5774e8458e786e3460d514752a64095374e749fcc9d2292cef9703a9569650d0

Analysis

user interaction
yes
max time kernel
74s
max time network
76s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Message.eml
Size 22KB
Sample260625-hs221sat5m
SHA256 5774e8458e786e3460d514752a64095374e749fcc9d2292cef9703a9569650d0
MD5 8d8a85aea634a834b1fc90fdae794792
SHA1 fe115e0a1b3b1b4b9c271710019695f528eeddff
SHA512 88380f7a255638f44bcac4f83be970a1b8a11f0ff1a6a37c0b77b58df55aa34c65d8f8d61478c5465d53e19caa42f52453bf9d26985d95119df2be33c91d82e3
SSDEEP 384:NllitVXQuJTml3OddrjvIUbucs4StJmIF97O2V+e/EcmlBj9ZuSaJH1RLlve6:xIVXC5Ov7IUFSHF9a2jSAVRxe6
TLSH
T1AFA2F8B542021C679EB35260B0113E8572A0AC99A57299E0F42B353B2DDF8767F3B7CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1224	msedge.exe
5916	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268445056735519"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{1C3649A3-69F4-4AA2-AF42-926B98DBF52E}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
4820	msedge.exe
4820	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5112	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 4820	5112	OUTLOOK.EXE	91
PID 4820 wrote to memory of 4796	4820	msedge.exe	92
PID 4820 wrote to memory of 3748	4820	msedge.exe	93
PID 4820 wrote to memory of 5916	4820	msedge.exe	94
PID 4820 wrote to memory of 3748	4820	msedge.exe	93
PID 4820 wrote to memory of 3748	4820	msedge.exe	93
PID 4820 wrote to memory of 2012	4820	msedge.exe	95
PID 4820 wrote to memory of 2012	4820	msedge.exe	95
PID 4820 wrote to memory of 1380	4820	msedge.exe	97
PID 4820 wrote to memory of 1380	4820	msedge.exe	97
PID 4820 wrote to memory of 1380	4820	msedge.exe	97
PID 4820 wrote to memory of 2120	4820	msedge.exe	98
PID 4820 wrote to memory of 2120	4820	msedge.exe	98
PID 4820 wrote to memory of 2120	4820	msedge.exe	98
PID 4820 wrote to memory of 1840	4820	msedge.exe	99
PID 4820 wrote to memory of 1840	4820	msedge.exe	99
PID 4820 wrote to memory of 1840	4820	msedge.exe	99
PID 4820 wrote to memory of 2780	4820	msedge.exe	100
PID 4820 wrote to memory of 2780	4820	msedge.exe	100
PID 4820 wrote to memory of 2780	4820	msedge.exe	100
PID 4820 wrote to memory of 1636	4820	msedge.exe	101
PID 4820 wrote to memory of 1636	4820	msedge.exe	101
PID 4820 wrote to memory of 1904	4820	msedge.exe	103
PID 4820 wrote to memory of 1904	4820	msedge.exe	103
PID 4820 wrote to memory of 1904	4820	msedge.exe	103
PID 4820 wrote to memory of 6124	4820	msedge.exe	104
PID 4820 wrote to memory of 5908	4820	msedge.exe	105
PID 4820 wrote to memory of 6124	4820	msedge.exe	104
PID 4820 wrote to memory of 5908	4820	msedge.exe	105
PID 4820 wrote to memory of 5992	4820	msedge.exe	107
PID 4820 wrote to memory of 4436	4820	msedge.exe	108
PID 4820 wrote to memory of 4436	4820	msedge.exe	108
PID 4820 wrote to memory of 4104	4820	msedge.exe	111
PID 4820 wrote to memory of 4104	4820	msedge.exe	111
PID 4820 wrote to memory of 3232	4820	msedge.exe	112
PID 4820 wrote to memory of 5028	4820	msedge.exe	113
PID 4820 wrote to memory of 4436	4820	msedge.exe	114
PID 4820 wrote to memory of 664	4820	msedge.exe	115
PID 664 wrote to memory of 5756	664	msedge.exe	116
PID 664 wrote to memory of 5840	664	msedge.exe	117
PID 664 wrote to memory of 1224	664	msedge.exe	118
PID 664 wrote to memory of 5840	664	msedge.exe	117
PID 664 wrote to memory of 5840	664	msedge.exe	117
PID 664 wrote to memory of 1388	664	msedge.exe	120
PID 664 wrote to memory of 1388	664	msedge.exe	120
PID 664 wrote to memory of 968	664	msedge.exe	122

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Message.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://eu.docusign.net/Signing/EmailStart.aspx?etti=66&m=44d6d7bc-e520-8e07-8033-34033597f233
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffa2655c188,0x7ffa2655c194,0x7ffa2655c1a0
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,13967933269706982166,10401464587551565943,262144 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:2
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,4391435018038659867,10823941836993298837,524288 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,6823289384843101739,14751944846012490641,524288 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:13
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,15719799709680361201,626796764836332881,2097152 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3660,i,10110633187622943286,17079813719045241248,2097152 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,4072684979583641356,16977493106756100612,2097152 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:9
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,1702460851765829606,11327463503970817686,2097152 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,899109552292472757,12731961219898687765,524288 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5424,i,104583300210646175,12664666568197763839,2097152 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,8149540515217606782,4123510763499269496,524288 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,4848831535642341097,1789068620054906091,524288 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,7846956484648243067,6286410670436109653,524288 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,7846956484648243067,6286410670436109653,524288 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,8398776585968996313,14810657838383095310,524288 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,10417399273007289226,15662861830711383259,524288 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,6583475162516333758,16081198020214304016,524288 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,15593149524597058730,14565948990750425163,524288 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,5423228141500483170,7223571495928047202,524288 --field-trial-handle=2668,i,15681469369320861484,17854450017228628644,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffa2655c188,0x7ffa2655c194,0x7ffa2655c1a0
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,9148320304216781811,6703793003810498369,262144 --field-trial-handle=2172,i,5448137781529349392,7484752227675281744,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,13446703019153510070,9456830252380393995,524288 --field-trial-handle=2172,i,5448137781529349392,7484752227675281744,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
      4⤵
      System Time Discovery
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,7115447374679715131,8856638000866607607,524288 --field-trial-handle=2172,i,5448137781529349392,7484752227675281744,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:13
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,17078680085330977040,13214132805000644017,524288 --field-trial-handle=2172,i,5448137781529349392,7484752227675281744,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,17078680085330977040,13214132805000644017,524288 --field-trial-handle=2172,i,5448137781529349392,7484752227675281744,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
      4⤵
      PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 287d0e9b1aa3787e3aae8b02fac102b52eaf99a89ff8e3ac6fc838945b42abad
MD5 c9c5559e55069ed7a3ad59efdf17fcab
SHA1 e70b6736781c4f31fb39f22c5801fe3f419a09c0
SHA512 f37d42c80d5dfea9d61e5918cfb894c09c8ba4a12b9e987a6e842e756a110c8aa549c5728f47c5f984aed4cfc000038286fd1e45cd0edd0319388b662820eeea
TLSH
T162D023713F167691D10510F495104121533B4C9337C2D60E7175C81EDC700D1E7C59F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b7e24cfe4830f8805a8adcf7aa78d20204334945eadacc05c85c6d720c21def
MD5 3f467326d36aefe6bc26544657f620d4
SHA1 e08edccb5ba082e3e1a01c5e43989129e929cc66
SHA512 520d4e4ae970356e16a17ffc38b72a2fabfcb9fea0922e9877ffeedc35289e5c5036bc1a5a3c8f0002c67e3316b5ae4433dbe4b4dd6a05638bf9b1b6d7161623
TLSH
T130D023F13F467600D14111F06408917173778853BBC2D50A7135911DAC705E5D3C60FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

3194aaf3-86c5-47b4-a706-89be86a9804a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3194aaf3-86c5-47b4-a706-89be86a9804a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 985a37e12416be215257a85197b6ec6e8d3082b4c4d20a73622f784cc91b54c0
MD5 7e7b296a8d512f1c3726716d5f56be3b
SHA1 b15de4cbd5e84f3ffbb59c45232d8b6d3ba7b3de
SHA512 48f33d8b289cd0bdb0fb2234a3760523fd96de91bb245c32d9f0f15f28e3a1fa432adfc217c45f6931a45d491664003a710bf01ac5001d11fbd38f4f593c440b
TLSH
T119E02BAEC8219C372EFD476860950746E74213A72B50586F363C43088FB5E26469781C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d4f36bb6e0f04c885620b3ba28822ca69643203b6ca77aad2b487fe6db4834bd
MD5 28f7116c0f7309edd2138d0fdce9b9fb
SHA1 3f740c81284beec096473b7aeec87f5a1bffbf5f
SHA512 3d81fe57b1982a4bec97224a49380c527f5dde3368ad96d43eca148a6a63ee1d4b650c7ff663d6f1c05c21f33e0b0e9fd9b16ee4e911a8cb3d7e55920a3b91ce
SSDEEP 384:6uFx7iB+n26/gXn2v717iILaosgnLDsdqEnhl+G8ij:6atiB+T4Xn2D1uILaosgnMdeNg
TLSH
T14213F5BD7A468C96CAD6217C829F9B3A3739D7ADDDD161F30B3A3030A3513427A0E116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 461d676d2b8d8a172f203ed616d6b74670ae55740ea3ce1bd76f308fd05ea1e2
MD5 b59150e63d7467c22ffed26b9c29f15b
SHA1 114869337f6f4f199fd29744562a4668d4b1ff25
SHA512 68c1529c3d3718ab2d4ea550808056487609a34eacdf5c0a59e62b96c7a9962ba4d9ef5e86c21d8d056c5bc14d7c0140fbeddb616267b0df5f7baa6533e17129
SSDEEP 3072:xVqL/RL//9hpzXAQu2yj8sGAPMAozL/IL/QL/:xVqL/RL//HZsGPL/IL/QL/
TLSH
T1F0445FF70951A00BCBA842F5E2133E3DE17B425D7CE1F8E9E57C4C852929B21B6BDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 0ed53634ed31771c2411d6556933ff290dd3e65a6d8c0f9454923bb091ed4f8e
MD5 d0923c44def2684f4dc24b192f40c915
SHA1 0a196d0844f87919412084f69d843bcf246f3ac1
SHA512 ec465352c27e7952203ed502cafed1978c48a811bcdd1a748c8f5e7d48cb13bee5cb5f8a35c745b057f4d544a84c03f575027a911b8e9876c8a8bbd9b49ad0d7
SSDEEP 3072:Yv9G+6KXFGkliHFFj+y90mxDkj01WIHDpkGg:YQm1GklazjI0cIjiG
TLSH
T1FE2517EECB682C83CE6B8774B0E0D9077E712183BA48D0D39944C5D997D6B8175E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 8b321712ed10e16f1fbe1f54878be40a1c929e18f7c71c6f9bc18553335e2aaa
MD5 5fbb561c0b3e8b6a91f4992a284d5597
SHA1 bcbd46bec3bcb09c3a121b3645665883d8655e95
SHA512 8a0ce9c7ce9dd945a1d3e45eac1e2b98efe70feb0aae20e249353c0349b255831ff6fc58f7eb34aece821dcfd67b78d850ac12c698704f3499e47dde361a7a16
SSDEEP 12288:hZD/dEFmL59nc//OEgO7OLcceU2K0JYZkhAacAYV9Rd45+MA6u1+nOPj5q/cdhNX:Xp0mnODd9jnOBCZNWMZ23mLKoCXP02
TLSH
T193166DEDCA6858C3CD639A30B4F0E9577C7413C3F994C1E6889CC584026B7C5BBAA66D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3102deac55f8b4a88ab67aac9b264af9de7404fd0e3fe84c3acd264b82c7b459
MD5 39df3bfe5dc0837837e8b4b8cd8e8209
SHA1 aae9bfa605302566cdf901e58197233778f5798a
SHA512 49348e9e32ee2d82d709718589093d2e44ef8e526facff7b8537cfd764887a9509bb505bb210721d22de8aab5d811ef77c13bf945ae234ad02e1658fe5f28273
TLSH
T1FD715F20CCE086E9EB5CF8FD90D21148337CC58D4AB72E368850A0B76A197E0F52DCCA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d845.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d845.TMP
Size 3KB
SHA256 d6aea45e00bfc6d5250a7e6ad6f5614b0da5a1bbecf5402abb2100755052e7fc
MD5 f80026d3561861c642793a96ebb9fe5b
SHA1 574337ae7fa6cc5ead6dc4b3085d0395f0f07c3f
SHA512 03af0781ad79fba3266acf1877b42c641cdf8ff97f70dac7af9c4b55180dd17a655a346351fcc904a665251d77b1e51c5aae3ec79d0bbec662479bf54232314e
TLSH
T11F713E20DCE086E9EB5DF4FD94E11248337CC58C4AB36E364891A0B76A097E0F56DCCA
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 bdcda295641aa9a3a697ddff8f97a66983d51362138a597bad4997f15ab70e1e
MD5 2e5638d15dfdb0b3c961893595710839
SHA1 85a00687723ed3ef72b3f464445cfd7dadb21980
SHA512 6cd54f2da3b8cc2b4bf34af3b14e93f1d1702c8ae1d3efdbfd949dcf15343c52b6a58311e1ea17828a3dacc876f84fd0e19b43971a4df78f5b737f0d99da70de
SSDEEP 3:MsEllllkEthXllkl2zEkl0Y:/M/xT02zn0
TLSH
T1F74404047FC00405C5405030C111C3505370D514051557C734510413DDC57C44D00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 ee733f4eb9f970a05a9765e080ef3e6bbfa04636ca9ade5f3a74008a621064b3
MD5 2fe26b38c29333bba13dbe1d6bef243a
SHA1 52b3f9fca76b28fb23264f58bc286a458af84395
SHA512 0cd54f5615e4b68cf163e6685bf4a5563dcc7a51575be688a1e0ee274dded9a0a975b80f64915c61732b949f2289deed3f89a710a2ab8ce6ac0f5450b07f52c8
TLSH
T135E0D8A599CFC26F551038C34934570FD284345BE6966D4757048CC87A02211B781D96
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 742a7b5a349abcbda45a0a583ab31365b75310c349a477d9b55cea50092c1311
MD5 60c810d260f3d90691773a6d843c621e
SHA1 6cda2b5cdd71826ac99614334050a8b782ec23ef
SHA512 4f8401ee0d7ef7ffc151761ca7b8fc432398d1e284876529c859086c85b6072c3fb1b30ab03309706f7e132ab89973d36ef91b7fe01f241b7a3d530737c18cc1
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfjR0W5LD9FtIWsUVNVqYpI:TtD4jJ/0UC+lf5mWxpFOkVTpI
TLSH
T171E2BC8C3B11F511C8FD733EA0D2C5E09ABC682C4A49B570863C9D768D62A62F49E25E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 7d7ac5ce3653a5d555b588c3486affab2c5075eda3e79f35670f9f4ba79fa185
MD5 fbc5e4bf5335993d7792ba41819c3634
SHA1 3d4acd7f65a5b1dedb0779ea9ebd78fd66f13aa3
SHA512 6d94b6d41dfa7dc8af7b10a73f66940064602dcf6cba0baac0f531e2aafdc2971d844ee386b92382b2064f616c17fe5e8847fa3de916a34283fb51c5bf9c60c7
TLSH
T1E1E0266855CAE26A912868978B68670AC2D0344FB2883946574EC8446101785F396790
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 32KB
SHA256 83613f4e0651fc6833d173573947835330fe44b1be533f503e24001e0f0090ef
MD5 e4179dadd5284dd015702ee168a2bfbd
SHA1 456fc87c176702d81e0a3d531ef1cfb73ebc0760
SHA512 320168678f5ae9af4cf5b27d11a8292f6eb09b472a4bfcc00c266dbdd1440484e1cbfc30f5151b0a12eb7bbbba02aad784a966b65fd811b3c0702931637a055c
SSDEEP 192:1moZpclMCkCXCCbMbWbSgMCDbYCDbaCDb:M0pvxOfoqGgMqkqmq
TLSH
T16DE2A5671E703C5ADF809E33FA13A9B950AB954C8FE5CE18A4A99D606CB5373133B04D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 cbcfd6fb7c0f8657c295cc6326c653da49a0cf724e490bf478122215017da91c
MD5 d773aa742ca5e5bced05b870ad2a75c8
SHA1 b943d7f30f31a4f37e2453aebb743ccf03aae17c
SHA512 e3079c5dd2fe9a108c8bb80fd3f7b0dcb515ef13b08ef4f0a040e9030c2adcd75c1d541a856021959cb101184f9a5f967dc090ab96ed9cfa82cefa3df656d5e5
SSDEEP 384:zqjqdqKh3cuC92ru8IkUI3ijVoWN3qL/uXmjqWqWqBqbquqIqCqGqIA:zAWN3cuC92ruJ4i93qDuXSbJwS3Bb3z
TLSH
T16E24E86F1F603B15CFA89133F99358B7149EF05E8FC29A99A8A51860EDF2363221D44D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 7cc7f7c936e519496224a1c181671fe14205a65ddbd0880cc14988e16efa187c
MD5 c455e69532623ae1b1451f43f14a22b8
SHA1 639bead11cf78f59327e4328daff5a11f6d6316a
SHA512 a021b375acb414e45f18d9e952b1bb164e98f48d8f0f97ad1eaa21582e1d73d2b387477ea5af639477e3ed491626f3e0ffd249ec0f9cd9c535a0d0b86187c4e9
TLSH
T1AD213EFB414ECDA3DFC51AA133112FADA902426BDFD1E6EDD28EA5147B291A0220445A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 33551c5eebc33a0798f8e8c724b4c9c52180888a4eab8d05e776fd4baac48497
MD5 87b42e787dfdda049855494bf68a6c4e
SHA1 71a10e0e3dc8a97219499fbca4520283e8e6e0e3
SHA512 877692671e9217baafe16bcd28f28d35d459ff68c6dad38e8a103f22a8f7ffd7c7e193f5928f7628ad2be481bf36a95bdc2ffd5797e89855f542f0b3ac3d3984
TLSH
T1FAE0D87485CFD22EA10420475664674AC3A4340FE6992E45AB08D845B441208B3816C5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 91ca3b247f80c62a29b3b5b5534046a3f414ae3c6c036534faf10c86613c82e3
MD5 2d488efc39f6ea098ad44be4b89bab3a
SHA1 8b1467810e9aa76d7b4e09f6567a45c61120d42f
SHA512 42a65befb31eba20932d0bac4c40649a7fabbcb3b8da840554309465778b1112d9b293d0de2cef0baaff9b8b34b9cf089d6a9b06a8aebad80f45499fe5c31382
SSDEEP 48:TWt/LopFMaty423w/a9NUuTPX1UwEF81soEwQ/et/AdS:6DeMatha9N+wsjR
TLSH
T13AB2304E1F747212C5F04B37EDD044232E3C115DD36332499D5850B28EA7AABB616466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 23d8647e53a8c3fd4aa6ae04a1a78aa081d0d95ffdae835241190584b18f95b1
MD5 fe990ef85dbcb8266d0fed3a2c6489ff
SHA1 cbdd355b676bc920186d7b9870d263a7969d433a
SHA512 a70ede1733b2ad7b4a1fb05ae09277f46ccc96342a77af13e187ee313aa45ec6989bf2d7bf2e8b06eaf06ee6497ebf5cffb9509085e45354e7f5bee43f9f14cb
TLSH
T1EA51AAF7C3E4866DC91156F0AB257E2FCE1D0910932C3D5AC9E4AF5B93E2471E101A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 856B
SHA256 4efa1963cda45c2e87be609c6164d38be4cbbfc18afbc4fcec3a1a3ad4f0b4ac
MD5 87cdbd597b86aa42079d81af05975879
SHA1 7f78f010a084b71c77d040c4cd5030540faf1d95
SHA512 024edb00c378262583d1bb9409f6083d17605ea75aefd9256a6ec22162cd3811adc83cbc3554e19ca372d4e9a791d1c1791f7ce0ae5b784830ed5813fac048ba
TLSH
T11B118C5785BEA47F103459BF1E48B80DADFADC30225294A4D9EB832CB0854FB4B8B426
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 69bd501f6b56ce26cb0e4105a3eb0fdfc8bd0b8b12ce0269a0491394c7adb57d
MD5 965246a74ee9b9444211caf569293aa2
SHA1 a45cd4783829eacaa963a423ceb9f6f01d36eea0
SHA512 6968aaf8046094fb76d669ed6cd6a9ceef5e393a221faff2e822762919a0a1a73dfab0b1319029e7ba4d9e48afb625389512f038f0d91a5f35c3e808219aa9c6
SSDEEP 192:sxRORsyM/jK1Ml8hc7/fBs8VWpVfJGZeKxOzoA8pXLk/g6+WNFJ/4Hu5+/Y9F/0E:sxRO2x7/fBsgWvfJweio/5kD/yH
TLSH
T16472D916A534997BCCDBD219FA557F53D2FC1573A2901E44AAFC8A0C01E7BED220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f739f9930299da7417a89d93368a2b7bbdea3d5cd76e850c1b4e478ab9db3587
MD5 f18b696b6a725448f5a9c0435df32e25
SHA1 c637811a1efac004cc88155e726718f768ecb9bd
SHA512 4d03cacae290cfb3fb06201aecd5b4aaa773efb8cb93167ecbd4303bddfda985f2ccd0277b74605a9f1cceeba1b032c22414255c2aeb500701d30ed7facf03de
SSDEEP 192:sxRDRsyM/jK1Ml8wc7/fBsu8lGZeKsOzoA8pXdk/g6+WNnQ5+/YZ69GpIgtJ:sxRD2C7/fBsXlwefe/5V/a3
TLSH
T14B62E916AA345977CCDBD209FA55BF53D2F81573B2901E44AAFC8A0C01E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 22c645972a8b6612f0b21e8723a77845d1ba3fb08d7123ce20d4c1b6d99f7985
MD5 1738a103132aee93b145a9bbbe2a55af
SHA1 c0c1e3acc03cd2cbb86c702b4f419591b0362d93
SHA512 30a7ff7e1017241a67fd5047b48d5458a116cbb957c8e7dd5086c562c5fe10f5463ecf85f9b768ce322389d6b2c1f271d9d25110ee5d4a5624ec9c791605d9ac
SSDEEP 192:sxRORsyM/jK1Ml8wc7/fBs88lGZeK2OzoA8pXuk/g6+WNn/4Hu5+/YZz9GpIgD7J:sxRO2C7/fBsplweBf/5YD/zp
TLSH
T11062EA16A93459778CDBD219F655BF53D2FC1573A2901E44AAFC8A0C00E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 418508eaf7c2f90f29df074f9c7f45d393bcab4b7681d1c1836e8918a89bf7d6
MD5 69fe6ccfcf1b1d70da8df8519f61fe92
SHA1 6e5ec0efdd3781d2c568a84128e3fe00fa7387be
SHA512 6cc91d1b9189342fe0a238162c3cf22a0f77c5ad00d7e0fecdf180a8214daf4b508f27fba638bcdb6fc328e5a6d158302b7ed8caba22089807a29ca6fd4751c0
SSDEEP 768:eOEtpf7pLuL7ZIWgKgf168F1+UoAYDCx9Tuqh0VfUC9xbog/OVqtREkTqQiro7oz:eOEtpZE7ZIWgKgf16u1jaRt2/Q588dE
TLSH
T1CDE2DC3B680CCB7E4F804A9CED297E9F6DE801CB96D8C95447EA840C03C67EB56165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 39a4cc3d6f503fc169d2fecc00c45a386316122c53661448f42d81dff49b6fa3
MD5 14e95621fddad2173724494d1b9070ac
SHA1 81ca4e54a5389e40a727d75c9f834c7ab3c498e8
SHA512 bc80174117c028988aadf4b2a06dc854a920133120e7bfa6378d823eca4fd9d1b23ad4fa1ef34cf7dfb6deffc3578cf8ce9066df664ce8c02de7b330037ee81b
TLSH
T12FE0262056CAD27E602620834A35A70BC2F8740FF2CA3D06AF8CCC446542605B6A7A90
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 7cbb94b3a8e3616a513856297eb704e6de24d4ef130483d14b388fe8b79b5188
MD5 4bba84b649251d1e709f187ddf62b32f
SHA1 3c7ec8c27c7ee1668fc7e1bdeed78df5cf3519b9
SHA512 3311e7f10981b983c7089309626048ca7d8106923e89db53c14d5fa41c780e2469e5db465e9fae8c17b4cb0e35fcc6371eabc37b06f8c3a0ca5b39cc48b3fb31
TLSH
T1ABB012543B00C329C8CA1630A6B45FE0E360F013204C0E237818AF304C096E42E508F5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 39e186938534be15663cd3a46602dff876647715e2b595b589560377416b28a1
MD5 d4ce3902d01b19ececa217bfca9b327e
SHA1 c296d6fb380154b6300d8840b8740ad6d9564cb6
SHA512 2d1036f44e0709789d77be3c2bfb0417802cfda4458eebd3a3b5484f4d175dc71f18ca25232a7433dcd0b116e85998b8c1f9319a399fa9c03dfc5568216beea0
TLSH
T11FE0D87457CAC33B7146308B4228E70BC1B2754FE6D92D15AB0C9848620A6447347A81
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 d3455c68ae0030730411c4fd01c0a21a67c9cb056235e47d4dc71d38e98ed7f3
MD5 11dd08146da731a6bcd2269c69a08d54
SHA1 95843bf4478d5f4709c9fd93ad2259f913db4fae
SHA512 87e7db29fb277c6a90be61ef4901a9352e482d781ff115985035e8eca8ab74914f5acf0db443004a91f44b138d77eecc39c046ebbf8ea8f2c22654d16f41a1d7
TLSH
T1ABE086709ECAD33E510571C38669970FC2F5B80FABEA3A4AD70C4844E501345B7AAE80
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 73846682b387fe528e3a4a2239eca8cc85f4330f5f12227ccd4a516715bb1a75
MD5 5a6c68d9bee4d455b925d79616fdcd4a
SHA1 07745b9124c25ffb97b56a108f73cea7130a22dc
SHA512 b3d81262ee69e93403e83fd978647acaf645ff6166fcd706cdc262ed9dc5a17152e8f64bc88ec91a1fc183b75dae1b3b76992ffba107dde81d102625ffbde138
SSDEEP 96:KbJKDnR77NgfkguvNKmsuRNK5Rs/b2K6YKnqGK+oKHqP0AKN3:ifXr3p3
TLSH
T19BA1268073BB27013C7E260585D4959F124230B73466683B7BA961E25E67E016FFDBCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 8d7fb14033a2d1ef8f8f48f86d87994bf82373e3f8a58f514e4fc6964565b38e
MD5 48c7faef9698a3932ee92c8a7da6cbdd
SHA1 60f879f21502716effa7fbcf4c8a06bd61148181
SHA512 3e8e4ec67be3e85d9217c8a9078f7a4f297d9e0920bdbb829d401b7285d2be0d1482e5a45f0203004442cc8c6cf4b2b69358aac40aa7f2f25423a1e3ad2671f6
SSDEEP 384:DNrvjSZyWSDnxTICEMEhIDyycEGud5vt5vCl7svbFKfk7:xSZlSDnigyIQl7svbF9
TLSH
T14044820E6770B001ED929C775D70C47A0A38B1AE8F16E7D01DAF245A4DA2982663DDFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 26KB
SHA256 8365356aa7101a0487cf734d978beef684b2a4b22301512d25a915f3a4630d54
MD5 6739fe4d4f6ccc4ca008e7b129c4cd08
SHA1 9b734d92b878177874aed33730554889225a9229
SHA512 50f0be01298eaaa2aade1fb7773df4675a687053861eb63202d1610e002b680c10f7eb6aebe16cade18cecc66a38fb6728b25f4f576597111089fc2f3da54f28
SSDEEP 192:1LTUCpCoCHbMbCCDbrtAOCDbCOA6bvCDbTAp:10sVeo+qBq5Lqu
TLSH
T1AAC2C7AB1E60281ECFD08773FB1395F9618BA59C4BC6CE29E0E95A507C753A7131E04E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 484d4f908c0916f59933557db690601d26fce15d093c2c28b23fd70d23507d03
MD5 6c9a6219961ad043e2aa5f3d02e19bbe
SHA1 03f230f89b6b8e33d2af129cf58d0e3006b15883
SHA512 bd2816f321a5cd4ca33611ea8473f22708fb737228d65201fc3e6c78a1d1e1715c91beb9ae3adbca43bbfe6f7c9cf19fe1dc01cee6cd14bd083c10f786a36898
SSDEEP 3:MsEllllkEthXllkl2zEelpYKll:/M/xT02zNN/
TLSH
T10644045C7FC41405C5151034C011C3D01370DD300D557FC7345105135CC77404C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 06e9b29f98a359068ba45989e3752651242f83209a348dbdf53aafc864d58b6f
MD5 e48a02cdb65be71d006f00b600b652a7
SHA1 f1260dcf1c23eee23d31814d831ffbb2f703db3b
SHA512 0f23a45ca0c9d0e94b264e7612c314fa4beacdc209faf417f00e257536e35d5c666387e790dce1f71c62f62de13277018df8907ba8d007954c8db5c52e225590
SSDEEP 768:EjaeqD4MlshiLdMma3zRPfcOPf/V5R4HTytYYqgHvPgOyjWtxjTo:EqcjhIdMh3hfbf7WTwJjyj2y
TLSH
T16103CF76ECB848B74CB29685770277976EB842A3C3C52B64D9CC5A0C059BACF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f959f55005eb237379a40404888fc3122c68cd4c7994c1ec49125185949f8f4c
MD5 669de0f6dd0b4878052183183900aaab
SHA1 426822f066bcf1a3d490ed6ecdc4aaa3a0092735
SHA512 d857bbe77e477e16edf0530162a0a3092bcbbba27c0425e3145cf8baef03f61dd5888f50405a0bb3d40d1b5fdf2e3e6cb9fc9f249e8473e77ef70424a7e5e6f8
SSDEEP 768:sjaeqD4MlshiLdMma3YVPfcOPfKfPiV5R4HTytYYqgHvPwVzn12bfQDTh:sqcjhIdMh3OfbfKfsWTwJ8ByQJ
TLSH
T18913BF75ECB85CA75CB3D545721233D77EB842B7C6C42A68E9D84A0D059B7CE230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 78718a1d66d588ff02abeff61e534890c6db5ac43747d770b7e5bb434339f9e3
MD5 b95394adbef7be1c7d8907c4486d4ed6
SHA1 281c461df0d8a12d8712d8df2ed73c4a69c2800e
SHA512 f87bef716c975bf02f70a1c8e79df82d357f2424ecec4dd5b57584542f8c0582ec70583c17891636e25433a0007669122019adf2f9e905c50ea7e8e3f4459aa2
SSDEEP 768:qjaeqD4MlshiLdMma34VPfcOPfKfPoV5R4HTytYYqgHvPw0FKxkjpzn12bfQDTh:qqcjhIdMh3ufbfKfeWTwJfFKyjpByQJ
TLSH
T158239D7DDCA41C7F4CAEBB48660E26666DA8023BC2F42568D7D40B0DD177ACEF306416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 071d8a899c5e9967fc48f0ccf59ebde5e80b01848f188af63d21ce59bd841b90
MD5 df9e0cbfc2cf3383f8a8e29864701703
SHA1 aa795f2e1b057d830f074491e5797a2a9b1a9337
SHA512 77b10a0521fb35f3997a9b29e91f3eeff988eda04482d8290d2d01b4aa697583d8820eb7100889024939381a69c3f8a57ba1da8d4409d50207fca660fb98f0b4
SSDEEP 3:MsEllllkEthXllkl2zEelPBW:/M/xT02zNI
TLSH
T10A44040DFFC41405C5353030C011D7541370FD10071557CF345504137DC77405C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4820_1164664889\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5112-58-0x00007FFA56F7F000-0x00007FFA56F80000-memory.dmp

Download

memory/5112-6-0x00007FFA56E20000-0x00007FFA57083000-memory.dmp

Download

memory/5112-12-0x00007FFA14620000-0x00007FFA14630000-memory.dmp

Download

memory/5112-11-0x00007FFA56E20000-0x00007FFA57083000-memory.dmp

Download

memory/5112-9-0x00007FFA56E20000-0x00007FFA57083000-memory.dmp

Download

memory/5112-10-0x00007FFA56E20000-0x00007FFA57083000-memory.dmp

Download

memory/5112-8-0x00007FFA56E20000-0x00007FFA57083000-memory.dmp

Download

memory/5112-7-0x00007FFA56E20000-0x00007FFA57083000-memory.dmp

Download

memory/5112-13-0x00007FFA14620000-0x00007FFA14630000-memory.dmp

Download

memory/5112-0-0x00007FFA16F60000-0x00007FFA16F70000-memory.dmp

Download

memory/5112-57-0x00007FFA56E20000-0x00007FFA57083000-memory.dmp

Download

memory/5112-2-0x00007FFA16F60000-0x00007FFA16F70000-memory.dmp

Download

memory/5112-5-0x00007FFA16F60000-0x00007FFA16F70000-memory.dmp

Download

memory/5112-4-0x00007FFA16F60000-0x00007FFA16F70000-memory.dmp

Download

memory/5112-59-0x00007FFA56E20000-0x00007FFA57083000-memory.dmp

Download

memory/5112-63-0x00007FFA56E20000-0x00007FFA57083000-memory.dmp

Download

memory/5112-3-0x00007FFA16F60000-0x00007FFA16F70000-memory.dmp

Download

memory/5112-1-0x00007FFA56F7F000-0x00007FFA56F80000-memory.dmp

Download