2f9cbab48dbc601c80c12305eaf63c471ba3296db508a9c1a046a149789f27f2

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Size 1.2MB
Sample260709-mf4sashw2w
SHA256 2f9cbab48dbc601c80c12305eaf63c471ba3296db508a9c1a046a149789f27f2
MD5 98cbcaf386db506ed34a1d12e6d02abd
SHA1 5ea9ab6e3ae09f7d0dea8f2981069d3838f83b8e
SHA512 67bd8ab348c4d74482d0e1ab3d6413e4c76b9838e146fe8aecb04da45c014e15fb9aeeed63416e8cecba90bb3bb086a1e01d10c5c1fdbfd437039f7e9c10520e
SSDEEP 24576:W/t6WkcM5o9c7dvPHgvw/l7Cn1IaEjeGKqw40t8wwusZe+:KyjfgvwtpBKqwNt5ye+
TLSH
T1D155AE05A79641EED4BBD0B4CA522A0FF5B2F8210239A77F9FE40E944F22B60973D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 6012 set thread context of 2828	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	108
PID 6012 set thread context of 2828	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	108
PID 6012 set thread context of 2828	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	108
PID 6012 set thread context of 2828	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	108
PID 6012 set thread context of 2828	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	108
PID 6012 set thread context of 2828	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	108

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1743797732\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5040	msedge.exe
5068	msedge.exe
5028	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280663342309682"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{7D5FECE0-7F8F-4110-9412-729DBA0ABCC7}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{403C745B-E5E5-4AC4-AD6F-337BDBFEC83E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
5000	chrome.exe
5000	chrome.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe
Token: SeShutdownPrivilege	5000	chrome.exe
Token: SeCreatePagefilePrivilege	5000	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2548	msedge.exe
2584	msedge.exe
5000	chrome.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 2548	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	88
PID 2548 wrote to memory of 3404	2548	msedge.exe	89
PID 2548 wrote to memory of 796	2548	msedge.exe	91
PID 2548 wrote to memory of 5040	2548	msedge.exe	92
PID 2548 wrote to memory of 3660	2548	msedge.exe	93
PID 2548 wrote to memory of 4652	2548	msedge.exe	94
PID 2548 wrote to memory of 4668	2548	msedge.exe	95
PID 2548 wrote to memory of 5856	2548	msedge.exe	96
PID 2548 wrote to memory of 3780	2548	msedge.exe	97
PID 2548 wrote to memory of 2868	2548	msedge.exe	99
PID 2548 wrote to memory of 5636	2548	msedge.exe	100
PID 2548 wrote to memory of 4924	2548	msedge.exe	102
PID 6012 wrote to memory of 2548	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	88
PID 6012 wrote to memory of 2828	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	108
PID 2828 wrote to memory of 4648	2828	msedge.exe	109
PID 6012 wrote to memory of 2584	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	110
PID 2584 wrote to memory of 1280	2584	msedge.exe	111
PID 2584 wrote to memory of 2956	2584	msedge.exe	113
PID 2584 wrote to memory of 5068	2584	msedge.exe	114
PID 2584 wrote to memory of 1448	2584	msedge.exe	115
PID 2584 wrote to memory of 4888	2584	msedge.exe	126
PID 2584 wrote to memory of 4544	2584	msedge.exe	117
PID 2584 wrote to memory of 5148	2584	msedge.exe	118
PID 2584 wrote to memory of 2208	2584	msedge.exe	119
PID 2584 wrote to memory of 1440	2584	msedge.exe	121
PID 2584 wrote to memory of 2000	2584	msedge.exe	122
PID 2584 wrote to memory of 2824	2584	msedge.exe	124
PID 6012 wrote to memory of 4648	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	109
PID 6012 wrote to memory of 4648	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	109
PID 6012 wrote to memory of 4648	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	109
PID 6012 wrote to memory of 4648	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	109
PID 6012 wrote to memory of 4648	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	109
PID 6012 wrote to memory of 4648	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	109
PID 6012 wrote to memory of 4648	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	109
PID 6012 wrote to memory of 4648	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	109
PID 2584 wrote to memory of 5040	2584	msedge.exe	127
PID 2584 wrote to memory of 5356	2584	msedge.exe	128
PID 2584 wrote to memory of 1076	2584	msedge.exe	129
PID 6012 wrote to memory of 5000	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	130
PID 5000 wrote to memory of 4312	5000	chrome.exe	131
PID 5000 wrote to memory of 3520	5000	chrome.exe	132
PID 5000 wrote to memory of 5028	5000	chrome.exe	133
PID 5000 wrote to memory of 4212	5000	chrome.exe	134
PID 5000 wrote to memory of 4520	5000	chrome.exe	136
PID 5000 wrote to memory of 1184	5000	chrome.exe	137
PID 5000 wrote to memory of 4984	5000	chrome.exe	138
PID 6012 wrote to memory of 5000	6012	2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	130
PID 2584 wrote to memory of 4836	2584	msedge.exe	142
PID 2584 wrote to memory of 4368	2584	msedge.exe	145

C:\Users\Admin\AppData\Local\Temp\2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_98cbcaf386db506ed34a1d12e6d02abd_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-default-apps --disable-extensions --disable-gpu --no-sandbox --disable-dev-shm-usage --window-position=-32000,-32000
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x254,0x280,0x7ffbe7eac188,0x7ffbe7eac194,0x7ffbe7eac1a0
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1796,i,5154728739742175445,10013223381580219025,262144 --field-trial-handle=2776,i,13060042414472769717,13253784575912638894,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:2
    3⤵
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,6277658893778078124,10409935570632875906,524288 --field-trial-handle=2776,i,13060042414472769717,13253784575912638894,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,18304924886892791651,10815683652678824935,524288 --field-trial-handle=2776,i,13060042414472769717,13253784575912638894,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:13
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3348,i,17476346427527730138,4322113208409290147,2097152 --field-trial-handle=2776,i,13060042414472769717,13253784575912638894,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3352,i,10266413101417710273,4328674684591972142,2097152 --field-trial-handle=2776,i,13060042414472769717,13253784575912638894,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3812,i,12192933188285830438,15621949641989764523,2097152 --field-trial-handle=2776,i,13060042414472769717,13253784575912638894,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3852,i,3136314527636364924,18030726689687953545,2097152 --field-trial-handle=2776,i,13060042414472769717,13253784575912638894,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:9
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,7341765247848964534,14262102590926080181,524288 --field-trial-handle=2776,i,13060042414472769717,13253784575912638894,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,4848147467052919943,15866441003782920807,524288 --field-trial-handle=2776,i,13060042414472769717,13253784575912638894,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,4271767522689808660,8571069729191229274,524288 --field-trial-handle=2776,i,13060042414472769717,13253784575912638894,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,4271767522689808660,8571069729191229274,524288 --field-trial-handle=2776,i,13060042414472769717,13253784575912638894,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --window-position=-32000,-32000
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffbe7eac188,0x7ffbe7eac194,0x7ffbe7eac1a0
    3⤵
    PID:4648
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4648 -s 660
      4⤵
      PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-default-apps --disable-extensions --disable-gpu --no-sandbox --disable-dev-shm-usage --window-position=-32000,-32000
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x254,0x2dc,0x7ffbe7eac188,0x7ffbe7eac194,0x7ffbe7eac1a0
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1944,i,11052107394673866666,9487853591469166732,262144 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:2
    3⤵
    PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,14822308093094592041,17316058521182308680,524288 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,13612054763359720833,3986387997863112067,524288 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:13
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3248,i,8703995243184379113,14970277662127218187,2097152 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3268,i,3206162593294811848,9071197929202898211,2097152 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3748,i,13122082815326956686,3849429456601464968,2097152 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3760,i,12367221696325242954,17269236398884147078,2097152 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:9
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,2095112729037942015,6956671619353545974,524288 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,2683450595079672704,4352333825879803571,524288 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,3171649374835904658,4242257430511095143,524288 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,3171649374835904658,4242257430511095143,524288 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1352,i,17733017580793528032,15041656911265197106,524288 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1360,i,1471888648068387872,5340147808877861355,524288 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1368,i,18073343684524771885,3562924213582882698,524288 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --no-sandbox --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,17474331131296207684,4794237180128892936,524288 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,5702352548557089737,13301933369573598918,524288 --field-trial-handle=2732,i,13195763363124230209,17407234727326275103,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-default-apps --disable-extensions --disable-gpu --no-sandbox --disable-dev-shm-usage --window-position=-32000,-32000
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbe84cc728,0x7ffbe84cc734,0x7ffbe84cc740
    3⤵
    PID:4312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1676,i,7527707900788639964,11426498284545586257,262144 --field-trial-handle=1876,i,6427344767500642102,1162332850028035941,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    PID:3520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,1865851668976475240,1166170165940955967,524288 --field-trial-handle=1876,i,6427344767500642102,1162332850028035941,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2100,i,6983441426916777836,11796219911220529356,524288 --field-trial-handle=1876,i,6427344767500642102,1162332850028035941,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:13
    3⤵
    PID:4212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2832,i,12185599366869403197,2483208967589444833,2097152 --field-trial-handle=1876,i,6427344767500642102,1162332850028035941,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:1
    3⤵
    PID:4520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2836,i,3742855693329724757,944935284503066751,2097152 --field-trial-handle=1876,i,6427344767500642102,1162332850028035941,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:1
    3⤵
    PID:1184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4028,i,17867091866831631901,9342296267693583593,2097152 --field-trial-handle=1876,i,6427344767500642102,1162332850028035941,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:1
    3⤵
    PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 725775f6165b8ebe9da959f530e05fe05c5614818afeed8e8ae4f3ec4475cbda
MD5 0c0a2fef79dcb44f0f6267e11eb2889e
SHA1 77ab88397392eb5d6c00f6072761c0603a25c968
SHA512 a4791a0120687758f88c542d26f5e589ef69a0ee18388c9fb52c8c84795fb48d4ad08c3a025934d04218b0d0db9c904ad311478d9914a2f29feda59ee76af9b2
SSDEEP 96:3C6U6d+acl8CHIuxfTVKnvpSRDotok5YuNTD5B6iGyvKtcJ4obB4Rv4a:3CQZclJo6SuDUDYIfufcJ4obBI
TLSH
T1FCA11972A16D89335577DA86B9027F43CEB9706BA611BFC4E9EC1F0C09FB0A81702652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 822417d69b8fabcc100841b346d2b8a9a5dc8bd2a6cae650d3e1b8962c263824
MD5 eb966759d4be04eda70871bda4e8993e
SHA1 51e434417546e61a5efe7a26b395297df28012b0
SHA512 42a3d053926ab19042cf1e941de0e851cde927417a2f2d10a341f2b0ae6b2da3b537d2d9018eb8d545bc405f8ea0cd6f387bad540e27a46bb71954156e9962b9
TLSH
T143D0A7A12A48EAC9D244107259528201B5740963A81793886100AC2DDC781C353978DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 10d980f142d09c0f1764c788ca138c07e37fb3c10a1c41b6758cfc8500ff9072
MD5 0ebe1743da548f5ac1b44d3fe71a7a3f
SHA1 dc6929dde21d844b81b7fab78aa081e92d6f966b
SHA512 b9678d8b7c4ec0f4e647c68a8207b2bf7c883d2e4577629f2f2f7d268f3cf5ea743a20999df4ee2abf1c61cec21ac0df780ceea34c268fc7958f5f372f583b97
TLSH
T114D080F53A44E549C28010725853D751F5754971F816D3C8A011B42DEC591C753DB4DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c063417feb542766473caddc4413e5943716924d129944de5eed57dd39683f8b
MD5 60754b8c00ba6c8438b1ed5584e13b9a
SHA1 b8b5a25d1c952b3939ff25682257efccdb0804f5
SHA512 be0705adb5bd831256de54f1ae08741795c002fc94e628df1987417ab945779470bdcb56fcc3b08760516359e93e6b4a207396a2274c9604041b873a69da25bf
TLSH
T1E6D080F13A44E44DC28010725853D751F5754971A416D3C8A011A42DEC591C753DB4DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 99348710dfa24f06e3cc9e5d66d99b450d2606932193b821d1cccbb1b0382494
MD5 99dd082560f2d99883b896493c6f1a16
SHA1 8c1328ed9b1727d8e368914ffd96b9d8d9882e17
SHA512 2eac54e4bf6c56c6a86be1ac66b75e47cf5afa02dca24674366691d2eae08e023308cf9c0e790eecff6d37160a3b4bc6aa0d7b2cbe2bf4b7074898f149ff8bfb
TLSH
T11DD09BE56640D94DC58020721593D555F5705931D80553C85001743DDC952C703574EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f2f36159b1a73a0ea0e59f51f1f373932375016885fcf17933887e7d1b2c3016
MD5 2dd00ee0ca93975f2038728e856681d5
SHA1 24fcfdb6befe18bca66bab129cd0fba4ad709e15
SHA512 d734e4919f2bc11b3e1a733c99b812ac0c7d2d76c45401d957b2b60a896b0bfc172f211ec13501d83d82cd3445e59aa5e9e4a25b2d71ff9d2f99bdb12460b4e4
TLSH
T10FD09BE56640D94DC58020721593D555F5705931D40553C85101B43DDC952C703574DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 1120ab39a9d2a20c83ccba3393248839ec1546d78bdc7a4478c351f8ff215499
MD5 d163312c6ee10f9a288dd6ab1468bd93
SHA1 9988dfae4d658056fcc01513dd2c74e8df3e4b19
SHA512 8a5c57daa51adacaf4f4c61daf56f2772c12b5c5a8baf33291c7b94d41904fa978c00a7f15f6c0617a2e36856cebcb84fa5085d76ab9a90168d1d55b69c369fa
SSDEEP 192:eqKflnQGeTaPhLZO4IUcgQSl4uPcaLhv2RmUz7qpPx0NieLte:/MJeTKO4vcnnuBhv2vX2PMieR
TLSH
T10713403D76606E02D7C780BE921B8B325372D4AFF9EA13135671363DA2563D22E3E065
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 f5484879ea5c9a0a70a4c81022ad59d3086873bb6e3e1595bb25174159ef68cb
MD5 307ce7c032ba1d2910854ea8e8d8fb31
SHA1 4292d49b51f93b1c41230bfc8c6a03a9dfa5acfd
SHA512 7aa542468956fff0a0afab1162a33bc56ac17193daa48ac4d10db1a75794dddfd28a7fa92de89837e772679694e672188c7924402892b94bd6d9f69d8cde7d32
SSDEEP 1536:771OgL/rhL/D3neA9DttBLZrJv+n4Xxuf:7MgL/NL/D5zn
TLSH
T1634440F71961A01BCBA852F5E2033E3ED177811E7CD1F8A9D6384C852925F31B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 466c07bc5522b4e5343cb33caa7ab0b5a7341dcb765aff2010c340866362a255
MD5 1f60e9fb867f189582f620f1f6889157
SHA1 0462c54486c1aa18581b8a3785a46946f26a6a76
SHA512 4b238abad5fe467a47be42e06120664b542c384e4f941543a65e1dfdd2a48854f9d99b50ce01c28aabfe8409221199c15760d6cb29dbaf605cf7926ad31fed19
SSDEEP 1536:/i49G+PNaMuAN4O7B7kT7A7Ts7zWY737F7GiHj7S7C7qDz+N7AReO7PX727iy7eM:/v9G+HN4u/9iHya8zp0t5bWWtDk9
TLSH
T14E2518EECB681C82CE6B877070E0E9077E712183B69CD0D39944C5D997D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 222cd71a1edfad6eecee9558eb8b352b5fef3d55f558c770435d9695900cce26
MD5 accd4487fac2903910a17a6b1f2fc173
SHA1 113f84c60b432c5804631aa60dfb612062e948de
SHA512 f0110b7026cec40cfcb55659d8b4827f5f5421a760863aa913a8efce63ae01b9a762bbea61a16391d8e6910c32cf9fe7a5624db6b758508219b3803cd54df4e1
SSDEEP 24576:qHqTzl1z3SW6vLYoSzx0yfDAlxKlaZsvcrk0hgw3+vDMhev:q0hS/KzrbAlxuFcrk0hgw3+vDMhA
TLSH
T15A167DEDCAA859C3CD639A30B4F0E9477C7413C3F994C1D6C898C584016BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 401KB
SHA256 6a5de4dc3214d4222924636215c5a493c04e939dad857cd0f637ffb2d610cc37
MD5 5d1aabca7ed21b4221ca924f3b607191
SHA1 d9d8fa6b53822206a6a81907c965c2981a8aae94
SHA512 91134059fae24d832b116a1c1d0348a6275959f25e89894144f443c30cc9e15c2b6da72355a37f02d9789dc31ffecf85ef7e376d4692772fc55d2f967b0c51d1
SSDEEP 12288:e+SS0aPiyjHu4kXEs5L75R4/+S3kvQZML4eVSEHn:TjR6QHu4kUGU/+hIZMMe9n
TLSH
T15894234847CE3176A1D6FB0B9AFB34036EC13649235F6500718F5A7927B03DCAA3A65E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 67KB
SHA256 a18896ce72cc6b17475c314b4a0d2279510a397ea198f6f2688c678f77415ea1
MD5 29f180f7ee3d1ca5e9932ae816c89d5d
SHA1 f18d9cec562c5cef057de1f6d64d3f0e12ba44ba
SHA512 eee7ab576128172da6d6dbc1ab79a255ab7345e56a616ccb821f54bc7e67df41a600e431d84b2622553153dd618e9a69e047073926c5657bd2f0c5ada045e80d
SSDEEP 1536:lyzibffH+TaNoWprV9aU9U+wKUQ8x1bGIRNfjGGZD:IureTanrAU9U+wKUtxIktZD
TLSH
T1B06302F619561407D791EE157076F2992922A0ABFB29BAF3AD5A360605023FF3CC40B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 162KB
SHA256 9287575cf1bab3f76bcf5f5eff78e5289de382667c86f1410457d9ea7a188579
MD5 43b935233ba0f738721dcec868ad9ebb
SHA1 079de7066ed59c237b4b385db1aa8dac69dabd96
SHA512 f252bbaa2ec5c805721cca1cfd31c96cb83a4a04f367d750d24ad684fe0d9d4ab8547c1197b442d5c326290be33740ae7ab28098b0fb1167cf5d7ff90232ca45
SSDEEP 3072:5fFFuU8pCGP8vcgZjN2cRnB9s5gKNdemyWTlJYlQiobRdXyqtPGh:5dFuU8pZP8DRB6qKzGaRO
TLSH
T11AF31339B779F10788DA92CCA0F26C0E2F771F692B106D4A19FDDDB447BA619831448A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 78KB
SHA256 6d2400e042c787710d26f8385221685a5f973ed0ded09b432a5e397b7898b781
MD5 642fec10a8e48577c0feb01023b1568b
SHA1 f3e934256be19bec144f8eecf3cf5615889b8893
SHA512 916223a301be9208fd6b59317b78b503d0d035b8c07959d2a2e02b816cce61be05d028244076dd5d785af4a11b481a1e7ea9fb12d478fea22e9f65b61b006aff
SSDEEP 1536:Yqa2NEuaJcNWPRtFJq+bD7Mfq6fMQBdPpFuRLUpmMYwz+bxB93rg/i:YN2NVaJcNgMNEQBRpuBvrii
TLSH
T182730223A1167A65731F184AEF618B0A48EB7B35FE201F19507E0CEDBF52EB242F5121
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06f9b8e7f50c3ca1_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06f9b8e7f50c3ca1_0
Size 259B
SHA256 643d359d01b1a0cf20f09c5169e48df9e689376735776db8aad06ecacef391ba
MD5 997946723147edf3b722863e0a648c2c
SHA1 4df1549226b9d336495c6e526e96fbd0886cf111
SHA512 91cb14042572ba215feb0171308ed8c5b276187f5344dd4d657bb2671c374ba99ce6b75a10eb1587ece46b02f2daa345a2a183b1f33ee2d7d413186d1b9e518e
TLSH
T137D097EB088600E8C40D01F1C2AF338BC2D3C18A1E0CC17480A4AAEAB1055B1B6A4235
MD5 SHA1 SHA512 TLSH

Submit Download

1215e045626743e5_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1215e045626743e5_0
Size 340B
SHA256 5cc1bd6add70c60f7c138b0f4a5c441008dbba9eb0b87acc15beede917bef805
MD5 8eab190a66d717b41de111833449d938
SHA1 1b217ff7faba1dae2964178ddebf8cfb8e1bb455
SHA512 94960300042115612b99cd64a491946f617cce4187d7fcc06b566f0da18b050af1f844b3c3c1e9e8a1a2948679bf4b39dfde4108d9a7a29d65a768c863ffe049
TLSH
T1D6E07D73459D0849EF4D80F1E95FCD87875B41468A08C7D0C69C70D7310DCE0F996110
MD5 SHA1 SHA512 TLSH

Submit Download

4c1fac1f5aeac8e2_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4c1fac1f5aeac8e2_0
Size 246B
SHA256 ae12d38e193976b8333402a0fccd8bd3e370facdf52bd63292eb84eb51884ae7
MD5 1ebed778bbed43bff132cb239fb4aa68
SHA1 31da50846c792510fc45ed833c96b5aca608e0f3
SHA512 bd25ee2d6ad4c2928775d0318650b5449fcb1c2d9f0d23c6338ea46088974053925b2996df77384e74c15b1b0e92570a21fb229b99d773cd8df917ff7da5ada0
TLSH
T164D0A7F769290D80CC5D41F5C65F27864611C99B4D09C56441F9E4F37314DF2B568529
MD5 SHA1 SHA512 TLSH

Submit Download

95679d660710325d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\95679d660710325d_0
Size 256B
SHA256 275f44ef0704eedc477e1c58f044daf27e41de7a5d650c12e33b09486cce17a7
MD5 1989d27fad5fa54b4ecee30cd12b06ca
SHA1 7d228993acc5b8bc4837aae9f6383f1861f131cd
SHA512 cf36f843c943728c14157c3dabcdddb48645d7e4e4d909c4f78e0791f026fbb39e72a6fb21eb2885ae2f3eb6737d8033a15c34e7e5c4ac1636d6f921abbd09b9
TLSH
T110D097A709A62B08C7A901F08A2F52E247A395852E0EC9808039E0E2301CC312570A20
MD5 SHA1 SHA512 TLSH

Submit Download

ffc61c2cc78722e7_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ffc61c2cc78722e7_0
Size 250B
SHA256 59b0d6cec56e3ce25bc387978357f713f1e041316ba8eff200cdb80931166f9b
MD5 ec2c6cc213628863dfa008da5e17d43e
SHA1 0ba8d22e29d9a64477d34beba80bded0ff0fff5a
SHA512 22989bab5464fcbd7e39cfafac29288c3624446368cd4ecfe35672866c9f24919f0ba195d6ee0f713419e55705d7a4ad16b58aa903879ba68bf69c06b4f10bed
TLSH
T15CD0A7D7BD681440CA5961F4DA2F16CBC6628EA95D5CC6418668A0B371055B1B274D34
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b89bc527987dd14c9939ec84ac77b8ea1e0d357135a31203c4b7565b2133a53f
MD5 f8330a2852b4b5fa6baace7522600332
SHA1 872750fd778b73c0666c06f4324eed2270852d86
SHA512 fc77ef4d6f02abd711908ffac4d32ec31cd6407a18e7784560b78d96b96b2aef657cd8abf0b1f4436df1f7b2fb6443155c3e8957f41081adb1e673f3be3f42c1
TLSH
T1E671DB917F54D590DBB8B9B229D08848F578806BC6CB2BD81950D6BCE8363E1D33353A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d8e056ecac7551a713562eaa466a8135c87f433bd55336d512bfe37582314ac5
MD5 2b74e9a2fcdd82f1273589d032082bd3
SHA1 27ab4daa7c04d1b94528d535093167174c6161e6
SHA512 c49a3b03689b6ea1184ac23a177f3ce798aaa9e11d31dafe27d25d043ee2c01c5716aa31b5bdc14441729c755875bd33f276990d27a2f5a8d716cd8b5c07b0d5
TLSH
T1966199902F21D5E1EBB8B5B169E0948CFA78846BC6C76FC84944E6B4D876316C33381A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 77f9cda1cdd0167f48702d19ac986d73a833b6db64a17bd1251d92cf9b18c7bb
MD5 2e93de4644849a0e4bb18d4bbd868e25
SHA1 09504d2fefe0d8c36a1e77cdc04de62b4460d656
SHA512 e848c55d724e480c4248069cac49e67d48dea7c89f1ebfa422beffcd656def009be9652313878028e277b0d6cf7d20c136860b3069b7027a03f66d21d736492f
TLSH
T15871DB917F64D590DBB8B9B229D08848F578806BC6CB2BC81950D6BCD8363E1D33353A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b55cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b55cd.TMP
Size 3KB
SHA256 744c3b94a486af5bfc35f719ad79b7883037afb93a5bae14e5622636070891dc
MD5 1cfa5a8e5c1b25e8f7b2f2f2db4911f6
SHA1 26e4d6bb7f2bebdd2dacceb149c9dcfb3bc8254b
SHA512 672565f35f03ab68a65ade4eed0387eeec26fe061d11b61cf3241b64ea5576f4858104fc6351e7a9fdc8029a201354165153877bf97bec0dbe52973d28201b4c
TLSH
T1A771BB906F21C5E1EBB8B5B169D0848CFA78C46BC6C76FC85940D6B4DC36356C33382A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Extension Cookies

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Cookies
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 322B
SHA256 998ee562cb6fdb1ca843c38f07d14b7333223d9eedd36e320d5f4c2a14282f4f
MD5 79b022a77610f7e472108fcb00e4736a
SHA1 75f47056a1f565e45bf670377352bf0073d470fe
SHA512 62532ab6396bb5b4bfc22c77dd091ce97113107d06e82761fdb206b426056f929b4021dd86a3f76d7ed815347c6649fc96c00817b8dca29b17f3ae7f085e50b1
TLSH
T147E0206955C8C53A911878C3C2B4AB1CD2F37C1BD39479512F1C8854B30254577CB5E0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log
Size 304B
SHA256 1f844da045ae4e4e56937a272b1c4679f12badfc99e892895bf61bcaea111fc6
MD5 e31621408f289cd9771b4a7bee72f0e6
SHA1 730336e9c21b7f4f753b1fd9c4cafb9d868be5e9
SHA512 a0fe5b23623294e52f151bac2e1d57ecdcaaad55297289ddf3657329e75744e6776ddf4421e5d7e89f899f72465181a9e33dd8e0ac64671678ab6126344a1f60
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 326B
SHA256 c406cfb2b42b07f8045ea99dfb4423e461d98e48f1b2d8c5e3cb6b8dddeb4f38
MD5 5171859c9544453d7d9771e6d645e5ed
SHA1 958d5c65b39e8e46d4f63958b063e5054129ed19
SHA512 d2740bf149562303ed4305bb3b284950b00cc64d04f0c5ea52eeb07407aed3140d961391630a607d05e824f901bdf791bc29284a070409e666a502d94fb5a7b4
TLSH
T102E0205C49C9C67990187CC38274BB0C93F13813E784B9412B1CCC54B342241ABC7EE1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 1633b04d8f8b9bad10889e8b9b9fbf4a873d5b0ff926386a24eed9fde3e0a051
MD5 8635f765b86892b33e50f7107acd03d2
SHA1 7f44fbae1d1dc2313d09a0ef5158f0cc825ea695
SHA512 bdf7a195bdc1cbbb892e03fcbaadd76ac50f81e2d578e57c1f47702d778eb8e630007838e647dddf15c83c8aa5c3a879cb0ea39412992c92489db4c4351baf41
TLSH
T107E0268886C8C939901968D7837A6F18A2D83493B3C83A422B1C98806303242A7CF2E0
MD5 SHA1 SHA512 TLSH

Submit Download

InterestGroups

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\InterestGroups
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

InterestGroups-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\InterestGroups-wal
Size 229KB
SHA256 d998927f7cbc69607ef53c5e9ce502980a571ac0ef1f76ee25d3b79dc659bb2e
MD5 033dd5feaf6498beac032cd2db23432b
SHA1 bbb0c1e59764d2a4e3b6e399f65ff6f1c18189bf
SHA512 0e280337f737ab5537ba4e658e521aa13d717d16453bcf028b2e2369ac9584a237ac66a8ac373ddeb1cd289c9ab62cf99e080b9a6b65caf22341779e5b0eb0b6
SSDEEP 768:AWll8l5l8lvulsl4lf8ldV8lz8lO8lSSlSQzQ/Q1QpQ:ZM+2L7DQzQ/Q1QpQ
TLSH
T14634308E5FA53629C1FA22B5DAD04D834E3E012FC7C356C9269452F2EAC3816D73D1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 d42aece26230b4a4a4b000632f982ebd996cf86bc3391fc1e2e65cb511a07600
MD5 53c21e0aa0b2674ed249820bafaa910a
SHA1 ee98072df314fa9c1645f93f5ea08c1eba01b156
SHA512 e1824ddf0c2e2234c7265395b39aeac6486ea4ebe1c803335ba7d09bc95f069a4e0106ed46adb6aa40ed5ddcc024e0a5852bd79339adaf4375bc0ac062d1ff18
TLSH
T1F01159F3182CD034D78281D85413FDA9D1236CA89FCCEEC4D0AC3297665A531BD25191
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 45b585da1ada8d267ae5941d590a2772d54fd160a9cf109a3b0c5e4e2032a7a3
MD5 f4a84a58481ce283d5f6cb125eccdbb8
SHA1 928d819daf663925e0f2356c10adaf39163c8aa1
SHA512 98dde5bbc681abf88810b094325bc1078324b15aa944c0294254ffe47691bc9ca94a7314cdde50674c53fcbd4799f0931433e679d4e42a69de88973f0304da06
TLSH
T119E0D8A547CDC1695145204B82787F0CD3E03417E7896EC26F18AD44F242408E7DB1E1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 db7f0818e757b1a31d38d1537891ab689c9a058fefb3f1a588eb1fba37751fd7
MD5 9367151c3cbcbff547b54f6bf93f69d3
SHA1 4177dc3373f5bae940180565e0af000b51677217
SHA512 2c23bba232c6808c4e822d423a027e9508fda57d887dbaf3e72fd621b06c102ee0f460b64f6d6f6b7bd79d038a88037280df893a59799d70153cc5ee67e95001
TLSH
T12E51CDF3C3E9867D8D1185F4AA146F1BCE2D0555436C3C5A89E4AF1BA3F2871E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 cd60785ed7cdf74a42921a90dff8d1dfcc0a073d3caeeb2acbf106b8523305c8
MD5 a7af70b3e58d93aea4b6bfba495f05b3
SHA1 d4bf0db50a9208e6ec0b0780c54fe0e836aee90c
SHA512 0abcc51c5723437ea1301d52208e609af2b36e4fb6399a74c879d4cfd6e73cadbbaffc10c2b1503568b4600623ad4d7da7a22e7679c877629372cba01a52284e
SSDEEP 192:sxR2RhyM/jK1Ml8wXi/f5slnaypioM4cb7CroA8pJN/g6+WNPCw/YPmdlTG9IgtJ:sxR2PNi/f5slayUnfRL/5t/Z23
TLSH
T10F62E8166634593B9CDBD25DF952BBA3D2F81573E2901E44A6FCCB0C04E6ADD2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 df00a61a2bdffbbbb8cd4b2cc7d9348604ca44b4de1b7091535f0999e923d76d
MD5 e14071c01742941e823c335de7059f0f
SHA1 46b8be60c68cfc9862c8e8d9d14f57b8bb274cfa
SHA512 5c94026427fed2ad079033307a02dc6a9906f634ec015350c29d5bf5ec872cc3613118b128a4d9020ad5f0eeefc2033e1328ea3d5df31713d01d6c47fead9950
SSDEEP 192:sxR5RhyM/jK1Ml8wXi/f5sERnaypioM4cb7CroA8pJN/g6+WNPCw/YPmdlTG9IgN:sxR5PNi/f5s+ayUnfRL/5t/Z2N
TLSH
T1C962E90666345D3B9CDBD25DF952BBA3D2F81573E2901E44A6FC8B0C05E6ADD2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivateAggregation

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PrivateAggregation
Size 20KB
SHA256 fcc11e1d32e72f65db7326f72f06a9af22ff934db247fbd2e1db6265f175291f
MD5 b75fbb6b6c9274ab483deec4683702c0
SHA1 82bd27e0cd226ce350d1e0733dc9dee92e174d55
SHA512 0fa0ad7dd74ed3d5be75dad91a4cb58bd6f035d6ea5ba7cd6063e6b7be04d48b54142f2c211ad44414914a298362586489bccff26ed1abf3fd515cf9b39dc5e9
SSDEEP 12:TLyqjXWhNOUhhQvbKL2LzKFxOUwa5qguWfpbZ75fOS:TLBjXWjD20wzK6UwccWfp15fB
TLSH
T15A9202834D449227C84E5E36C3C393D1CEB5711DCB61EF80539068133FD02C0426E619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\24e1b9c0-d0b3-48b6-a7c9-72828a9ca70c\index-dir\the-real-index
Size 360B
SHA256 34e852a423eb4e250574032cf41aeeaa923ccf442b5a7013f90c4fbfb1323e4f
MD5 0fe5b1058d6feeedf61df9e438354b7b
SHA1 04f99dbf9d95ef6244d23ec22d6f181d2b27e9dd
SHA512 faa2c20b43861ed4a5ff116c411aa8bbb868a626a0b1b29a30e2626062f4ad2738cd3a01854c5e66c3c26b50486ab0c7ad944dcf34a17a1d391b2c17bc53a296
TLSH
T1FDE02EA1CE602917CA02137909F62419233322EF3B805B2308BC243EEA8BA2C9128348
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a05dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\24e1b9c0-d0b3-48b6-a7c9-72828a9ca70c\index-dir\the-real-index~RFe5a05dd.TMP
Size 360B
SHA256 45e4bcc71ce91e888e02dc5ec8fe05c88398087db988544fc7fecf71dce7458f
MD5 b2f4965ed21a94eac29267684c99d34e
SHA1 1d883e8522a8533d34ce04b1ddc8c7b48046b231
SHA512 7c95983ca7f2034332033eb3c7fc6de89a61145f37bc78de76066114eb16726f61d305d4cb67bd50fc64677420faedaedb4d2a4930a40108b93b5f8b1c21a546
TLSH
T10BE097E287803F93CD0607BF0642A84D3333747A3B84A323005EB06DDE92BAC962534A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a3b35925-721d-48b3-8ff2-4c66bd7164c3\index-dir\the-real-index
Size 72B
SHA256 95aa088a409301d0392fb001c0f7ceef54743ef9a75721df3bfb34eb27a7d2f5
MD5 bc69b15edab1713bde8ff4922f5d1a38
SHA1 916c27d49ba2e373c994e7b4708d73993dd476a8
SHA512 a9359bb63ebf2b81653e70673363f257685013a942fd93beaade49e89bf933d1e97b75d80838784d9641888a1fe6d44ec3ab39c41cd88a810f144664e402af98
TLSH
T112A0021596C0012BC00723F43BD6416123104910E2012B2551A0024CEC585B949C702C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bdcef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a3b35925-721d-48b3-8ff2-4c66bd7164c3\index-dir\the-real-index~RFe5bdcef.TMP
Size 72B
SHA256 4eac77d2d7e4ad4a2d4683c3f2a55dd1667e4d688018a2ad71eb1e730d2f2199
MD5 f29d4b4328d4ebf551fad2200b0a9c44
SHA1 701bf9c240d935a60ae583582c56a9f9677aa9c8
SHA512 4bc20ac5262d54534de01cf0c8aecc0769af2e6193a3dc857f811cbe8becc197bf77e13dfd585627e0fd743fe1d1a00fa21c5c59e07d60bcffb04131bff4e50c
TLSH
T14CA0022003803109C01211B725D2927213408991114123774196058CCDD0E844A5610C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c49904899f3cea8ba507318b70ada343289943facc07e6400da4b017ed0c99a9
MD5 0918f8967525497ca311099efdb0c3b1
SHA1 1657ebc1d2a4d0a13e06ca0cae90ccb62bfe7151
SHA512 fa53cd241f0a889e6fa15198a7b626ae0a61bb74272432eb68cfddd514a2e1f07ba62ce54b14d8656f94f591489d89e45b7f3e9757bdf31892946b6846e9c578
TLSH
T126E06FBB3CF30808ACABA3E6103084A001097858C868FC4E702EA3C360A2335381AC2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5e677f6e057124e199da745dc1fc4ea0e8c2dac4800f0f0b3a57c3cd66b90da2
MD5 11458a50d9fd64506f4ba2b1bdd52dd3
SHA1 30041f18a2febb52f916d03c8bc20dbbd4b95759
SHA512 73fb0d14d732a69ec158b808b1eb0325993950705dd59bbe094df553a0dff564c5e161215e525e23eac1598795e583f92d6491d01e7b337224d736dadc36b716
TLSH
T1A6E06FBB3DE30804ECABA3E2103084A001097858CC64FC0E702EA3C364A2334381AC2A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 4ad5268aa5ee18c92034162f7214ea8e908648b49f7ab38d58ac082745ee1b6b
MD5 060975bbc355eae160fc9fab7097ea08
SHA1 a77ce4300d2a4f7fdf4d974c1a246659e051dd47
SHA512 fe8e3beede32f4c2b309df32eff7d27b48683ae65528d9bed91bb583d5af0a6a271d85254de5febf00e3401820a90171e37e6f9777611a9856c411eac5c2e9f2
TLSH
T19FE026944AC8C9FDE119204342399B88A2F4B827D3C87D463F38D940A347505BADB5E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 62b2060e6a1c2520924a359ef4f7de4e2175d729a93e342252a215937fe725f0
MD5 8dae3af2e02725851b247aa0ff46cc3f
SHA1 cfdaf5beddfb3f956c160f8032c2ada2bd54ac43
SHA512 d551403a1af9ff793725ee9c9792ce8ac09266f93ff82816539d0fbd72f5acc884a641d35687da9c60506e0fa9c4661d21bed5afefa875f386a7b93e1d86a5fc
TLSH
T15BA00215D95A9076D00002F090A1528923A08CDC4A19225560FC40DC9C565D043F22BA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bdcef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5bdcef.TMP
Size 48B
SHA256 e0347473e1baea0f9733a7fdad07a7e32dfa6e0df82c36f41e292b2d3ace04c9
MD5 5773305173a29b8d85655c5ff5f5e0f8
SHA1 f732930854cd1a625fb6dca9f4529ba4546cadae
SHA512 98a8eccb4f1bd502fc133630c0623f6fa18ab9d0481bd676dbc9aec64ff65ec9d09ce754706700100abe429250c4ecf5b769db9a729189563d4706e8d4c52a32
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 8KB
SHA256 f58dee2c03624fa517b9351efbda9466872cd41a2cedfc24855ee684004c479f
MD5 6e2e8f506d0095c584ba1a0eb0b51e0d
SHA1 9e2264b1d3d441e49760776428df62b76bacccbc
SHA512 349a828ef41d3d9a8ab557ccff41b167dc97def89ebdb444e54a06f35b3e25b8228784953fe8d967ca3a4be05dd45000ea6d4519204da05c79b8c9f4c37cdcb0
SSDEEP 192:noBi55s9keltD4ut+cQxo/aOF66ubrQ+moPveGT53E:oB85s9keltEut+fo/aOU6QQ+RPvz5U
TLSH
T1C0128D5AFBAA405DF7FF8E71186124994C7EFD422C9DEC99009442CD0D3AE48E871E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 61eb6d884a043265ed25990f17e8317eac20acd82b32cbebaf15994771e8d269
MD5 9c1ea70edcdb330b4dab2be7d42f41c9
SHA1 e73a94890405b005b225c562af7ba81553b55f71
SHA512 8a59ba059c1901af2fcdc91c24efe270458562806f725554714a5ad92be811319f4a7d9206d02743bf163c5d2d3a18b8c9ed30cd8d3ac485fb8e77e752f919b4
TLSH
T10FE026A807CAC2795110646B42356F0C92E13413E3A86D432F19E840A302106F3FB1F1
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13428066333503566

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13428066333503566
Size 848B
SHA256 22f5096ac960e7818653893e44f0c9e6920fb9134088bb6fa615fd98700f8691
MD5 7e14636c2bb8ca3a7c6633d63f8ecf82
SHA1 00c3ac66310df3b53e98852956b81d0e0331d98b
SHA512 81ee8e19580fb7c4abf7395834f7348aad72fb430b103898bd5ae7fa3e17c7113e1415578ce4a9bf071f277875363eb8e5918652aa6f2359b66aa6a6a395aa1b
TLSH
T1BA015C3A9D58063BC5BE4A76E1C604E7FB305C0577820E0B014272544C337620F5AC84
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 0cfe002cae97b3ced618e1d0c6f4fe898515d7ea1e8d7dafbda1b60fa6aaeae0
MD5 55de04bbfd743f6d350126fc5331a4ad
SHA1 5a7b5c23a74fe08691bd47c0f7cbc67c8ab599ac
SHA512 cd531e28d82a841d6b32c18645ad1b60211cdc972ba903921e3eee1b4d71140e848414743fd6bd71afdf2027466bdd3d60a317c1cca95e5f0a099feaf89c4de0
TLSH
T1B8E0927866CEC63BA14A608F4275EB0891F67D26D6D869627F1CA844B30628472971A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 bf3e8e00a60351dd880e0910762571eba4d752655006f17b7fb82f84ee43962a
MD5 8e8a4f1d35a191d6cbf11d4c89ccb0eb
SHA1 94fafe00a20f5a88a467e1dad75bc1f6bd9635e8
SHA512 3c513d84b1f3dfb308751be87fe56ee9ec67748121534a68b9dc1b2f1f0f0d4150350932338b9fc55b719a6a4c39e7a2a30427abae68ca620a757a6116a1e2d1
TLSH
T188E026B486C8CA39900960874274AF1CD2F8BC17D3C83A82AB1C9468F702285B7EB5E0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f7e60378cacda8c1bdff271e5fcf9e1c1e1d7a05b0aee6edda480996d3049a6c
MD5 1e329cd9bb1f66f629464d66381d4b7d
SHA1 43636b5ee624b5d587c9344da40f7a426eba34f8
SHA512 a041d8aa5e20a54370087a5791ef24be6170a940aa8933665ea41ba8a2a52346c02db3689725fe01646fa83528d4ea138b9a5ad4e24cb56f03390880fc807d0b
SSDEEP 96:KRFSr/VPTXWbAOgHXK42gZXc9lYrj8HbEBVj5J1WdSIg91K4EgT1c7j6dJklQUuV:CFSr/VPTmbAvHN2gZM9lYrj8HbEBVj5v
TLSH
T11A91A890713A0690793EA91CA478841FDAC574A3309DB46B37A83156CF67F078DFE4EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 b01aa480e547c835ef7f12982014458bff19e10c20afbcdfbf122081a0aa14a9
MD5 950ddd0e242f0347ed3c9d6d282d0b4c
SHA1 679474871ebf8864f62b9a3c0a007ed198d6d5ef
SHA512 0cec389d01b49602a96e9a68a3d5077317796d4e9a8e8b26076f79c4b1d1f9313ad04173fc35e3e1af7dfed5701f75eb42f6bf0d557995624397ba74b9f12895
SSDEEP 384:zN5RZyCSDnxTICYMEhIKyll7svbFKfk7:hHZJSDniwyI1l7svbF9
TLSH
T16E44640A7B747001EDE2D9725CB080771E3C616E8F22E6815DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arbitration_service_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json
Size 19KB
SHA256 5aff8c44b87ea4ce18f920e968b12704e9905366d716a99465e2de7aa588505b
MD5 73a472aea2a998a2af88f6c61bf0f4ad
SHA1 7666b8d53304ab3101a234f363cfaf17d3273a4c
SHA512 4b4d8f9cf5f708c4fd2cb0022404aac7f665cd7d8af4fa642fe9b44bf31de9d5572b8f268b6b401911cdb57189e22a84fb6630bd37cc186aa8a637613776555f
SSDEEP 192:vQeqfRR+nft0joCxc/i4utSfnwzYOq59/Z2ef8Hw54ecoaSbqG/I5zT8/:vQeiKF0jojq4uGEigefsSraSbqG/d
TLSH
T16292C150FD1B7D6F3BBAC0246B9464475CAA879EA874900AF2BCCD049FEDF240216D5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b09f5dfa-8a7a-451a-a7e4-c9e59735c5f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b09f5dfa-8a7a-451a-a7e4-c9e59735c5f7.tmp
Size 27KB
SHA256 9744e22d1b6abc88abbb95c1dfe4e39badd617532cda55ca56f93c90dd2f1863
MD5 ae4a0cd6a2361d738cb63be3453f6bb0
SHA1 769f8a698ba5628db75780deb0b41d163e712ef4
SHA512 368aa99c7bd860c46ca55efc4db705b4473ee34953ead169466404f66ae9da3c1a55d2d66acbac138ef91821b5b4df2a9764baf47b7194912214f34e9f237612
SSDEEP 768:5+Mc6pWgFZfsl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhj/eXroVj8H:5+Mc6pWgFZfslu1jaUTeEVj8H
TLSH
T1DDC2FA2B640CC77F4F844AADEC25AE966DD801CB9B988D5447FA890C03C77EB521B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 17ad2dd3409c4e1b2959a85089227df782f92af4a19918b1692df8260747d2bb
MD5 47a9ab471b296e018a7c77ec75c5d392
SHA1 9c547c5896b60df01c3faf5f683e3da76c162796
SHA512 304b464d7c181886260714249ac0180e44012c9713692cae91db0483be5d918f62afbaff6a5c54b58a79fc7e5fe03c179a7e5162a42c9369259806d98c3a2123
SSDEEP 24576:BmGfCdAXAQmHbwl+/AZ/iUl41mxUkRPUW7DhKPRwXQH1i+MEzTRNd69K2nve+UP2:h
TLSH
T1E716A8F76C06916AEACD8578A80BFF56583346218628C8D5FD7D4CC37B396023DB89C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 7e7ad7dbbf4bcdf1f4840befa80920a7e0d341985a20e88d5835ce6a3fe39d3e
MD5 6667c21c8dc45f654c3c12ecd899a0ec
SHA1 912bd6eda5e5273fdabb1d7a9b718330f7aa419e
SHA512 1bbc7442bb55420fe7b38f6294beb9e88da8c1fa67a193658c6f7e9fafaefc89b0ed6da7ebc0d4f6e91dcf55d4e1c647ece26cf6a94b91b03e8b8ad9088c0010
TLSH
T13FF0A8E76E020977CC02A4354133AB83FB6699CB002464BB03CD226B2A2E2F1C9CC0E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 3c242ad0c19c1cdf8897d6f0747a58a7e46a8cac11707ea9ce625409adfde732
MD5 bd708c0bac4b1969a30b60f88aa8178c
SHA1 6e8b8ffbc7b98189f0bee73cef6e8259d517c6b2
SHA512 e0f8773c59ffde8bfcfce01c25daddb30661c062b3a6abdee1de554ed9946f7464bf8c178f62d96d8518cbf83d7760b2d2cf4bea6ca5a09a0675e2a5482f71c7
TLSH
T152E02694EAC8C1BEA5142487013C6B0CA2E7381BFB983D863F28C444B303101BBCF1E2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 94774152f3e73c907b780c4a89b3ab6a3f4c17cf8dd3356c64b6c0b0b01b59cd
MD5 84b52df266824d2ea142006588aed86d
SHA1 7de2550dc2fe2b8f0fb58486995a5784f6943602
SHA512 f528933e20798a814e70f86d2357d1904c07eccc9497277b4e5af48e3882b1f219252d1c56d81b4770871fccb6298412ae1b5e39219da9e08ba68268d664820e
TLSH
T1C621B116F330D118E64A427E607E9B291338E8428FBCED0F44BA34252E75F052E8B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 bc5cf719bcd48eb7602e67ec67d06086e9de683f65985e81cfe4bed5f66318f5
MD5 eb810ca098dc34a02cb8727ed815717a
SHA1 96d25a06b0173511daeb24ea83e1db1105c6496b
SHA512 6c2e893bfa0202642f470b6833b2c9031cc89b6949435bf8ee450b0aff6e69927fb7d58e80cabae40b41ee7e650573000b03200010ad2fbe69965f9f7885d710
TLSH
T18BE0D89465C5C1AF61502483017C9B48A2E53817FB943E413F288C44530314A778F1A2
MD5 SHA1 SHA512 TLSH

Submit Download

2c1b2e6e-8ed6-40b5-b67c-71ca017f32ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2c1b2e6e-8ed6-40b5-b67c-71ca017f32ed.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 f0e812e7cbbc41b4abcacdfa83c6ab29da9be5b418bc9ec1cede6e1a793baf8a
MD5 9998261ca6fc7c6e8ecaa8ac485bc0e3
SHA1 5381a0b56d6bab4e0bec43c4ba57a798d8f7507f
SHA512 eb7f191c3702a608f88d533ab04bde8aaf3025c5fe5de22682bd6f32e1a49b0fec23473c69ed6a5afd9264f7fe751cf66a8fe64bf31ea30e9a2fc3df2d9e754a
SSDEEP 768:Jhj+9v3qwFJGkMf5bfPKfPStXfmb5WFbxsz56f0+ynoQ3b9M1:J89v3ufBfCf8fW5WkQ5yb+1
TLSH
T180F2CF32A8225DB34EE386C5F2573A4BBEF04273D2C41D849ADD7B0C45DBAAC1317826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 9803ee5dad4b0e6fc23ab468abdc78a17b3a0f89808d2a5d87979563e6b665f8
MD5 6f87f97dc96027a7209ce15d9d33e6f4
SHA1 5fbd7de310782049f2bfec2732a12beb751a3ebd
SHA512 2ba9c97fd3f2d44df8f50ead4862df5ea8c749a3400ff353bfa069d0d31a8c7f4f0e1987e66558aee11318e064750592b6193991d5aebd2e6e0af43497859ee6
SSDEEP 768:RqF1j+9H38wgLwcif5bfPKfPStXfmL5WFbxsz56f0+ynoQ3b9M1:Rv9H3RfBfCf8fW5WkQ5yb+1
TLSH
T13E038D36D861DA6BAEE38BC6F7563A4BAEE1426386C85CC4DACD6E0C01D75ED0307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3a7176159758f9ecf0f31f658ed30bf0649645fe00e56e33ff51d8c663465e58
MD5 f9bb1936a9859ab7881973462bbb7ae1
SHA1 63557c0f3c5f768e58de2ff09753dcea22174b91
SHA512 e6fe7029ff4e126aff674bf6bfdb2c0b31bf14190e2ce0ca3217bafa8cadeee98092b35c179bc45ea82d2a3b4c50c342c6718810d0d530f2db407c28ec9a41f8
SSDEEP 768:Dirv+4UNbdl3NvzuJGkMf5bfPl5WFbxsz56f0+ynobLUixK:Dibsbr31NfBf95WkQ53UX
TLSH
T16E03CF36E82499778EF3D685F28B7A477EB81263D6C10E84C9DD3B0C469B49D2307963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 75994b7495ed0b8c366d52ac33f9def9ac961ab0c136238fb144dff475ade98a
MD5 5ac194040921cf2e8a0bb859c0c9f95f
SHA1 330c6793d9c54433b4e688925a0da0d770ee12ec
SHA512 7fbc312fbc135982c9393a8ed15e8a7b3577892bfb23a05e13ffe3d1b2ef468704b41f0a1c179186dee04e747043e29e572a6d0be088a398d751bd1eee7c233d
SSDEEP 768:Dirv+4UNbdl3tpPJGkMf5bfPKfPStZ5WFbxsz56f0+ynoqeUixK:Dibsbr3cfBfCfW5WkQ5xUX
TLSH
T13103DF32A82499739EF3D285F28B7A477EB85263D6C10E9489DD3B0C469F45D230BD63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

a0cfbbde-b7e6-46b8-8d15-c454e580a2c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a0cfbbde-b7e6-46b8-8d15-c454e580a2c7.tmp
Size 36KB
SHA256 aa69d6e893508f635f73fb346b7ec55ac5432df6479350ea169e96f2508b4da1
MD5 b1574fb8be00c06ff771a6028c883e2c
SHA1 06796213592eb64ea8893de496b9528e2908ca86
SHA512 2cc5a80a8ec1e3e5009157782a152ed18fb269befc12529a085d6eafa468d76c0e49245ba6c76cfcaef9b5b6d1d7eab2df55241d25cf78dfece1267e7efcfbf3
SSDEEP 768:/hj+9v3twFJGkMf5bfPKfPStXfmb5WFbxsz56f0+ynoQ3b9M1:/89v3HfBfCf8fW5WkQ5yb+1
TLSH
T173F2CF32A8225DB34EE386C5F3573A4BBEF14263D2C41D849ADD7B0D45DBAAC1317826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f057e3ae-7963-49a6-82d6-df3fead6e0cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f057e3ae-7963-49a6-82d6-df3fead6e0cf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download