hxxps://forum-minecraft[.]ru/resources/catlavan-client-1-16-5[.]4323/

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://forum-minecraft.ru/resources/catlavan-client-1-16-5.4323/
Sample260623-2kre4agy4v

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5272_2056801143\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5788	msedge.exe
5132	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267279434721162"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{AFEAEA5B-92E1-4653-8950-C0384B06286B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{274D2342-4128-45E1-9EEA-09F7669C95E5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5272	msedge.exe
5272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5840	msedge.exe
5840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5840 wrote to memory of 4444	5840	msedge.exe	88
PID 5840 wrote to memory of 5132	5840	msedge.exe	89
PID 5840 wrote to memory of 1740	5840	msedge.exe	90
PID 5840 wrote to memory of 1740	5840	msedge.exe	90
PID 5840 wrote to memory of 1740	5840	msedge.exe	90
PID 5840 wrote to memory of 4756	5840	msedge.exe	91
PID 5840 wrote to memory of 4756	5840	msedge.exe	91
PID 5840 wrote to memory of 5728	5840	msedge.exe	93
PID 5840 wrote to memory of 4500	5840	msedge.exe	94
PID 5840 wrote to memory of 5728	5840	msedge.exe	93
PID 5840 wrote to memory of 5728	5840	msedge.exe	93
PID 5840 wrote to memory of 4500	5840	msedge.exe	94
PID 5840 wrote to memory of 4500	5840	msedge.exe	94
PID 5840 wrote to memory of 2236	5840	msedge.exe	95
PID 5840 wrote to memory of 2236	5840	msedge.exe	95
PID 5840 wrote to memory of 2236	5840	msedge.exe	95
PID 5840 wrote to memory of 5236	5840	msedge.exe	96
PID 5840 wrote to memory of 5236	5840	msedge.exe	96
PID 5840 wrote to memory of 5236	5840	msedge.exe	96
PID 5840 wrote to memory of 2544	5840	msedge.exe	98
PID 5840 wrote to memory of 4348	5840	msedge.exe	99
PID 5840 wrote to memory of 2544	5840	msedge.exe	98
PID 5840 wrote to memory of 4348	5840	msedge.exe	99
PID 5840 wrote to memory of 6108	5840	msedge.exe	101
PID 5840 wrote to memory of 3668	5840	msedge.exe	104
PID 5840 wrote to memory of 3668	5840	msedge.exe	104
PID 5840 wrote to memory of 3668	5840	msedge.exe	104
PID 5840 wrote to memory of 6096	5840	msedge.exe	105
PID 5840 wrote to memory of 6096	5840	msedge.exe	105
PID 5840 wrote to memory of 6096	5840	msedge.exe	105
PID 5840 wrote to memory of 3000	5840	msedge.exe	107
PID 5840 wrote to memory of 716	5840	msedge.exe	108
PID 5840 wrote to memory of 4448	5840	msedge.exe	109
PID 5840 wrote to memory of 5664	5840	msedge.exe	110
PID 5840 wrote to memory of 5664	5840	msedge.exe	110
PID 5840 wrote to memory of 5664	5840	msedge.exe	110
PID 5840 wrote to memory of 5852	5840	msedge.exe	111
PID 5840 wrote to memory of 5852	5840	msedge.exe	111
PID 5840 wrote to memory of 5272	5840	msedge.exe	113
PID 5272 wrote to memory of 5552	5272	msedge.exe	114
PID 5272 wrote to memory of 2808	5272	msedge.exe	115
PID 5272 wrote to memory of 5788	5272	msedge.exe	116
PID 5272 wrote to memory of 2808	5272	msedge.exe	115
PID 5272 wrote to memory of 2808	5272	msedge.exe	115
PID 5272 wrote to memory of 5648	5272	msedge.exe	117
PID 5272 wrote to memory of 5648	5272	msedge.exe	117
PID 5272 wrote to memory of 2424	5272	msedge.exe	120
PID 5272 wrote to memory of 1144	5272	msedge.exe	121
PID 5272 wrote to memory of 1144	5272	msedge.exe	121
PID 5272 wrote to memory of 3164	5272	msedge.exe	122
PID 5272 wrote to memory of 3164	5272	msedge.exe	122
PID 5272 wrote to memory of 5376	5272	msedge.exe	123
PID 5272 wrote to memory of 5376	5272	msedge.exe	123
PID 5272 wrote to memory of 3224	5272	msedge.exe	124
PID 5272 wrote to memory of 3224	5272	msedge.exe	124
PID 5272 wrote to memory of 5028	5272	msedge.exe	125
PID 5272 wrote to memory of 5028	5272	msedge.exe	125
PID 5272 wrote to memory of 2160	5272	msedge.exe	127
PID 5272 wrote to memory of 2160	5272	msedge.exe	127
PID 5272 wrote to memory of 872	5272	msedge.exe	128
PID 5272 wrote to memory of 872	5272	msedge.exe	128
PID 5272 wrote to memory of 5084	5272	msedge.exe	129
PID 5272 wrote to memory of 1192	5272	msedge.exe	130
PID 5272 wrote to memory of 6100	5272	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://forum-minecraft.ru/resources/catlavan-client-1-16-5.4323/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffbebcac188,0x7ffbebcac194,0x7ffbebcac1a0
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1668,i,17990831705235515267,6362630123385766621,524288 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,13151653169670454543,5658472491433624501,262144 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2060,i,7801186051305891045,17624575612923329878,524288 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:13
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3664,i,15602721421334180674,3091772833215465219,2097152 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3684,i,166217024406469013,9498056563619029198,2097152 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,8556208924469402116,8521558039482358839,2097152 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,464811164806870065,12157549562882304508,2097152 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:9
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,6447837341664196247,11933915377840392761,524288 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,12841225836812709973,8241716745833610497,524288 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,12088594442332345118,6054940619904577460,524288 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,12088594442332345118,6054940619904577460,524288 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4324,i,17634901588980882209,17919162749836553686,2097152 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6536,i,3046290393895678815,17697342024714584298,2097152 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,1522629147770371321,14620928952221680572,524288 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,16031790840821357010,16045455477270183141,524288 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:14
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,5400915687354140445,13816590418187351215,524288 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6212,i,6741288568213692299,5736779968268687545,2097152 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,3937410774799985751,15344097521970638926,524288 --field-trial-handle=2244,i,8724047515233734699,7969457837753805969,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffbebcac188,0x7ffbebcac194,0x7ffbebcac1a0
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,3981649376277956314,16499323302379691758,262144 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,13822659627977236350,18279280308579683407,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,596069608409512592,6175004281721695675,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:13
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,16318613966011484416,17251297683720753295,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,16318613966011484416,17251297683720753295,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,1472259615603343009,14437840380138508353,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,3339730665845080558,4355833132246278253,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,1004604931622512463,12905317919516898087,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,15826416594343779127,6943838900964158093,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,14836874571857933133,4527785777397568849,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,13033035930082812462,2141176691937724923,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,2225739141609742642,10625862607824267507,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
    3⤵
    PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,14552563210130777339,9734462151985363332,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,6789975003490896633,4062425772327145751,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,10363573347904125998,17523541754830888632,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,3321243353723832243,15278690263273165991,524288 --field-trial-handle=2244,i,8756287935058983697,6328061697662813043,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
    3⤵
    PID:620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d95af56642c91bd0bb694f30e011d8793561b38a6715826cbbcff4590dba2696
MD5 d823c7941df73093f8773343b736973f
SHA1 de303bf8f71a6ab37b3670ffd5fcc5067fe9857f
SHA512 725c3abe1b65e03da225d639e618c40c1e3171cdabc49d3d808d7849a4dd931467209043f23fa62f5c4befe5ca915815005ed1c9aee8ba098dbe8a1b6d8e776d
TLSH
T18DD0A7683947F449D21910F199254B24675A984376629202E4559C0ECA8B4A412D64C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b778cc535cfe9ef8131b9d727f221c5d63c7f15bcd4cd19db345f2c97bdf5594
MD5 a4b8f3b6133ca4686118d40b6c8d4ea7
SHA1 cbca41492cec17181764c1371da84a0e0481f93f
SHA512 65135f099a2e372c9a11538ad8ff73abdfa24612895545773034b613318a9166b5560e41026d2ec245dda6b088efde1566126dae35182ddcb3fe795a786554ad
TLSH
T1B7D0C0743F42F108C04904F08534EF101337B81230839900F070C80E84E40C0A3C9053
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97eadd050b73ba3a7664e2244bb13a4ca60ae80af51a8693198269aeb45ff789
MD5 27c89d9be1305ba74dfc64bd0df7b888
SHA1 269d5aaf853060e68e4981b47b6f27ef42a7e9d5
SHA512 3b5b01a1de0f4f32d74be94bb760872f247eb83c711ef248f0e9bfab221382aae32148362bf5d01d4a0c409e69a1470def00111f5601ad135b529a49fead2f77
TLSH
T190D023157D47FCD8C11510B1DB354F1467579426B3D35103B595B81DC4CAD9862C6D42
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9bb1d4698ea9a20de22150ab995b3af573098253a0afce98383cca2e91a1e8a2
MD5 3cb6cd78a8e4655d903f4b41f23ee055
SHA1 4a67a956ef31595baa43f319861cca9fe37490d8
SHA512 2da711bfd9ee3b5ff214002d6e2c4f73c487d71c4b813085a4c963de07f38fc8dd233436f262df1ef42ca0963ad5d54bbd2933785e264b6c1d9a66b6b45a46c0
TLSH
T120D023157D47FCDCC12510B1DB354F246747942673D35103B595A81DC4CAD9863C5D82
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b4edbbe62f29386512f6cd1726c675b23fdeee21a26a2896a394ff9b87143167
MD5 c0060c375421fc206e85d98fc2ea6677
SHA1 2189b0dd881564dfef39585cc2cffda4dcd3ec91
SHA512 338dc8a4791fbbe759582d4a8fd55c1a6245fcc722bff11ff926118daa91041d62e98b05cb2e63b22ea119d41a557c511dcfb12592ab416dab9980af0b5ca713
TLSH
T1F2D0C0703F42F008C04904F08534EF101337B81230839900F170C80E84E40C0A3C8043
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6f6530b92653305a53f6f9d5e67ce58799e69000aa44d025208506ab6044b54d
MD5 81505f96d8cfd4aead9497c0aa35aaf8
SHA1 7f8b145a26edea932aef947959d671824f394da8
SHA512 e007952c7e4d81ff5900333cbf2b87643da3ccfd08a1fa013938ccec259c4b49d2df0938a2d8a4ab33dfdc5a8b5933fd64196d0bb6ef034078c9547e6fcba513
TLSH
T1EDE02BA6C811EC2B14FD075DA516574BDB4123972B40494B7A3C820DCF7477A4686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 fddada0bb4e05255c0e300862a22d66d81ec55ad9955a1e889d3ca24185ac2bb
MD5 555c4bb3352c6624ca0eec06d26d8096
SHA1 828a536cdf787eca8c73e68a5fca02e07cf13d6a
SHA512 ebb0a5be88c5eea113544c9a3cf0783ae4bdfdf2dc8ed042beeb913e6be72fa2e2431458d746f9a8fe1f0be6e8303d64c004b5f438abefd1ba9e632f2a929d39
SSDEEP 192:PExOFrhpcJ2o1rDsSB1EYEYKACVU3jP+MzRnG3sKv+aFGDeYv:PEkxOHJDPB1EYEECG35RUsKGDeY
TLSH
T1F8131A7DB6948C26E6D378BD04071B3A77B9E7A4CCC42293537EB4B0836AB854D4F5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 4defa3cedc71440c4fdf5aec6c63778c2247daccd7483a8420a41ac37c2529bc
MD5 95ae1599a73e5522aa428846229ef970
SHA1 e6ea1df74a22ff99dba8fa770da824ee9882f4e8
SHA512 ed6d79f244ae6dd6a80f87740f3129a4e785eafdf8eabcb709408d2299eb7ef2d27ae3c92c0b873dcfdebf7e3c6830278d5859ce5f7aa470d171b9e40f07ca0c
SSDEEP 1536:5yhL/QVL/w3stUucAgyoXa3F1u9gpOs+RL/0Wmd+MHL/wL/k:5yhL/QL/GkZDFKL/4L/wL/
TLSH
T17B4450F71951A00BCBA852F5D2133A3EE17B425D7CD1F8E9E63C4CD52829B21B6BCA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 3916fbe9e3eb2c346910e516e2bb3c25a9399c8b3588747fb4365e37dbd36157
MD5 06b28c7e5a7005d436833e39851a53bd
SHA1 78acff2d2f17fdb7bc1defa5b142240db8db7b9e
SHA512 38d85c0cbf9ec67b68cdd8c1869be6ebf35271cd20eba383ded5ae00908c938fc0dcbd2e4696661148334a8b311a643ed0a2326a24f1f4781f6e48a30f73313a
SSDEEP 3072:Lv9G+6tjGarS+HZdicWoj7iOWvDkg5mtP:LQpjGgSyd04Ir0tP
TLSH
T1042528EEC7682C93CE6B8770B0E0D9077E712183BA58D0D39944C5D997D6B8176E82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 664e22bf319cce015814af531939a68816e0a39d3eccdb76e13ef26f10aef406
MD5 81cb3c031a5c0153172971003c16b5e7
SHA1 491d2889784789094cd22aad41f0726c570a6014
SHA512 8bce8a853f9bde685c757d842f1cda99383fc72ef4d4f9a85657df7e2cb1e75c98b1c003678d130fc59c7370ea60645e91e9e26b2a436f9685ce7d68793151b5
SSDEEP 24576:xyKnGsPoqhxYsvZMW1xElsAcE6VZnPS1Oz/E:xvnPPo+mQOchvPS1OD
TLSH
T1CA167DEDCA7858C3CD639A70B4F0E9477C7413C3F994C1D6889CC584026BBC5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3d0576580befd9bf45532a9b55b2dea2cc6b7fd6a30956517a7c5156520a4175
MD5 c016b4ea8b52b3e5de927446aa15934e
SHA1 2943ec94c980184405706c3c8d1ead1d8b7753ac
SHA512 36fd32e2b0ae8db4eec0d7eae45cec63d5f14c5867debfc653e9c05cb3dd8c437e62f6cb09210c13b8c42bf3c9f27649241b87a82a188fffb0c107a1f7496a49
TLSH
T1AA711B246962CBA5EB6BE37471C21CEF33B4E0D80D0B2FA00BD07230C56B7C86030989
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5951cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5951cf.TMP
Size 3KB
SHA256 be013b8f043539f39e3b29a078be60ab6a990b90d5866825e46056a06409a5d8
MD5 919fa92ae80e58f637cf9eb2eb1c2728
SHA1 766fdd4c74b4e7b84976e64a9acc8f59d32f1105
SHA512 6bb9dbe1464faa2914ba7ae871cd43fbb5f0920d7fc4d69a88bb1500adfd2c962edef4625b9b7ad2154fb81cbb856b536e6b2378028f68027cddf5c23921f076
TLSH
T1BC71FB246962DBA5EB6BE37471D21CEF33B4E1D80C0B2FA41BD47274C96B7C96070989
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 f793409f74dd2eda127c788c42a4b827fb6310690ca4b8a7063befb11f32da5c
MD5 888d8f7f946259e454a15af6f2757fe2
SHA1 0ac05915afdea6497f839482f526673cb0664bf1
SHA512 4fe34d68a8b1cceb9fbe3ffc2a32579f645d45230586c57809c487dc5ef788f9335d4d9e93dcfcee67bd263b689f691337b34f0ee19456e0ddba47ca4b6e25bb
SSDEEP 3:MsEllllkEthXllkl2zE/lP:/M/xT02z
TLSH
T1594402046B901406C5002530405183A453B1E5A416526743345114729C996440C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 789ee2f841d0a8f7bae8605640f6b861b223ed5214977614db0623ed84aeb3bc
MD5 593da56d7cbf68b90d3abfa04ef347cf
SHA1 52ab764729de58dce9741e51d53c8cd3edcaa0bc
SHA512 5a303e6e2bc2b749704facef92f7b2138ece7bb5e4e6e374a1892b8f575fde63a5bb076a0af498c1aaa117f28e828c5e50d442c71e70bc443b32e450fc9067d3
TLSH
T166E0D89598C6D26D6D5038B241387B18D2813857E787AD07179888C57A42255F24155A
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 4d49081bd39cac7ea2ddc8cb29ddf10c9f8ac6b4a280c15c4db61afb3404cb8a
MD5 bb3fb58353d2f440a1c899a19decbe7c
SHA1 2ff5e72e80b2f41f4f22431a04f3dc05fe56a830
SHA512 f2303550fb8e9c3650f201836f11b1d6e3e069894c3e7fce1ef3aa730f8c22973b002b7699b47643f31dc9550ef0ba01ae29099ebf3a93bfa0d057616362e159
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfjbY4PW5LutFtIks0NVqYpkn:TtD4jJ/0UC+lf5PPWxaFOks0VTpkn
TLSH
T1EFE29E8C3B11F511C4EDB37EA1D2C5E09ABC682C4A4DB171923C9D768D62562F49E11A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 2cfddf5df6ea00b93f49d976e7455296b68ec5373318b2372c9c22c6447b37d5
MD5 36a5bd6e41cc173ceb891a6d5ee00f53
SHA1 adf337cb56704c5147e0024401e6cde109aaf7f3
SHA512 82dcde06b4abfca49328824d7a574400ccc3d20ed80c418a33b30210abf2b336ecc3a5dd705ea75cc17e25d321c490c2286578a65725e2338b8f0682bef554e6
TLSH
T110E0260848CCC3299A94689782BDF708D2D0340AA28B3D462B5ECCC46122389F287280
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 c17bc2fe58aaedbbbbd0d5bb812841223e13a3b0a7056ba97cdf34bddebdeae4
MD5 c6eb6e8bdccd48f142523da95922cd41
SHA1 d4524576f8243bad898a34d94315f1e12aae267e
SHA512 065c2d2cb77cb3006775f4beea4882e52caa6a04b860acd674f1e3c1662e4aa565c8f09c7e5c95f3770a4324ecfe7f628019d551b267cccb79f624f4a4a78373
SSDEEP 96:y0bFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqrn:y7H+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T17424EF4E5F342722CDBD913668E744A35C7DF03F8B5366DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 19B
SHA256 ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7
MD5 0407b455f23e3655661ba46a574cfca4
SHA1 855cb7cc8eac30458b4207614d046cb09ee3a591
SHA512 3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 037dfd29bf6a75cef90c906a9a268524e34f22761256139540032fe99a49c52a
MD5 0bc575102e0c0e37dc9250d870326b7b
SHA1 77e4fce3e26fca33815154adac522561e2e028c1
SHA512 a9edc3ee255504fbb828a9229a991a214c174035936e0e2418da7d053eb7d0b414a57803070045a97c9354abeb9a4cfed8c6c85447585a4bd0d35885b31cfbc4
TLSH
T1CDE0686081CDD21A1A043087823DB748D3F0300AD68B3A061B08CC80B402184A2A31C6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 6fa660bea42dfea294c94f5343fcfe623217d0f1e58771bc7d81dd09c2c9cd03
MD5 ff78b7463e3d7d17a6f1ac54fdae2521
SHA1 f46d8a0eb648f2f74e73813e879e2cb5fc4d1b83
SHA512 944c7de05d7a74ba527faaf4ec944ddee19e04571b8bc82193e54b6ca1cbf99af825004e70bfe6a9f4445c43cd681239a496b41d82bab8cda6fc54f8c16c3b6f
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7olJwf9go5l1aSd7:qDeMatha9RApJm9g61aSx
TLSH
T1D3B2414D2F347211D1F45B73EDD085632E7C501D93B32A8A9E1820B3CDA26ABF6065AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f4d04db548079515a916bd23c7e07763778285f6b2653da7250d865a50a69b83
MD5 01357ce53c74a8933e3afefaf83b1459
SHA1 6f2bc90a5d67a23241f047f4c1d0b3739b1de325
SHA512 95bf14b532b1cc9c4d8ef66160421cbc94224fa285f61bbf68206e6cba8fe239fec5d1ac6b54fb24f12f8a1a6f2c03af99fdc72c2d2560dd49dcc36cd0fbdf57
TLSH
T10741BDF3C3E8856D890156F4BB187E2BCE1D0915832C3D5A89E4AF5BA3E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8d59f7c80c79186f9f0bcb93a1935394c70d6cc0dd03d5d2061644e46e69ce70
MD5 7b547f80e04aa4026687dcad38edfc06
SHA1 b0bb7dc8ee8fa91261413b485ae0e0146c569797
SHA512 187037c26721bf02449c867015a3639dc57bb8f990c8b320832d744314fd17d0fd908ffd788c93e6d0784761dcff223fbce9ef1ff947a6a938a712d02ae98441
TLSH
T1B851BDF7C2E8856DC90196F0BB14BE2BCE2E0954832C3D5A88E4AF1B97E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 186B
SHA256 b22054735bf34e687f797c25f81bc8a23cd624c51b37bf7d33074163b7cda7e3
MD5 fc3c1b4defd4cc0105586c5c43e3332a
SHA1 475a706e5b2784e30473e49975838ff125eba838
SHA512 e445464b2e83b0f34a038fedd8d13aa91e3f944639a9e49d0c3aaf1e99e526861d5e3798884f654fa08811f906db2d54135e7953178c29e0e5d7fdb2510e54c7
TLSH
T139C0226280F8E0322025083D5EC46881AABAC030100294E1E894C37CB0811B75A26029
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e5f48307c118619949adf36aefab85830289287a2cac5d3a7c96ef368f914a54
MD5 dbf7aeb681c70512a876920783ae90ad
SHA1 e13173bdf7632ba8747c4b29187054a656dcdd8c
SHA512 250434bbdef92b68781dc2f936f37118cbad68cd0d462d597020378cacd42d074638bbec15a46dbe43773c34597177910de3cc7a57143bbbd70ff25f72ea925a
SSDEEP 192:sxR3R8yM/jK1Ml8wFO/fZss4cGqJzoA8pi/g6+WNIYYMzYuqjGrIgIJ:sxR3SbO/fZss4fti/5ICqis
TLSH
T14D52D8156628997BCCCBD20DFA55BF53D6F81563B2905E44AAFCCA0C04E6BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 493cf87ea657423435bf94e34eafcc0b48321acf24ed7a8f3ad84b040356b9f2
MD5 55120c84293eb6530d8ece251a159dab
SHA1 cc42fe027896be947232f6d17d28f7dc1517ba54
SHA512 4a8eef46331f100fbc085a4c9de11810af889971088b1edb06afb188a47f9cba7fbd24824c2a3ba66c58ffc66f4faeda042e8523c6f183bfd8d562864ae4242f
SSDEEP 192:sxR0R8yM/jK1Ml8cFO/fZseWpVEIcGqFzoA8pUW/g6+WNIYwMlYuqigrIgDjJ:sxR0SRO/fZseWvEIfJX/5ICqXR
TLSH
T13862D916A528997BCCDBD20DFA557F53D6F81463B2905E44AAFCCA0C00E7BDD221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 09eab7f0066ab3ccc23bb94b1d752dfc5a0d84459c3c8b7b8d1054098058108e
MD5 eb3a82e1332edd43a37f496cb9042079
SHA1 eebdc7e812980be036585f1d61fb4c840a46fc16
SHA512 241710f11470982704212978f06455750478c61fbddca4624b554dfb96412914511ea232312de1a315bfd156cc3781575d7e9b849dc7d3b8f7686c6c09228950
SSDEEP 192:sxR0R8yM/jK1Ml8wFO/fZsg4cGqJzoA8pi/g6+WNIYYMzYuqjGrIgDNJ:sxR0SbO/fZsg4fti/5ICqiT
TLSH
T18552D9156628997BCCCBD20DFA55BF53D6F81563B2905E44AAFCCA0C04E6BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 32874a3426fedee015c859bb6b30e2fe18c35018ddb25d2737360aeb5e25690b
MD5 b71dcd639e99cdbfa2323ab2e9a04058
SHA1 fe21d3529602f3aa649887c2d4f6c5bf297558e8
SHA512 d46a0078588e0552cb473711f72446f265fcf498c6448d37a36b1e738f90745cdc3d2cd59603dae20d86ac06d2f343ef9eb9ef248a8ab88a2f5c1f6d161b9194
SSDEEP 768:j+8uI7WgNVfq38F1+UoAYDCx9Tuqh0VfUC9xbog/OVbBJ69rolNt:j+8uI7WgNVfq3u1jaaH62lNt
TLSH
T151C2FC2F640CC7BE4F844D9DEC25BE966DD801CB9B988D5447EE890C03CA7EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 d4f8ef05b027745e828b4c34a94a3dad3d8607aca4ad4b56df41de86e1093868
MD5 b7fb0e0737830b3f92fdc44e52352d23
SHA1 99888cbc1adbe8e16984efa0b470440192d6cce3
SHA512 b4a0f5860d11358253abca8ff07c645a8f814aaa589f865c1f23697f9908d227ecefe6902584ed75f970c0c37c5d3c9c5a1fb6468b8286fdf86411ea50ad1158
TLSH
T18FE0269045C8D2BDA8672447422DAF08A3E4B40BE3CBBE0B7FA9C8C065836C5B193580
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 100B
SHA256 4dbf2d1b5d588473b24d529c3e3230f9a60f6263e9a2a786df23a2e853d587ab
MD5 2477c2758abde4b15f658d973277318a
SHA1 4aa8a2f8f4e671e9cd5636467161e07277603708
SHA512 ba301a664e5590f2fca6c87a7f6778624c059b5df3bd01ff5df5642c18532fedf1c9e12eea2aab6a3ef0065764f35447f6b23a5facec0228c6be985c13f35827
TLSH
T150B012007B44C003C5024CB00D44DF007322F4160410021B48208F211F427FD3D41C83
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 2b5e0a3e700e596f6f4c79219bcdd54b39dd6647afb175cf17ed736df9060c01
MD5 430688ed74fbd661ae57895fceb43925
SHA1 364ad7d2d73cb058253ea57989bf0a399f56b9e6
SHA512 9b57b950bf85055b49a79c74f1a2dcc2da6f79997efbbaa76db6c9e0b8838f8d429ffe0c4f267a544937d46054e98a6bd232409cb3b1d0a172f0b84ef4379949
TLSH
T11AE0D86455C9C72A7596218B425DFF0C91A27406E6CFBE363B5D98C072072C07243140
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 9564c811be2f90d40c980c04970258ac17f99d444e594e27f65658fbf4c9b459
MD5 7d99367f2a19dbac9469fc1bc77400b5
SHA1 396a2fd0178708428b1d290d2ad61995ee3b6225
SHA512 088b016893c7aa03287f5be837d14b30665ecc00a906b37466a7ceb2fd0830a6e75b9e9fd4135b8f0f0532e885891e5816e70b257da62dbc34148bc91af37714
TLSH
T170E0867485CDD77AAC58A0834769B75CE2F07C0BA7CFBF6A671D48C0A9012C4B2A7690
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ada83f560efc2ee6812c879aebb6346bc19970ffbd2a5749989190d93e8c418a
MD5 c4c7afe0c3c2aa626b4660455fc728b8
SHA1 ae66f38c501eecbbb0f1c5c81a36562edf3011c0
SHA512 3a70b59cc95432bf9f9215cf4a86969ab5ebed613ee35f2c5454fd5bb34d913887643122f1f4e526f1d8fd339af63549291f585840ba84ab687282cf7dbbb655
SSDEEP 96:KMswK1aufwrkwe2Gm4WJNWwmKejWymSYQRCQ3eT6K8seh:Krfwrkwe2GFWJQwAjWy5YQRCQ3xxh
TLSH
T1C6917802717B225428BE268C95D1A56F464170B734AAF56F3B6924E21F3FF401EFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 69726196ce2364563705dc9fd365a1a4eb24b5bc8e54d2c81dd7aedf620b96e2
MD5 b5aed04397539351b23bfd4a8f91a1ea
SHA1 630682d725258c8226463ab1ff56d4e07beb1c2a
SHA512 3aab3f0d6447246b114b95c1d35264e68dfc2fe168bf9fdf67e6c0b3e664938b7fe9912d3b177e342f986019150e81a838a305f36205b6ad7bad367cd742b2dc
SSDEEP 96:KMswK1aufwrkwe2Gm4WJNWwmKejWymSYQRCQ3eT6K8seGfqKwMT:Krfwrkwe2GFWJQwAjWy5YQRCQ3xxZO
TLSH
T1E4B18A0171BB235028BE2A4C95D1E52E5A4530A73469F53F3B6924E21F2FF811EFE9D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 1632cf2125226c0a4532c8fa226ebc882a173e0ca20974d2c3ba2d2573be0f72
MD5 692253c2741bd1901cbc39cbdb78763f
SHA1 c93f7f63f2654bde62ef559ba8f9722c21d212f2
SHA512 916ff741b5064bd9daffbfe855dd97541659d8531b20908acb6040a2051dcab31e48cd8410caf6548ca867b26f6b9161b57767803f43b88ccdb52e704b94fb02
SSDEEP 384:DNrRZyCSDnxTICfALMEhIKyll7svbFKfk7:xFZJSDnimAAyI1l7svbF9
TLSH
T14B44750A7B747001EDE7D9725CB080771E3CB16E8F22A6915DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 f5319a77c576588d17e842ef16a6144b6085e794f31fa0894fbb2e1a2ab348c6
MD5 3eca7aeb85e50590bf1e9acc8e8b1d6b
SHA1 390b60acd593080b57649021e19b7964d2c982f4
SHA512 6c232d1e43ac4f49bfcac4589932dd31d66844c483c883f2e2df8ab3016c65ba2f062f1ed0f99d312efe2fd6b1d71a795c9a35e130d5b423d697b711a7141480
SSDEEP 192:bQ0IIIrb7MIM9cYcYfD6OItAsllr+xrsjd:bQ0IIIrb7MIMWBQFI+s/Ws
TLSH
T1E142745E16051B73C19F5F7A13AA86449FD848824032613E72A62D0F8DF3FA782D92F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 720be11a15a50cabaf75fe58916e49be10f2e8479f852c814d85d34d7d731d8c
MD5 646ae3b92f53b607b982e28a0e3d8a28
SHA1 c5b0f86edbfb9bb60f7d5fb85b911245d40510cc
SHA512 47aff254ce65dbd65f205981e92a2a9cef9cc4283dce37ea73f2abbd949b7c2a22456b378ea8aee44a449843e52910ee09ca70175c3598d186965d8d8b6fd670
TLSH
T1F1E020D1DCC5C25F6A566087112FA70CD2813D17EA8F3D091F25C88875012407257142
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 863d4b4c6ab1f4955d72beaacb1154b04e4ed776469fd8bdb251820af2b416ed
MD5 cc90e89ea938598a668780c3d97fa4ed
SHA1 d0e1005e9bf87ef6d05def155341f734f024b729
SHA512 571c079a519d84b127b4ab0af3d9d6e01828cc12caa9852d2dd293d76f926e0b8568103decc8ee10edfac7b0514d02d50d82f3419b7e3044b7e849a5fe20391f
TLSH
T11B21D695F330C109E15DC67AA47E9B391738D8428FBCDC0F55792434AEB1B040D4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 a292e2c7d4d7391d16f36fbca0bf744b788249bd6b7f7855b9c120e0ee98c227
MD5 0b8783a87796eed354134e378ad5b1c9
SHA1 2ce36234b8b94c57b7a8fac9e8f2d74d85a5d5f9
SHA512 0cf1cd330daeb12172173da26d07ce9fd65303666532efea93f9b035a46231c5131ac9452a3619ceff5331c23e07322fb3d5c83880b19a6ac2b2f0730455098e
TLSH
T1BCE02051ECC4D25F56522093016FF34CD2923D17EA8F3F051F25CC84B501281B257142
MD5 SHA1 SHA512 TLSH

Submit Download

ea7bb5ac-f9ad-4a60-bae1-164b7aaf7bc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ea7bb5ac-f9ad-4a60-bae1-164b7aaf7bc5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 80d42e8d0414d423a17f2f7f4ac07fb30692e026e7d1736eb4ea0406102f307a
MD5 9912aecfac51637db4b4eb9332448bf8
SHA1 544cfe4781e08fd5c3edcc199f28fa797b529591
SHA512 3cf0897d0267f56baf65cacf2d67aba96937ce6c018a6e89a3cfebd3d253775b779914ad37faebbfdd85d7dc58f4ccd28baa7451234436bbabc6cc5d74b805b1
SSDEEP 3:MsEllllkEthXllkl2zEIl:/M/xT02zB
TLSH
T1F74404047FC10545C50010304071C3510374D5110D31574F34D1041F7CC55700C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3db83016b096cd3495db12fa5dc1a19aacff09c53fc501b9f1adc9eeee12fadf
MD5 b5cadfd586d4a1563a8642f09c984cff
SHA1 f36c68ded1cf0c4458f17cbc3a959c2631623f9f
SHA512 8c1b6969ccbfc5437479e6d2d35c6d704a2a1e54f81f84ff366fde3cc20efd48ce52cb3b41469f64440744943fc370b6002604971d3e861ef05f614a760d44fa
SSDEEP 768:txjaeqD4MlshiLdMmG3BXgafftfnAYfn7ryJ5p3EFlnNMLmO7/wFKTy:txqcjhIdMt3jftfjf78p3EFlSCM/CX
TLSH
T13D13CF3698A4ADA79DA2968476077393AEF0056786D03B89DCCC7B0E01D77CD130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fd76995071575d0ad98c4a9596963ab5574c4f3a83099ad7374523844bec5048
MD5 6736c2d4011141389cb62dddba202291
SHA1 214ca7f4c125f0e81dddf499fdb9de3631600e79
SHA512 b66a65543116bf3f49c9795a22c0e1c7af19e2d1a1b1237503f58a4f2889bf87efdd1fe7edc6816184d967b5c437fdc94fd191d1b87f857cd5e39cff5d253154
SSDEEP 768:tAj+943gXgafftfnAYfn7GyJ5p3EFlnNMLmO7/wFCn:t/943Gftfjf7zp3EFlSCM/CI
TLSH
T1BAF2BE32A8A0AEA79DD18784751B7747BEE0466796D02A89CCCC7F0E01DB7DD134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 64bba3767f4ea8bb492ad7eaa6f4959d8d454cf66ae88f996871041df4fcf6cd
MD5 b7fb57dad0b3ec79fb62df0a472942cc
SHA1 29d1510f7c79a75f70b04c3368a6d83820d01127
SHA512 d770e8c2f299f76980f572a9379dd469c3b43a3b4bb17cfac989bb4767f739fb70b94fb64b8bdb32a610e147bfbd211cf68339f79a9be059594239ab75ee60b8
SSDEEP 768:xgFCj+9w3NwgeXgafftfnAIyJ5p3EFlnNMLmtyq6XNhVOwFUM:xW9w3Iftfip3EFlSCwqEN/OCh
TLSH
T134039E369C908D7F9DADAB84761B23976DF00277C5B06A59DBC86F0D80A36DC230BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e95953d4069a3975e583703fd6ed7abf0e00260b62df84bb4d4c081c16b69272
MD5 e4d8504a5b901c7f2613357ecd415597
SHA1 c9f60a062111f72b3a6ac1406f288fd5739c5016
SHA512 76f529b6b864992a356c200067732eca06b132b27044a37a26e139c3c766ea3ced1b71bf871f7f40430f5b9499a2a316e86bd2d7a7bbb8f2156132b68ad95ff7
SSDEEP 768:xRFCj+9w3NwgeXgafftfnAYfn7IyJ5p3EFlnNMLmtM/wFUM:xh9w3Iftfjf7Rp3EFlSCW/Ch
TLSH
T15203AE329890DEBBEDD58B84B61B3387AEF001B789916E55DACCAE0D00877DD134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 30135cab321040177f2536caf8621ed90110a8542087ccabef7db63474f27bdb
MD5 818431cc6410c8aafe550045de58471f
SHA1 dc2ae091ba6f16c87b112ebec234c714e1909cad
SHA512 2d53845229306b7889afd580cd55282d06531c5ec1a4275f8afa3053faf0b24b026c73d2bbc0e922c6348f52083cfee401b42df55022b45fe450e53e6da71763
SSDEEP 768:NAj+943tXgafftfnAYfn7GyJ5p3EFlnNMLmO7/wFCn:N/943/ftfjf7zp3EFlSCM/CI
TLSH
T15AF2AE32A8A0AE679DD18784761B3747BEE0466796D02A49C8CC7F0E01DB7DD134B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 87bd5e7154ddf550c02c16d720cfe7a2dd364dde368e8fcfcc1efd3d09174078
MD5 5ba069ec01a2d0386001ea1934be07fb
SHA1 b4f7652cc423d3280020a29aa4359c029d4a7c72
SHA512 5ce93265ff673391406ed8513de598335c30a3ff451b836a229ae8285ba787fa65999552582ea1e97157219f8a3f984932b63a9410ba3426fd372092f5a4bb72
SSDEEP 768:lRFCj+9w3vwgFXgafftfnAYfn7FyJ5p3EFlnNMLmOzaKo64hSw/wFCn:lh9w3Nftfjf7yp3EFlSCqaKoT0w/CI
TLSH
T1CA138C3E8C919D7E999DBB48760F2262ACE40277C5B09949DBC85B0EC0736CDF74B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c5e9e6967210811edbcce8e4f8e99375ba27dabbefe80ce435fb5b56d305894b
MD5 32fd09517917aed6403ed4bb124b4a36
SHA1 d6c6d2cfd6136adb4750498c94f93ac99239a077
SHA512 86df90249cca6c84128a2ad8c062bbd4689835048e6f4dab125a5e3c5d66426f9186b3290178e80380cb3a03516a14524779665b7cb1315333657e87b69e46fe
SSDEEP 768:UjaeqD4MlshiLdMmQ3n3gafftfnAHyJ5p3EFlnNMLmK7yjWtTzTb:UqcjhIdMH3hftfvp3EFlSCAyj2v
TLSH
T18703D03A98A09C678CA696C5760B77976DB04693DB913F49DCCC7A0E00AB7DE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 98d0c6f7560138454827126c11de4fa8e4b2d30dd62a1bcd6ba4386ef7c5b03a
MD5 6ae83e51e9542f347fe7b666f46e7444
SHA1 f8d665e921d821a69d627bd895e5383c7bd63671
SHA512 9f5e33ff42d921245e1674f02f8755f3cdde2b1dbd10339f1b99ef7ab71c75b2176f20957e131cf47b3fcc6669cc9d23216149fe23ec80b749b5d06acc7f261d
SSDEEP 3:MsEllllkEthXllkl2zESyKtl:/M/xT02zlyKX
TLSH
T16A4404047FC01505CD0010304071C3530F70D5130D535F4F345154177CC75704C00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

126517d8-43a9-4b5e-a5ba-eb6b77eb0db8.tmp

Path C:\Users\Admin\AppData\Local\Temp\126517d8-43a9-4b5e-a5ba-eb6b77eb0db8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_381005703\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download