4a640bbd8bdc62cdeeac7bd78c5f228c5169591a42f6e7ea65f56d0afc690529

Resubmissions

23/06/2026, 11:19

260623-ne3dhsct8s8

23/06/2026, 11:14

260623-nb9cnact6z7

23/06/2026, 11:10

260623-m95lpab19p8

Analysis

user interaction
yes
max time kernel
900s
max time network
889s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Elsify.exe
Size 39.7MB
Sample260623-ne3dhsct8s
SHA256 4a640bbd8bdc62cdeeac7bd78c5f228c5169591a42f6e7ea65f56d0afc690529
MD5 727441b6956955da28981db2068fa364
SHA1 1962e199fdb5de53b6812ae6dd84e60510ec74b7
SHA512 5712150ab8ecd5e3dc89dd27e0334ee3f4ced24bedb70cee961811dcb12fb497ca05fb0879540c8f494dcfbd937f589e098a2b2e72e26c3f68bbdc5c82872e60
SSDEEP 393216:GOZcLGgjctJYGdrKRlNw4+sX/XhiAwpwCvwnM:GOZcaZOGpyX/XhiAY7
TLSH
T1DD978D0723968E2ED95F17BEE0D10325D739DA06A79793DB280C99991FC33C14A352FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
83	5592	msedge.exe

Loads dropped DLL 2 IoCs

pid	Process
6132	msedge.exe
6132	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1162555988\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1162555988\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_874841436\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-gu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-ml.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_963159915\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1338626627\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1753686693\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1162555988\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-hu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-or.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-sv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-cs.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_998718224\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_320720208\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1162555988\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1162555988\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_963159915\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_776798832\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_320720208\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1162555988\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_506951927\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_442871926\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-lt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_963159915\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1556461650\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_998532756\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_184297775\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-nn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1866404865\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1162555988\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-uk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_998718224\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1162555988\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1162555988\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1434359092\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-pa.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1753686693\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_874841436\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_184297775\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-da.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_998532756\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1791620323\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_776798832\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1338626627\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1162555988\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1434359092\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-eu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1162555988\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_874841436\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_963159915\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_160259257\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_160259257\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1556461650\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1434359092\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_963159915\shopping_iframe_driver.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5592	msedge.exe
2044	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266872490763342"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{5D35EEBD-C1EF-4035-9E2E-8664B148E0C2}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{78834F5D-2D45-4705-8F1C-54690E9FBED2}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
6132	msedge.exe
6132	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 5560	2940	Elsify.exe	88
PID 5560 wrote to memory of 6080	5560	msedge.exe	89
PID 5560 wrote to memory of 5704	5560	msedge.exe	90
PID 5560 wrote to memory of 5592	5560	msedge.exe	91
PID 5560 wrote to memory of 5704	5560	msedge.exe	90
PID 5560 wrote to memory of 5704	5560	msedge.exe	90
PID 5560 wrote to memory of 2052	5560	msedge.exe	92
PID 5560 wrote to memory of 2052	5560	msedge.exe	92
PID 5560 wrote to memory of 4620	5560	msedge.exe	95
PID 5560 wrote to memory of 5888	5560	msedge.exe	94
PID 5560 wrote to memory of 4620	5560	msedge.exe	95
PID 5560 wrote to memory of 4620	5560	msedge.exe	95
PID 5560 wrote to memory of 5888	5560	msedge.exe	94
PID 5560 wrote to memory of 5888	5560	msedge.exe	94
PID 5560 wrote to memory of 1828	5560	msedge.exe	96
PID 5560 wrote to memory of 3420	5560	msedge.exe	97
PID 5560 wrote to memory of 1828	5560	msedge.exe	96
PID 5560 wrote to memory of 1828	5560	msedge.exe	96
PID 5560 wrote to memory of 3420	5560	msedge.exe	97
PID 5560 wrote to memory of 3420	5560	msedge.exe	97
PID 5560 wrote to memory of 5424	5560	msedge.exe	99
PID 5560 wrote to memory of 5424	5560	msedge.exe	99
PID 5560 wrote to memory of 1612	5560	msedge.exe	100
PID 5560 wrote to memory of 1612	5560	msedge.exe	100
PID 5560 wrote to memory of 2584	5560	msedge.exe	101
PID 5560 wrote to memory of 2584	5560	msedge.exe	101
PID 5560 wrote to memory of 1268	5560	msedge.exe	103
PID 5560 wrote to memory of 1268	5560	msedge.exe	103
PID 5560 wrote to memory of 1268	5560	msedge.exe	103
PID 5560 wrote to memory of 5168	5560	msedge.exe	104
PID 5560 wrote to memory of 1444	5560	msedge.exe	105
PID 5560 wrote to memory of 1444	5560	msedge.exe	105
PID 5560 wrote to memory of 3948	5560	msedge.exe	108
PID 5560 wrote to memory of 3948	5560	msedge.exe	108
PID 5560 wrote to memory of 2672	5560	msedge.exe	110
PID 5560 wrote to memory of 1252	5560	msedge.exe	109
PID 5560 wrote to memory of 1252	5560	msedge.exe	109
PID 5560 wrote to memory of 2672	5560	msedge.exe	110
PID 5560 wrote to memory of 2672	5560	msedge.exe	110
PID 5560 wrote to memory of 3652	5560	msedge.exe	111
PID 5560 wrote to memory of 5444	5560	msedge.exe	113
PID 5560 wrote to memory of 820	5560	msedge.exe	114
PID 5560 wrote to memory of 1316	5560	msedge.exe	115
PID 5560 wrote to memory of 2780	5560	msedge.exe	116
PID 5560 wrote to memory of 2780	5560	msedge.exe	116
PID 5560 wrote to memory of 1712	5560	msedge.exe	120
PID 5560 wrote to memory of 1712	5560	msedge.exe	120
PID 5560 wrote to memory of 2192	5560	msedge.exe	121
PID 5560 wrote to memory of 2192	5560	msedge.exe	121
PID 5560 wrote to memory of 1840	5560	msedge.exe	122
PID 5560 wrote to memory of 1840	5560	msedge.exe	122
PID 5560 wrote to memory of 2660	5560	msedge.exe	123
PID 5560 wrote to memory of 5540	5560	msedge.exe	124
PID 5560 wrote to memory of 5540	5560	msedge.exe	124
PID 5560 wrote to memory of 4104	5560	msedge.exe	125
PID 5560 wrote to memory of 4104	5560	msedge.exe	125
PID 5560 wrote to memory of 2004	5560	msedge.exe	126
PID 5560 wrote to memory of 2004	5560	msedge.exe	126
PID 5560 wrote to memory of 4896	5560	msedge.exe	127
PID 5560 wrote to memory of 4896	5560	msedge.exe	127
PID 5560 wrote to memory of 5804	5560	msedge.exe	128
PID 5560 wrote to memory of 5804	5560	msedge.exe	128
PID 5560 wrote to memory of 6132	5560	msedge.exe	129
PID 6132 wrote to memory of 1616	6132	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Elsify.exe
"C:\Users\Admin\AppData\Local\Temp\Elsify.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffba28fc188,0x7ffba28fc194,0x7ffba28fc1a0
    3⤵
    PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,5306279675198473515,14283333647476070577,262144 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,11445121634154974601,12581302263885806901,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,14387689859804103651,10982113631085151958,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:13
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,6457502433939776937,371051414110022127,2097152 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,7345529058234310204,4171069100423898009,2097152 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,16021318444064733432,11741922158375489954,2097152 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,8367203186750867565,3938114744111023015,2097152 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,3377263033522420523,11563231568194209650,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,15199700160382325091,12195782967759542986,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,4944023050255461545,15010806980212394438,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,18370747638776890697,17126101573976740767,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:1116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5904,i,13813975354302615758,10347245668184821631,2097152 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
    3⤵
    PID:1268
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,18370747638776890697,17126101573976740767,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,5681289281067035509,3842169033866263157,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,15135447697130378914,15330105501070670565,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
    3⤵
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,10351912730004930077,16300908289274705637,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6908,i,17328675913226986960,10255535448519046583,2097152 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,2022109642605122870,18227556783311436992,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:14
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,15682467449300946139,16321627009218804317,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,17748803392125899152,15216468370069338498,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
    3⤵
    PID:820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,4334856090798147540,2820684229512998227,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:14
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,12937730127913797632,330503109189199363,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4092,i,12451754384942757957,5906554790072873509,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:14
    3⤵
    PID:1712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,9760613895128628385,12627647966233612170,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:14
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2692,i,1929142002118591627,1478071729262908977,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5804,i,6588774768706387967,4376212842435196507,262144 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,11350357871757719081,16148349724080432191,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,14344201232958130029,3170188805318612915,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,1323052973499344635,749527324026444912,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,11486544837368645158,18205496006048408007,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7484,i,13432974656916220812,10908445931183314835,524288 --field-trial-handle=2988,i,14460658477380987296,1933590818056389358,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x238,0x328,0x7ffba28fc188,0x7ffba28fc194,0x7ffba28fc1a0
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,6526867696310732022,15839438236216271673,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:11
      4⤵
      System Time Discovery
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,2952432119457705878,15579049162712720630,262144 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,4969516870588360179,11527697827895317293,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,16809965635373658057,9346684127815534970,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,16809965635373658057,9346684127815534970,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,15547025959653809976,3196925033102746505,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,16592760135863418533,11990641773051320614,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,146693186448734918,15803719882936696872,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,980531131254684165,2967214867760424962,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,16823881821704723904,10828382010460445361,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,7713246632005528140,13655244262120816102,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,6684401399832371779,6736246270299910958,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4868,i,11268837355371178610,14740254934453307108,262144 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,11141012876587393702,11097554335125707032,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
      4⤵
      PID:2256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,16226559493333049227,1431114409234102126,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:14
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,9188887215159693957,15469601083872834676,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:14
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,2784116964027468510,10570621973004829554,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
      4⤵
      PID:3876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,10790114005815573314,17332225237346243485,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:14
      4⤵
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3200,i,5494438008754154126,11092335221462607763,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:14
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4068,i,18403332295542437559,5459786622556857236,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:14
      4⤵
      PID:1812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,16991795375374011016,16589277843537068438,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:14
      4⤵
      PID:1268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,5058304902853193367,15254767468939988962,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,1391497863151237452,18345173797597304953,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4652,i,14787322983586679435,13022875369833884916,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:14
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,2814450173921903920,6061973395058513204,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:14
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,4317305026988220193,8231667352319182818,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:14
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,13629299513078612363,1919150972456861,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=1112 /prefetch:14
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4100,i,16687433000078609315,7035736051307830879,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:14
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,13636608314002377076,12106614167562415684,524288 --field-trial-handle=2252,i,73934118142042176,2491600222715546297,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:14
      4⤵
      PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5912

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
PID:4660

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:624

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35a098a6875f10e14e08bfb595d517cd7953bdedb921bfc380276e769daf61d8
MD5 35991f3c52f2815322e52e8cfd2b691b
SHA1 f76c5d8e4bcc176fb368fc3551f808c6f1303285
SHA512 07d664648fa09dcc174e2a59810d9ac038decd9234074ca6d32c340888a31964d5731a720f290756e7af52670186004965e3fb9e88447055c8b4161d5596bc29
TLSH
T183D023323D2A79D1D12520B595104274572F49937752D20F7555480EDC75490A3C6ED7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ed7705b6a42af248d127d5d4533d0801b2e299b4debe734b06a7d1f5d8ce58d
MD5 411d5bb111c19cdc1b73534a2e98ef3a
SHA1 00b5d245e8235091b1b76bb4a70773f1d2a8bfe9
SHA512 5c78f6cc8e04237eb31e20c749eacb7823dc5df3d710d78d8f379b0d6a5457a867bb9edde082cec24a0a3a6cba7b2f5af7c6a03112a82aede3dc71c40304fe7c
TLSH
T1FDD0A7623D197C00C50130B4681042645727C94BB651D14B7665840AEC064A0E7C9593
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bb892863c122beffe9b5d6c71de8e65e198e013a09b95df08d7e2d067608ca5b
MD5 e70df1faa5f012ff2ddbc022dbec065b
SHA1 bb7242cf31b4a18d01ebc4d4a49b6f814abe969c
SHA512 8e22afcefa5f23dcd5c13cc7e837276be06b35f2753f0e85c1b2d58a219b16ca96bf110b7707417178531689b391967989e466bce6ca55f257f00358386729a1
TLSH
T12DD0A7623D197C00C51130B4681042745717C94B6651D14B7665840AEC064A0E7C95C3
MD5 SHA1 SHA512 TLSH

Submit Download

4866c972-cb1b-4f38-a103-cb60e41355e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4866c972-cb1b-4f38-a103-cb60e41355e5.tmp
Size 414B
SHA256 58d83b571f7cb6f354fc11ee4cc20777234480c911d50c08fe2d2ed86fae9fb6
MD5 7e0b224c405dfbb9fc601518c0354d1a
SHA1 d2488dead40a4276b89518349e925e05e6dc44d3
SHA512 60552e3d9ba6abc97f89b808b098b561acb4557cc374ff0f8eda7abf7dc6d11145b15204fd654b1fb737ceea075ae048c106f6d35ec86ff0b97c6169eea4a997
TLSH
T158E02BEECC219C3719FC576A64A4078AE75113563BD0894B3B3C8209CF7167A058782C
MD5 SHA1 SHA512 TLSH

Submit Download

967dc380-dbbc-4f07-bbc3-873f1a94f566.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\967dc380-dbbc-4f07-bbc3-873f1a94f566.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 6483055e0f3f45b61b31fee5b347cfc26434954065255938c4acda8ce29320b0
MD5 038f882f77c25a1139e58532bd25cfba
SHA1 78e58ef63c391c9f1a4a62fed07e5259e667ea70
SHA512 faa3943fe02abbaea24757480a6feece0a1bc67fbbafffc7ac714c2ef6544382e0824dbe5ba47b7b458cad7f2dfc0e53bc9813bcf396f37a8a447413af49889b
TLSH
T1A1E0DFB8D7E2E3EC46C19806859CF754E900B10DA9CFDAEE329CA0C5B412282D727D82
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 274B
SHA256 aeb6efc855ee91f6497a3562cba7ed75dd7024722cb38f4702af787be885001b
MD5 24c598a5b4fbd82f3edc0c76dc47cb5d
SHA1 5482955f93843b1fbc3c85984ffee37522518aa8
SHA512 3517d5736616aaa923275b13728ccf9bdc9fd6339de23e393e616361c38affcff7fcd5606a6514a0a99b2ebcafbb9fc5c341bd681a350d91ee095da54a7c8d43
TLSH
T1CBD0C2BCA9CC684FD3E41AFD4266B0400F6442D25816DE120115F98133655F01F96070
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8b3ec43ec822600f50cfee6ac3945b281d2d1f78c657b93af6a934dbb332112f
MD5 189b7f51fdcd5dcff6f6efb761413027
SHA1 8a1fcd1615448c0833ac389a8bcfe1f70ca8fa8b
SHA512 ec3f76829f7679d81b3202959e0669434ed038209e8ef65dacaf8ec2b5ad8bbb5e7d0ce6b65c954d93fd3ea3dee6249d2239fab614b13abef87631ff5a90336e
TLSH
T12D71E9D1B461CDEEDB6541F3C1F11BA83BBCC2EE450BBE1AC35C6879F85AB588400A91
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599fb1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599fb1.TMP
Size 3KB
SHA256 78f55c72ad954d925579f28be89728a6ff54992a34c9dbba7878542bc1c774c2
MD5 d453cd7761411af8d76df5d47867bcc5
SHA1 7da7c85dfb5c49f92b77512d560e9c0a3433090b
SHA512 43b3f034bbdc1878b2ed435127351466c89772977719a8445d3bbc3e99744db0bededa465aeae13cd284b719d69e9c54f3d09dd07c5a80a24219d87b3d502fb9
TLSH
T13F61A581B061CCACDB6040F3C2F11BA47BBCC6DE450BBE2AC39C6879F91AB5C9441691
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 c2e47a62576609351722893eed7c4a47b5cabde5dee1cd60935121983622b16f
MD5 d3b27b8ab5bf48f7838936d526a357bb
SHA1 2c16b181f6398bb3e879f99ecebeb45209ee9e46
SHA512 6d964fbd70f31b0ee62b6962bbf724fd4cd0f3c94f076907455da2bb98b37d813c7cbeab4080f66330a889dd8b0a462727597a0d3ae264edf41e3cf8fcc5803e
SSDEEP 3:MsEllllkEthXllkl2zELgIV:/M/xT02z9I
TLSH
T14D440404FFD00D47C50030F44013C3540370D51407115747755154735DC55440C00C00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 828ba53b47f40dcd124212206fd3b4f3f60ed7a111245834a79650656f914fae
MD5 a20323be8096333569fdba0287eadaf6
SHA1 38c5d51f66eedb7b6d3b46c9b502f42219fcf273
SHA512 f90ad3625ed79372fd5e26677c937ab588a47aa49c4ddd0ef4ed3d922ce304ec03b5da3c39b1a8d25dbdbff7768e1c0f0263c92af739a3c10f67826ca404db4e
TLSH
T165E020D495C9C21B58E464A7427C5708E6F07547A6873D891B5C984B610138173C55F0
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 4c027660fd2d48f0d7bced97e0e2904d4a8f38f9c8aa57a33d4aebdab79d0086
MD5 f0540b6c2a6813671251ac4aa2a8b2f6
SHA1 eb3d56440650d1e0cf9c9c7b51921c5b1e35bca4
SHA512 f259aa5ed3bf4a9c74a49705c65d6e2da686f962479b75bb2db257cfbd1cec607589c2d85c83d5f6274d7af0f8e20e9a4153403d88585381d308e50c54d4a6b0
SSDEEP 96:6BCxD3vWRiIO0XqItzIKFWR840Xq64uXl87A307BMT+QFvWRFIO0XqRIK0hWRk4w:waDOMBj7A307BWx0mMG
TLSH
T1F0927307EF70B803DF201A77336A9434D77B951AAF8BDEC53C654410C8B3696A0623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 160cc67fd687ba12bc6a23f4540e36a6fadcd7fe02f176b6cedaa1c74622f9f7
MD5 1f7869af62d95e6d002ba4f84ffa3173
SHA1 8ca1424f27d882d70234ff84a05c5cb0c7e082f4
SHA512 c40713b379d7431c0ee3e7e47f73fda97a1f7434f2f29e083ea6118e730de7d2af45e9fdfb0ac98b8d059f4fa6d852488a8ed85116500d2f9fd888124f12f630
SSDEEP 192:45ZRDH+bF+UI3iWGVoWN3qL/1QtkVVV63:45XDIkUI3ijVoWN3qL/1QtkA
TLSH
T1BE24454F9F302612CD7C513669EB44A39DBEF02BC743A6DA6C654460CEF3A52A01C5AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 7d5b653b451cabd1ac77dfc6938942d56d9a421bc0c3b947ab30d494c8ca26fc
MD5 ca46cbaf3b36081404ffa58de8ba3104
SHA1 7ffff966a466b7ce7ed6f853b8a325cec5fbc8f4
SHA512 b9eb8e8e2b74d9cb08c41c4696d4980be1bc80b9bfea95073fa6e73f3c34a55b2dbdadc3d3fadd03fe66ab09465727f37519c2caad8cbe6eb6d518e2b3c4381b
TLSH
T18FE0D8A1C6DEC35E618420AB82397718E7B0350BDA8F2E896F08A880B005188A7925E1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c0e76b77303877b8008528113c83762697b15215461e26bccb850c3fdb283aa9
MD5 b7800ffcbe43cea79927fbf0f3c4d340
SHA1 992db643ebc3b733a9ff3ab3a1c93bc60e6e740b
SHA512 3133448cec0328f7a749da7086a5a48871568fec8f039a601f811dcc29e109e8cd8794f0222eeaffacad28cf401b112a86fff23faddbfaebdb3555d3c59192ee
TLSH
T19451BEF787E4856ECA1195F0AA18AE2FCF2D0515432C3C6A89E4EE17D3E3471E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b2ec294722ad5d21a876116053d0d65b410d7098373dacc554c8ea92f71da98a
MD5 b987126daa8ce3d4e7a4fd88e3db5984
SHA1 d94eff1aac9885424575503eef20972f5372abbe
SHA512 818549987bed8ad253b47448622ea6bac334ae8458bc14e34c7d41c23b64885c4621128d93f5ece1ea2ced74e4d1c491337879e643a3849822bdbb99b30caf52
TLSH
T1F551BEF787E4856ECA1195F0AA18AE2FCF2D0515432C3C6A89E4EE17D3E3471E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0c5eef30e1157cb5c98e0874288eb34b9ad2f53e8a9170a29e475462bc3338a4
MD5 d8a909fc5c7d1e91328e62d741381105
SHA1 9cd570c6c00a1ff0291988a7ab9bae9c6f622aac
SHA512 652dcf036d4f754b43dfbd93cea68ca207d645e0ec538fab17460e5f913b37ebad4a857fda32d4c68f4391d529a83eff786f7fca4df5ab43f83b23ec1560340b
SSDEEP 192:sxRhRbyM/jK1Ml8UQclh/fCsTWpVczKYZ7j2kzoA8pLO/g6+WN3qH0/An9GFglId:sxRh7quh/fCsTWvczKmWy/51/22
TLSH
T1F472EA16A5349977CCDBD21DFA55BF53D6F81563A2D04E44AAFCCA0C00E7AED221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cc943da078303d7d7e7d29918cbb8b8b72cb1a5352cdc961c63952a66909db12
MD5 2c4a845ffa18ee6d1ad02b51681bb85f
SHA1 122ba2f91f55e358880d36580846568ab6afda9b
SHA512 eb1335cc2e7a478e29b718736a1fdcd8d8dc5a13ddd3d14eed5b31f89289491637126f10176add7b2f02504492599ce36ea2eaaae9b8595bfa7a7e0bf8c771ec
SSDEEP 192:sxRyRbyM/jK1Ml8wlh/fCs0zuYZ7jLkzoA8p9O/g6+WNZH0/AnZcXGlIgtJ:sxRy7Th/fCs0zumhQ/5O/m3
TLSH
T12562DA16AA349937CCDBD219FA55BF53D6F81563F2905E44AAFCCA0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 37238efa5b522aea6d4055d23fd5af09af3557dd554d32bccfb7cc0a084c1590
MD5 070a7c65d01a000bc17f1f98a5db8846
SHA1 8e3bccf7d2e47f700cf64dd8e28a0fba37a988ac
SHA512 7b6d93eee617b333f4815a1ba80f199c24cd76547016200aa1f61a5ab9dd1abc9f278ee9345ebc35f57ae85d3be5e51c386d64c2b4a15016bbf3f18882c04d2f
SSDEEP 192:sxRhRbyM/jK1Ml8wlh/fCs9zuYZ7jLkzoA8p9O/g6+WNZH0/AnZcXGlIgDYJ:sxRh7Th/fCs9zumhQ/5O/mY
TLSH
T1D562DA16AA3499378CDBD219FA55BF53D6F81573F2905E44AAFCCA0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 06e98c611fc97e126b83f4ad30932f05c071fa161e651cce8f0add65614b616b
MD5 981ab80e9b955269d3624ab9fe95a39a
SHA1 a129be9eb415422cec75c51aaaa3f3275fdaf781
SHA512 5cbf80b46633ba59c847ba0a9659fbe968d8246341c27516da90045378a0e8c75567e32d849ccb7b8167ac79b2298abdbafdd58b74f7c7291fe5639ced0f0d86
SSDEEP 192:sxRhRbyM/jK1Ml8UQjlh/fCs9zKYZ7jLkzoA8pLO/g6+WNZH0/AnZeXGlIgDeJ:sxRh7qxh/fCs9zKmhy/5O/C2
TLSH
T17262EA16A6349977CCDBD219FA55BF93D6F81573B2900E44AAFCCA0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 37a55da692af929bc661dbe752d252626d126f14e5cde1aa9d7f0c32c394f3c6
MD5 d73f3badea633ec47fda688ce1bec1ac
SHA1 b9651f9181cd2b1100579e535845e4f636f46296
SHA512 80a757a27f9657b0ce0b9557a6f9ff723da750563a2c78fd2befc70314f3dbdd2edd24e7c411e2eef188f0a586dda348f97df98dc39dada5d88d4465796cb2ec
SSDEEP 192:sxRhRbyMqZjK1Ml8UQclh/fCsCWpVdeYZ7jCUHIkzoA8pLO/g6+WN3qH0/An9GQQ:sxRh0quh/fCsCWvdemy9y/51/3Am
TLSH
T1AA72EA16A53859778CDBD219FA557F93E6F81563E2904E44AAFCCA0C10E7BDD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3bfe7deec9e1794254872296aa5bc265dbfffc16789fbc87829798af0283d204
MD5 89267b28b1c4f58449f9bb6775f7179e
SHA1 f37641d3c72feee08249dc86599f5a1398793b2f
SHA512 bf8734016b0cefca286dc9a65b21c405f87b6885479376f03c0606025f85fc15ae04e7dfc03c3811006b9399085926b637818012ba4523f1e324132c2528b280
SSDEEP 768:eOEtpf7pLuL7ZIWgKgf168F1+UoAYDCx9Tuqh0VfUC9xbog/OVHJEREkTqQqro7R:eOEtpZE7ZIWgKgf16u1jaSJE2/QB88oc
TLSH
T12AE2DB3B680CCB7E4F80499CED297E9E6DE801CB96D8C95447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 6dd8c04e8536eeefdaca45afaa2346f371ee03b7cf378f339ba51d58e047e094
MD5 93a557f2f4a05225457996edb9f19006
SHA1 0243e6c3b585b961ad327bf3d0cbd2ce3f54b917
SHA512 b36b6b8053209958dc88b8821d844e207a3d403e3efdfaffcfe935465f687d17be9a073634b8cd81679849896ed889a181be946f96f47c3d06aef97fd2f9b8cd
TLSH
T1F7E0209096D9D27E70D6245701789708A2F4F60BDACB3D8A5F94C8496182644B3D35B0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 2ef47bca57beb9f6f4f5b81b0016963c98189e7e63c867d34ca3cbaba1d8fd4f
MD5 9a2a117c47bd33ed1bf8a5b439c0ec02
SHA1 96d0261eef208b38b95ba299f71e446049fd95bd
SHA512 6cb2415af8f822b4ea9299d8aaa838933be6034d4c3253c87c30a8df58962baa4108b591bd0f7d99561ef1c836fb1a2a9cb6b294f983a15c429999e5383b5081
TLSH
T15FB0128AFF905126C8CB8C730D904BC07720F053110085038814CF1A9C15B64AF05DD8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 b0c0930b6d8f23a80bdc9c28e73a27a9f366baf3337f2ed153f74d11f1b73bbb
MD5 e795181e3fe6fddf7c2378a719c414a2
SHA1 4f333d42f017766066c92c4b000b31cd48e51a86
SHA512 db1f89b37136b43711d6f47a5b16f3f2f3f64f7bdce51e5b54a510e8e1fbe0a2dfebcec8841b9dec9b410831bb99b78cf960b826b26752bf2b68da5f46096082
TLSH
T1F6E0D86096DAC36B62C52497527AF308D6B2B507DACB6D992F0CB49062466807343691
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 43eeb2bb722634e66de0a748cb526b20ff184637a9591d5c048bc20d3ec90035
MD5 6d2027caff249735e556a74300cdeded
SHA1 ed4819d75c0f39e313db4ed8e11f6f9db1682646
SHA512 e8611ed9326777c257978ab3e8ac1c852d51029ae5a04c31aff81c316fe057386b8cc77c41487941e83f4aed4711284b8312729530185eb37fcefaa943720bd2
TLSH
T1B6E026B4C6CAC3799584649352BCA70DDAF0FD0B9BCB3ECE6B0C9480F141680B3A6D90
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 044c9fb5a63572dd4ad386f71749679d3ee4daa1f5880e609fbe2e9fa0644197
MD5 4e58dab2c44325ac2ecb39f03f163ebc
SHA1 4384f168bd7b7f0d08a760063a94b61ee73d5e78
SHA512 02f2236aeba223dca48219ba6c2fd1177e6641323e0d86cad7ee6099ca8288eef6c54f9345532e745d3c215caed79425a94a005326c271b946bb59ac003f2b7b
SSDEEP 96:K0OcKnq/9qbuFfVpH8x6eqNHKCGqzHmnvyh5M9li3DlnHB8j8cqLBKCoqlBmt1kU:a69qbuFfVpcx61NXGqzGnvyh5M9li3Ds
TLSH
T1FF91F29170B72301387D299DA5A1956E72513063346E6ABA3F6C30D22A2AE410FFDDF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 2732a37e03b497cc3a1b22153ab13a5c011df4a053e0108348b4111a9b780d62
MD5 75d2ec1313b978a3eed33874e9bb16b6
SHA1 6e32f78f2682da5c60d1f8260e7cf2c2ffd69d1c
SHA512 22096f5f64972a79318ddb57c6851370f16b4432f6f95ca43f9a28b3e74dafc74853473b7d9fbc9d9b06f00149b3f11429ed3e19d5975049c61c90d409934fa6
SSDEEP 192:zQ0IIIrb7MIM9cYcYffXOLsAsdl9HMQ2s+Hzb:zQ0IIIrb7MIMWBQGLVsXB2s0
TLSH
T15572945AA6410B33C69F5B76037AC248D7D58C420962E3AD74A16C0EDDF3FA781D26F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 2227e353f8fc17af1514852a27ffefcfac6e3afefef266ac75fdca6a5bbd69e9
MD5 6f8b9680262d6b30b00ad58508593814
SHA1 84f9db5701b540f360c0a13b2b900100a85aa0ef
SHA512 f09ebe8a384ea21e3692630afcfdd5a1e976550098894a6280e69c6ab3d4242f2d9a6bfe488bc05d94c1c6e6defd5379796dd658af941819a6542d9092c423c8
TLSH
T193E026D4EACAC26FA1993097013C530CEAE03A1BEE8B2DCE1F08C448F401280B3869E1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 85b7733eb4a7b4da0c85752f25531fc4caaabed1141aa7f8cc01a27c6d2b9e2b
MD5 028c0ea3bb6e38e88e49ebef86dcfd13
SHA1 98121950af85764e858155d8da267fb4fe6b2950
SHA512 e3717c742a66e832e9f8083a65a0263a1b6abbc5c2c772e4b54810eab89f72ce519cc188cf4a1d8957ad233f931c74abfd9d2e063c19f4e687085cbcba6b0366
TLSH
T154212659F330C009E14A827E647F9B390338E8168FBCEC0F947A20356EB2A440E4B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 a3e08cd3744e9108ec8506c72abc4fa8eb924385543608621eaf37b32f59f06d
MD5 f720ddc71b7142b5b3f08d8fc54a6878
SHA1 c2a8a528b17f5f71aaabf18ea3d72c8bcde71488
SHA512 b3725e5ee14c1c688a8d627d07a28c55e9bdab744f5980b8f32957a29bf51f5be9e18def2104142a0f2b831968d51ed48eda79cf4017d64af45d7e1d40bf92be
TLSH
T12AE020D0E6C5C2AF519424D3017D9388E6E1390BEE872E8D1F08CC58FA0138173465E1
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0ce2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0ce2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 25a94a13ccef8f6cb1412c75007fe107a88f2edd38da10a27e72d73e53050e1c
MD5 8212387ed4b3ea219deec5a266ad8785
SHA1 2bd484a2706915483b6a1c481c7d488f6a36f3c7
SHA512 78379f510878b15f869b916d999549aef86a0f9ff849eb6122bd6621ae37c0c3e10924daba2d86b8cf576c9006e68b5951031f7b9b4a8419ec17f351b191decf
SSDEEP 768:lF3j+9I3jwgMeVKfcOafutV5R4HTytYYqgHvP7B+oKHN/F+0WvG:m9I3AfefWWTwJ1+oKt/FyvG
TLSH
T1B62337F688D7897AD8AD9B87633D2E4699BCC263B1845594F7C80E0CCC975BFD306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 605bbc3ae2fb0159adb8799279f4f20937e4658a610c6f658c3416349e3d4efc
MD5 66f623bbfa7adcb62e3f1dbd367d5869
SHA1 5aa4ee5cee39f6497427f0198e1fe28573284157
SHA512 e21b309f3dba612c953a49dbdaca9069a34f69915c7512b45912ee37560b587668985ef703fd8fb7b451236c2c7a2ce191515ce1ac31c63c5742cf8fafff00ac
SSDEEP 768:fF3j+9I3wwgMPVKfcOafu8fiQVV5R4HTytYYqgHvPwYDKxkyu/+0Dv3:Y9I3KfefBfiEWTwJLDKyyu/nv3
TLSH
T1E733E4F98CE7893AD8AD6787673D2D5658BCC233B1A45594F7880E0CCCA64BFE346805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f2a5b420eeb36ad03782cb53bb18c9a0b6121afa1e0cd182d576b8630094c5f0
MD5 15a5c51cf62c5cf55a89664c834a45b1
SHA1 713fdc0e52eab2a9072e0835806400747147a75b
SHA512 7919eed1517d11f558596758dd86d6a85019519e3b35d565a47dff41bcb5144a070bb104d2756ee8034812071a781e09b7b009c1cb4c3c1d5bc517f3d95954bb
SSDEEP 768:Fj+9Q3t5yPfcOafu8fiQCV5R4HTytYYqgHvPw//+0Dv3:w9Q3ifefBfiHWTwJe/nv3
TLSH
T10FF2BF71ECB89CA71DE5C695B60637CB6EF8027392C02B55D9D85F0D088BADE174B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cbedd93dfb44926fe7ab04cbcafd1fb5d44eaae4f8068507790e0af27ccec1af
MD5 d4179c6c26662647915309af5bb11f8d
SHA1 b15c5c0e10b38d43499c9b1b7be4b0e7a817e026
SHA512 788d808f24c0db8b353662ab0b74208b4b8a10781dff1748406de008edf36ec43b53951d28a9c19873cb3075d10bac6e9a3ba5fdb2070d9242aba4cc0d51e5f1
SSDEEP 768:EjaeqD4MlshiLdMma3NePfcOafuxV5R4HTytYYqgHvPguyjWtxjTo:EqcjhIdMh38fefwWTwJvyj2y
TLSH
T1C303DF7AECB85CBB9CB29581770277976EB842A3C3C52B64D9DC5A0D019B6CF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 973bb7d32a58e1bb8befbaac6fe902fef5c028bb9647a230f0c265b45cab710d
MD5 fe000ffb40babf3d627ad203a8dc0ff5
SHA1 f9400c3984a5ae611fe788c91e86260cdb058b19
SHA512 61558c9a225ae86d90111a28525671e0a348b429b91d35c5e728d5ad3000dd6199a98f433875379163794ef029d73001ca40a93430c3a8a221b6075a3441bfac
SSDEEP 768:tj+9Q3mtyPfcOafu8fiQ9V5R4HTytYYqgHvPw//+0Dv3:I9Q3bfefBfi0WTwJe/nv3
TLSH
T107F2BF71ECB89C671DE5C691760237CB6EF80273D1C42B55D9D89F0D088BADE1B4B80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 6dceeceba718a6f58a2e8cdf1914db25fbd9c841fb5e04c4d80381ee842119dd
MD5 9b0559a892f208a944049ff5fb961f76
SHA1 b22c96360604398cfc9eeaa552a65c9958760029
SHA512 ddbfaf8df68b8dcf6a427a5c09bae80fbcb758176756dd64cb868392193ccd2f672512b1b81092b00f7c312407d897a77fc110cc2d49734aa783d2f7a55ba39a
SSDEEP 768:fF1j+9I3mwgRpOKfcOafu8fiQ+V5R4HTytYYqgHvPw//+0Dv3:W9I3MfefBfitWTwJe/nv3
TLSH
T1BB1339F298E78976DDAE8783673D2E8699BCC163B1845590BBC84D0CCC875BFC74A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 801a5e82e9c48d0582904ca39393f9b5d25041dd57d5dfe69262588112ad71d4
MD5 888e39ab02d5a440ff40c5440d0f2a99
SHA1 425538db18c866e1d8f7e39c24919d678f563969
SHA512 679d44011375b4f737adee3c4cb6ccf0257e6d0cbdeb3d89d4998bd6149edde880b51f9efcc3e5d04fee23fa691a053e2a870ab7c217eb7433327bd9912aef9a
SSDEEP 12:TLJYJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3iscQQtydek5zcQAJW:TL+j0afDdWec9sJVUOOkys2Vjy
TLSH
T11592DF2679352473ECDA477ABC5349E10EBC175EC9A7B8148ED40C6209B1BC2A2591FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 4e083843d7f9ab9bab1e24463dca4d6a37b5806d6293ae38d074f03decbef922
MD5 37ad11c2f7663670bd1e611af0f172bd
SHA1 970afb29d2d92d88ae250dd980872c82171428c3
SHA512 f61fff9e488dc56e5553e55d6a26443ba29d98ac65d4947067cf837abb131dbe54f7e4b3075477865004b991c2fb6b6ab2cd04100c7c9731beb2675dba4ee728
SSDEEP 3:MsEllllkEthXllkl2zEFll6ZKlt:/M/xT02zvZq
TLSH
T1394404047FD01C15CD0410304413C3501370D5104D5157C334510513DCC75405D5C444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ae2e75c1-a9ce-4352-8316-c3b09c495c1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ae2e75c1-a9ce-4352-8316-c3b09c495c1f.tmp
Size 1KB
SHA256 2b7c607fd6a639934c6f7311f36aa760dd4a600f84b9f8e2d066832856488091
MD5 a36353281ee63c90e6d74b67255fe9ed
SHA1 f8aa66a70fe63c5f2aae1964243c68b3617d9c57
SHA512 9950368809a0ccd2b7cadae6c5ad4af6b981a19210a81b38ebe99aa0a683ffdc822d6bec67c6e4cf1ddbf1d47b71b7aeae4380c6552f5d5b6298fb649949ae69
TLSH
T1D3312FE25C2D1AC1D0BE0EEFE48B29EC84E8D216F19434392898ED94567D91E258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 21075672ed04fcc0ad86c96036a015a0479bc539f9eb22ed2ee07d5f51ed51d5
MD5 a8b716843d7c8f9dba996daed984824f
SHA1 0c96d6d123c2416eb76b7da62e37d23071beadb7
SHA512 5d339045c75561891f8b131b85aa5713a39f0c762a24cffd19d9577849262e259f66a06264e6b97d4d7a2b39170891003f4bfd55c6f8d31f9da107ab6548e117
TLSH
T1DE21F0E15C3D2AC1D1BE0EBFF0873AEC90D89216F5D4347A2898ED94823D91E158187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ae32d9950928870c88235c4c17204b62b83ed38c436c2dd65ff80e018454fd14
MD5 1242319dd708adac46dfcb9d40c77068
SHA1 dff7fdf5059dcaa1f995142f3980df184021fc44
SHA512 5d2bd511e97055ebc6b00ef355284a011fa67ec5483ad8ca69504713c30386e967955c27411472de128ed8661c16bd2a8289de30d9be2b75dc6ae33bcf2e2395
TLSH
T14B311FE15C3D1AD1D4BE0EFFA08B29FC84E8D216F594343A2898ED98567991E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ae3abeff1a7ac2b396b3e38dc9d2900c37a4fa3623cd6a74cdc34b502978149
MD5 d7023fa4d2528dc28cb0aaefeff697bf
SHA1 a9d914b66ca62916a33ca38b55ff971687cec7f8
SHA512 a12e587ee1c0f13ff6b3da22343b7611d6985799073cd0898decd626042b0e3a69747a3419b461a74ae1dee8d439eef7f39e61fafbf6bc2d3be40d501161b36b
TLSH
T13221FEE26D6E1AC2D1BE0EBFE0873AEC54D8D21AF1D4347A1888ED94923D91E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 df444b5ed91161c5d2e84013e91e57a28fbbd1e4302590bddff64bc98663199a
MD5 cf37b72670448143ffb4009cf7ad060b
SHA1 e2e210f06fa8d4857fc11a37a890b02f672ed738
SHA512 5f6b4f3a776ba0f062d4fbbc5e594ca2af360bbdeaf0fcbb1d649d6f58cd39e668cad4551281c2374c3b44e3aa54648011bd878f27eb16660344550443d39f5c
TLSH
T18B3120E25C3D1AC1C4BE0EBFA08B39FC84E8D326F59474392898ED98563DA1E254047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d4f5f34a25513ebb2dbddf60319142763fcee96a7e387c538e1a60e9faefc72d
MD5 67224293206a594e6a8de4215a2a12e1
SHA1 9769d03ac519a93bb95d80edf413fec20a9638a5
SHA512 6701b6b07a8362d368e2e44b0baad8accabd38f99e499fc4f26bf595df04a42e45b37ae452a92aa2dda013b2043fa334d45d5a408d8fbf6ec0f37e77d437c214
TLSH
T10A3141E15C3C1AD1C4BE0EBFA08B39FC84E8D226F5A470792C48EDA8563991E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 93f18265a715e2f600fba3e696fb5ac85385ac6c579f006b602cf207fa28ac92
MD5 95002998815cb7e1873e6fa83c4c5248
SHA1 ec9dea284e263032a968a61a4ed6c7f8df1b4b68
SHA512 df6009bec4c9a641afa6118b9c78510898b85a38add6ca7a42779dfe79131842c00ec03857173b891ca9f65eea0e95220a2c1b0ff0bcfd684a3b610633296969
TLSH
T1534131D15C382AD1D4BD0E7EB49738FC84E8D726F590347E2C58E994467E64D258183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f6c1848dfcdad34efdbffe7e9e4357c38a29f518705b3af2f88fbd5daff0ca45
MD5 7afae7d0cb0566d6ee0ebb06791bb709
SHA1 f43ceef01a690948d596c25ae133aaed9ab6de3f
SHA512 cd239165a4d078e5df98381a9615a855830f69a238d0932067f255b9c4fd656b82e4b47941a14bdf6065592fd8bec020b87b6c4e1163ef9852b60a054cf374a6
TLSH
T1955130D05C382AD1D4BD0E7EB48B34FC84E8D726F590347E2C58E9944A7AA0D258183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
MD5 d3c09492385327b4a73e8682955af55b
SHA1 240fab0985703fee85cf6f4073e03764bdb8aa5c
SHA512 09a4d78749d0d19904aa74f079fa2811f4b5de2b62305c89fc775606945a876578959e3f95cfb06258b2450dae9c4ed8a80ecdef86debcfb139ef6a47615ec6c
TLSH
T15A11F0D25D6D19C2C5BE0FAFE0877AFD40D8D216F194707A1888ED54427991E114147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3489c67589d11382f649439c79a0c832b6e49f2c9809d163291be01ca4ea7c46
MD5 e090b1e8aa5233a6b4e28e3f7303baea
SHA1 5c65bc9f725e2bd4a99b7b8606fd1161c942d482
SHA512 427144d1ee99a40e52b584c676072af484613952acbfe07de2731312ca11dfb1300a4add92f1978fafbb0c04bdf72db9851cc05435c049d23c126ce52921410a
TLSH
T1BC4142D15D3C2AD1C4BE0EBFB48739FC94D8D226F59434792844ED94563D50E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2630367e8b5ed2b717cf0495605456b345138e71c95960d3b68357c8c5213d8e
MD5 6fd7771b6d3cd3ff58aa6dded1fc6696
SHA1 26484975b0092e7e9163e0eb3e67850356a325a7
SHA512 d41e027caf9ec9c6e70342af39464752b75bee28d823e13bc793e8fe8854a0e90fa3ce74854c9174fb93c02e908d9490748322c59048b3560e64d800638ac3df
TLSH
T1304141D19C3C2AD1D4BD0EBFB48B38FC94D8D226F19434792C58E954563D90D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a2c8edb1a03770a12aa5ac9d0a836ea72bf71721fa39d06c7b59cb4403e1a8cf
MD5 d1ab6b2595be4c4cf1a63ea8bad2d758
SHA1 6b86abced81be8d070727ef7db581db1c27de215
SHA512 d3df5caaa929db8e0e719d801c44869b2d6fa26c035cabccedc20a80a126578d6997aa0566690eb20abaeabf24117bc4c41fbbeb23c26dabaa7a4b3c7338d059
TLSH
T13F4131E15C382AD1D4BD0EBFB48738FC84E8D726F19434792C58E998467A60D658183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 80ad61194d7a2aaa813f5b8686bc887c10fdbdb39cb81f3ab832331ea59eacf2
MD5 1ba73e30253beb55fe27b923e9d943d6
SHA1 4116ccea55d58231960687d530824c1c14241347
SHA512 a91c70b062091ea0f0359934b84690656530708474bf7a36a3dfd65f153b2fcc914480a4b8142e87466adc73553bd9b5c53470e5dc742870a9041d7155f7b118
TLSH
T1D65162D05C382AD1D5BD0E7FB08B74FC81E8D725F090347E2C58E9985A7A61D248083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bb49dee9ad94fc1a743784956b7752a6d8b5bc0d26bc3617f5a12d3a78ac5c4c
MD5 f9bca9fe817e4e925042d0012d37418a
SHA1 82ef3b5c084534bf24fb0d17981f365ef1128fac
SHA512 e024b13445c8edba4f0f8aa0ab0656fffaed99934daeabbb86713117919a54f0eeed474b05514e4b24e8b380e769976495eeca3ba98fd6f9c1cc22acf0d60ad0
TLSH
T1014140D05C382AD1D4BE0E6FB49738FC84E8D726F0A0347E2C48E9984679A0D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

e755932b-d9b5-4762-bc28-f5c73a477e44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e755932b-d9b5-4762-bc28-f5c73a477e44.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5560_410559411\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1162555988\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_926470860\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_963159915\edge_checkout_page_validator.js
Size 1009KB
SHA256 04047fbad72cb02b113ee3a1f1823227aac74e1615fc5fa359d11776c727259c
MD5 21147b0280aa959a020d50a7d5738f17
SHA1 2e57c2a0e0b2c1f1cc78acf1a8fbb833c01b984f
SHA512 92db10d864968ee94156df795552867723aeb7ef03341e00c7f8cf11542a8443f83e1eb2487631ed38b441d4af751c8f4b3f99319312e50d8501df74263c01a4
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErg/OUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErg/OUfq
TLSH
T1B5252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADB0F94723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_998718224\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download