5b376f070770cc01382795e4060cf0c6b93fd5167afa1651f2831d3ca157603c

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_5b376f070770cc01382795e4060cf0c6b93fd5167afa1651f2831d3ca157603c.html
Size 33KB
Sample260623-j3ly8abs5k
SHA256 5b376f070770cc01382795e4060cf0c6b93fd5167afa1651f2831d3ca157603c
MD5 c2bf04874e2d17a317d56e502f4d06e3
SHA1 72ce1caa8559bc729c53a16958b4f4687dad07af
SHA512 b87b6698594834475bea33ab0f71ae837933ce64547e997ec53b6243c47fe4f06f068709fd8f3bf63f7a91ddda9719da1057d73733466e0510dcf2a35cfe4ab6
SSDEEP 192:Fp5HOxV2Fq28FU6RFX1YqodYh+GehPjzEfe7W3sppk7zPECH:FrM7TECH
TLSH
T1B2F287ED2ACD64083DA5E41DFEB6C433A29339F107032247BE774A81AE5D78C55A2F19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_2114699811\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_2114699811\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_547100979\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_133797697\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_133797697\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_133797697\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_741846900\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_547100979\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_547100979\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_547100979\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_428344797\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_133797697\LICENSE	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_741846900\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2088	msedge.exe
4700	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266759067537694"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{6356FCB3-EE5B-42D1-A3A9-0C410FBF8EB3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1340	5044	msedge.exe	88
PID 5044 wrote to memory of 2824	5044	msedge.exe	90
PID 5044 wrote to memory of 2088	5044	msedge.exe	89
PID 5044 wrote to memory of 2824	5044	msedge.exe	90
PID 5044 wrote to memory of 2824	5044	msedge.exe	90
PID 5044 wrote to memory of 4724	5044	msedge.exe	91
PID 5044 wrote to memory of 4724	5044	msedge.exe	91
PID 5044 wrote to memory of 4568	5044	msedge.exe	93
PID 5044 wrote to memory of 4568	5044	msedge.exe	93
PID 5044 wrote to memory of 4568	5044	msedge.exe	93
PID 5044 wrote to memory of 5048	5044	msedge.exe	94
PID 5044 wrote to memory of 5048	5044	msedge.exe	94
PID 5044 wrote to memory of 5048	5044	msedge.exe	94
PID 5044 wrote to memory of 6112	5044	msedge.exe	96
PID 5044 wrote to memory of 3360	5044	msedge.exe	95
PID 5044 wrote to memory of 6112	5044	msedge.exe	96
PID 5044 wrote to memory of 6112	5044	msedge.exe	96
PID 5044 wrote to memory of 3360	5044	msedge.exe	95
PID 5044 wrote to memory of 3360	5044	msedge.exe	95
PID 5044 wrote to memory of 5968	5044	msedge.exe	97
PID 5044 wrote to memory of 4836	5044	msedge.exe	98
PID 5044 wrote to memory of 5968	5044	msedge.exe	97
PID 5044 wrote to memory of 4836	5044	msedge.exe	98
PID 5044 wrote to memory of 4456	5044	msedge.exe	99
PID 4456 wrote to memory of 3016	4456	msedge.exe	100
PID 4456 wrote to memory of 4700	4456	msedge.exe	103
PID 4456 wrote to memory of 2924	4456	msedge.exe	104
PID 4456 wrote to memory of 2924	4456	msedge.exe	104
PID 4456 wrote to memory of 4604	4456	msedge.exe	105
PID 4456 wrote to memory of 2924	4456	msedge.exe	104
PID 4456 wrote to memory of 4604	4456	msedge.exe	105
PID 4456 wrote to memory of 1584	4456	msedge.exe	108
PID 4456 wrote to memory of 1584	4456	msedge.exe	108
PID 4456 wrote to memory of 5608	4456	msedge.exe	110
PID 4456 wrote to memory of 4384	4456	msedge.exe	111
PID 4456 wrote to memory of 4384	4456	msedge.exe	111
PID 4456 wrote to memory of 1664	4456	msedge.exe	112
PID 4456 wrote to memory of 1664	4456	msedge.exe	112
PID 4456 wrote to memory of 3344	4456	msedge.exe	113
PID 4456 wrote to memory of 3344	4456	msedge.exe	113
PID 4456 wrote to memory of 2032	4456	msedge.exe	114
PID 4456 wrote to memory of 2032	4456	msedge.exe	114
PID 4456 wrote to memory of 4104	4456	msedge.exe	115
PID 4456 wrote to memory of 4104	4456	msedge.exe	115
PID 4456 wrote to memory of 3620	4456	msedge.exe	116
PID 4456 wrote to memory of 3620	4456	msedge.exe	116
PID 4456 wrote to memory of 2872	4456	msedge.exe	118
PID 4456 wrote to memory of 3080	4456	msedge.exe	119
PID 4456 wrote to memory of 2412	4456	msedge.exe	120
PID 4456 wrote to memory of 2172	4456	msedge.exe	123
PID 4456 wrote to memory of 2172	4456	msedge.exe	123
PID 4456 wrote to memory of 5432	4456	msedge.exe	124
PID 4456 wrote to memory of 5432	4456	msedge.exe	124
PID 4456 wrote to memory of 5996	4456	msedge.exe	125
PID 4456 wrote to memory of 5996	4456	msedge.exe	125
PID 4456 wrote to memory of 2076	4456	msedge.exe	126
PID 4456 wrote to memory of 4196	4456	msedge.exe	127
PID 4456 wrote to memory of 4196	4456	msedge.exe	127
PID 4456 wrote to memory of 5360	4456	msedge.exe	128
PID 4456 wrote to memory of 5360	4456	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\_5b376f070770cc01382795e4060cf0c6b93fd5167afa1651f2831d3ca157603c.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffa06e8c188,0x7ffa06e8c194,0x7ffa06e8c1a0
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,1363550548375719548,6848655561887416129,524288 --field-trial-handle=2164,i,8663281159360296848,15646453632499043385,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,14421188456287252736,10452973472786016549,262144 --field-trial-handle=2164,i,8663281159360296848,15646453632499043385,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,16912027426713631142,3278657285049294321,524288 --field-trial-handle=2164,i,8663281159360296848,15646453632499043385,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:13
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,6590632601933251612,2522919317040014764,2097152 --field-trial-handle=2164,i,8663281159360296848,15646453632499043385,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,14039405578036760747,14535228264992317555,2097152 --field-trial-handle=2164,i,8663281159360296848,15646453632499043385,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,1167083118598981741,10435638984278286992,2097152 --field-trial-handle=2164,i,8663281159360296848,15646453632499043385,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:9
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,12584350023182238240,12136340495271410669,2097152 --field-trial-handle=2164,i,8663281159360296848,15646453632499043385,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,4243505057647670437,3622778551703993195,524288 --field-trial-handle=2164,i,8663281159360296848,15646453632499043385,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,12792258311870298307,7700634954326608428,524288 --field-trial-handle=2164,i,8663281159360296848,15646453632499043385,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x2e8,0x7ffa06e8c188,0x7ffa06e8c194,0x7ffa06e8c1a0
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,5837232596767656802,9170274268481278486,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,371536268253056442,3475012849351197182,262144 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,14945228798595513676,17037082861348473949,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,11611042736885028565,319941533207359903,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:14
    3⤵
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,14836912336956997985,4491595215897239411,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,14836912336956997985,4491595215897239411,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
    3⤵
    PID:5608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,18180623199599028186,8049686897724843043,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,10971091517461971784,15534355244222213405,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,8353997682450632545,14150636048007539007,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,11626088223568789796,55427956592839614,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,10876162274637377026,6515061303793553471,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,14148696732246352846,8839280056253848641,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,3775300646126222207,5553508217598320754,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
    3⤵
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,3741364779766162127,13723117927926211114,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,5539347026260720159,12710899220947921121,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,12175687525768725252,16696866810772674694,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,12153204953470426208,18272090780416717609,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,284768744399513041,15349138456685431526,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4264,i,1629994966081670292,12120961969191057936,262144 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,14047897537773026843,2541129018321527894,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=836 /prefetch:14
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,9359356002196752163,4129821784070661975,524288 --field-trial-handle=2616,i,441905617376226220,12749794633823433510,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
    3⤵
    PID:5360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

3cf2ec21-5c74-46d1-9bd9-4345675b1ccf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3cf2ec21-5c74-46d1-9bd9-4345675b1ccf.tmp
Size 12KB
SHA256 18e7de5c122d53b5027e2e857191921975d22af448315a1d2519bf48f1e8cc16
MD5 8bc8901c7e907ed2d0c79c3c080e0c81
SHA1 7671c0bda1706d7ff59dc1ae59f4afb453b643b6
SHA512 bca5af8734b508d56192994436078b040d3f423a0eb4408f708be93463f950ca968a85cd7f4729ca498003d7ad80249bcdc32af3e525d79e686f1e6b68e20898
SSDEEP 192:sxRRR0GbO/fZsAWpVOWxYZ3GYnzoA8p4l/g6+WNIY91dGyIgtJ:sxRRhO/fZsAWvOSmWPg/5IK3
TLSH
T1A5428416A928993B9CC7D21DFB667F53D6FD1032A1D15E48B6FC8A1C10EAADD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

834309cb-77f9-41a1-b531-c7b513c4945f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\834309cb-77f9-41a1-b531-c7b513c4945f.tmp
Size 12KB
SHA256 ddbe87e1457a45c48c484fd5044ecc8dc777577acc676345d67f1bfd2a180d31
MD5 beff24a145ed71a114a8a98ef675a405
SHA1 661b38fc896b7961874ce20805d18333771fb39a
SHA512 ac1b730739276e7cb011a64f0837cec39afb25133b276071b2076f39b71625bcb951cc1cac91c3a5a9bdb78c36750b0d17e734b4c03357e18983c69c510bff7f
SSDEEP 192:sxRWR0GbO/fZsLWpVOWxYZ3GYnzoA8p4l/g6+WNIY91dGyIgtJ:sxRWhO/fZsLWvOSmWPg/5IK3
TLSH
T1AA428416A928993B9CC7D21DFB667F53D6FD1032A1D15E48B6FC8A1C10EAADD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 bbdf920333cd7a2b4124d869c34a5b88abc11e4bf3d084c26894b49b4bc7756e
MD5 e763b139ce3246837263df04da5c5ddb
SHA1 354013ab1e112862c62c745b0d71089ad11774f4
SHA512 3d4211ca45aec5bb3ec2af6d95601b1f85c60f9a5f22b18515f143c553f80446a2612339401d3e2a304231e6301db54baa48a774f014a0059ee5013de3ba23a9
SSDEEP 1536:S1lfqL/OaL/YmQ8q/xnupvqIJpwOm79lVoQn931HjPC6vtmHVfdOEnPL/MlL/jL/:SDiL/RL/flhwEHVfdOEnPL/MlL/jL/
TLSH
T1C4445FF70951A00BCBA852F5E2133E3DE17B425D7CD1F8E9E57C4C852929B21B6BCA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1a63d2936c260dcc0793e9fd11083a521344ffb54a8dd33ee99003bc84a6740b
MD5 5ccb1af78a42a4d0098a0b93b0fe5084
SHA1 cc442e9abbc9dac297970d93eafa153ff6aa7d8c
SHA512 20d7d28daf972dc87bdbaa47a210f958e905298ae0557553ca13a27e305ce0e7704347005afd69c7d7f445be51b6209f30fe720d9a092a26292a173b7549d5dc
TLSH
T1A7714CE880690961FB2AE7B5A2F014B973F8C85151D7EE1348A4907BEED5F07738E08D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 db8c34fb1ee3f299f613b9177bcf9560e1e7d274de45162c82b0b0bbd249fb84
MD5 23259667bb291b9dffea9d1bc6852090
SHA1 f191b5daeb40e8069860313ec70e38f22d81bfd6
SHA512 06e19fbed1f4ef8bb7635053b089ba221ef101841e5f96d4199f906d3b1fd46c14de44db49f0ad8a9e182ad152224d506ae215fa2203404ed39186b8d8d513b8
TLSH
T1E2E0D894D6CAD21D7994388655345B0CA394358EDA977D0B2700C8CC764614DF741546
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 319B
SHA256 b34a6fbff7c04ceb0161c2e29b7aa1059e5e273b19a8489042321d8dc12350bc
MD5 a7cff423db8ec0746e34ddabe902e84a
SHA1 1740c2661a2892285f313d5d9e8d85c00ebf9cee
SHA512 9a911c0013a404dc2617e789d3bfc4a8e31456b080fc81aacef97056f83dee3f1e875b095a81e415492de5190232069456ea01570be03bfae4ee37cf0498d3cf
TLSH
T18AE0865965C9F62970A474E7C6F4970CD395350FE79B3916270C885C7143788B3972C0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log
Size 304B
SHA256 1f844da045ae4e4e56937a272b1c4679f12badfc99e892895bf61bcaea111fc6
MD5 e31621408f289cd9771b4a7bee72f0e6
SHA1 730336e9c21b7f4f753b1fd9c4cafb9d868be5e9
SHA512 a0fe5b23623294e52f151bac2e1d57ecdcaaad55297289ddf3657329e75744e6776ddf4421e5d7e89f899f72465181a9e33dd8e0ac64671678ab6126344a1f60
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 323B
SHA256 2ebf448a8bc8be741a0292f3e93fd2d36589af346cca35ce7be5e556da772f3f
MD5 955fc9e048aa281f04152cea4fe72b44
SHA1 b60fc87202054509f30e5bf4c4ab8be9b44e8bfc
SHA512 81cc5b0fcb3ed4b1664622aac556e38c1db5937a0d1d810159e1c2cd808b9bbe9fc8efbded1d358251ca3b807c2e8d4e90e73db71318fdc4d1d9f8d904697e27
TLSH
T19EE0805849C9F63970E8A8D386B9930C93D5350EA69779556708CD9C7101744B7535E0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 9111841dc849cb906cb49cbdbc6c4722e418c79388f1d28652cce2410fbc413c
MD5 40fddec46551024f35d91375ec4132fa
SHA1 48379ae4e20670ff31ee137503771beb3e64ea60
SHA512 c5f42eb801f89e3c0d1e347ccba4c97da2531a2836c6b8a77f670dab337a8adf9f7128286441ff31bfe72571883b417c37f15eabecf65f36862bf748b323eeb6
TLSH
T12BE026448EC8E22DA1A47897867D430C93D0350EA28B39062708984C71013C1F386280
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 7ac16ca45f193a5b12680d0242d8a45a544411d140efb72eade4153b02efcb00
MD5 cb1cf3156bd6a7a8b55b4453b566ca74
SHA1 8a328de4b0773a2e5f346fefe93f54f17a22918d
SHA512 d38c233a43f8b5f97ad717ae5b621402e99b79bef7f1fece318b1e899b68236486d3855e38e4580ac1366a8ba30113a57395ae8a3275f32fc47cbf79c8f73630
SSDEEP 192:rgZ/H+bF+UI3iWGVoWN3qL/X68ZVVV63:rOIkUI3ijVoWN3qL/KoA
TLSH
T18A24000E5F252722CDBD913668EB44A35C7DF03FC71326DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 8KB
SHA256 14579c99f343b11782f4a5cc01ab0a52a540ff128d942640c0f0b8adf0b299b5
MD5 f9863382d8100fe8c547de799dd2beab
SHA1 4f71197b304f6d9f7a92ecaa2b9ad3ec9413893e
SHA512 f3b05c9d9efbffb5a343cccac4b76220c981e9ff5933e71bc8e7a3134cc90a2d6203435d5730435546901d8ff48b21d2a345234b4edd955261710776af28a565
SSDEEP 3:4tlldv3lljq7A/mhWJFuQ30VkWUitn4dwenqFtjE9SFcTpL0WWaV1vGrV9RUIx:2/dk7/Vkgtn4d4FS99pLTB1eBz
TLSH
T1D20212910A609973E858AA3EA2CB40EC1F72290C8A92D811820CCC190A02ADCD24885A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 d922fb7f865432fc420e0105f404a0755d72dd8dd1e0c1fd15108588d3150f79
MD5 ab0770736c2007a41368f09213f56dd5
SHA1 7c4d2da006acafc3d42457f6caacc4fb679a795c
SHA512 5ee5f5575a04132b84425543fedfdde36c08bcf0d898456e18eeef7ef863c8c807b6d6d27be3d8093d9e2d528078e2ee3efb144114bbb32b07d7aeadc9c4ca2b
TLSH
T128E0206085CDD21D7294608B4374770CD7B03A4ED68B3F1A3B04984CB101544B7833C5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a1e09ddc94d83a0dfa58b23780790ac3161e4cbff86df2607e5128e57d7d3737
MD5 1611eb91ed5cc8bfbb6e77eb90fed14c
SHA1 b0c1af31887b6a477a1979db0bcbd04346679e17
SHA512 1ecec7b33824bf9674975b7725aa62355ec08134a209d92ac6a1c976f70af18a10fde6addcf4753824bca0e7c3787c1ca6f41335a6bf38bf42dd3a1def276185
TLSH
T16B319BF7C3E8866D894156F4BA146E1BCE2E0A54832C3D5AC8E4EF1F93E2871E24055F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0b78ab7ef119582dbeaaa239ebc1af3f382fd93318153a9437f79aa46c20a123
MD5 ea42f51b2a156e70e1b82f1814a6cf3c
SHA1 cfad78066f943e1a03b8e57c6b8f84a15a8f15d2
SHA512 386f765e6afbf81c9816eb38d8f1d7f1abbbb04132b95b30cf65b873be5324bd7cb03a6f635e5e10b288754caf8ca589966a4c4ce272e477cff30bab08556094
SSDEEP 192:sxRSyGFO/fZs02RWpVONkU4nzoA8p4l/g6+WNIY9jFgyIgQJ:sxRSjO/fZsdWvO7vg/5I40
TLSH
T192328516A928993B9CC7D21DFB667F53D6FD1032A1D55E48A6FCCA0C04EBADD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e176ffbd910e372f43e95182c526c768e5bc6fd878f9de784df777e47bd87a23
MD5 2901f097d250849162abae63a5e9025b
SHA1 510894c5e9f87c62bde0e3c8fd3955b2df08544d
SHA512 9960dac89887de72b49f3d63a92b85f85bf90eb27ce275470c0f0b69e80d3bf2366626a1b1f092004a36e12a81a7be5e9ebdfb5142aec9cb9f01a3c42415f25d
SSDEEP 192:sxRRR0GbO/fZsAWpVOWFYZ3GYnzoA8p4l/g6+WNIY96dGyIgPJ:sxRRhO/fZsAWvOqmWPg/5I/R
TLSH
T138428356A928993B9CC7D21DFB667F53D6FD1032A1D15E48A6FCCA0C10EBADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 70e361587b9d9e58f9c33734e964f9466c8d5d4e60b564a17a8780370ee60369
MD5 13adac2caa9ceaf697a80723b694c704
SHA1 13322d96885c1bbc1df44c4c913fc46ef72bd99e
SHA512 d2740526f704889e1581e0f4c0a82095ca25bc1f4078d1ae24a49e051cbd9590ad321a7b2757144750911d77cbe142adca7111ddedf110379581aa1f03d6ba53
SSDEEP 384:eMwutFCfCtgKgFfY6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVDEk19q+RDgro7:e/utFIWgKgfY68F1+UoAYDCx9Tuqh0VM
TLSH
T186B2DA2F604CCB7E5F801A9DAD1A6F9B3D9802C79A588D4047FE994C03C77EF92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 0b00d12b2f6feae2492e3893b5a0f6fc1fc05476f3704361274e4e0915f388e6
MD5 0460f6ac4dfd914fa5c84c743e3d3d9c
SHA1 81ef94a5111bfbc18cf98c9e4e88c018991c3fae
SHA512 1d5cbf57de40cfbee01501db939e052ef42f528e6078d69192e95a5ea68937fe6c4afd28d1b0caf7f0897ccd7b93e8cbd4ce827784b6792423cceadad1c858ad
TLSH
T1F5E0DF9456C8F27AB0DA30970638834DE3A8760FD2CA39462F008C4CB143684B392190
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 19b795cc21bb979b8a97f4e23ff60eb8234695397023dcadbf881a28e7120cb4
MD5 3ae7d4f0e0721fcbe231ea068d31009d
SHA1 8a34a9291d7ae732ec0db280c533f443733fdb16
SHA512 92ae623197a016d06a3a29c4a59916798c4254198de64ba88ad0e41a60c9887b8fdfc91a53025f1d4ac37e508133f7304971de85889cf9b1aea8e655c805ec22
TLSH
T11FE0D82057C9E72A71CE208F5224E70C92A2750AD6EB69257F18944C7706280B383280
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 af245815743a201c15c1f31e3d543cd9502e69523a1dedd57ec1f0a44f58ceec
MD5 fae0cd47f8aa9e444f98b062ca3868b0
SHA1 ba47c4c59eaeacf693374bd097c309c259b73bcc
SHA512 bfb8f4fb5933be70b48185412003e411fd5a89b30817e9e5d94472d61263ee340cac382f62246923a968bd07d55613632d56dae8bb48b2d4b8de1ac20340cba2
TLSH
T1E1E0267486CAF739608060D74274974CD3F07D0E93EB3A0A6718544CB242288B3A79C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 7168991467937434473ed6a8bcd91b468e17775591a6da788e544bb416330fad
MD5 d85635fc7916c8490a48987559e6c770
SHA1 c21bbce281db036c98c42a49e75aaf40fe63dc76
SHA512 6e4c5cebfbb0849df25526747c18b8d829f6ed444a42ff301a6ea6912b85c9003f83e2201a01f52c1b6802331f714577631cf1716886ccf9ceb37978479ff56a
TLSH
T12F81230031B727047CBD3A8892A1996F52467077713BA82B376810E61E6FE411FFE9DD
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9489f7a36414e59f341341388c6a0ffd2a3328c6e25545416ad0ffbf9d9fac31
MD5 505f1bb3674c9ca90af905e67065b1b0
SHA1 5b3c1f795d98e681985605c93c607fdd487b5240
SHA512 e8d150679328eb19bb5f210146c4b56fd13cdd8cd707b2c62d78463a06cd51761600c48956bfb5098ceffd6cb6bd7cce138b4dc3ee450e688c5a2b08cbcad682
SSDEEP 96:K0QgK9Sy2/WKUErah/nX2pn09Xh2KPTX72L5BMrBnZhYPzhq:a/RtHl
TLSH
T1F691040031B727047CBD3E8892A1996F62467067713BA92B376810E61E6FE411FFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 275B
SHA256 56400490b789e86edb9ed9daa0736a0e3948adc04badf9c71691787926caf13d
MD5 1cdabdc23d7a213a7d5cf95c4efcce8d
SHA1 a355b96dfe14c49bc20a4407bc987bc72b778708
SHA512 27d9e342f2c75e491e71ab838d69c1037151ab6fd9d07ca9e35f64f12b5855fa01f2f81a816b262772d014981ef193d202ce8b08509e815500be9959ce143db4
TLSH
T1BBD0C25013BA31545ECCBA80D2252817608839AE132F8831331D60D80B4C8062FAE935
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 b76f67cf7126fc64870c2c37930ef21ef48b4b70447bc39e2195f37177847b14
MD5 60b4c923ec22943a78ebdbd2dc3b0f22
SHA1 6674d66bc4b312a6fbb0dc92a2116c62d38e7312
SHA512 71f956dd698b3044cd9e1eb7c7fca7ef54a8435fdf9fc901ed0ac56841e546cc075d189d968ec28f954d87c36bb6815202786ad8a989f25fc967ff35da6ea685
TLSH
T10EF0CAD76E430977DC02A57154336B82FF618ACB0424A4AB438E206B2A2E2F1CADC0E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 4449de7c76fe5a5ef0edd7802c29f15232a52bccf6fd11e78c58f1edbfe1a9d4
MD5 c7578285c0713b944ce73e6b946554dd
SHA1 660f42de0e51ee3f9237a8d26e2332629106321e
SHA512 58f01ec0bcbe26cf089cb28619cae08d8accc5e40ef155315d4d745491d8104516e3dd9d46c5a0b0d06efc51d2ed76daaa6d1a7de098ea9ae1cfa0590814b997
TLSH
T1CAE08650EECDE26EB1D420870578435CB3953A0FFBAB29BE6F14C44CB1052D4F396596
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 3ba2e8386c3e2ec91a5662cbd677917fd74078f4557f38a888b842fbda7e1a7b
MD5 c854ec046162771ff9844d62216f0668
SHA1 b3241092ec1815194cc9b506b50985422326e171
SHA512 e72a719dc1557498f6f7edadcad1caa4218c490707826501da49e424da3993cf7eac2a5cd58de7f7002ac7ec6e6560c2080cac8f8839605c5541896d19509718
TLSH
T19521B159F330C018E14A827E647B9B350738E8569FBCEC0F95BA20656E76A441E4B7E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 80b6ce767749eff0797f8b6df401f5de65f191600e47f109a89fe8bfd991a3b9
MD5 a796eac257cb1f3741913c20c56fcf8f
SHA1 da2345516eaea1e32c7f5ca5044e8d4335d6559c
SHA512 b83d2aaf3437d1a48a3c47f3ac3ceaf413fb3b783c2b47140e0145b75930bd774dc7fb13b50fedaf6b202b290cef7e21e5c02a8f8153b9b954b3530dd518eb5f
TLSH
T137E0DF10E9C8E2AFA19020C30978834CA395390BEB9B2F2A2F10C84CA101281F38A592
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59aa5f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59aa5f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 76e895dc42f47bd75c7dbf1ca81c6d480627af733f29a87de867c2bb6c5eec8b
MD5 f2edfa14112cf2274ce1b57fa24e83be
SHA1 b7611d315b29bee91b1fb14970f67553d6a182da
SHA512 4841c7165341b03f5d7ea78c407fb26c981d617aacae9b2a31d2463e3a6193bef40e8f38bc45debb49b9b47fbfba7d223cc9785c5a35566fd6ca5fbfd3f92241
SSDEEP 3:MsEllllkEthXllkl2zEfliUWKX:/M/xT02z4X
TLSH
T1A94404047FC31C05C50110314551C3D013F0F5100D11D74734D345335CC75500C44040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 2329b69b9b7e680a38842f5b4ac8d08aef619405408143f70ec53358e299071b
MD5 c1c2ad19b000d21d2cbe0ff792617fa9
SHA1 07db156cd771e1ce6b8ec9aec19605caf30aeb2c
SHA512 6bfb8046670c9fb0cda5ba79f452e6d9235d002dff76a1c3ba321948c09cf3cf3ca5ac4a9ca32cd3996c82ec621eaaf65a65df84ccd31d236d541f058ce5ee0e
SSDEEP 3:MsEllllkEthXllkl2zEflZyPKX:/M/xT02z+X
TLSH
T1804404047FC11405C54010304451C37033F1D5100D115753F4D104335DCF5400C4C041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 8a47916c2a663f6cc0b0e22c32c6ac0d9a0a21b6e84a8fcf4022dfed86d94f07
MD5 c8f8cb4c306de47bb9b0c785ea1c2c42
SHA1 11e472c5c6d1613a26010f2cbe93cdd444b4aeac
SHA512 584908768d2d8ba7bb0867b6f728f318c37fb44360325b91b90d40e7c26a65ae752b5bed061753d2b0710be813ea1b2d8a43d9ad771f7c1d77fd501a14dfe23b
SSDEEP 768:sjaeqD4MlshiLdMma3H4PfcOefZhfuWV5R4HTytYYqgHvPwb+9vNyjWtxUTL:sqcjhIdMh3sfifLfrWTwJYMNyj22
TLSH
T1BE13AD7DDDA4487F4CAEB744720E26676DB84276C2F02A68D7C8570C917B9CEF30681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 55830fd1a6101b842ca8ab7591a0cbcacb7257a413829d6d68f9ace03b8482c3
MD5 faba7ccaad968c4e3d8b7cc4044f77d9
SHA1 43c71e3519a9e21eb8840981d9d7dfb3783244d4
SHA512 887ca3daed8f71e79f79d0f528149ea8b311e4e257a339846d33e317b5ce9b1dfc9c47ef8dd2637e459cdd4ec9901df926aa99019827c9d214bb79501c0d62a8
SSDEEP 768:wjaeqD4MlshiLdMma3d4PfcOefZhfufV5R4HTytYYqgHvP73yjWtx1TL:wqcjhIdMh3GfifLfwWTwJryj2L
TLSH
T1D313C0B6ECB85CB74CB29585B21336976EB84253C3C52A68E9CC5A0D05DB6DF130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 81dfab0a32f3f0c309d50cf67b6f55f16f71cc5cbc4779b4cbf9f73b18a1e59f
MD5 91bad40f0338453b0a40803727a72331
SHA1 502247f4a56466ec9c0e71eb80c5c7b33dd33e77
SHA512 1d20a0d2bd7dd4a90ae2b0371753a00e72a8a1105247ff65bebaf8457c3e2c29de66827122cfa51a667bc0cffe735eca857008af4e4bf2169abe35f32d7480a2
SSDEEP 768:Mj+9w3i7cfcOefZkV5R4HTytYYqgHvP7hF5KHrOaAAR5v0:L9w3BfifIWTwJ9F5KLOaAq5v0
TLSH
T1C003BF75DDA48C7F4DEAAB88B2073B472EF80237E1D01A58C7C85B0C4597ADEA307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b95d518091ec33c97f10e0341f5c784b3b4dbd30d1a462b29e748c3c89aef95e
MD5 7a6a5105722d86b5bfa05671bbaa95b0
SHA1 8086f9005ccee2ecf212c5f286f1137fcdb37666
SHA512 e34b62355fccc1265ef4539805bc96cf6ffcbea64d3395b58cd80c81aa13e6d51b2f1bd8ea3c290f38aa833324a930755c83f65f8b703a8a22ca7e26f0a3c690
SSDEEP 768:Nj+9w374PfcOefZhfudV5R4HTytYYqgHvP73KAAR5v0:o9w3AfifLfQWTwJrKAq5v0
TLSH
T149F2AF72DDA49C771DD2C684B11237877EF84223E2C42B6896DCAB0D05CFADE174B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 57KB
SHA256 718b4ecb996b65fa4b2466d8825f867b0571f70ebc01610b2e7074181cbb3985
MD5 ff9eb22bf04f789af84e36841c84546c
SHA1 ddcf1c5b9479244971126ee2c515b70b41d1aca6
SHA512 570e4bcfc0f979deacfb9be3f87184940ca801521df396c91cb6e87b104e360f151f2a05deb4a99350305ff50893bd6be6a7176f95e57773f0f05afb5923e216
SSDEEP 768:VFZj+9w3pwgk93V5R4HTytYYqgHvPmyqO2i+zcnurrwvQcDhF5KHrOeJAAR5v0:Q9w3GWTwJ2yqoTYc1F5KLOIAq5v0
TLSH
T18443CF75DC94CD7FAEE69F88A30636979EE40233E0D468A8DBC85E0C40CB5DDA747909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 48b81140f83d20fb9b7e60bbe9dbc568cd9008c20a40704ff83173ea9c9a5414
MD5 4c63c2a654becc1de22380c8c817c89f
SHA1 e8973e64fb409a234c1b8c52c35dbb3d488f8ed1
SHA512 d7419f77de61374dae05ec8c2ead3cb440008e42c9f351b65734d0fb41e524bed0481c5b470ceab8248458117d866b6b80270bdc503b2795e673fcfbdff7d5c2
SSDEEP 768:ijaeqD4MlshiLdMma3Z4PfcOefZhfudV5R4HTytYYqgHvP73yjWtx1TL:iqcjhIdMh3ififLfQWTwJryj2L
TLSH
T13413C0B6ECB85CB74CB29580B21336976EB44253C3C52A68E9CC5A0D05DF6DF131B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 753f76819b4fa4b66c79cb5a243bbef7ac29825219f8a75615872914c74e59df
MD5 af9f8c2aac2475d8f64f32c5ad11f134
SHA1 d25925c00beb4fc986a7f2a3c6f55ce1b5053403
SHA512 e4aec2eeba0df8fef0a569db7a4c7aa94b71a8995fee17e5c3f5c1150486d068d6310461a974ef942019e1f6c7a375210670f915c917dcc754e0435e27801f5a
SSDEEP 768:rj+9w3i4PfcOefZhfudV5R4HTytYYqgHvP73KAAR5v0:+9w3JfifLfQWTwJrKAq5v0
TLSH
T190F2AF72DDA49C771DD2C684B11237877EF84223E2C42A6896DCAB0D05CFADE174B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 27fad621ec6a91335c725479086cd3541a45646a2bbaf8593f83fbfb363339ac
MD5 36597150089eae5025060b9ab7a36f50
SHA1 b37a537873e414d4e5b9822fc6bed2d810ada0ab
SHA512 ad4d2167cd9a14610e2f5fb4b85d807c1101b6dcd50c1ac502ef03232232058f31b5135f2bdf043caa5a98b76833c730e7df5d0b18730a64dc8800d309d0115d
SSDEEP 768:EjaeqD4MlshiLdMma3GuPfcOefZmV5R4HTytYYqgHvPgjyjWtxjTo:EqcjhIdMh33fifOWTwJ2yj2y
TLSH
T1D003CF76ECB85CB78CB29685770277976EB842A3C3C52B64D9CC5A0D019BACF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 5838e7a9e05be7ff68af7eb1fd9f9288593e675be6c520ae08c0fde0d86627b0
MD5 8fdbcfbe81c02eb60c8339342a1b3253
SHA1 dfc6792a24d0c77b2f2cafeb17f9989773502105
SHA512 aeca5a8a4d7e1cf0b387d0b0d45e7ad422d2675f509f4e2cc666eada4460a99848602865d1cd4e6a1b2f934f2018f6562c76ffed9767c5f35ba9c5314b589817
SSDEEP 3:MsEllllkEthXllkl2zEflMZKlt:/M/xT02zNZq
TLSH
T12B4404047FD01C05CD0010304453C3503370D5104D1157C334D10533DCC75405D4C044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

c7e11b16-f873-46aa-b81b-012342f02f49.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c7e11b16-f873-46aa-b81b-012342f02f49.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 98a55546e41fe03178af27446c0389ccc2781038f0b7348d2ad50846dc33f5dc
MD5 ed12c620433363f3bae135c5d15dca2f
SHA1 5414b1db440c59cc15f8847894da1f79ac9843e7
SHA512 3da4b07665fb714d7203dfd8512ceff56b29f2a6e7cb17d602a3dee21969cfb4a20236fc1605374054268d634d1412a3887a4a76a931bda931eb469c22b04b75
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfLe:TY/IHRH34kWqB1kQnjhHmr6ITmU9Le
TLSH
T10323886EDA2CA9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5426757-213e-47ef-a78f-2fd5a6075a4e.tmp

Path C:\Users\Admin\AppData\Local\Temp\a5426757-213e-47ef-a78f-2fd5a6075a4e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1566014577\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download