8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
Size 2.0MB
Sample260723-vysfzstdke
SHA256 8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5
MD5 70379cb7a4b463eb82bb714f1b5bc4f6
SHA1 f42b07fbf23bd3c7aed23b8fcd640bdee459a3e6
SHA512 863caa6140e91140e0ccbcc754f5ca4b49ccf9f608f6277fe9eadff7ff8c75cd641c0c38ae959a8a001d0c254a7fab5ea14d2ef973fee3445e00720ce33f3d77
SSDEEP 49152:neGae3xs3TrauzUWzFZaG/wcjddddddddddddddddddddddddddddddd7n:neSBeHn5n
TLSH
T13A958C0BBDA448F6C0AAA2368C72A1517B71BC550F2223DB2AD0B67C2F777E05DB4754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3928	chrome.exe
1884	msedge.exe
4360	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293010679276831"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{CAE1F327-4598-4C24-89EB-C2CC1773F408}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
3588	chrome.exe
3588	chrome.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3588	chrome.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe
Token: SeShutdownPrivilege	3588	chrome.exe
Token: SeCreatePagefilePrivilege	3588	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3588	chrome.exe
3776	msedge.exe
3776	msedge.exe
1600	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 5812 wrote to memory of 3588	5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe	85
PID 3588 wrote to memory of 3696	3588	chrome.exe	86
PID 3588 wrote to memory of 4092	3588	chrome.exe	87
PID 3588 wrote to memory of 4092	3588	chrome.exe	87
PID 3588 wrote to memory of 3928	3588	chrome.exe	88
PID 3588 wrote to memory of 4280	3588	chrome.exe	90
PID 3588 wrote to memory of 4280	3588	chrome.exe	90
PID 3588 wrote to memory of 4132	3588	chrome.exe	91
PID 3588 wrote to memory of 4132	3588	chrome.exe	91
PID 3588 wrote to memory of 5064	3588	chrome.exe	92
PID 3588 wrote to memory of 5064	3588	chrome.exe	92
PID 3588 wrote to memory of 1516	3588	chrome.exe	93
PID 3588 wrote to memory of 1516	3588	chrome.exe	93
PID 3588 wrote to memory of 4600	3588	chrome.exe	94
PID 3588 wrote to memory of 4600	3588	chrome.exe	94
PID 5812 wrote to memory of 3588	5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe	85
PID 5812 wrote to memory of 3776	5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe	97
PID 3776 wrote to memory of 2684	3776	msedge.exe	98
PID 3776 wrote to memory of 1884	3776	msedge.exe	99
PID 3776 wrote to memory of 5876	3776	msedge.exe	100
PID 3776 wrote to memory of 5876	3776	msedge.exe	100
PID 3776 wrote to memory of 5876	3776	msedge.exe	100
PID 3776 wrote to memory of 3880	3776	msedge.exe	102
PID 3776 wrote to memory of 3880	3776	msedge.exe	102
PID 3776 wrote to memory of 4248	3776	msedge.exe	103
PID 3776 wrote to memory of 4248	3776	msedge.exe	103
PID 3776 wrote to memory of 4248	3776	msedge.exe	103
PID 3776 wrote to memory of 4432	3776	msedge.exe	104
PID 3776 wrote to memory of 4432	3776	msedge.exe	104
PID 3776 wrote to memory of 4432	3776	msedge.exe	104
PID 3776 wrote to memory of 5312	3776	msedge.exe	106
PID 3776 wrote to memory of 5312	3776	msedge.exe	106
PID 3776 wrote to memory of 5312	3776	msedge.exe	106
PID 3776 wrote to memory of 876	3776	msedge.exe	105
PID 3776 wrote to memory of 876	3776	msedge.exe	105
PID 3776 wrote to memory of 876	3776	msedge.exe	105
PID 5812 wrote to memory of 3776	5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe	97
PID 3776 wrote to memory of 1668	3776	msedge.exe	110
PID 3776 wrote to memory of 1480	3776	msedge.exe	111
PID 3776 wrote to memory of 1668	3776	msedge.exe	110
PID 3776 wrote to memory of 1480	3776	msedge.exe	111
PID 3776 wrote to memory of 3068	3776	msedge.exe	113
PID 5812 wrote to memory of 1600	5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe	114
PID 1600 wrote to memory of 5200	1600	msedge.exe	115
PID 1600 wrote to memory of 4360	1600	msedge.exe	116
PID 1600 wrote to memory of 5364	1600	msedge.exe	117
PID 1600 wrote to memory of 5364	1600	msedge.exe	117
PID 1600 wrote to memory of 5364	1600	msedge.exe	117
PID 1600 wrote to memory of 1900	1600	msedge.exe	118
PID 1600 wrote to memory of 1900	1600	msedge.exe	118
PID 1600 wrote to memory of 4796	1600	msedge.exe	120
PID 1600 wrote to memory of 5504	1600	msedge.exe	121
PID 1600 wrote to memory of 4796	1600	msedge.exe	120
PID 1600 wrote to memory of 4796	1600	msedge.exe	120
PID 1600 wrote to memory of 5504	1600	msedge.exe	121
PID 1600 wrote to memory of 5504	1600	msedge.exe	121
PID 1600 wrote to memory of 5808	1600	msedge.exe	122
PID 1600 wrote to memory of 5808	1600	msedge.exe	122
PID 5812 wrote to memory of 1600	5812	8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe	114

C:\Users\Admin\AppData\Local\Temp\8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe
"C:\Users\Admin\AppData\Local\Temp\8995ad1eeb5dbe47c8d2910c6ae7e326665cdb455dc83f8ec50afab35b2834b5.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-position=-32000,-32000 --window-size=800,600
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc53cfc728,0x7ffc53cfc734,0x7ffc53cfc740
    3⤵
    PID:3696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,3645713755573990220,10343440038621556919,262144 --field-trial-handle=1900,i,8954201599532662932,1160645493473760666,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1896 /prefetch:2
    3⤵
    PID:4092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,7947301846254579253,12005773583026330165,524288 --field-trial-handle=1900,i,8954201599532662932,1160645493473760666,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,17334345495444418544,17931850224878321083,524288 --field-trial-handle=1900,i,8954201599532662932,1160645493473760666,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2568 /prefetch:8
    3⤵
    PID:4280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,5434718262025103865,16733680597585619363,2097152 --field-trial-handle=1900,i,8954201599532662932,1160645493473760666,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:4132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,7279701712591172897,2118358759686324549,2097152 --field-trial-handle=1900,i,8954201599532662932,1160645493473760666,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4164,i,9692610599348801836,8534038302720059432,2097152 --field-trial-handle=1900,i,8954201599532662932,1160645493473760666,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4168 /prefetch:2
    3⤵
    PID:1516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4516,i,10735958413780375459,3351379562673483051,2097152 --field-trial-handle=1900,i,8954201599532662932,1160645493473760666,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4568 /prefetch:1
    3⤵
    PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-position=-32000,-32000 --window-size=800,600
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x274,0x7ffc4629c188,0x7ffc4629c194,0x7ffc4629c1a0
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,8637683614747937672,11056203510968423689,524288 --field-trial-handle=2344,i,2331661853732972617,16476544439911516297,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,13760060443370971347,8170115883055683034,262144 --field-trial-handle=2344,i,2331661853732972617,16476544439911516297,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,9001790637589507779,7793527001241202050,524288 --field-trial-handle=2344,i,2331661853732972617,16476544439911516297,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,16238724296368487134,5375958029709898274,2097152 --field-trial-handle=2344,i,2331661853732972617,16476544439911516297,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,5516242446666485360,10748722346438617799,2097152 --field-trial-handle=2344,i,2331661853732972617,16476544439911516297,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,11003968274672432012,11068092710244790369,2097152 --field-trial-handle=2344,i,2331661853732972617,16476544439911516297,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
    3⤵
    PID:876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,9614291452268070262,18437482034242681998,2097152 --field-trial-handle=2344,i,2331661853732972617,16476544439911516297,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:2
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,7515366862374810013,14624355245088905333,524288 --field-trial-handle=2344,i,2331661853732972617,16476544439911516297,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,13734846178345170247,1902850056775147616,524288 --field-trial-handle=2344,i,2331661853732972617,16476544439911516297,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,18339668702133510518,8405633411932130113,524288 --field-trial-handle=2344,i,2331661853732972617,16476544439911516297,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,18339668702133510518,8405633411932130113,524288 --field-trial-handle=2344,i,2331661853732972617,16476544439911516297,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
    3⤵
    PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-position=-32000,-32000 --window-size=800,600
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc4629c188,0x7ffc4629c194,0x7ffc4629c1a0
    3⤵
    PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,12215794878197431966,1304835634333326224,524288 --field-trial-handle=2144,i,12805746448918117237,16947902693219737289,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,3908922222157369833,12910219144271998947,262144 --field-trial-handle=2144,i,12805746448918117237,16947902693219737289,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,12654452811733201621,9811168092619914290,524288 --field-trial-handle=2144,i,12805746448918117237,16947902693219737289,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,12980598105632516412,15942502945289118080,2097152 --field-trial-handle=2144,i,12805746448918117237,16947902693219737289,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,5988762887670930621,14399700981161606034,2097152 --field-trial-handle=2144,i,12805746448918117237,16947902693219737289,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,16420735189812061819,10206456781361317036,524288 --field-trial-handle=2144,i,12805746448918117237,16947902693219737289,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
    3⤵
    PID:5808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2f32e8a90b1198bf349bee91e5af105b2c77819201f0a0d08663e5f4d931f921
MD5 cc5e6253462da6912b856fbf14db7dfc
SHA1 07e432e902b0f0dd65845501efc2594283967549
SHA512 8bc3820b569e6a83ca4ffb3faf1a0ff2204f27ae785a7273f0884385b0096578dfa982755fab070f39880b6aea90af0e795403f1a0cd700b1fd18769879f06cf
SSDEEP 1536:T4QyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:5qfd7NtZL8cHQRZEQ6Spsk
TLSH
T183C30237DBC21F339E92CF60B9530FD697B644A59034D301EAAD77AF6C83891694289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 94f40511ea08a0b6a5296f0532f655edb1ff5b802568267057a10b9a850c3df9
MD5 1d5dfbc6f7dec6803aa8fc7ec805839e
SHA1 301f0013a4f8dff7ba9babad8791aa3ced8c30a0
SHA512 c72b47d1d5b8cbfb51273c5f54f380345f34c6234f6c4cb560c31768cb9b8965c22d1cff5b0f4f68e25ae5facfd1c5b91e33c6d09e6baea7aea919322ffd1514
TLSH
T1D8D023B4B42A75A1D72F00354430F150A26541737277938671554C0DEA7844497FAFFA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 36eb8dd92dac2d46d8a08ca8df3e32ba9cde497593740afcd42879c379595b23
MD5 595a736d6345f51188034c8a0b82d16a
SHA1 b8f3dab7f2a4ee1f3e465d208b61e82d0e29ca8a
SHA512 4d15e2ea03bb4b0f2ec1733e339473eabdd0e5e25fb2913ac1b44dba2f0017aac82a97f8276ec1a94b73739cf60d92240c4f76fb1c3bef522e1bcdbc4acb1487
TLSH
T161D080F5B55A7511C71F00315410F260A22740317177D7927165540DB57840897FE6BA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3e14ae57e94d55d2b685c24c82b63ec1313a2c8e26607f9508d4d0f466c977af
MD5 9d94654e87995343dfc7c8b377ff96eb
SHA1 99b4537a45434b4ffd2c32677f82906c6ce88a86
SHA512 483af9e59287d5e206d9e0b92fc3aa1ae9a902776f5f8620648e95dd078a048445935c12c34129982ce40e4e1b76ef50c952bc2a1887454c305a19842469d15a
TLSH
T141D080F5B55AB511C71F00315820F260B22740717177D7927165540DA57840897FE6BA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 782b843288cb80696e3af23d8650fb5dfbc1f62500b86aaab62d0eedafd70324
MD5 09abfd014c9b492188b8cbfc4e35cc4e
SHA1 bba786cfa1c2313cef0b4fd4b48af9e34af9420d
SHA512 d32eb8fb06db5ae86e7085d87b840e513329593300f5e9272f39efa6188d46a09a9fd756037bcd4ae66a0b9ca75829bf9e17726dee9ee14628713a2cba4cd0c0
SSDEEP 384:cRRiRcRbRTR/R/RTRpCBSB3wB4PKd0CVtvLF5BEv+Lr8iNK:cRRiRcRbRTR/R/RTRmzvU+LrBNK
TLSH
T19E13E83F72614E22FAD3167C4B1F8B39A37AD1A1C8D243133B707299A756B211A8F165
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 cf854f2e3643194b7e81721da731968a7737e77a8e9700d2fd6e1a99c95c993f
MD5 1b730cd290d972c8173f68e2d9906789
SHA1 577e7e8567388acc0e7e78fbe2bed41035248278
SHA512 5a0843330ba7a3a2023d16efc1eaa219d3abc55de6b9df34fc0d9d0d7b73ccd9ca7c701dc1f48598507473773f7a1d14712ef6253a26f2456e4f5d2480318cc2
SSDEEP 1536:Bk5rVQxUkL/A18L/Lp8YTNqGFt/zsNlZAUL/SL/L3LHL/U7CL/V:OkL/7L/SYTNlYNjL/SL/TTL/RL/
TLSH
T1EA441DF71951A01BCBA812F5E2173E3ED17B415E7CD1E8E9E27C0C852825B32B6BDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 3b4e5242d890d17f316d88e874da19a41fa15ea43c3bc2873956fda40fd15314
MD5 a95fed507acfa40ccaa4069cd1df647d
SHA1 69c618d2b95b2964c0a65ec6f6d0777b9d67544e
SHA512 48ce3a90e02463002eafca92e3d639bafb880b966832580fa800ba4706a16423ad4096d45302c50ccb5ac54ac5fb1c4dbc06456d2696ef0d95ab4d8d5a53e505
SSDEEP 3072:oX5mlFZHQvgufErs2FXIaKcWLbr6y2ts4:oX5YMvtsrbJWLbr6tV
TLSH
T1982518EECB682C82CF6B8674B0E0D9077E712183B68CD0D39944C5D897D6B8575E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 cee57758ffd9a18007f1c1a4d4ea7420f9654250146f545306d55b320f982636
MD5 771c1260d880bba7cebe89f3c9925365
SHA1 2d0b75aaad4854911b72384c0daa159a262d1665
SHA512 f1df37348047c4f999aff266516c5a8f22011c624c776c01f08cfe313d0956bd5a2f7e942a3d9cf39ecc716dc84206e23d13be0e5152a09af1b6598cec94c675
SSDEEP 24576:wL9ol7YzuHMKKKLYO6Os9+gMnnR5S8Tf3RWUmXzw0SR2ER:wwYCsKKKLcnMnRTPYX8Kg
TLSH
T1F7168DEDCA6898C3CD639930B0F0ED477C7413C3F995D1D68898C584026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84b5fc782fcd0ca6_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\84b5fc782fcd0ca6_0
Size 231B
SHA256 78bd12738726efa68dd8b29ec9e79953dae3c287091b01dd20eff8bab5638232
MD5 dbc4c08f5c5c4c1610c031f4c45163e1
SHA1 041d4480a02de392a26f9478e7fe62fa626d5eea
SHA512 e2382ea296a67c60c6a1d76b17573402a18dd852a5f605c15a958b6b9125c15b3cb50c4f31ba2a23b866994e76e71a2a562491fbbb638c7d95cc5de1f5e218e7
TLSH
T15CD0A7B7ED28D514CD6D16F4C59F5295C12260650B6E82A1947C9AB63544871B606022
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 ebb52c955ed5c37cd8954f50a4cac4db4c07d25170eb7782d53f6d1273b33ba0
MD5 5374125e9486d41415960c11aeab9856
SHA1 158ed3a9911a22922134e6f3f779dc88884f48c3
SHA512 0a9af7997d5ef10499ff8424eb466762d89b59dea9191b03cc9362490cdf0037d9842bde06cad19001be3c79b20cb8883fcc77c9ddfe3cfeead89a38a56bcd31
TLSH
T1D6E026C444E8C22D9864E8D387BC630983E03802EE8C3942671C88E4A941781A3E7782
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 f671a41ce679b022011424b1fc3bd89e1434dc8e30dc54ae1a103635c30b9ef7
MD5 4afb5b85e3362a123a64f327d5426296
SHA1 62e5014bad1a530930a11060ab69f9a08f12805f
SHA512 f1e5c97d6b572f9b154250aba777cee663630c68ee283f77caaf3027ec075f108906476c3677dc266f3d3db80d190e8c9d5923c8bbaf26147cee0044e3abb866
TLSH
T1EA1156F32C2DD431D69281E95513BD98E2336CBC4FCCEED4D06D21A76555571FD24540
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 80697aff8db0ce066262b3ab41fd70c47abb65663d174e0252d04a5dd12035f5
MD5 7b8a9db533d2196e784e9d505a4cda21
SHA1 f30f860a1b5255455414af471602737cf76c85db
SHA512 ffdb24ca1043f5359d09a36e85f9b2f585b1908109121b67882472d3ec576c90123fc7fe36099a14735c021970590e5755aff0795e3b77bc03866a76670392b9
TLSH
T19FE0D8A4C5DEC129AA64609753787709C7F03546DF8DAA812F1CDC85F441148E7E25C1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9454d282f33a1d55e049140af1c5b67b90b9e0eb88086c4790231e6c8320a359
MD5 3cb23eb0fce7d9c7f198e3a1c015da48
SHA1 0e9c67783b887b39db9a19732050a8aad330c13d
SHA512 acd14c1b7bef90672cdda5814037dffdc9ea67efc1cf9193669131f8de65b7e411bfafe0ffd9bbe2aed3834e7dadbac12305174d4a6f6d1c7fac624a3d65b048
SSDEEP 192:sxZpRByM/jK1Ml8MKP/fIsZ8E0V54bECdpm6HW6+WNBvI/YHEboZIg4J:sxZpbyP/fIsZ8EuitHb+/Kc
TLSH
T1C052E6166A345977CCDBC209F905BB53D6F914A3E6900E48A9FCCA0C04E6AED2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bd77c81e53af650fbdf74dfe27a74ec2fb9df48d4c29f9249b278f5f28525403
MD5 a3a6d11235e8c32fcd6867dd8554882d
SHA1 5926102ca48e0f3c36028860f9857f60944a5c0f
SHA512 2247777bbf646e93b1c419fc3b19dfb9933bd1f51848f1fe1460c02bb95ea69568847260cc2ca89b7b7c95d944b25d94eff64779de55157a228e575d58df0051
SSDEEP 768:OtUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RNroVn0z:OtUZYTMWvg0Pou1ja7eLZmRm+z
TLSH
T141D20A2F280CCB7E4F844E9DEC2A6F963ED801CB9A584D5447EA894C02C76EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 523010738ce14663f8f1b227c876f1fc38083a39067a5c6b8c6e9f0b0f952a68
MD5 9db5efbc9a3ff7dfb7830297a03bac80
SHA1 66edfc7966b6139147a7988173373a09a24a9bda
SHA512 29a730ded478835460e2e8d029a10ec0fdd6c2f6a99952897d9874a6847e2cfc5b13fd6b4dfae45dce99e6a3be2785d450c2d23fc6af0374b294a59655841efe
TLSH
T17321328D4EA0898FF8A481B20172E1E0737098CC4B26A2135C3C31316E2334D36471D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58215e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe58215e.TMP
Size 1KB
SHA256 65e0eaa25ce359ccfbdb2786db188b2f8b6c57a75662ca16a51ad0581f5af957
MD5 a283c86d351c0a5e34a3dd60ba1db315
SHA1 019ad717acbb741f38d832a3b76017de4efba85f
SHA512 5e9283dd0a17217ad56d06296b370ebf5a927256596d57e1f5e8b13503d84e1d2aebd9427e20bed24c586c5a623a28ff00c2b822cb94c00e2a992add0ed23518
TLSH
T13A21108A4AD1890FF88550BB0A63F8F8733188005722B393693C62395D21B8E2A4F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 ed8d0245b73d23a6c0594f88b476b4809f274d13fd5664dc39aaa7ab13918d45
MD5 2d0bed19d4f03776b2a5d9bad9dd48a5
SHA1 e41247e6e556ec6c337e05070e8b4e7f6220a749
SHA512 ceb02d0241a79bd719a7a7eb1045a44cb25f827c7606dae5613d0db271c40f165c29d19fa185dc29859026140c82384d22d7a410f92c1161eda286d764f2e067
TLSH
T15DE026A48AC8C17D7975604B07BDE309C3F5B467DEC83D423F2CC8A47A86684B3E6590
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 8KB
SHA256 cb98b3cbeef8487f12f066f37ec66463491ddbcf891894cd47cff2f7578f2383
MD5 2c67ac92316a67de4300e0cde7db0589
SHA1 c0a35edae5497b1ed365b422561b9a385be96865
SHA512 7225dc73abfba719e7fd09e8ce161bd7e6be3583304b1ea490452a8ba498e55633b130224df806da0928e04feddc8dbb3365828d012c39adb5cde279a5b1f31d
SSDEEP 192:9JekIJ+aQfbDzPPaOEBtiWejqNPCGTh+4EQJs4:qkIJ+zrHaOIUWgIPHU4jJp
TLSH
T172026A5AFBAB505DF7FF8E6518322495097EF9462C5CEC98019441CD0D3AE48E8B1F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 e536b67dea3bca06a97e51d4c115cf295f19e201cdbd2fd291e1e3f52ad65f3e
MD5 6fe7a235966ccf454580be2fcc8b54df
SHA1 47bad7ca00bafc6302bf25cf6af8b0f7cedf4fda
SHA512 e93543b5484bc5c3c6680eaa23b739a29a5c96c7dccf5cb5da910a9aadadc4a6aa1b1a5cf40dcce027ec8bf4e55524703b2357f41d865e895c7c15a8170c4537
TLSH
T152E026E456E8C12DA9A0A49703B8734D83F03402EF892D826B1CC8947641681B3F26C2
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13429301065109720

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13429301065109720
Size 3KB
SHA256 23f81528a2ee31990acd93dcf5f18de070c1d7df11c149f3d7768cb8bc5c22f1
MD5 4da9152100be44e6ee5ea56cab9ae44e
SHA1 d7fd0ebd4e96d973a839a827699c01a498c4506a
SHA512 caa2d39ad52195cf80744d2075ff61adf5ee16ac71119d8d789364f71be9d5c4e443287258e66f739bc721a76f015c7bb25b925abfa5354ec2d0fc192796537b
TLSH
T1C771CD6558D4043EF67E8AB8E6F625E66839BD403981CE1D8621724C1C31B41AF73D6A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 2a91d00a4a976f4e56a90f47a28d6a1f8d6c25eceae7c10f11843d56883575d0
MD5 ebe8b813b4a16045bab41fe893d1e902
SHA1 37d0b2e70664524be609ac69711ef59433847464
SHA512 02948f8823e8c4a9ec8e7e85ac88ab386a157768fdffc4cba46c11ca1a3a220880c14c65c26c53b64c53eee6fa1673ecebd96b8b336fa3389a2e9a57b129c00e
TLSH
T193E0D87495C9C22A6595708B83B8F30DC3B2B406DEDD6D523B1DD4C466463807793640
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 d280963d9b0de981ac683d7679b1b32e641eb6bbaa94598a6f7fa264f24e94b7
MD5 4feda08b9cfe6043b81926f964fe86e2
SHA1 f804378c6a183263ba774383a83b7d9eda473012
SHA512 ed42d7fa1f8e8ec16ce536c4815b3cad7b82e85851e0e3c80b2b83ff3a444925b472e2261c87d49f256a4ed84446c2085cb81c277f4c7c05e34a65809512f30a
TLSH
T1F9E086B085DAC3396854A0C743F8F70F83F0BD069FDA7A86671C44E4A942784B3F6A81
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d0d00e0bda9cd9ef671070f4e2da25ecfcf4a51df03706a4c3b325ef326e014a
MD5 9b5952327521d5da0598d7c2e3a50378
SHA1 85fb36de32b5f49d45a099319ba58a550b1f63c9
SHA512 e0ffa10c4d942dc70c4b5607be93c650b04e6b0a83487e4237d2b0b9071c8d5b14262d0993a456b150891af8e0606f022d116aa0c5e9917cc0fb719e403fec2f
SSDEEP 96:KA1eK2AEK0KTCqyuoKfq4NAKtyiiCAK7i7:E2//3Pv8
TLSH
T1F5D1324670B602923C7F6A0C83D597268E52B6633018E52F7BEC04B24E67E619DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 ca3105ddbb572120f2a82b08b0d1b4e6be57aabe9baed4b61a627d8c994033c8
MD5 bbb0f9fc88a6ff59a6915b08762ccca3
SHA1 2563e61889c3a9bd778cb6b9f0f7d48c74cc23f2
SHA512 4ab748ea6acd479dc1885df8daf6f5b9b1d2529da2f8984f4f568c7dbe9d7c5a9a64c782d6259d0e494c82cf318f43fa5fed7639f1135e7b0fd33fe608d458f2
SSDEEP 192:/+5W7UAfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:W5JAfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T15924640A7B747001EDE6D9725CB080771A3C716ECF22A6915DB254698EF2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 84KB
SHA256 331bc27c188b738489bdbb83b33b5082c683fb8810dca062645b2ee907f207f6
MD5 0e7dc6815c282ffa00a4bc936716bacc
SHA1 f04aa40fbc9803e543418259a3fdd30fd0e01fa6
SHA512 34285d15c6f61a5b109639040c94b6c2d13224980a6fd49050dc7c50aa92df998ab47d57a8ace519f3eb23ff8b8859971c8644561da420c5d61b0fb42563df77
SSDEEP 768:QVOkjUbA7rHDkVR+DLaafVcP6Wdba+nxPCdffSvUagsM9qooYg6CdVAD7R5evZe4:EQ8RcvZeTwQI
TLSH
T1FF83EBF3AD0992A2DDCD9178D40BEF41547382728A24D9E5AEBD08C33B7D602BC796C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 4.0MB
SHA256 4803d497195fbc010576e4dce493711151a2a259fefa0fb697badb908a07b11a
MD5 0fb9738552b9bb7671a80bbc349bd1b5
SHA1 7b314f3bc0d6037995e575c094c3b9b78c0fddb9
SHA512 4b3e66ebc6c457b3d9e3cc08e6ff7588c21a35e701a86432dcfd3f101afabfeddf6050833b2eaa6375429effbec591170d228b42c5e03d3d2e5032c9c3b1667f
SSDEEP 98304:X5/7GPDp40XowFPMmEn75Aj5WlSsPF2lhSFK7LRf6TH3n676iTF5Cb:X5/7GPDp40XowFPMmEn75Aj5WlSsPF28
TLSH
T1DA16B7F36D155266EACD9138D80BEF01547392318B24C9D9AEBE58C37B3C606FCB5A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 624716be555d0a08bbeac6e74b6d937b5f2a1594f44c465321d6623a3247d6e6
MD5 d2aa89740064a66000100f213df2c5cc
SHA1 810cf10717f883aa4a9be875de5aa4c84f88ddff
SHA512 675887ad4b5cffed1388f1d4f08b39e6db8a147f6020f28b3321a4e2081293cbab475b9c92666d76f37e05ce2c8209d64e91f46a25b31f06f454bd31bb6f48b8
SSDEEP 192:TQXIIImbGMIMslYcYxRYOv5Asclu/uCsG4:TQXIIImbGMIMuB4vasG6s
TLSH
T16442706E3A052B7BD19E7FB61262C6465FD888814938213D3161680F9DF3FA793C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 4e7776507712d4c0b59dfd680f874d44a0f5681fc83ab33fcf14371226ae9bf3
MD5 ced7cf467d82a5b0eff750038489fe99
SHA1 972d6574758cc8ba3a481c16088f946b0a7ae3d5
SHA512 ba1f694a9bcf6b337348a2ada5f2d999d6285a40151d246053926a8bd2d852b08d0f7f0f6c2186df1e4832c1dcc09172105a43d4e97d027a3d5bf76c8721ec7e
TLSH
T10BE020E4D5C4C15E787460CB1278530983903C03EE9429456F2CC4B8784134077D5743
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 2b10f4307d72504793ee210e14617f597fcd9403634315e08d26792b8c46648e
MD5 1a94b370b1d0b16c4d80c01720e4b77c
SHA1 b1214a1e9ce08cb39674f29c64030cd273a932df
SHA512 52246988bdd155c4a62306afd27696432804253ae50cf60de23f0531dfd1f99c6d585b6dc0a507bb8be7262b36d378c9fe291a34594b61d47964be887e90b055
TLSH
T11321D496F334C159D28A4A3A647EAB150338E917DFF8EC1F547620642E76E040E4B2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 c1e59b7c1eac807c0b0fd804b833246164933763145a94143a7a56c077ffa4f7
MD5 4da6afa07a9de0c50f3a683ce7a14989
SHA1 2499e20fa8cc73cd833021bf6e2831e4bda190c2
SHA512 7577b1cafbcbecc19adf723a56b24ee946d8ebd12f8b0c40a41d18d7f65db6394d48338737b0eff23cfe9708849485283c79c5a6bba6b883642c939d51508757
TLSH
T1ADE020E4E5C4C15F647060C702B8A34983A13C03EE942E416F2CCCB87D4138177D6743
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 604dbd3b48d80ce3039adffd25ca54d04e1e9828cc837fd40a6f8560db5c9acd
MD5 e56621aa764eafbcf928260420e9e461
SHA1 0135859f67c3d02b392bc2c6d94d138e1b125d95
SHA512 266540c836c09272d9acf2879a4d0f9fc27957e01f49037ef63ad5a1b6befc78a600ccaab8cc972277949ad6cee07e1d0f38bb5cf5f47cf62f20028e36da0d93
SSDEEP 384:nPZcIhsNWh0TET46RPzX5od+0ODn7ktJrswRcOObjI9G6w7mZAK:HhtDOFOn+hswRc29M03
TLSH
T138928E31A9786DB29AF7EE11F48B36135FF8607BD2941F44D6EC9F0C01975AC1316826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2bc63a6eb191b85ffa47f4accbde5aff83652645cf7dbf6098ed24a0ddbdc79e
MD5 9f37c056e83c765c2930eb949dc036f1
SHA1 999881bebcea843e51dd5d9550d8fbc4d5efca57
SHA512 d0ff5c3fcf686739e75525da4f4ba3529458bbd3c0351b499e4a8262c33ec36a9cea713d194a3f99951480e499d9774f4bceae2c4df2c9150644915dc7cc91ce
SSDEEP 192:yON461VWQmiUy1YgGX5Obd+jwODyRiV/awi39qXU6:yON46W/gGX5od+0ODnYwEqXU6
TLSH
T16102D83569686C778EE3AE49B48777135F94206BEA956F80D6E81F1C00D765C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e690bb0b0a780726f46c1c434280506e9171ca76987010da774219b3a1db83f5
MD5 d59b4d0a328ae81061b390df37611453
SHA1 ad06f0354108a139cc1d6dfd64246719a2451527
SHA512 d5d2b7eb57970146c9c8643e61ff8d4544694cf8a11187b05e22260fd7ff60de9729f2d01937a51b325dd3bb71c59670197c7f7494c816d43075dd9363571087
SSDEEP 384:nPZcIhsNOh0TET46NPzX5od+0ODn7ktJrJMBnItOObjI9G6w7mZAg:HhNDOFOn+hJKIt29M0B
TLSH
T122928F31A9786C729AF7FE11F58736134FF860BBD2985E84D6EC9F0C04979AC1316826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 764cce327d749698375b3276c5667085c5b81587b23f6563b683c91bdccecea5
MD5 92c13a1f867a1b6a595ba0e06f2956f9
SHA1 82486161c5234cea7285a60019c501419224ac3f
SHA512 1f76537cf99ab2f58970e53992fe579ebdaed66836c82c96824f4ed888818982773ae424f411504dc22a70240b04164b528089ab3bd74fb190a8a346c62b3078
SSDEEP 192:MONX616WQmiUyGYNGX5Obd+jwODyRi7kySJrAjJwEqPcU6:MONX6L4NGX5od+0ODn7ktJrYwRcU6
TLSH
T10812E736A568BC779EE2AE45F48772535FE4206BD6856F80C6E81E1C00D769C230A836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 cf239e4bb25d9b92e10a6f7a66a102399e52b7b25a6f6bfebf192139ec3a80fc
MD5 f296228d4d30d4c363f59e0b6830d01c
SHA1 f7ae05317356fe6b7ad72ba726d7b5e68285b105
SHA512 09add7d46076897fbd9e10e7b54fc9a0855f54f8d3c5e33765760ba71d1c3966ce8d96e607ab4d03afb26c8c9b937e6fb80e6679b4ab857acd652da456b23372
SSDEEP 12:TLpOPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isOmQQtudRJzQdRyzcQy:TL85UOl0afDdWec9sJ9a768GDB5fc
TLSH
T14F92DF22B9212023E8DA4B76B94348D00DFC16AFC9A7B804DAD04D6109A2AC2B6950F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 45c700c1e6906c9905bbd01b1dd9c9c86588ba8037ea92e00ef0813a143a608a
MD5 07296058683d9ae7afe61b827c313e6b
SHA1 c4c03d34e7c5ad8c87d94eaec10245a65ed0781b
SHA512 3497cce3be33e442c26f4f27b62dad250f532e91ed4dbfcaaea3b19f4913e4f692c86a0e751e7646610ef88603bd31cf30b7dc20467c01ea1cdafa3fafd328b5
TLSH
T1B241F658B6FD1148B3B76E5A9BF7A46E447BB9372E06C49D10120E4E0A36F40C972737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 0046b490a77833ce741fb353db2971735aad885e03f876fb45f40265f436f9b8
MD5 2f5ec134cdc7a284c51676c0d9811293
SHA1 7addc12d1c81f45e146b2598e329bcc3f7b54cb2
SHA512 d913a37472b37f41f68c597dd069c6027d9e5ee7d4b28e0b05f3c63199a5dc87104f45a986b061b5e26a19c728e7ce56587f8d5a69f2eb977590cf43405e15fb
TLSH
T1BD516B5CAAE95149B373BF469BF6756E887F7E332B07909E10010E4E0A23A40D871B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5812-0-0x0000023061BD0000-0x0000023061C05000-memory.dmp

Download