8083cd963c2252f82834d461b4bab918e9f6d8cce7a653dd5a34c3385d45e34d

Resubmissions

15/07/2026, 00:17

260715-aleddaat816

14/07/2026, 23:27

260714-3fw1fsft7r4

14/07/2026, 23:22

260714-3ckg9ahw2w3

14/07/2026, 15:36

260714-s2bxasfx7n3

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
899s
max time network
751s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZenMenuLoader.exe
Size 261KB
Sample260715-aleddaat81
SHA256 8083cd963c2252f82834d461b4bab918e9f6d8cce7a653dd5a34c3385d45e34d
MD5 924575f51aea2592825fecba340c1087
SHA1 91cc5e36986d3741085953a4893c1f70a00511f2
SHA512 36df45011065d67d1496104506fe1d725c7135261609894438d65da2b63e1052c0f72ca3b1f95956b6d322b80300414e68c674dd89cb6316e8d6bb5babc653b9
SSDEEP 6144:K5tBhmZDM+QH0Lo/OB9daoMJJtFzfuDLY4v2ZQw:Wtck0LObJtkHY4v2r
TLSH
T1274412338FB2DE0BEB3543F5F4428DD12A11036657FABB9A53F3EA4269A24C53217815
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
10	discord.com
21	discord.com
59	discord.com
96	discord.com
147	discord.com
2	discord.com
9	discord.com
18	discord.com
88	discord.com
94	discord.com
95	discord.com
130	discord.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\Notification\notification.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_92445866\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1306179360\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification-shared\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\Wallet-BuyNow\wallet-buynow.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification-shared\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-tokenized-card\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\wallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-hub\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\wallet\wallet-checkout\merchant-site-info.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-tokenized-card\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\bnpl\bnpl.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-ec\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\bnpl\bnpl.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-ec\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-hub\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-hub\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification-shared\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\Notification\notification_fast.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\wallet_checkout_autofill_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-shared-components\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1633752713\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-ec\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-ec\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-mobile-hub\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\Notification\notification.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-mobile-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_1306179360\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-hub\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\wallet\wallet-tokenization-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-shared-components\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-shared-components\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-ec\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-shared-components\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\driver-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-hub\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification-shared\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification-shared\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-shared-components\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-ec\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-ec\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-shared-components\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-shared-components\pt-PT\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZenMenuLoader.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4772	msedge.exe
1824	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285483130441671"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{5926C4EC-4225-40E9-A6B8-5C715D84CD6A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{6BCCCC41-FFE7-4A6B-A99E-45BA202D98E3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{21C45920-4D89-4979-989E-25B067CDE499}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6176	msedge.exe
6176	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
264	OptionalFeatures.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5584	msedge.exe
5584	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 5584 wrote to memory of 4256	5584	msedge.exe	89
PID 5584 wrote to memory of 4772	5584	msedge.exe	90
PID 5584 wrote to memory of 1516	5584	msedge.exe	91
PID 5584 wrote to memory of 1516	5584	msedge.exe	91
PID 5584 wrote to memory of 1516	5584	msedge.exe	91
PID 5584 wrote to memory of 3392	5584	msedge.exe	92
PID 5584 wrote to memory of 3392	5584	msedge.exe	92
PID 5584 wrote to memory of 5224	5584	msedge.exe	94
PID 5584 wrote to memory of 5224	5584	msedge.exe	94
PID 5584 wrote to memory of 5224	5584	msedge.exe	94
PID 5584 wrote to memory of 4856	5584	msedge.exe	95
PID 5584 wrote to memory of 4856	5584	msedge.exe	95
PID 5584 wrote to memory of 4856	5584	msedge.exe	95
PID 5584 wrote to memory of 5732	5584	msedge.exe	96
PID 5584 wrote to memory of 5732	5584	msedge.exe	96
PID 5584 wrote to memory of 5732	5584	msedge.exe	96
PID 5584 wrote to memory of 6392	5584	msedge.exe	97
PID 5584 wrote to memory of 6392	5584	msedge.exe	97
PID 5584 wrote to memory of 4360	5584	msedge.exe	99
PID 5584 wrote to memory of 5464	5584	msedge.exe	100
PID 5584 wrote to memory of 6052	5584	msedge.exe	101
PID 5584 wrote to memory of 5464	5584	msedge.exe	100
PID 5584 wrote to memory of 6052	5584	msedge.exe	101
PID 5584 wrote to memory of 6892	5584	msedge.exe	103
PID 5584 wrote to memory of 4676	5584	msedge.exe	109
PID 5584 wrote to memory of 4184	5584	msedge.exe	110
PID 5584 wrote to memory of 2556	5584	msedge.exe	111
PID 5584 wrote to memory of 5908	5584	msedge.exe	112
PID 5584 wrote to memory of 5908	5584	msedge.exe	112
PID 5584 wrote to memory of 4104	5584	msedge.exe	115
PID 5584 wrote to memory of 4104	5584	msedge.exe	115
PID 5584 wrote to memory of 6176	5584	msedge.exe	116
PID 6176 wrote to memory of 4192	6176	msedge.exe	117
PID 6176 wrote to memory of 1824	6176	msedge.exe	118
PID 6176 wrote to memory of 6432	6176	msedge.exe	119
PID 6176 wrote to memory of 6432	6176	msedge.exe	119
PID 6176 wrote to memory of 1564	6176	msedge.exe	120
PID 6176 wrote to memory of 1564	6176	msedge.exe	120
PID 6176 wrote to memory of 1564	6176	msedge.exe	120
PID 6176 wrote to memory of 2472	6176	msedge.exe	123
PID 6176 wrote to memory of 2136	6176	msedge.exe	124
PID 6176 wrote to memory of 5380	6176	msedge.exe	125
PID 6176 wrote to memory of 6612	6176	msedge.exe	126
PID 6176 wrote to memory of 6676	6176	msedge.exe	128
PID 6176 wrote to memory of 6676	6176	msedge.exe	128
PID 6176 wrote to memory of 2256	6176	msedge.exe	129
PID 6176 wrote to memory of 2256	6176	msedge.exe	129
PID 6176 wrote to memory of 1220	6176	msedge.exe	130
PID 6176 wrote to memory of 1220	6176	msedge.exe	130
PID 6176 wrote to memory of 4804	6176	msedge.exe	131
PID 6176 wrote to memory of 2072	6176	msedge.exe	132
PID 6176 wrote to memory of 2072	6176	msedge.exe	132
PID 6176 wrote to memory of 6116	6176	msedge.exe	133
PID 6176 wrote to memory of 6116	6176	msedge.exe	133
PID 6176 wrote to memory of 3448	6176	msedge.exe	140
PID 6176 wrote to memory of 3448	6176	msedge.exe	140
PID 6176 wrote to memory of 1272	6176	msedge.exe	145
PID 6176 wrote to memory of 1272	6176	msedge.exe	145

C:\Users\Admin\AppData\Local\Temp\ZenMenuLoader.exe
"C:\Users\Admin\AppData\Local\Temp\ZenMenuLoader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:?url=http%3A%2F%2Fdiscord.com&timestamp=1784074693546&source=WindowsSearchBox&medium=MSBLink
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffbb5adc188,0x7ffbb5adc194,0x7ffbb5adc1a0
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,9431137551013629241,10638737721475971615,524288 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1916,i,18123164288269328472,11060112977591779547,262144 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,17815775946949341654,12231042346130807778,524288 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:13
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,6520274392767493490,539088509336296166,2097152 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,7967345549578677034,17198607934103131871,2097152 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5092,i,9542633899103584351,6213690182149746025,2097152 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,15213363763578245207,13714560473331129949,524288 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:12
  2⤵
  PID:6392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,1765573968900986744,18203731803276404056,524288 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,481509860962880575,4674653458681246938,524288 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,9116133262874029690,10679787224429046486,524288 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,16303059694699740550,13974520674143509368,524288 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,16303059694699740550,13974520674143509368,524288 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
  2⤵
  PID:6892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,15775349144661211737,12873800839256417346,524288 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=1432 /prefetch:14
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,8040722014059241053,3799793733165654657,524288 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:14
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,10057662289438964763,17208575106186346427,524288 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,13777415182055147506,9089217478496561370,524288 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,12013382173484903743,13176858940266991213,524288 --field-trial-handle=2352,i,4341146260703690324,8772257092668407619,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x234,0x7ffbb5adc188,0x7ffbb5adc194,0x7ffbb5adc1a0
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,10145330585431183523,8807383203110978936,524288 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,6304574657730946975,6568530190347767123,524288 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:13
    3⤵
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,13483526653208021222,5474192394594931111,262144 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,7256804783689096638,4062357418275661911,524288 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,7256804783689096638,4062357418275661911,524288 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,17587994513365158913,5543794088949723102,524288 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,2204718058944438670,2191752568492179357,524288 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,17432566523422562230,17033249653799532286,524288 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
    3⤵
    PID:6612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,10946782314720573753,8008652369338534749,524288 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:6676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,1678092279775780956,6015970115419050339,524288 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,2324142580052546544,3092137759007528483,524288 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4912,i,4536502714441757830,17822682578497670786,262144 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,16634050747349147195,4940620650427022623,524288 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4100,i,6814258890054393527,15582574343519420964,524288 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,14119691312691186926,8504265154717698781,524288 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,17117086699847310643,18253268046869402308,524288 --field-trial-handle=2276,i,18122865842842605355,1404894202005806663,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
    3⤵
    PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3808

C:\Windows\system32\OptionalFeatures.exe
"C:\Windows\system32\OptionalFeatures.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6580

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f157f7329f2eba924aa0ca39485e6cde2fd8278825380c8456e9bec4022d2733
MD5 59bfb83bc4725eca05ff848ac3c2a4a2
SHA1 4d2623d00f7e4642df9afa30ce06597a532c5453
SHA512 e4c15acf75ae26b73ccdaa3290247d924d3a7f8025a4ef63ad06120f7648380481a6c1a9768e22ffc9e30b047079c9ae0efec32c522718f8316b4789f8905471
TLSH
T199D02321BB387CD7E5281571D031CB007A1A157362B792026650C40C5C7A9E266C76D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 542d8bb008e8cf82cc85278f0d76d564b1685e8a2452aa7895760eb8dc0c1d67
MD5 2411f6dea7570d496f1220765c54a38d
SHA1 86d454232963122cfaca4fd94258096d56ac2d3b
SHA512 d3938d86390c427289e4a9e409dc323f9aefafdbdf59f594e42c477849621baff6eed95bd642c55ff94a9e5d78cc8e6f26353e68aa507a129cfb2c7990b494a1
TLSH
T176D02320BB1C7C47D6451A72D512CF05BF26542371BF9202A570814D1C7A9F357C6197
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 2f6ea14dfe8ee9291caed5de1f77a1913371ae3275001c367a9112d9ae62ff73
MD5 70cbb2bc5f47eb69b68abdf27bd4bf85
SHA1 2096495cc380867b69fff6b02c424f676e5e0e3f
SHA512 e25493abcd9371cbfd8a8e3764ff73b57ed3a3ec81135718a26dd5e51d4109db93c6d7ac5223130eb1bc06c18a565dc5224a7ee14801b98c01a959ed5dcc4d30
TLSH
T148E020AD49CCC61DD340B64F4294430D42403A8BD7C46A4D1780C48C714505CABC27E5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 92a973fa8f43e6bbe56af5b1d6fa5d7cdf55bfe802df730198b1f45fdd812bf4
MD5 3be0c11962ee216ef2908c1a909de89d
SHA1 6735c8bfdbf3433111a55484b7523759d3a4efe2
SHA512 20b2f448310d71aed54df599452395c476aa73f812c1412148b715f1a413b7863acba1561219bd93602706064257343b8bc6e84fda74449055e5fc44743b54c8
TLSH
T151E02BA7C961BC376AFD1B1860580687EB50131B3B41984B3B3C835C4FF46374686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 80KB
SHA256 bae7bead114c4436a56c09b084a77a40f0fc4ebb690a013756514a7b2ca3d6df
MD5 287b5d667e64546fa9092efd3e9c5c4f
SHA1 5746a1b0ead8f156b6114cb930faf019ab0d3124
SHA512 c74008d8e10879bcf5ba340c29be5a7d44af40a519bd7bc26cb67358235a2f00847326879a0521ee64ffc7c1bc662e8f8779d70391a73c444b2461ee2d9eed98
SSDEEP 768:SoTqEAWGcwOuAu3QCGnYixNRM293A9LTNwYCQNFiM+Dp:S6pAWGcwOub+nl/q2KW8op
TLSH
T121830ABD69D13D57C9C7827E181F6A743368DA32C3928527122E300A661AFCE4DDD8CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 776KB
SHA256 ffcf998483ab12dc5c6177d87c7824b970abe27cc7ef27eeb8313f48e77a459b
MD5 e996b3cc721368e74728ec2e9070f273
SHA1 69f9747080b1af42b92862820a1a397c5146b322
SHA512 5957c861d0140600f90ab6a02870fc5f2ecac8f5b37d6d37c5ee815d5f49e088c3e9dd15a14ad5df819041b25374be8f1a924b5f899f368e8483a29450b83542
SSDEEP 12288:dL/pL/2L/cL/ZL/7MMKVakzljtx8RhEENObp/8VLNNnRIP:DpKVaklIRhqh8VfG
TLSH
T1DFF4C4F785006829CB3C12F95343367C9337458D2CDAE9DAF57A1899682DF32B2A4DD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 4.0MB
SHA256 e24b2a4e67d7439bfb6691b61171c93c2379add12e74e457d619f0a2beb03d68
MD5 be05ada7e653300e814298bf77c7d928
SHA1 f28c106d2dc3f2736310a95fefff572b66a0dd71
SHA512 0456a687759f1d43d9991e020e9cbbd8b34eaf40b9cdd8cb466111c0ec61af1c341afeee01454926ff0921d8db766809b1f7aacbfe633f2894a25903f5dfd118
SSDEEP 12288:XQG4iXo44ccWMpzOhgxwVSnZP4gU4oz55F84swVluncSi3TvJG/odEupurbL138b:u9FBOKv647qnhNzV87UpbGq9P
TLSH
T17D163BDF87747A92DBA6DE70FDC4EC6A3EB811C2AED6E0432502C57D10837C22A5558E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 29741a2792e938a8b834af8ebab0963b19243a32a0ac84d0b46d31095191a4d5
MD5 612dc7dcdd72e6892dea5ab665e1c8f1
SHA1 e4dba2024cd2d12c5f7f7ccb6c53884e99613894
SHA512 68d03e0008ba4d2617d12148122ee3b7708693f4d835ca3a2bf90ef8ab84fe365faac44e0f8b9c707a103b34eb621089bf5a5825932a20d95bd0fa1c34ab75b9
SSDEEP 24576:+HcKN0bvUXcut3R5l64MLaUWZvh1uMyzNOowls468/JfvFU+rKKy8:+8z8Mut8PLarh0MyzUOQ/Jmdt8
TLSH
T18B16AEEDC96858C3CE639A30B5F0E9477C7413C3F994C1D6889CC584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 393cd26c578ce86ead683959eb0866320b31b96b5274e49a2b15b8209353854d
MD5 57b059d5f08b0faed3adf5ac0d13b93c
SHA1 66c520f68d0580b76d3f62fa7f2f2bbbc38af554
SHA512 75a48af482d7fc5024f531bfa783d0d4ce8a83cf83007423cee4f1420b498a6e80f18b10ff3d645150e6836ce24ce0290a3856477bf8748ee093e6758d60171f
SSDEEP 96:8u+hLdGh/G+PZP0Ms3hugVVRpY7GsqDyi19d8hKgzYXcsjTB:n+xwh5fs3hJTiGs02hpsMsjTB
TLSH
T1920297AC9EE734C3EB141475A4E1A8A534F964790E871E1E650D7E3C840EF992CC22CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a4df2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a4df2.TMP
Size 3KB
SHA256 df2dbc2d6d83a8df6661bbe7868926d1743574240f7cabe2290b875d1742bc1f
MD5 9b171e2ecfa9ae5db0b7e5f754a3f2cd
SHA1 124334f018b4984544b82d7b46cea270ab2ea78b
SHA512 91bba06e41c6dd04d6ec50d51a7e5c8022d3721630cd71a99e684bfbb9dad3c6fcaef8881ae5822ce8deb5915cf070282fe28dab8af07a7e7f46d174247c1746
TLSH
T16B6120FD97DB1AD3F72864B2AAE598B839FCB4A61A476E1460006F38C40AF047CD411B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 d852e3bfa5dea78d5a9f5c914e12b4e103021cf3008136b573c4efc881ba76fd
MD5 45462d43a8d4201a616f80a5fad18a44
SHA1 b87e36127049272e926028298041af25d55010a2
SHA512 2bb55c643b82eaa2983bd9b281c7e015814623697b15095bd85b86d2d65fb0f0825b57d501dccbcf1e5ca2c9178458f5579ec38f42f015685c9857aeb4ab3a8b
SSDEEP 3:MsEllllkEthXllkl2zE3EXl:/M/xT02zoEl
TLSH
T17544040DFFC00C07CD0011314115C3501370D4100515D7477D7115175CC7DD04C00040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 5a343a85f53acfdf4236bf2e64da1226a4209b657034dd1213575ce386fed9d5
MD5 b988bb3f6c7e7e05848e9cc433c3ec25
SHA1 013a94aa03f43996d641c0094275d66b9653e68c
SHA512 a3bec958f2856ca9b88409fc74495efe89a6c7a1befb6a8edb34c2ce1b40d9ac4405acad9ac8c33f63620e0eb94cc2bad5fa32407f92c52c43ee923328934ecd
TLSH
T1F2E0D8B559C6C11D999435824128970C928438C7D785BE43275088C47B47215B396A87
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 0aa74d94812db3a431d61df2e5b564651af50f29df366ddc4686a9da138cd549
MD5 aa1c371fe051800f6f4efbbff98a4eef
SHA1 d827c07574547a3a6fc85deb68983a59dfb4881c
SHA512 3fb555f50a00ddc45b89bae64ad9dbe7d856e0a90c01e6952c1bc3379be7c6c1992f7c0ba643e46f26dfd761587cc548e96bd2ac1f08d9e9f99fbff365bd8af5
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj+W5LkFtI8NVqYpf:TtD4jJ/0UC+lf5yWxkFOcVTpf
TLSH
T123E2C08C3B11F511C4ED773DE0D2C5E09EBC686C4B4DB5B1923CA8728D626A2F49E15A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 f0a30de16d677023716dc05ac3ad0ee90b7cb7a523724220f00fbe8992fc254c
MD5 16833694b82263b22f7f7cb9cda2a5c2
SHA1 339eae38a11db954ae8ab1ba86a2956cab0cfe45
SHA512 d5ccc93ba5aa4ff58452827b3384ea25c93c5ac1733655ebc3a2852be9e61898133c47576a1fd1a3978726509404d9a1b2570038f70122be060176670cd878d3
TLSH
T179E026A409CAC139D0547DE38278630F92E038C2AA883A42178C9888A281749E3E7680
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 56KB
SHA256 4d51bb74fc1ba8779773222a4ba918f61f274b1c515dc43a0a3cac37db706b1f
MD5 506e48590ae71c6ef556cf82a5e289fd
SHA1 32a08c1485a9af6d9c3e41abdd1f4a0310db3db8
SHA512 8fdcb88c454e1b06306a361f8fda6c939dcd4eeaf23a0dfda535c1083c8f670e697c759d6a995ef8e8dd51a5e532a1937d004a9e3b3f432f4f239e13c9751cf6
SSDEEP 768:NQQQSEbG+Q3wJMHTFcyg2Yte5pbEbGnP3w+MHTFcK+G2YEgJ5Cs:NN8i4kTFcyg2EeTwiIpTFcKl2dgzC
TLSH
T18743D068DF3130C3C36507B61B5B55B60F6803C7DCA44972304785BA8CA9973BAAB75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 d1614e2e7955dd7aca6209b3599b2b0fdffb32a42584e032a09888f4373883a7
MD5 74a260ffc8a109864ddb0bac6caaff08
SHA1 d45f96fb45c7434285e75a2c59d34fcf687f8c37
SHA512 d4a23a9d2e77c22e17118490543aeaedbe562bd9ff1fb82a8ffcd28f42d87547eab47f6108a62312c17fe79855c8055e639e9ab0305aec3844c9c3140ff5e2e2
SSDEEP 192:V1vxMcZH+bF+UI3iWGVoWN3qL/+B8wajVVV63:bIkUI3ijVoWN3qL/+B/ajA
TLSH
T11224301F5F302721CDBC813669E748A35D7DF03F8B5366DA68621474CEE2652A02C8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 10KB
SHA256 4866c1ba5d8060715496940062314e74687d858a8d8f979afeb62e5f7702e074
MD5 e480b6f8a75224de91987db22af28b81
SHA1 41f77c60a669743a3072302b48df6ff758d93b2c
SHA512 15fc371fa285bd47b7c863f0852da1e9600d9298887b96ca9c660150d3496a393551cef5a5e86c32f8ed5d54510c9f671cdf57aa154ce8633a6bae40ac4620f1
SSDEEP 96:8CLyLOm2nwej8bB/GZtZCoLyNGUiADZXYAyKU3Q2mIAMuZnlOv3y/K4VKXl+CJFu:862OmGj8bDifuU3Rknlyi/DUMChWjvb
TLSH
T15422113FD418847E87378737928B3519CBBB297E184CF559D1C71D0C066E2AE111699F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 9bf328bf0134a68b8b652fd2bffb58899050554124d28696910d164e1c0f2421
MD5 276e86130bb7205ce0a95d4a0156cb78
SHA1 33432e5cc9e32aee7448b39ab1202fb0e48172d0
SHA512 739c1c6c8c36d87aaae9d9eea0a4e2bb265431067e0e27a4aa973be4d2dc9602648459c0f3d98e2f2dea14eff961d2a510f50e2ab0562c1142d47149ffbe2289
TLSH
T19FE0D8705ACDC519A14430AB42BC770EF3B03887F6887B411B44A854B10D008A7D75C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 f58c36a6492f4d44c3cf234a58dee0071499837cf81505a159fa8bf27c0971ff
MD5 2ffeaec833192cd5dc1ff90feda7623a
SHA1 558f042080309fa50a43bfd9ad32ba597fd9aac2
SHA512 e0b741cb7bef6f46e1e88859505913a52f71ca3513570ad6df65a82fc92281688f32c02ab4bf2d0d9ca4fe1abf38d478b0fa5a5bdaf26f4d997e328e7a341004
SSDEEP 48:T32/LopFMaty423w/a9NUuTkqf7fuGvwTB7x6fvtb3m/HNbO4d1UHNblfEohG8g/:KDeMatha9rfZex6fkhOhlmTm7SJ
TLSH
T110B2F70F1F212152D2B95673CDE448161BAC015C8BBF39D5E89474B1CFF2B67B9060A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 35cf9c6230bcc05127279825c490ebb1b9e1523f238debc2b7498933b7f1545a
MD5 7f90deae424569e04725e37911882bb7
SHA1 c7b15778a0f063d461415ab112d45696842b903a
SHA512 45059800be42ce106dc53ba7099fa68f91327dde7841441e8ac989df11c09f69477c9725363cc946c0b907e07024d1245a26e8a9bab19a57b6c24bbeede04658
SSDEEP 96:D1+OuOuquBWu6uUaVcaij69HzViufQueyud5u3vue3uzd+TueCubuqIGu6hLulwQ:D1trBEWVTaVcaij69HZiuQryU5Evr3q3
TLSH
T109B19BF383E8862DD91156F4AB143E1FCE2D0964435C3C2AC9E5AE0BA3E2571F181A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3dd5b2963b60f4e5f1cc96dfc15acbfc4a3fa1d2f0182256f7038fee4c0f262d
MD5 0a63a1e78cac8a0c62f1019fd00585f8
SHA1 c43959da4ea3c4c5db34559b1ceb0a35eaa1c5b4
SHA512 4df3a1f933037cc036e373c2c7c3caeef6e55cfa2020ed357e622203df4bbd684e1f134d46d4f15eda99efa0593f278bcd3d6cc73be595c0a842daf7b812444e
TLSH
T15941C2F783F4856EDA1195F0AA18BE2FCE1C0515832C7DAAC9E0AE1793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 03450c7d4785fd43d08b5aee6a3665917fc0a8c0e7eff33baac08cce93b674c7
MD5 93e32c83fb6a052695740e73fc82fa9e
SHA1 dbf28adfded980fc1113088a12ac862520b1a588
SHA512 613ba3cef645b6d9b0e45fcc3745d0c84be32c16d365b28ebbf563ff01363bbe551e1fb82fad6efe7a2f07d4f4d461d5de3cc96577de317b96715a72e60ad80a
TLSH
T11741B0F783F4856EDA1195F0AA18BE2FCE1C0515832C7DAAC9E0AE1793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 8b9913a741dd55cea7e3b33bfda7db88169a64ce3758ce26e465f86024764284
MD5 acb3c04b40fcaf32142976d45e2531fc
SHA1 294d270fd5412ce668e1ef336e0362be726c562a
SHA512 186812dbfc63c54ccb88d63e08005ee92a8709c8526c2866951285b87ff084895b7bc533104015237882d92711778b9367b39f17fbf1b72d09eaf543b2c3ef12
SSDEEP 96:D1+OuOuquBWu6uUaVcaij69HzViufQueyud5u3vue3uzd+TueCuuqu6BwXCu4LuM:D1trBEWVTaVcaij69HZiuQryU5Evr3qK
TLSH
T158B19BF383E8862DD91156F4AB143E1FCE2D0964435C3C2AC9E5AE5BA3E2571F181A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 ec0cc9286363c821176bb8b3885d09a5c5b0b82fad856a1ccde050482b3c2065
MD5 b08a98e0440efccbfeb346c0e2a52e29
SHA1 570965ee029e45144116734e724777c1fdf80fec
SHA512 e7ef7e9d95d5bae826276f5850c42fa4b47014b26daa5738623d6b0b78b535a63c3a65f90abe2e16f233e12ab5c79b6977d321c0f4d102334d0580e6afd79f94
TLSH
T131217B13D17EB42B1C384DBB2E89B50568BAEC321281D4F9DE9691FCB0819B75717067
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 48e80be64b5b2be8a6590c283aea6c2bdd492f31e9418c2c21c8869d3a163e89
MD5 b0f7a2ec35a5300de6c67daeb61d28f0
SHA1 6aa5de38f909989c67ccb96ab040398d92625e36
SHA512 fc92aa075a6f98b451ac03d819416977113a1c635a1e3cd6debfaa3dd37f758ba30b2c52b1e54565ef3d7953f0e93fcd1e6a720f26bc1194e20a1de6790f74f6
SSDEEP 384:sxRsAqZ/f4smYWv7juN/RIV/N/5dZ2KUWsGQV8dLDf:swpZ/fJY7jcW7/5z2KpsGQV8x
TLSH
T18172F816A9249D7B9DDBD619FA957F93D2F8116392905E44ABFC8A0C00E77EC220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 67cacf5a4f6419bd3b92011ef69a67df6b9daedd16a1e38bc801463a25fe0165
MD5 c445f06f9ae7195f7b2d3ec2b9e041b0
SHA1 31508aa6b93b4aadddd22a1402514be09ac7e685
SHA512 33522b2dddff8fdb0382caa7f58ebf915924911e6f7ff819e38c2867af4f1c31718720fe40cb84ee61cc0106fc3001dd81a64fa9ab3841651bb16f0369e4ed34
SSDEEP 384:sxRYw8Z/f4s8jyN/RIf/N/5X/WIgsGQV8/Ljv:sMVZ/fIjwWt/5PWIgsGQV8X
TLSH
T18772E916AA349D3B8DCBD609FA557F93D6F8116392945E44ABFCCB0C04E66ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 afeeb4fb554f04446f7348ebd5792721e4cc30f1e27ac3686e51e11cd8a834db
MD5 faec9eea9b0ed88199c572eeed165c9f
SHA1 bd71a57f810e3eff38a742f698e2ffa5721098ce
SHA512 1b9524b889d802f2453d88e9e9bcf663bcfc6599b3007c04767016a73853c5aab9ae69e3ba5afc7dcec08a91c7db334576650d2bc07f98bce2749b65d87acf98
SSDEEP 384:sxRsA8Z/f4smRjyN/RIV/N/5X/WIgsGQV8/Llv:swlZ/fYjwW7/5PWIgsGQV8x
TLSH
T1B372E916AA249D3B8DCBD609FA457F93D6F8117392545E44ABFC8A0C04E66ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2d88ad81a5d8e793f00c102fad75ff4aa68a5b047ef3aee72df8099279cdd203
MD5 4061d0fb983db26ff08db8d3c4101ec8
SHA1 58fbe1e27096d5d155c9f443670858a3e3aff385
SHA512 3ca83018397bf029c5d15a95ddbb1d24a16771784ff2a08311754fb25d78b85054fb99714d968c5ea2821cb01b21d6e0fe19da1a98bca59c97243c298aba0a96
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDobbDwzroD4H:Ob4YZnE7yTWg1NfwBu1ja0obHwAEH
TLSH
T126E2EB3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0a6478e88b0efebb7db19941476653ab4c606dadcb75b52382cdd9514d8f1e30
MD5 11b98f91dae058cbdbd7b7c5191b544e
SHA1 a25b051bafea6acda12d1cf0e738be47a3ee3b91
SHA512 e0b9d36356f8529e27285fbc0e975b6b16db7c41f0adb37219a66d74b0a2ffc66ccac228b1bb857c030d528777ba220d64e7e3467fa1291217702d24727d2e09
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfuB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmobbDwzrod43:Ob4YZnE7yTWg1NfuBu1ja1obHwAy3
TLSH
T157E2FB3B280CCB7E4F804ADDEC29BD9A6DA801CF5698C95447FA450C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 af7e5639d89c3f097a978c600d1ce8555aab62922bb041b47bdcf588aa84b8fc
MD5 2b8eff25284894fb2ce2d8b7e1b79623
SHA1 c59a38211c2471f3fee5bdf0430c7d5e81ce3e94
SHA512 caab458d11a887e08a9a8744d1324e136b15377a60c7abcaa7516ab36e0e21507e559d35a1d6dd2d574ddabf178be1b9dc5092e6ff6e03128d5d288a3767ea64
TLSH
T1B4D023A7F05505B0F7FF8F800712213E0E103C8D044C648D9901002C2C45F13E123F87
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 67fcce7e9f9b9331ffc910995418c49423daaba3cbe8b1c8a62375e68e06fec8
MD5 882f4405d0a9ed5249d4fa8d9226d4cb
SHA1 aafaae23510fb686b78ec0f24dbbeb96c9204c72
SHA512 0aded4a4ef9a5577a4ad18dd61dff7d96a3df8fb1df96222c6aee48e2ff08adc4467f9e2ec97223a112ae700250ec1c7e65a0ccbc397272c6d83fdd71ce306b6
TLSH
T15FD097A7F06204A0E7BF4A810722216E0A243C89094C648D9802302C2875A03E122F96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59c5b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59c5b7.TMP
Size 138B
SHA256 dd6ab9ac9be27ee54dbf2ff699d7552ade0b06d64f3ff8ea687889aa2c07e7a0
MD5 724c821dcc85016820cdc65b3b1ee17c
SHA1 00e5e2a8765ff1622ebc3bde02e585395c3e3bfa
SHA512 f2c5bd79ec9ad0522451af278f304a0df7d0aa556d9e0e4470f3e8f41b7ecf84b9a5fe0c178202822659fb12a79e69de713a7adff866aafe20f4f01a1a0dda80
TLSH
T176C02B63F0550104C72A42800332226C5F003CCC298A884EA013342C303AF236106FD6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 ccdb84fefefe453bafd250eb21ba7fdcaa27bf3b7055f283ef65a0d472d86c3c
MD5 2ea9d214670db85bb5b436f47a7f32a6
SHA1 799634de337665550c25ab3186c3e82a448ce0f7
SHA512 f4a5a8d38f9f1b77c003534921807291045fabd90b2c0b2a5857483799c48f01a4d4176706a5d85cfe38fa4478e29a20ce5d0a4f10670b5ba43603ef5c9cb0f7
TLSH
T147E020A40AC4D1BDE19676530228870D92F47997D6C83E412FC4D94866C6909F3F3640
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 517ae642d4d4aef60739308cc19dcecc048642a8fb52456facf4af50450420be
MD5 468d4a509394522cc17ab3c5245aff72
SHA1 9ed4c436c945f3ed969fbcb562892ea8503c9d26
SHA512 956e096d115ccb1905cc641abf3cb7b5664528625a8677611fbaa26b4a16823781dfad077ad40fdfb2553be8aaacf5fb5264b7733b058bcd75d8cfe1fa92f85c
TLSH
T1DFB0129937138B16C8C4047303F487806744E01130C1D603C808CFF25F097A83E468C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 06ed02402aac4679b5f6b5665e84c6668586edfb6da8be2dd2fd04c7e89e21b5
MD5 a128dc70c0fca1d94b7ca24dd1b6f16b
SHA1 8b605129dc657a5f699552f56ccb530a834a6e3f
SHA512 201a6a448dc4fe11bdccef6db463bcba21c99bf153486f6b10ed97f71ca2e491957cbd77e9dbf8bf8e217a34599f4756afe17058c1b866f730f30f8fbc292289
TLSH
T1A3E0D8712AC9C76AE18535978254D30DD2B2788AE6D97A523F48E888734B14473A7541
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 ec31a5e468963e3ac9663e0fbb9b479b8121d5b4078c20edd383d6a7b84ef943
MD5 129d743623e8a46d3e7677e8df782402
SHA1 55aa207ed941a1e056ceb03564c6a7eaaad5f55d
SHA512 3fd2c9bcff6f3293eb5fabb337fbfb3bf285000bdee426399eab655bc5fecc302791ec8cbbd1d7a52e5135eeebe10c0192833725299fd0c3a687ddc424e30696
TLSH
T177E020F08AC4C67DD080789F8265970F92F07C8A93C43B415B4C54886645114B3F7580
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 4acd54c7e21a4806d0c10b585a2d7d00445709e60fca76b421fa3520d35a35c2
MD5 c30d970015f79c1e38637c61561032b2
SHA1 254641478e27199c6ed7f683e064fe181450c1d3
SHA512 c59162e566bbff2655dbd8ce1511170ee4a8ba4b59bb0bb1e93671184cd9a29abf0498865b3c8b6b9ece6135a18cc05a4cdd3a22851b3dd5cf3351a98a730e55
SSDEEP 768:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9sfRLb:yv+RpPYDDRPbIhJ9sfRLb
TLSH
T156C25E11713F52803C7EB90C9178991F92C2B4A33119F52B7BA845A65F6BE039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d55309ca1527bf5bb9dbc406c1703b2619dbe2be4ed4eb5a12c2b34951e412a1
MD5 795523e7a599a9a3d9bf9a0726f03219
SHA1 14f7ab732c6801a08f8a0313dec6a9401f1d2e0b
SHA512 d15c3bb799b18e75a251e9fa4c62f2556c6b35f948e96e36a433e7bff10625bcacddddf673d05910eb31e7de50893c4c729e4f27e9fbaf0f73d54a008ae1a75a
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9sf4:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRG
TLSH
T150B26D11713F4280383EB90C8178986F82C2B4637519E53F7BA846A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 86cd31ba546f80e3e1806650a8be98798c710be597041d0ac19e0cb5ea840574
MD5 5d1a75bb77e482aaa105ebfde2730208
SHA1 65b55e0737a877a6eb57e22587043954642216ed
SHA512 c8a0d245343a97fa91957b46086dd12d694da38f4f761a1657e489f0c86d27719e8a8c1472d1d06f85f3c7f562e686a69ba8697c277ea0a17412db294e03955c
SSDEEP 384:DNrRZyCSDnxTICpMEhIKyll7svbFKfk7:xFZJSDniDyI1l7svbF9
TLSH
T19B44840A7B747001EDE6D9725CB080771E3CB16DCF22A6915DA264694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 b9fa694fd869280f7f2aacf882e7e5334bc41fea7f913aecbe9c063f409f10c7
MD5 f809bdc818cf684aacf02f29636fb7c6
SHA1 2fc8e2a2c83ac79b6555e5d98b819086bce439e9
SHA512 cef78ca569885fbd04b1152f7e3d6a52067d8fd89ecc4e57597ea3b8b6cc6637acd7ae18429ecc61bb4b9015bb5cb47375b001c428522a7542356a093c3b453b
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBgE2/o8Gt:DEK3tjkSI5IUltGhp22iSBgJ/o8W
TLSH
T1AD52A99FFE343223CDE983318AC001E1BE7A503E8FC6E70259D610155EB9651A31FA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 347f6167358043ac0bfc1e8230b689ecfb3bb00f11aa3287ed9bfc16225dbda1
MD5 8bf2c02631c4fe149f0e2b75ab90c937
SHA1 30845f0ad81fca315266d79d239c06c6d41da75f
SHA512 cfe8c68c3dfb0ca5f89f80e6b7a731725c2fe661bacc3d951ff74634494ef9a654d9e58c56ebecdba9d72e53e6eade8e6c091a4398693d7dc1d1a257d259dde5
TLSH
T19B3163C1536A64C47E89EA41C22D6803E4E57D6B260FA8B2335D45F45F88C1B8F6FD72
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 2aa52458d3b457753e38f37416b9c949d69f866161eaff62967838aedf7dd884
MD5 d6bf00cd8b902c465ec6117c55c353f9
SHA1 3f8e8116cc8e63ac065177cd43dd8f8bc855af46
SHA512 2b217bf3cd803a369ccbe54cf2896c119b00582172f049601309f33b82e8e180cd29f79d23577a3e030eb84b93b477e325c4b6c8a15eee1f15ab767ac5ca505a
TLSH
T1BD31DD15F320C14DE54A867E906BAB360738E8568FBCED0F84B920762E71F441E8B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 35260a054b73dd03dee261f3b3e025c82d326bfe40b16ad0e3427fba1f604780
MD5 51b718c4af23fd6e831c587bfdf17f32
SHA1 8acf86a65c3a6bc1c1585a4aad9183863575a908
SHA512 b267745f6912e91134ca20a505721fa37b9151c6998a5f9509d9ab39f0a50b0a53336a8d4fb43b4c0fde76e24f4479a08de58b7ab221082556caee8f9488674a
TLSH
T126E020A07DC4C15FD19175D38269C34DA2A13CD3EA8C3F411F45DCC85686549B3DF541
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 5b677adb6b7abae17b41ff20d69ce799d2e89f4aea5f9d78970ed95769eeddcd
MD5 56ddd65a7e03d523df60d86b65e32fc0
SHA1 6602bbb42ebb7ba43fb1eb12c9fc8988a03035c2
SHA512 c6c5a42cf293f2c6bf9387d0401d75681ccb95b3ef5de1f94ea41cb7bd031f3e8b4f082a919a5e7f26e945ebf72f116bcbdb49b6997d507b443971ab9348e0e4
SSDEEP 3:MsEllllkEthXllkl2zEClbNtl:/M/xT02zpRt
TLSH
T14B4404447FC04C0FC54030315411C37413F0D5500515574335513C537DDD5400C00011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 95835f3c5521efd00c5317d906b57eccb6a1521a00d90a6aca2413e78a261c49
MD5 6d59f1bd9434eeca758fb73189b13e78
SHA1 956ed56472118c3407105f03ed326abe3babb0af
SHA512 a45d1889de47623cbd26825d81fcfa159c9847e53dec2db2cb2d55445ec795ee10ad6cc19c3364537e7cfa9ed4f7c570a2092080982666b5f10bbf4a731aa0a5
SSDEEP 3:MsEllllkEthXllkl2zEClZckhkl:/M/xT02zpHO
TLSH
T1054404147FC04C0FC50034315011D3500370D4100511D7433D5114537DC5D440C04114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9a7b00dab132a70c024b3a34dbc9c37b1d7a0141054943991a6fae767d279628
MD5 a161679f1172515a8e6aaaf1f65964a6
SHA1 d76c0821b2a9ff5effe74b7ee5e0f14ff7208dfb
SHA512 0a3a5445be6373198ae749077ecb0da69468a7e784caefc81678ec84c635175bafd246822ee043da7a282d6a79bcec36d4dead994b1b67470a079d6154a97fef
SSDEEP 384:nHiF1tNn/s3n9Sc8NLF8TUNTUlIR2PvuTmE5zEqfbYGGpe+DLAlImwI8LEEIzHH:CF1j+9hQFwgMuC6CGGNyIm/
TLSH
T167B23B32E865CEB7EDEA4FD8B34A7646DEE41163848D8AD8DAD55D0C00C76ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 54dc02e292bba7cfd913c1b159b632c8270fb3b7b957e88d978c9b586588981d
MD5 bdc55bf3ecdc19f40303996d29246e9e
SHA1 659c04a271962503b6883fd13ec408fa66208e86
SHA512 4e965104c20d199221835f516be321839df6d07b2b27fdb2735178f3403b71362b5d1681b379797dba0e9f6d5b5e830bd81eb6db8957122cd8b32d07da89625f
SSDEEP 384:nRiF1tNn/s3n9So8NLF8TUNTUlIRqPvuTmE5zEqfbYGGpe+DLABI3Ua5tIsr8LEb:4F1j+9hQFwgouC6CGGNSIksio
TLSH
T1F4D24C32D868DEA7EDEA4ED9B6497686EEE011A3C48D4DD8DAC94E0C00C75ED074BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 00da9b03d492407384112537ba5d41461a6a50124dccfcd3aa70844c9c455b05
MD5 ffc52aa1d47ff60f2c9e73f7444a5154
SHA1 46ad423acea07f8ffea1b1cdab79ce7a85fb0c8b
SHA512 36de2a0acdfaccd559abef2fbb50c4daeb85dae5df7a0dbe8f490403a1add7f1eca562494bd9ea247487513072c2b8398ac5c22900b8cdf978ae199d1b997f05
SSDEEP 384:nqiF1tNn/s3n9Sc8NLF8TUNTUlIRqPvuTmE5zEqfbYGGpe+DLAlI3Ua5tIsr8LEb:hF1j+9hQFwgouC6CGGNyIksio
TLSH
T14CD24C32D864DEA7EDEA4ED8A6497686EEE011A3C48D4DD8DAC95E0C00C71ED074BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b4266887c914b930f5d5440c62e68ef41ba3a4d3209d24dfede4567e15d16a21
MD5 e52c02f23aada612b8a6957cda9f0c61
SHA1 0c35d6e20789ce6727580699aa8a433edc9f7fea
SHA512 58bfc5cf2280547ad6101ceacb6a680503a0f174e99ca73f50626d4b422a397cd7984451c6189097e56b8aa174b6bec9ea3037a4c513c43bf4f0629e1d3a5262
SSDEEP 384:nIiF1tNn/s3n9Sn8Ngm8TUNTUlIRwPvuTuUREqfbYGGpeKLcOObjI9G6w738LEEy:TF1j+9SXmwguudUGGrc29MJ
TLSH
T11BC25C32EC59CAB7EDEB4F99B34A7A46EEE01167849C5AC8DAD85E0C00C75ED4307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5c8ef1ae45dc9829c47db11b2256ece7ab82176ead3db12154c817f540035c78
MD5 d167497c5d242d8575545a7ee08dcb30
SHA1 ccd5244485a5e0ab5287bb2902d3342cb4c785a9
SHA512 d2184b222446e5f652e0a9ef32f20aa47da3828635ff58d443bb70d7f21f0e0c7c80865aacf577d37a9cdd6e09f2a8b86aa574a3ca7feaa8d2595f0aa6c6ce8d
SSDEEP 384:nRiFstNn/s3n9Se8NLF8TUNTUlIRqPvuTmEtzEqf1YGGpe+DLABJTIKxXIKvsppG:4Fsj+9bQFwgouCkUGGNSmjKvsn0ksio
TLSH
T1C30391F99CD7997AD89E6B8B572D2D1599BCC137F0A84898F7850E0CCC620BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 dcab7d8b6971efb4fa57ad715d484165e49712acfda3a6f4c9d7284b9aed95da
MD5 96d06fef19eb15fb7d055e46b1d40a84
SHA1 20b11c6d663de4391bc6fc2f6c7d6042d8cbb438
SHA512 87a48d0493a6a9949f6f45f6b5057b9cacd1b361b3b4cca77e8248ffbc2a21872a984783c279938bb640105762793899be04ef8eac49c012bb1d10dfef0e927f
SSDEEP 384:ngiFstNn/s3n9Se8NLZ8TUNTUlIRqPvuTmEizEqf1YGGpeWt3zFrKRZmKUa5tIsk:7Fsj+9bQZwgouC7UGGHDBKRZm3siF
TLSH
T1B3F2A1F598D7997AD8DE5B8B633D2E4699FCC163B4984998F7840E0CCC921BFD306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 f635e2e791073d0d17dc469a18d727ad1825c0354efb65de51898f1a38827775
MD5 c13d1abc0c7ed710cfb9adcd1bf0ec89
SHA1 a994e01fddc38df5221985773bf73b582405e26d
SHA512 366b1b1af24496076a98a51e99d12174708664611f5dfcfcb8900499199ff35cf9612836bb1e2d2a359cae3978b55986a9f33141705072e1575674198a5f4853
SSDEEP 12:TL6KeJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3is+zAXrddvmQQtum:TL6Rj0afDdWec9sJVUOVXjpq7+jy
TLSH
T10D92F1166E312033E8DB4B76BC9389D00EBC165EC5A77951DED44C210EB1BC2E2552FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 61004293b78819b676bd6ac88366c3aaecc4224d28d6265d95f6ce2052bdd539
MD5 125e3ec19c9c2e5456ce86bafa618073
SHA1 bb17dc739e3ad146b04e661c42028d60bef01f29
SHA512 40b6e6b8172329b065ace7d4e5bae66779fef46ecc66b0ffce3cf02807481126f600fb53369915665a905b9352184215b8bcfea200dd0f24d6eb046aefe0cf2c
SSDEEP 3:MsEllllkEthXllkl2zEolF/Kt:/M/xT02zDZ
TLSH
T1A54404157FC4040DCD0130304531C37003F0F5550D115F5334510C735FC5DC00C40045
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

d2d5d214-ce82-448e-89b3-ad90cf420715.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d2d5d214-ce82-448e-89b3-ad90cf420715.tmp
Size 2KB
SHA256 d2d7822c1054f8c1a2eb16531760e5c21d74c6144b9d0ab04aca0147cc61a897
MD5 ee11f6c1a2e38e96f03c81d9a5bbbeb8
SHA1 fc5a4b16db147ff90f2f4624fe1085a7b4ea61b4
SHA512 04c765bf30a5721884bd5ef7e1deaf727bd788d093c0550852c4b4fc4481f0d3b76df4991b54222de965270705d8061975cd7f8e8badb389f7f8df4a8eeeddd3
TLSH
T1824141E04C3816D1D4BD0A7EB08B34FC84ECD726F490343D6858DA985A7975D618087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a820f208c91036d40d1c127bfc9e5773b4ff2fccfd6ec11655276cc35d6a686f
MD5 0ba661c1bab82fca1a1db0ef3949e61a
SHA1 b33ad0f3ecc7df1f164214680caeb8f6b37e056f
SHA512 0a1e8d79d46a81f0070c932dd90a9940241459e4ca9c4bce7d5138275cf387d10e770a0fa0a5125b6bcff2a8eaf475417ae565fe5d4ad3e7cdc207bea9c70469
TLSH
T14E5131E08C3816D0D4BD0A7EB49B38FC84E8D725F8A0343D6858EA985E7975D618487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d08cc2f063a71566eea46cce811b7da434a9a700a3892b1e013ba690de0fd610
MD5 bc7f5006b973fcdf4aeb8cf00c37f06f
SHA1 e72d9f16083f7d27403ad97a3d57655fcf8e145b
SHA512 ae4de683201eedbb85196eb6be3072246b77baa5824f1805211c2134f415141525f6fa0c1147c72708015725b1fec1848a0d333afc36fd21fe8c74c7843005b9
TLSH
T1F25141E08C381AD1D4BE0A3EB48734FC85E8D725F4A0343D7858EA985A7971D718087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ba2c39a656791f671b81af4ec36117623ee13b48747095d1b5a925851abaac08
MD5 27d8a4e08cd9068dc92fb2f8d31a206c
SHA1 df3048300f9b51d93e4bf6949b67623b4c3cb30f
SHA512 7dca6dde2b979b2587d942ad00a4b2402b27c084414842cb62ebdc83cb77bcbbe0895b8408667d9b44abc932ad34e48cb106359dd1c52dbd9d85c2f55cc6c858
TLSH
T1A95140E08C381AD1D4BD0A7EB48B34FC85ECD726F89038397858EA985A7971D318087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8bd7bb85e3452ef4cc4d2f429df5a381b3406b5e22fc1f714a61cdd6c14fb910
MD5 61f3664c035fd4c0c11d9f5f2e3f1985
SHA1 f35a0133d0fedd9c78646de41d36356b18de9a5a
SHA512 705e5ef54366fbf1eb36358d279a2f770b56b27d799c7c6dc530227379aff86b28d350bc443764ddc70fb259a97a9843ec7e7bab1a9a67275c865fe012fde612
TLSH
T1164150E08C381AD1D4BE0E7E709B34FC95ECD726F4A0343D6858EA985A7A75D618087F
MD5 SHA1 SHA512 TLSH

Submit Download

miniwallet.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

notification.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\Notification\notification.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_310959737\json\i18n-tokenized-card\fr\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6176_92445866\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2284-56-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2284-0-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2284-51-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2284-1-0x0000000000400000-0x0000000000485000-memory.dmp

Download