017546462306,2097152 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:7124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,16463870587854015158,9139690208616198234,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5156,i,11646468090758801887,6386394293511658430,2097152 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=1460 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3952,i,4743866718987343934,14376009787969883444,2097152 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3900,i,14956500629331919394,15230462112322120426,2097152 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7784,i,7163819163207575420,15086852225893352380,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:14
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7748,i,13843852432052682417,7017033354727658589,2097152 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7560,i,1546801294861382042,11073584059304838860,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:14
  2⤵
  PID:2096
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Users\Admin\AppData\Roaming\Microsoft\3dccg0w2.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\3dccg0w2.exe"
    3⤵
    - Executes dropped EXE
    PID:5964
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:7112
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Users\Admin\AppData\Roaming\Microsoft\9ikrh5tg.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\9ikrh5tg.exe"
    3⤵
    - Executes dropped EXE
    PID:3424
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:2744
- - C:\Users\Admin\AppData\Roaming\Microsoft\pw17mbv4.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\pw17mbv4.exe"
    3⤵
    - Executes dropped EXE
    PID:3036
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:7000
- - C:\Users\Admin\AppData\Roaming\Microsoft\th9e5ecs.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\th9e5ecs.exe"
    3⤵
    - Executes dropped EXE
    PID:4792
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:7076
- - C:\Users\Admin\AppData\Roaming\Microsoft\wt9mnhsh.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\wt9mnhsh.exe"
    3⤵
    - Executes dropped EXE
    PID:1676
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:5416
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:5928
- - C:\Users\Admin\AppData\Roaming\Microsoft\zdi1yj96.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\zdi1yj96.exe"
    3⤵
    - Executes dropped EXE
    PID:2908
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:1388
- - C:\Users\Admin\AppData\Roaming\Microsoft\3yi8gmpu.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\3yi8gmpu.exe"
    3⤵
    - Executes dropped EXE
    PID:4396
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:6864
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:616
- - C:\Users\Admin\AppData\Roaming\Microsoft\9vqn9rm8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\9vqn9rm8.exe"
    3⤵
    - Executes dropped EXE
    PID:6620
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:6848
- - C:\Users\Admin\AppData\Roaming\Microsoft\cfy2sm2x.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\cfy2sm2x.exe"
    3⤵
    - Executes dropped EXE
    PID:6624
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:4336
- - C:\Users\Admin\AppData\Roaming\Microsoft\mw7o4u87.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\mw7o4u87.exe"
    3⤵
    - Executes dropped EXE
    PID:6828
- C:\Users\Admin\Downloads\WinSystemUpdate.exe
  "C:\Users\Admin\Downloads\WinSystemUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7472,i,3182763667738316236,13179683822788364136,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=8368 /prefetch:14
  2⤵
  PID:6652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3892,i,12191962493868230360,11113994538521430176,262144 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7936,i,14864805184184304435,17760142464980414120,524288 --field-trial-handle=2320,i,14120510670498040302,10167113967919019439,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:14
  2⤵
  PID:980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6848

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4804

C:\Users\Admin\Downloads\WinSystemUpdate.exe
"C:\Users\Admin\Downloads\WinSystemUpdate.exe"
1⤵
- Executes dropped EXE
PID:1668
- C:\Users\Admin\AppData\Roaming\Microsoft\ttfbx05k.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\ttfbx05k.exe"
  2⤵
  - Executes dropped EXE
  PID:6632

C:\Users\Admin\Downloads\WinSystemUpdate.exe
"C:\Users\Admin\Downloads\WinSystemUpdate.exe"
1⤵
- Executes dropped EXE
PID:6500
- C:\Users\Admin\AppData\Roaming\Microsoft\zqoyy52y.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\zqoyy52y.exe"
  2⤵
  - Executes dropped EXE
  PID:6664

C:\Users\Admin\Downloads\WinSystemUpdate.exe
"C:\Users\Admin\Downloads\WinSystemUpdate.exe"
1⤵
- Executes dropped EXE
PID:1992
- C:\Users\Admin\AppData\Roaming\Microsoft\6vwcr3zb.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\6vwcr3zb.exe"
  2⤵
  - Executes dropped EXE
  PID:1288

C:\Users\Admin\Downloads\WinSystemUpdate.exe
"C:\Users\Admin\Downloads\WinSystemUpdate.exe"
1⤵
- Executes dropped EXE
PID:4276
- C:\Users\Admin\AppData\Roaming\Microsoft\m9dl4g1r.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\m9dl4g1r.exe"
  2⤵
  - Executes dropped EXE
  PID:2256

C:\Users\Admin\Downloads\WinSystemUpdate.exe
"C:\Users\Admin\Downloads\WinSystemUpdate.exe"
1⤵
- Executes dropped EXE
PID:2948
- C:\Users\Admin\AppData\Roaming\Microsoft\9s2g2s8s.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\9s2g2s8s.exe"
  2⤵
  - Executes dropped EXE
  PID:1628

C:\Users\Admin\Downloads\WinSystemUpdate.exe
"C:\Users\Admin\Downloads\WinSystemUpdate.exe"
1⤵
- Executes dropped EXE
PID:6564
- C:\Users\Admin\AppData\Roaming\Microsoft\j9iae0du.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\j9iae0du.exe"
  2⤵
  - Executes dropped EXE
  PID:248

C:\Users\Admin\Downloads\WinSystemUpdate.exe
"C:\Users\Admin\Downloads\WinSystemUpdate.exe"
1⤵
- Executes dropped EXE
PID:6732
- C:\Users\Admin\AppData\Roaming\Microsoft\ii0z7ms6.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\ii0z7ms6.exe"
  2⤵
  - Executes dropped EXE
  PID:2536

C:\Users\Admin\Downloads\WinSystemUpdate.exe
"C:\Users\Admin\Downloads\WinSystemUpdate.exe"
1⤵
- Executes dropped EXE
PID:6760
- C:\Users\Admin\AppData\Roaming\Microsoft\51pudxz7.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\51pudxz7.exe"
  2⤵
  - Executes dropped EXE
  PID:6160

C:\Users\Admin\Downloads\WinSystemUpdate.exe
"C:\Users\Admin\Downloads\WinSystemUpdate.exe"
1⤵
- Executes dropped EXE
PID:2264
- C:\Users\Admin\AppData\Roaming\Microsoft\iv6w70ly.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\iv6w70ly.exe"
  2⤵
  - Executes dropped EXE
  PID:5496

C:\Users\Admin\Downloads\WinSystemUpdate.exe
"C:\Users\Admin\Downloads\WinSystemUpdate.exe"
1⤵
- Executes dropped EXE
PID:2848
- C:\Users\Admin\AppData\Roaming\Microsoft\zhn4cdvm.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\zhn4cdvm.exe"
  2⤵
  - Executes dropped EXE
  PID:5556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fbfdc6639449912c7c98b931d8190c5dc58f3c2a0bf5687e437a1f10d8fb4d03
MD5 0648a8cda5509f4d21f145a8d2e85107
SHA1 0098998314a76ff86c61b0ea846ab42ba2d245f1
SHA512 d12c9f38e4b1be9f515149cbec2d53104d76f99eb87ea993bf787c888cea28fbc81e79244b64386a0c5a5111415c57c4251ad0e5528252f3302570bd3971bd56
TLSH
T1C1D0C0513B2DB402C1241370841343706D09C503E333C10639BDA40CDC9A4C4F3C1543
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7250e4ddb51fa53ec8c4b9199831864f7ff3c5cca1fbf2e4e5086ae0576d31e1
MD5 d67d9caab78f31b2ab2ae61fc88b12e8
SHA1 c439af9d2a4c79b1936d0b654cdf2b2a6da22a5c
SHA512 f8e3ffb5bbcb1740ce2b25ded24b3be72c6285c98433cf97d12acea2ff455dd8da18d81f9348060457962fde88e3e33b5654dc94e329100848cdec215f571788
TLSH
T1C3D0C0513B2DB402C1241330882343706D09C503E332C10635BD140CDCDA4C4A3C1547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0b04dc0efda178e85536f42d9e04678377ee292127795943dc08180e884b2ef8
MD5 6ab02b29a8601d7be147d2f7c6fbbe70
SHA1 ab27bfd9b43fc2f35ef2d6312e5ca197bab80629
SHA512 1b44110040778e79f3e54bb3dc8b5b77fa1484cb5999058e44dc445e317de99df394247d6d37c65aa5b3a7f4cc26228d97cc9229639e6155a2480b58aad57e7f
TLSH
T1C4E02BEAD831DD3B1CFC171C9494074AEB51130B3B50945F363E8A098FF5776458582C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 58KB
SHA256 ebb08b319d907c206b43689bc2f49c05c85059d370b6f0c5d51c79c9e4609300
MD5 a6d95b98a3d56983e0bd78e800f9a5d7
SHA1 977769d02a114d447730d25e02f29151df8cb86a
SHA512 be36f9b0e4a5a08b5212682ba3f92f33d13bd5355335bba27be94a6ed4680088f0176e2c0d4b7316c9afe0946cfabe09e188b3fa7ce46cda8b31bac0b70e392e
SSDEEP 768:EoKYbxJfTuF4KzC9I+VSoUeawZbafQog74eqWLo8aSJ5Z4/LN4SxB/nRGZY/mJs6:M5FxolgfC7JLnaO5mR4SZGZYgs9qR7D
TLSH
T187430258F1D9F6F157AAB3F28C8E0538B964C623FBA40703E3653960A4AD427BB14538
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 45KB
SHA256 edc58c23360e9c04f563c8c507d83a67694cbdc8fa475a03c7d79fa3be823840
MD5 661dadf467cac708267adede0b7d1831
SHA1 259af59a77e3258a796d1af9bc93f61219a918ad
SHA512 d68973623b0fd000e67e4ec6472d5fe5ffd6b1a9fc22cf6bf97e40420ab3a1d9f51d51372759d40355b66e7ce5085bbd4fb131dea4e5d05c791ed38406b128a3
SSDEEP 768:SqqHB8vBzTpFNDZRtqxiFKYCuHe+bY8VKT+r9X/Akqwsn3RAzRhWX1YGH0aUTye:82tNH0xiFKYC0uyr9PAkuAzOFN6We
TLSH
T1E523F17311C18A8F28DE66B9F0B065FFE56BCB8A9D4D0C45293E277F350018F1B85911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 89e96307e09982732df1a3c8243ffa7fae9ef581363237ab785591cd55eff550
MD5 53f2326f883a4c33bf51d59eb8b2a3b8
SHA1 072f632ab96a50e07d54ce094cf2eb12fbd6731a
SHA512 d6b085c7bf0a341dd876912fe0c2fda81df0499c4d5043c7cebc7ac9034f93b130e7c80baf0cde7d62aa64d4300339300125d9ae9f68e508dca65f1e75473722
SSDEEP 96:JZBAke4lV33LC/82vMMjxIUd5MLyufRHkD0E9tI38KqmWM+Hn4xRLwWQujUoPudh:JZBAkeQVne/82kMlIUd5MLPfRHkD99tX
TLSH
T1C1A18442909D39FAFBD10AB4A4D018E937F61C96FE4B2E1253879DF4BC46F9294B3580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 101ac4a6470a37bfdf1797781d140c2bc24c6df7bde7f4643111174a6e8b1955
MD5 27e279d4fa76d3c9baa0c78e2e42e689
SHA1 59643d114e50341e030edb62f2172f972f3925e2
SHA512 9aa821c2b6b146dc83cf5c76ca55942335f44818f4d5c3a4bc8988f3f17846e16de7ce5dc52a7c116f17b045ab8eddb38505ba64a83b07c73ee051d458ccbd4d
SSDEEP 192:4hhG/k31YUdGamGfpuODaO9tlsKKFqkxr52pjUGd2jC9pXDMY6kY54nZvDaxNMpR:4hhGc31YUdGamGfpuODaAtlsPFqkxrgP
TLSH
T1EBE1CA42829868A6FBD01AB494D138F937F21C96FE672E1253879DF47C26F9158F3C90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5942cc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5942cc.TMP
Size 3KB
SHA256 e2858f7325aa735706f77417db6c82c23b3ae58b7b8288f64d543b10f0c27916
MD5 a8ca69f0386e9d06797580c65a95fa3d
SHA1 a0ea399fda2a69e5c9740e9aa035c284f25d7802
SHA512 7b9e71b25c703ac04164aa7506ea78213a9c0387a67b4b1683b63bb2f8f2706bfb38807b77238d64a57700e25c256b182f9adb64d58c7fb126221b97e1882b9d
TLSH
T15A615053C16D39FAFBE642B560D110BE37B658E2CE0B2E1163A755F8BD46F52A4B3080
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

101f0217-62fd-4a25-b18c-56c0a99caa12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\101f0217-62fd-4a25-b18c-56c0a99caa12.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 9a786d8822ec63b865ec5bc0846c3faabfcce6b498758bb24dda69d898fcbcbf
MD5 412a3dba52fa28016ff199285aac8436
SHA1 e6513ece09c645ee07d0f3a31fb356e52d696377
SHA512 fd35c7978a80f4c8cc3e1b1a8bfbdf55116d49faf2e50cee8f6da0f16e398dca294e01ae383fe1ff65f364152e78c767496630f38352436fd25dde23c1babbf9
SSDEEP 192:D1+n3KgVJjD11DWaVjhnE1j6VCHVetmDvHbmtC2Ijl1aFR8DnV77lnkM0MiA7KR1:D1+n3KgjjD11DWaV5E1GVCHVetmDvHbK
TLSH
T18B126AF787F4992DDD2252F0AA196F1FCF590524836C3C6AC5E4AE1693E2471E201B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 7db26842619379e4d37e25513ffe7b9e99b9e5fb01f67740914bb13374fed825
MD5 41636ccf2d933536a13b7c0238c55265
SHA1 f941286dae686bd982dd77b874b9b684dd736d7d
SHA512 edda9db88bc2e03fa7a109be2f73fecfe707dcdf5bf5c7eb5d9581348067bc65f57635b088e3ffe6835505dacd0c86025bbc03497fd6d4ada760c2ba3724c895
SSDEEP 384:D1+n3KgjjDY1leiR7qJJq1DWaV5E1GVCHVetmDvHbmtC2IjdaFR9nV7JN0Mim5il:W/qNZT0+aL
TLSH
T177527DF787F4996DDD2252F0AA152F1FCE5E0924932C3D2AC5E4AF4693E2471E201A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 40537ec8779bfae06cb4d2d8278d8b7321000a0d2a024a0a0e922410c14e58d8
MD5 cc55690806ae73dbcc66e9d60582ef42
SHA1 58986af1ea56c55732304c47c8fb61e3f1c76dfb
SHA512 9683d7fbb6a282cfbf869c0cdaa4699ca74171565d1ebf0d6c7d9522a0b3da9340a5ff8f31770e1d29fe222b43495fdbb89dc4eb3bc7b8a8072768cc9582c4ae
SSDEEP 384:sxRZoC7/fEsp5z7QH+c+D/5h/oTDfprgDHY:sVZ7/fB5HcQ/5VoHfJr
TLSH
T19F72F909AA34597B8DDBD219FA857F53D7F81563E2945E44AAFC8B0C00E7ADC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1c225f43456a98c2405b10e6f98d52c2ea843f5b5cbcd67181c2e6e2a202eb7e
MD5 46807c1759ea41017100aabdb573e0ac
SHA1 c74740af8d96ec09811a43bcf6960cf94f37c335
SHA512 4079b4afb89f232d5053102de29786df4669c430e572a20732b2ce41b209fab59ddd876156a879077c108dabfa684fad6548a12f16afdf3d250ec91821598fc4
SSDEEP 384:sxRZ7C7/fEspMz7QH+c+D/5FXDTDfprgQlHn:sVW7/fBMHcQ/5RDHfJtl
TLSH
T19F72FA09AA38597B8DDBD719FA857F53D6F81563E1541E44AAFC8B0C00E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 ed0d4da5495a7a2bc13e86b1f0fbf98af8dc55f5604596ffaf5ee4e294c90388
MD5 bb9778d0814b6238c4f2f68bdcb0aac0
SHA1 c224bd81faea176296ab847cde849e90d71b9db6
SHA512 b6ae7b97e291202b40eede251f42456b4dfe097ee2cebd937fa04a802d8e8631ec18979933f37cf03d94d7a96ecdbe10e12210cde621324f253a5f4da8419b1c
SSDEEP 384:sxRZ7q/57/fEspMz7QHFc+T/5rUXmL0VZnTDfprgQlHn:sV2B7/fBMCcM/5u40bHfJtl
TLSH
T10F82D817A634597B8DDBD629F581BB67D6F40563A2905E84ABFCCA0C00D7AEC2103C6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3c943d132aba4ba676e83a5d11349e1b4fc33869adb8bc9eaccfc5a24e27ebf7
MD5 dfe6bd87a8d7554ce1ca54d05cd12d24
SHA1 4452d6dcd4f0bd1e9e5b1b4120e58542c0579ac7
SHA512 72ea9c27e731d03b6babbfdc3147f127d5a683a10fdfcc60df200a87a0be677db3136a6851635f73964bf1e49460f74cd0c142de9a268491f37bf6143ffcac29
SSDEEP 384:sxRWoC7/fEs/5z7QH5c+b/5IATDfprgjHY:s6Z7/fn56cG/5IAHfJd
TLSH
T17962EA19AA38597B8CDBD309FA857F53D6F81563E1945E44AAFC8B0C10E7ADC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4a23f9de4f4860bb04447863c2411c851f8f1774472fee987831740c92b47975
MD5 c5f6334d7b6522d519147a9645ca7a5e
SHA1 65a6094479eb8a283fde1c47f815e4a1bcdf3ab8
SHA512 301634d6861ebc728a14379b1e674eee46f4f14c9f6bd17febee390e4f61c919902ebcfad709ace7d4826163a17452a60705e686986093d906af702d917814df
SSDEEP 768:hDiNNidNi/Jt7pLuL70DiEWg5Niuf+Xi08F1+UoAYDCx9Tuqh0VfUC9xbog/OVTC:hDiNNidNi/JbE70DiEWg5Niuf+Xi0u1s
TLSH
T1B5E2FC3B680CC77E4F844E9CED29BA9B6DE801CB96DCCD5447EA480C03C6AEB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0be1800eb31237d1b637c18beab1b482fcadc67e734ea919327b7ed6ae7c4794
MD5 b68cfac7e239a146911e0274ccc812b8
SHA1 e8fac7ba09094e350224817413b287a173407422
SHA512 d1dc88b8304fb1c5eff3847f77834c15235248d507977c8830adb85bf0e87723ba4bc282f946de65c47ae92ba9b069072a762c880b5f4934880588a004965d2f
TLSH
T157A002111A981177C4C25677A46643DD6B384C5542251311B1FF38E88E5064CC123718
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c886.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c886.TMP
Size 48B
SHA256 68429ad93e950851acf59083d01ec3e45b2710e38cdcebafac1399cc91dc9ebe
MD5 f1efe94bc3c7b26a208367c89fd1a372
SHA1 3d6ba508a333b9a2481159c03b3b82228a09ad2a
SHA512 fad252a41a21d57f35c857b3007e2a6b1dfcffca76ed8d344ed2ffeb35689d15627814b840aafb398f405af60deaf642d4731cb1371750cee30b5f5ab2142182
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f787c75f5a031daee311f0b8dbbee1cc1be2be64b22d93cabc9741f9b09e7620
MD5 2f1bdfa3bdd44cb63ca727fb527c43a7
SHA1 5b8f546e8e00495df8ab0cf93a498d6b21481496
SHA512 b7e814a434a5cebbb9aa0ea13a914411b63a80729431257da5a4319af6b933e7a23ff4ca0a490ac1efe645be2add182e542b95bb140ae083c8e7177d7cdd43e3
SSDEEP 384:TFUxVXrvC7WZd5J5PClV2Hlftp113RFJlbDNOzD1L:TFUxVXrvC7WZd5J5PClV2Hlftp113RFk
TLSH
T16AB23911797E224138FE690CE195952F234230B3701AA63B7BBD60E60E67E015FFD9E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 16adf00f90c9797f3b03713321a7c6b3ec3fa9e4707f9b87c9a2580aff2dd7ae
MD5 83f714d302bee305ddd0032be64bc739
SHA1 c63eb15f37a3c70681cfa6b87c86fd27898f6e79
SHA512 9c315c057426b6083430d35afa2d8acde90b6234185d7e992d3ad03a8ffecb98544736a5240f7e0fed3f1babf5839d21a6d6207fddf37fd5ea3a40c7b482673b
SSDEEP 384:nCiF1tNn/s3n9SM8Nm8TUNTUlIRxu6EWuRXfLF1LKn88NndMkyOb282MbdbJC8LP:JF1j+9dvwgqmu1M88Fd/72ixjvX
TLSH
T1D5C25B75D860CE7BADE68B89B74A77479EE011A384C85EC8D5D86E4C00C72DE074BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 2039c0553ae105ec22a9f2e3c14747f32b3189fca239beb7659a4c07be2f0cbd
MD5 2685aa1a1157a82ccb554f5f1579e7c1
SHA1 836a88081c3cf1ffedc08ac83ead5078141ea454
SHA512 6c5b45d3c8d6d881b1573ac9790d6687e7139a865fea966f4b1376074acfb7cccf9de16a6437a5850a1bd64d1ac0a70bd39e5b5ec327a04215d0fd7c363c7166
SSDEEP 384:nCiFotNn/s3n9SR8N18TUNTUlIR1u6BxuRXfLF1LKn88NndMkyOt282MbdbJC8LP:JFoj+90kwgqyu1M88Fd/N2ixjvX
TLSH
T11CE2B4F594D38937D8AE4787A77D2E469ABCC163B4885984F7D85D4CCC822BFC70A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3d6974c787b631a17e5483f3618b1657a31ebbe3fa726379157f92cab58b4f02
MD5 a5c919fee7f000a01c901938b1d7fd30
SHA1 3b0edd35d65abe8ef2f03b00778be2eca1818836
SHA512 5da725f45139e1007085b4f11bc11e375c1f2369aa3e30ef842baafa5e5e3bce098d980510edc85659d1dce7fb413461ca7809ee043cddec5b84457b59bd7553
SSDEEP 384:nxiF1tNn/s3n9SN8Nm8TUNTUlIRxu6EKuRXfLF1LKn88NndMkyOY282MbdbJC8LP:YF1j+9wvwgqau1M88Fd/42ixjvX
TLSH
T139C25B75D860CE7BADEA8BC9B74A76479EE011A394C85EC8D5D86E4C00C73DE074BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1363cbf9944303565c00453f4f1fc88ba6087a67809bfd05b4a11bdfd73438a4
MD5 a18b92ea7d2e9028683c80b7b7f97f57
SHA1 e17fc447f28118e3e9de860e6ffc089de1bed478
SHA512 6b08de2cb6fc2545106605dac7800a3e42ec09273e98c39aab2cb8f1600b25f027f697928aaef20bb9b2548233f710d001fcc46e6f1396bf4fa5a649f344614b
SSDEEP 384:nkiF1tNn/s3n9Sd8N98TUNTUlIRT+u64VjRXfLF1LKn88NndMXFITGT0IK8Lk1II:/F1j+9YUwgdh/T1M88FdUFi+0gvK
TLSH
T19AC23A76D864DABB9DF64FCAB70A7746AFE011A3C0D85AC8DAD85D4C00872ED0347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3b8220ad5861f9b98ea931c2ea564b563ae572e797bc6590c9f15ff8878ac2c2
MD5 cced68b7093529179a7d0d9f98798038
SHA1 8c79f99cf77396984456137119a24c6c57d5237e
SHA512 f6369b38e300c391e971161ac744cbedec364b71d661d83edb13d2aa53125ce81b78d43099a4fda8beebd84edc7094c90c7d2cfd470ae2b9e9ec1e9b1c0c83fa
SSDEEP 384:nxiF1tNn/s3n9SN8Nm8TUNTUlIRTu6IhuRXfLF1LKn88NndMkyOY282MbdbJC8Li:YF1j+9wvwgEXu1M88Fd/42ixUvX
TLSH
T18CC24B71D861CE7BADEA8B89B74A76479EE011A3C4C85EC8D5D86E4C00C73DE174BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4f158867d5c68723f24b5bc297c0cd1192a36e3f7b9dd201801b4b5327668380
MD5 deeabf8388df1df4dc524d9e7f3cae35
SHA1 21b800bf5face1d60761c5c5531d5c12977d10c9
SHA512 9990261009e6c02500ca9d0afa03ad5b6220e753ad72a10b3bd5935e2ba28bc00806ff2b8ffd45972f4e66266b99ed9ac7155f085c7e3d3c809eedabfb9fd227
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a3741d47c85463f2a257f6d1d54337f9bc40a672627119853cf93344712dda3b
MD5 7f413a33738e9e15b977a398bca94f2f
SHA1 9f771857d63e4fb87a0f4637d31a7bf9d07edba0
SHA512 d88f06be74b7ed3ebdf3e7aa1c651a73cbaf512c3cc17dba5647362ae5869a48c66c4615735e309bc8fdab4c4b32a809f691b3821b87d2240327aa61a4ecb151
TLSH
T1E9E0020273444297C026037140C71A5035F28060036341050D1002644C163006D21654
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 70dd6524218bf3d3ba7c8bbd1bdcbb65e2b2027a1023d39a58c42c70c71f3716
MD5 07f18cefa317de1c22a36d8b5affb7db
SHA1 cee5b3766f1501cc43d4f9e6581dabc2e67ec6f7
SHA512 2168da36066717b771dffd9576c571ed10b5a202a30af4e61713dfa9d2cae457b5456377132008e66e7c77f1088bfce4eaaf33dce5e3310fc226dada0e873db9
TLSH
T1032140E1583C1EC2D47E0CEFA05B29EC94E8C226F5A4343D2C98EC98563D65E268087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 200cb5e659ed59622a8f8b57594e80e1bea4c75ab1b93885b1615da12092430e
MD5 1e7e60ceaf8e7b28af7f83fc4a48b9db
SHA1 b2b499b0465cfec49a916eb29c6efe9364fb1dba
SHA512 88ea9bcfcbccf5db3d365610a9fc7e3a78724929fb1a1f65016fcea042452531db4f10e726935872494ae06b747ac7817f40cd54c086d1bc6bf91e974539c1f2
TLSH
T1872141E1582D1EC2D47E0CEFA09B29EC90E8C215F59430392898FC94563D61D2580C7F
MD5 SHA1 SHA512 TLSH

Submit Download

01v1y37e.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\01v1y37e.exe
Size 276KB
SHA256 1bc4bfd72b3b21e446266e65a55b2ba0857d0ad37280696e7b147adfa3706d22
MD5 e49835aaf0e4fb90e667996257d9cb3b
SHA1 ae27b380f903c76c951367ae5d4a84e4710d6754
SHA512 79bc6b32dfe18991378728dc399efa8e3cf4c426c3815821508aa71fc4b65c1171be1c4d3e3202202a124c214817f5678ead6fa065a084bdd05b6801ee02264e
SSDEEP 6144:pxhixu3VMA5F/GkUTmS4SXPY1pP3+b5YFYABS5:p/ixUZjGk4BS1JK5r
TLSH
T17654AE09F6A908FAF577C575C9520902EB737C8647B0D7EF0B9049968E136E09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download