hxxps://login[.]microsoftonline[.]com/common/oauth2/v2[.]0/authorize?client_id=b277eef3-1a52-48fe-ac7b-e7adef52ee1f&response_type=code&response_mode=query&scope=openid+profile+email+https%3A%2F%2Fgraph[.]microsoft[.]com%2FUser[.]Read&prompt=none&redirect_uri=https%3A%2F%2Fcp[.]sansgiorgiosrl[.]com%2Fi%2Fc2v_zayNYxEK1LZWA5s4bSP4&redirect_url=https%3A%2F%2Fwww[.]chinafirewalltest[.]com

Analysis

user interaction
yes
max time kernel
76s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=b277eef3-1a52-48fe-ac7b-e7adef52ee1f&response_type=code&response_mode=query&scope=openid+profile+email+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&prompt=none&redirect_uri=https%3A%2F%2Fcp.sansgiorgiosrl.com%2Fi%2Fc2v_zayNYxEK1LZWA5s4bSP4&redirect_url=https%3A%2F%2Fwww.chinafirewalltest.com
Sample260729-e4e5vaea56

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1784	msedge.exe
1116	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297729913148389"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{0773F914-4506-4EDC-A33D-310165F7F508}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{712C02A0-1BE7-433C-9CCB-6046F8BD73E0}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 4752	4484	msedge.exe	86
PID 4484 wrote to memory of 1784	4484	msedge.exe	87
PID 4484 wrote to memory of 492	4484	msedge.exe	88
PID 4484 wrote to memory of 492	4484	msedge.exe	88
PID 4484 wrote to memory of 492	4484	msedge.exe	88
PID 4484 wrote to memory of 2224	4484	msedge.exe	89
PID 4484 wrote to memory of 2224	4484	msedge.exe	89
PID 4484 wrote to memory of 3140	4484	msedge.exe	90
PID 4484 wrote to memory of 552	4484	msedge.exe	91
PID 4484 wrote to memory of 3140	4484	msedge.exe	90
PID 4484 wrote to memory of 3140	4484	msedge.exe	90
PID 4484 wrote to memory of 552	4484	msedge.exe	91
PID 4484 wrote to memory of 552	4484	msedge.exe	91
PID 4484 wrote to memory of 2188	4484	msedge.exe	95
PID 4484 wrote to memory of 2188	4484	msedge.exe	95
PID 4484 wrote to memory of 2188	4484	msedge.exe	95
PID 4484 wrote to memory of 5392	4484	msedge.exe	96
PID 4484 wrote to memory of 5392	4484	msedge.exe	96
PID 4484 wrote to memory of 4828	4484	msedge.exe	97
PID 4484 wrote to memory of 2688	4484	msedge.exe	98
PID 4484 wrote to memory of 4828	4484	msedge.exe	97
PID 4484 wrote to memory of 2688	4484	msedge.exe	98
PID 4484 wrote to memory of 5304	4484	msedge.exe	100
PID 4484 wrote to memory of 5424	4484	msedge.exe	115
PID 4484 wrote to memory of 4836	4484	msedge.exe	116
PID 4484 wrote to memory of 1604	4484	msedge.exe	117
PID 4484 wrote to memory of 360	4484	msedge.exe	122
PID 4484 wrote to memory of 1780	4484	msedge.exe	123
PID 4484 wrote to memory of 1780	4484	msedge.exe	123
PID 4484 wrote to memory of 1780	4484	msedge.exe	123
PID 4484 wrote to memory of 240	4484	msedge.exe	124
PID 4484 wrote to memory of 240	4484	msedge.exe	124
PID 4484 wrote to memory of 3740	4484	msedge.exe	125
PID 4484 wrote to memory of 3740	4484	msedge.exe	125
PID 4484 wrote to memory of 3740	4484	msedge.exe	125
PID 4484 wrote to memory of 2972	4484	msedge.exe	126
PID 4484 wrote to memory of 2972	4484	msedge.exe	126
PID 4484 wrote to memory of 5508	4484	msedge.exe	127
PID 4484 wrote to memory of 5508	4484	msedge.exe	127
PID 4484 wrote to memory of 4556	4484	msedge.exe	128
PID 4484 wrote to memory of 4556	4484	msedge.exe	128
PID 4484 wrote to memory of 2576	4484	msedge.exe	129
PID 4484 wrote to memory of 2576	4484	msedge.exe	129
PID 4484 wrote to memory of 5940	4484	msedge.exe	130
PID 4484 wrote to memory of 5940	4484	msedge.exe	130
PID 4484 wrote to memory of 5940	4484	msedge.exe	130
PID 4484 wrote to memory of 5308	4484	msedge.exe	131
PID 4484 wrote to memory of 5308	4484	msedge.exe	131
PID 4484 wrote to memory of 4600	4484	msedge.exe	132
PID 4484 wrote to memory of 4600	4484	msedge.exe	132
PID 4484 wrote to memory of 4600	4484	msedge.exe	132
PID 4484 wrote to memory of 5476	4484	msedge.exe	133
PID 4484 wrote to memory of 5476	4484	msedge.exe	133
PID 4484 wrote to memory of 5476	4484	msedge.exe	133
PID 4484 wrote to memory of 4036	4484	msedge.exe	134
PID 4484 wrote to memory of 4036	4484	msedge.exe	134
PID 4484 wrote to memory of 4036	4484	msedge.exe	134
PID 4484 wrote to memory of 4616	4484	msedge.exe	135
PID 4484 wrote to memory of 4616	4484	msedge.exe	135
PID 4484 wrote to memory of 4616	4484	msedge.exe	135
PID 4484 wrote to memory of 4180	4484	msedge.exe	136
PID 4484 wrote to memory of 4180	4484	msedge.exe	136
PID 4484 wrote to memory of 4180	4484	msedge.exe	136
PID 4484 wrote to memory of 228	4484	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=b277eef3-1a52-48fe-ac7b-e7adef52ee1f&response_type=code&response_mode=query&scope=openid+profile+email+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&prompt=none&redirect_uri=https%3A%2F%2Fcp.sansgiorgiosrl.com%2Fi%2Fc2v_zayNYxEK1LZWA5s4bSP4&redirect_url=https%3A%2F%2Fwww.chinafirewalltest.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa7507c188,0x7ffa7507c194,0x7ffa7507c1a0
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,755484784136808921,4535874878722193935,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,3285185228235835014,7354032457245485632,262144 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,537882456994960669,829305504024591273,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,16171945890340626570,3726797302446657455,2097152 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,14285904231249081874,12288878112924043755,2097152 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,17146707325562953924,12988389910690672466,2097152 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,14849445162078865863,13026701518100358516,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,2766933348968342805,10460153929194324613,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,3995262783292361530,10411133034926039497,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,16482143120321241954,14317584245468266887,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,16482143120321241954,14317584245468266887,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,13130327701879344596,3713185519156749433,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,2723833878400477258,10768942065051446342,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,3494020677121467907,12174755178054599636,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,7386401128935306320,6072736078047067579,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,7386401128935306320,6072736078047067579,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:8
  2⤵
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5996,i,9627412663424484085,17557983385048804917,2097152 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,1378843432965374947,9653208653899213332,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6332,i,13325213246369009165,1088453230031997635,2097152 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,8699715453996138935,8111568678369018596,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,1921504862159619465,15912386062173156836,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,18350663321390241643,6099497589779938491,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,7332299567195129898,2355479791095454478,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6720,i,16413161388874167636,12435973316178835337,2097152 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,16586629033342217671,431305296195719048,524288 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5876,i,9468231884405233388,15854331820630140622,2097152 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4988,i,17452037422921272202,6336545321938831068,2097152 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5092,i,13345418943996575269,11121318656001636878,2097152 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6776,i,13540300817705834829,5297629257780878870,2097152 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3528,i,6810093416887048187,9118458497595458410,2097152 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5032,i,17148326056791377359,4303838746773960651,2097152 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6472,i,14153329888349650972,10046820680365381994,2097152 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4968,i,11680177728831860309,12635357169254114564,2097152 --field-trial-handle=2308,i,4845800158943250137,7289876684405376295,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffa7507c188,0x7ffa7507c194,0x7ffa7507c1a0
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,1451444489169666561,11617370644416505626,524288 --field-trial-handle=2264,i,15790751647489139569,14773405541727982570,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,8163191076067017102,1581070152100288960,262144 --field-trial-handle=2264,i,15790751647489139569,14773405541727982570,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,16141753701446627080,15161350845100186229,524288 --field-trial-handle=2264,i,15790751647489139569,14773405541727982570,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
    3⤵
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,5247352411127530296,8015080633847052472,524288 --field-trial-handle=2264,i,15790751647489139569,14773405541727982570,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,5247352411127530296,8015080633847052472,524288 --field-trial-handle=2264,i,15790751647489139569,14773405541727982570,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,5780255457567174314,17400564222337699655,524288 --field-trial-handle=2264,i,15790751647489139569,14773405541727982570,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,10038714279619164309,7147157975140896726,524288 --field-trial-handle=2264,i,15790751647489139569,14773405541727982570,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,2948496779592821470,14711538175567663405,524288 --field-trial-handle=2264,i,15790751647489139569,14773405541727982570,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,11827395094691876290,9496199941970029227,524288 --field-trial-handle=2264,i,15790751647489139569,14773405541727982570,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,4917170018612687341,11319796529434205387,524288 --field-trial-handle=2264,i,15790751647489139569,14773405541727982570,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,17423949321689177694,789055427391831482,524288 --field-trial-handle=2264,i,15790751647489139569,14773405541727982570,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,17853681944226219587,18168636018940308203,524288 --field-trial-handle=2264,i,15790751647489139569,14773405541727982570,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 110d3f52d5ee708e756475c42c9d7696a9f600de79d860a23196205019c54e9e
MD5 91d4e9de75d02eed75be1e704645d7f0
SHA1 d2e4f69a97b4cf6daaa2b363bfbcd0264f01b808
SHA512 469a7fd01e674783f481c9ad0d98d20f9afdc148ecb0a22e7831f840a2bf0931adb051c36568c96641584525b796852be513a5fb749693d1f60dee1ea4ac60a7
TLSH
T131D097F8691AB2A0E03D083260204600B22C06A228A3A306E1AD180CDDB800062CAAC9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46c1112618d0a9ff54856c5602d23769a3fe5e31b47eced6fe2237854f046d55
MD5 d2f469254e1d4c202f5f9e37ac764335
SHA1 828b61f0ac83e01620fb609874988a70379f66be
SHA512 7014d76b6181718d2dfd44ff4501aa0327c1a488a14aba5747a3b3b0887d26e82676d2930052fa35f73d747932e62a8c7b3ed82b335e39dcd65768059e13546a
TLSH
T1DFD097F87A5A3010D21F18303000C110736903A02C5AE321A079200CA9A802022CE0C9
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cd12ae7e85c00161034447878776aea4ed256bf6be603954ad164660ea8e94ce
MD5 85319d41e48311f6ef69fc4e38c7e8ec
SHA1 69dafbba8a3deee767813807186d13c86c90892f
SHA512 59cb74d3adf42b2d8cb1009b6ac87bc3c89343f3416e94dee57d5624bcd8dd7050cf1e6fcec5f284c2f328fc4a48382333cce4c61487d61977f2ae2318901985
TLSH
T164E02BAAC8A5EC2708FD0718A0098756E74123273A40995F3A3D82088FB062656CBC5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 25dfd0403f7c85f6da167d77012eb9cdd473ac9cc622e7ed035dde2817f21a36
MD5 07eab50c1b9f2621009d13b7bc9232aa
SHA1 373bceb4472f3ae49e387159d844baef83959313
SHA512 71788a6a5b96bc71b56cc3a3a46805756e4f94e992ba6955ad9e2fc22f284a69586b4fde68151a23f019bda5e1ff9218360d6ad472b96ac821d316ef6a291de7
SSDEEP 3:MsEllllkEthXllkl2zE/lMll:/M/xT02zDll
TLSH
T1FA440414FFC00547CD0055305051C3501374D414C71377477C730533FCC57400C44000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Extension Cookies

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Cookies
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4484_388345267\CRX_INSTALL\_metadata\verified_contents.json
Size 2KB
SHA256 6f64306515428487987fabde07ddf1646f64ad4e3dc4841e982d40ad91459822
MD5 c7182c4ef7a2cd6a57e48d44bfd4af9b
SHA1 2e1e4746da948d83baf4bcebee618784f8ab209c
SHA512 d8af16336b66e4f264eda4ea68de4c1763a9c9b99635184d9ece67a9ed69a09bc1088bed254b3d2a8877ba3218e043065d1e4a06c20f18b58d312d93fb84bc83
TLSH
T1BA419322CCA5BC1F293173704EB90662AB0595AB2081295A70FC099D3FF15666436EBD
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4484_388345267\CRX_INSTALL\filelist.txt
Size 134B
SHA256 543c0e50c16159439d3dfb3f1151bc64e2f5b60a0e3824c5f93c4c5c14dd945b
MD5 3bf6b4eae5af15288bf0d79702f9cb78
SHA1 b8a052dc4973757ae865661ea0300dea1d27f3b6
SHA512 25e2502ad314635035f303aa1f0f195c28af91d0b51280e5a4c9310aae65aad857073137196f41a9a2fd7ef96e54ce9b329c448d5acf87b10134168ee7652c0c
TLSH
T1C9C04C206C0494B7810CEF55C5F9FD34940616007E33DC8913584270101B68E8DB5324
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4484_388345267\CRX_INSTALL\third_party\babylon\LICENSE.md
Size 9KB
SHA256 4135d3051e1bfdccf0440f6d8867a6dc1e39587694995479c3e29826e53aff63
MD5 e57b8dbca804bf4a2db759fa1a70b3cc
SHA1 8acc131b3698964249b08a0178f7c8c467337048
SHA512 d2ca91851daeadedcda21ecee4cf7c9244cf21a15709e472014ba6a332a374cba80acd165b2650ce2c3994c7d0156376c22db00fe0c47833e0fca466bcb8c627
SSDEEP 192:agW/NVo4UTo1YE+FNzFE6GGfGb2y1CVzho1oHqxQJbbLwY:a7hUk1+bXU4qbQ9l
TLSH
T18E12427F7748137B0AC30172B78BA4DBF32E903C3B9556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

babylon.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4484_388345267\CRX_INSTALL\third_party\babylon\babylon.js
Size 1.2MB
SHA256 b5a426a0769b378e196ab2698c14a326d86ab2443010e16e4ac3cdde06371e6d
MD5 e1adfd8f62854c2d9ce65f13268c1ac1
SHA1 d564ea1d59305bbec12995ee43f1c28838e82519
SHA512 ffdf74b8bba179c7d5d6d49205b8aebfc7b27395852d05f1ae5de5c23b5dfbd87776f2046fad20b652a7663dacf90da0336a802985bad14ba3591bbfd9ca4caa
SSDEEP 6144:j7WIrpHJ1yA3d0xEWv/v/82mXgBYdnU7yTGpjGp8MTYgANTJCpzesRGvJaGpLsXW:vC/ErriNqfGp0KV
TLSH
T175450999B3217926478390A5143F090BA33B68DE940540BCF299D8DFACFD149667BF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4484_388345267\CRX_INSTALL\third_party\typescript\LICENSE.txt
Size 9KB
SHA256 43692cfafa6a5c09136cfa0138b9c78efeb56ee6b9174553dbf704b888771f6a
MD5 f632dfdde0adc0da86f701c6f2df38af
SHA1 5a7612b4d9977a7e79f60e88df556b09a90df828
SHA512 87722a2d675028d18ea276dcf18c24e891a0bad5f85f7387702310976d2fb8e1d0687321b0844b6c47947e6fbb489fe08bd1ffbe9772955ac7191ba4e274c8a5
SSDEEP 192:rwqW/NVo4UTo1YEHFNnFE6GhUGi2Re1CVThOCoHqxLJbzjwA:8ZhUk1Hf4Rg2HbLNB
TLSH
T19C12637F774903770AC30172B78BA4CBF32E903D3BA556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typescript.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4484_388345267\CRX_INSTALL\third_party\typescript\typescript.js
Size 10.4MB
SHA256 986134e07f34257fd85c084441c825d7d8951705a0b8c76b0d7c5499536cc959
MD5 d931cf27eb964f239e5bec661810abf5
SHA1 1616508213014fa7cdb50e691cf737169019c6ed
SHA512 9c2bae1025c1c9579e5e7ba8119e11bc298bbf968aaaaea94f12b8a96155f63bcdbce60deb1445c484aeef3fcfdf96156fc804c2867726617e7b772440989fb6
SSDEEP 49152:noUsnsTsUGJR5dZjSB1FBUWx3pZzoYzuQRlbVbOFeWSeoMTNKtsL4IMltR6SMF9K:BTsUqRIb3nYz1q3X
TLSH
T1D3B6E6BE79E330B16A5B2136672F8001B735D257220CD8907E9CC3A95F1587462EBFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevToolsPlugin.html

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\DevToolsPlugin.html
Size 220B
SHA256 fd59488175e43bb4713fd621e785b618fc647a3521d305874722bd6b7fd1c649
MD5 0d09cc16eebaeae80fe58be258501fc8
SHA1 898cae597eb3039e94878df3eb5ab1c012bb5264
SHA512 f90c0ea0174598146450074c57344765b725ac0e44ca5c21f979b8f77370be94940aa53b684d9ef1e77c3090926e2004a931e6c0bfaa1f5bee3247a55799ff83
TLSH
T131D0974D08CC55A2432004636A26BC0C3F4CDA20813BC6A3E878C1582022EBC80D0880
MD5 SHA1 SHA512 TLSH

Submit Download

DevToolsPlugin.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\DevToolsPlugin.js
Size 8KB
SHA256 fe217348fd4d7ea4969f563ea9dbfc778e6591098a6fb26f231f859bbcef0128
MD5 7f32ca5d3f52675f538b041bd67c0444
SHA1 a8f6a8ff69ba0b3ead7a44d9b64fb009ab0e4e57
SHA512 ba763c633c8a959644535e9a2999e229db42c2fe61a57fa4e58136a05aa29d445f5e4278bcb5b529bc35e443534e516bad7cedc6d0ca2d408a5fe412f6e56df9
SSDEEP 192:95G3OvolW6gQWaxciQV23vrYbSrbS6tk63yidWJvy3BCd2nx3D8jyiQjElDXQqA4:95G3WoaaKDqxVIFB
TLSH
T13C02215EB8F62032F017B576197F8009B63540137418CE19FBED93A4AF92037A993ED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevToolsPlugin.js.map

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\DevToolsPlugin.js.map
Size 16KB
SHA256 1aa1227de1acd3b490b9fc09a2165788cb78afb9e0795a5d0a75f007206f907d
MD5 9eb2d561a925489b69a25fd78f7b47ab
SHA1 d989f19f74b1b436e0f84b29a1b6b99033e26603
SHA512 cfcdad655a516a610ee8b6d50d62868f42645e003696438668f8cc0aff0d9e9c569d878dac1cbacad7403b1816197618c8fb1ebe628dfd456fd54447cdfaf9f8
SSDEEP 192:fVuVl3E3tRsSjJ5FWQzgFMO4+wxVdGdFWdYixmrfReRc525y8uj5p6UJO1DsWy:fVuVlU9jFWQzVdGdFWuiYro5y8eQDg
TLSH
T13972881720BAD837B44767A718EB81A67E20545C7D98A70479CCD302F3D2F3BADB2865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NamedFunctionRange.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\NamedFunctionRange.js
Size 1023B
SHA256 aa5606bd8607fbff0998828a2285421f67bf46c986217a23bf54b8b9c62f9e96
MD5 fae98d8d75b2ddab58eb531d3c08a8f6
SHA1 1e197513c4ce482eb6aef6c436afba74c1c69e10
SHA512 fcb07e23e1e96f5d3141dcaa389b9e250c0aeeb94dc3dda9c9005e49b41f5c4b64b13cb68facabffc8c40154e5f25f5caacb1d41da4ce46e2b5050e74bd9cedc
TLSH
T1A3119B2B59EA1926AFBE2413BEDF33485631010B5CF688DCF42D93406F614678CB1F91
MD5 SHA1 SHA512 TLSH

Submit Download

NamedFunctionRange.js.map

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\NamedFunctionRange.js.map
Size 2KB
SHA256 a03e6965ec2315ae26572a646e4477fa341630038a50762149a19978a91a2389
MD5 b2816c88b5f892e2a6c0cd97af1b5896
SHA1 d422ddf8f1513981c623db31579adfed682bf54c
SHA512 5754bc51de04ad9e73849c1c0aaaf7702d0673b7f55b7f289a1f2c6f370f55a758f15bd7574097c5eb78aa236a2b47d58a7b7550150ed29aa557cce0b6166daf
TLSH
T11F415813441DAD333E1B225BBDDB16A52F31114D6CA82758B49DCB25B3A2F378971A42
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\_metadata\computed_hashes.json
Size 185KB
SHA256 91146e26a28bc108564354c9ec740ff60ea9e7ed120b3bf8bb986c8786443dfc
MD5 c44785ed27cd0a3074ddd1835095efe3
SHA1 e00aa1942712d56e9b0cba8678585cf7d101b424
SHA512 4efe13ff4966e66e53a0e11df7e36373336045f14718f1ad14f87c95bf31c9fad0a201e543730da1565d2324365ff3a715117107a9116efea0d5ed7e8979c67d
SSDEEP 3072:/V4gORXIdahdQQUg9K+6HrkjWWmTxWsA8F46Shm3ljOQsrUmKWrABs9T5:94pR3yQuTkvJzi46ShpQsTrws9T5
TLSH
T1BC04F234CE1E72668F2AB5FC0A951C31BDD6834A17414A06BCD483F63A7BD471606BBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\_metadata\verified_contents.json
Size 2KB
SHA256 5b1fc94e2b28caf5ccbea9574de0e42c860401620f0763c10cabe3a05a7154ad
MD5 70f58c8151600335b5ec548cade5b98b
SHA1 b916376a8c9e19541af0a787845f80535656478a
SHA512 e8fdf5e299909f96733d0b11c0617d3ca06a22283438f04d7395a4799c04672fdc5f7770e84b4cd0c66311b131e15c2e24924ce1f5e2417dcc9ed495b9685129
TLSH
T16451E730C470359C2D1A12304EBE1363DB51A3AF20817D1B38DDC89E2FB2B4754A7CA9
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\manifest.json
Size 766B
SHA256 072441aff81b94a2d6a4cb7e86c40fe27ae8a9701f7d466f76db124fd3d54330
MD5 c447a41c21cbb2bf5411029cb0936e13
SHA1 07acb13340be463e041ed22a2b26d5b567fd2023
SHA512 32fe5b340df5d7193bfe9bdaaccfadebc0e2c945f6cf61871f106e18daa4ed164aeb0d39f5552a09e3ed82104d69885288c8f4bc596a4e9291cdf627b57edd6d
TLSH
T14B01757D889FC8B782394B016893C48AF3354B5EA400A20C79B0C05C8871376E913629
MD5 SHA1 SHA512 TLSH

Submit Download

typescript-tsconfig.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\third_party\typescript\typescript-tsconfig.json
Size 91B
SHA256 69500e16f1f9355aee311a80fe52f531ba348bb7f6d4667a2d33c3cd75113759
MD5 40d3e3fbfc100769071a2a27040e33f9
SHA1 e150fe3170a949d8a5d86e9135726cfdc5be6c59
SHA512 3ec8cab677386a19d82240628d27b0a1fcdf1aee56f59cfee994aaea96a1dfaf2b3eab73d0c1902503bac61bb2aef5ab281e73e4b0078994b1242104d9bb2830
TLSH
T13EB01220C5280C1006F975440F2D90018160594286565E2631CFC1384756634043F360
MD5 SHA1 SHA512 TLSH

Submit Download

typescript.d.ts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\third_party\typescript\typescript.d.ts
Size 486KB
SHA256 2b06ea0beb73119a4294b56961eeb2337c6e706c8f0311de1bb49ca47c92abd5
MD5 9f7f369b169033ee919dba043b424a83
SHA1 ec2ec5846812d366045c969e5e03d037a6e1cbdb
SHA512 f84397b6219a1b07a1d5c1f9a470e1fbd9d3e7143c55c7ef345be147fb0a56b8609e97708cb0482711382f448da57b7fb0b1a55a9750b41d2083d9c86e74aeb0
SSDEEP 12288:HGeBiBCdVZ+dISrJXnMEEuIwmn0NtIRFqr0dhbPzPKUnrjM/MqV6VQ:BBiBCdVZ+dISrJXLEuIwmn7RFqr0dhbS
TLSH
T1E6B4C6A768D514B1091580E26AAE9041DF34E3A33719D0B5F5EC83BD0F1EEE917EB398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typescript.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\third_party\typescript\typescript.js
Size 9.2MB
SHA256 eb27b35a442aab5e5963127d468c1c4ba0009fa67e18b2faf73f5e1bc1ddc6ac
MD5 fb1c951f849bca76b6aeec81fafb1ee4
SHA1 12a47c6376f82c9d529b0102d82214b8cea02e71
SHA512 bf05030b66e25e7ba27b0d999a670b582d602d639e84b1f6bef01894a95420e1f94c88cacfd841bf7ac4838754fd32e398cf0c5a4c362091ec48d8d572bb4dd1
SSDEEP 49152:8eg4L1W7tVtRPj3HydvhWw2e/L5/sW5iaVf7bnePoMM8AGdcBeEmkCPt2sr+nVsN:LW7t/RF5PB6kl
TLSH
T148A6F8BE39E230615A4B61766A2F9001B735D267320CD8D07ADCC3A95F1583462FBFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typescript.js.map

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\third_party\typescript\typescript.js.map
Size 6.0MB
SHA256 5842f1041fc42ef727b2fee220a55f00bf38eff815920207d8ae560169aef766
MD5 bce05726f69c72ee12576c1ea1a3fba3
SHA1 575168a99c46fc263bb371e09be457d5c18f53be
SHA512 453cf0fc7ceeb1427ccd09bc16ee1354144fba1eb721b72c697eee4544a5fe9b641404d4de715e60dabf68a6ce1a6711353ed3161f442a1d5279a5fc666d865d
SSDEEP 6144:ITyuEDfQX2uiFwGOCqjXqW2N1ekQ4n5LeW:2PX6D
TLSH
T10F56A00201BBDD6BB45B16AB29CF81F2BE50849D7D98BA010988D715F4D2F3EBCE5472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 f4552e9444b2ac8d327df1a20a7ff288fec8c6428f88cbbad3d57778daa2b3c0
MD5 12bd1bfb16518f1b12cf71fff0648cb7
SHA1 9a951bcddcffe987144ef1d293a25f09c228c1a6
SHA512 bce23f5b107028ce4dad3d5f86c9323442d05e08a61b98fa6a9c7a7d10e14de2f32751a628f0e5c8514d44973b3bdf165d34a4af4b4b9e444cdd16aa473ae7fa
SSDEEP 384:OXj5H7IC3/83uICtTBBU4SX+Cm7DXspU3it:m5H7ICTptTBBU4FCnU3W
TLSH
T10714845F4F603722CDBE40766CE645B79D6CF02BCBA2A6C9A8611474CFE3712642C4AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InterestGroups

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\InterestGroups
Size 124KB
SHA256 7a0ee91c7a554def842ef65b590833eb17331712cb5dcb234854b7280c519867
MD5 682edb3c6289f03ec9795d962d49dffb
SHA1 0aea2360b507fc04af2811d62dab24062ad19fb4
SHA512 c34d875eb230ca9bbae7118ef5ddcdb37b8d812bc62b0e46b7bba6cfe6c911495c75e7bbc90582fbbd48b0bccef0caf0faa2c246b6bb76521f23ff83599174f3
SSDEEP 48:T8nB76Yhhv0PBTNmYMytlBU1qHPG4rZZiHlVUHFHClMiJAJxY6dAzh5cju+UnOps:wB7tzmllLHaEHFHObMxddIcFTE6MuaN
TLSH
T1DCC32B9E5F683129C5FE11B6DAE00E934E3D002FC3D756C8269446F2AAC3866C73D0E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2c6b2ec8fbe4449f8c283cb95162ef8b37d340909bb5aed453581b29853a0dff
MD5 eaeee43909434e7d8f090f88d16e9e7c
SHA1 87e503113bf45b6fbe1660f8b593586556efc6a1
SHA512 92d455f68a2fbf01d96892d40bde34a5fdd3375f5cd7037690cd10d70a5fb27e483d9eca3cd7d929aa19c593982876a7111940c266280fff89850c2e4099bcd7
TLSH
T150518BF783F4866ECA1196F0EA18AE1BCE2D0515436C7C9AC5E4AF1B93E2470E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 003f80733b3e964f9322ec09d9b1f28324199a4ab368532f8de025949b23e3ac
MD5 488994e9060d76a72687cc64c910ad38
SHA1 4779c13c69f37fc322d88ccaaf29ffe30d86cf00
SHA512 8ba2e30bb90a23df7c262899e1bd9c65d77b9b8e746f780d82c7bca5517ecd99f11d77d985966cc416b86adb22815468b3cd8c529a83df18cbac7f746536d701
TLSH
T176518BF783F4866ECA1196F0EA18AE1BCE2D0515436C7C9AC5E4AF1B93E2470E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 da538aed2a3b5bc0028e4b86574272129422ad6b1dce6b0fa15692dd8405b4cc
MD5 392470f75dfffaa4623c22a6eebc4100
SHA1 90427fbdd214e50ff64d4d97de7db9ebca9d5c70
SHA512 d58e55da12f740ff5d5ef88c50e064fe24e1c126b565489e757c4fc367a40f52f396444587e42525594366b4ce0e3bd582a0cf4caac889bce1ef5df5f344e530
SSDEEP 192:sxZwyR7yMqZjK1Ml8MkwB/fQpssUMaZdtjzodpIoHW6+WN2FL/Yv5uv1jQIgj/J:sxZwyIMwB/fQpssUMazt4ZHb4/V4jB
TLSH
T1B962E9166A38997B8CDBD219F6457F53D6F91563D2909E449AFCCB0C00E7AEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 f29c504950c766d69340a344987f0bdde2d3dcbd7d069090d40bab871fb3d4b5
MD5 cefeb1200a283685f8582f5aa24eb7fb
SHA1 ab0bbc54db7f757325c932fe489228cd3ca807b0
SHA512 a22e570f65aef385fc1f7b15e6ecb2ba2561eeddce109cd52096a75915f877417385cdda121febd71720149997686eef7a949cab4ecb3c45f4bc68dbfec08f7a
SSDEEP 384:sxZwyI4wW/fJZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGNpsYWvaGpJ4ZHbX/cPf:sTTD/f3jfW9RC8wAePYaGpEHbPcH
TLSH
T1DDA2D60A5424ED77CDD6921EF6B57F63D6F5461683806E5C69FCCB0C00A6AFC221B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivateAggregation

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PrivateAggregation
Size 20KB
SHA256 fcc11e1d32e72f65db7326f72f06a9af22ff934db247fbd2e1db6265f175291f
MD5 b75fbb6b6c9274ab483deec4683702c0
SHA1 82bd27e0cd226ce350d1e0733dc9dee92e174d55
SHA512 0fa0ad7dd74ed3d5be75dad91a4cb58bd6f035d6ea5ba7cd6063e6b7be04d48b54142f2c211ad44414914a298362586489bccff26ed1abf3fd515cf9b39dc5e9
SSDEEP 12:TLyqjXWhNOUhhQvbKL2LzKFxOUwa5qguWfpbZ75fOS:TLBjXWjD20wzK6UwccWfp15fB
TLSH
T15A9202834D449227C84E5E36C3C393D1CEB5711DCB61EF80539068133FD02C0426E619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 f651f84bfe9d37a9b9f812cb722663fa9a19f6925e32211bcab1212491bf3a76
MD5 0867e34cd9882e5e8ae3e39534cc00ea
SHA1 0a38057a857bca08d044aa87b6c9b8447877ee8d
SHA512 0b010374dcd5c8186696d545d553a5b0fe4a49f71cc293430975f68fc80a897a3c57793ead261c04ed0c01ad27f4b517590278f6c6982031965dab063fd3fdaa
SSDEEP 768:ZYsQst8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNU0LlEe9NsQronRLh:e5st8Od/hWvFvmXu1jaCU0Lm2NuRF
TLSH
T1E8E21C3B284CCB7E4F840E5CEC26AFDA6DD801CBA6588D5447FA854C02C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 2b4d003fde0d0b7ae0d45a4b993f727e328a4c060afb0a67e312efe8a87214d3
MD5 d30a482b44bbfd7e249dc229bfb6b56d
SHA1 337e0361833ee3ce799ae8f8dfbffedb3a2799fc
SHA512 c84d528adcf4fa0b6213c3a3ce3388af9f80ec50370432a8e68faf9c784228d5ba87edb76c2811487b49f241314665ffd17b404662a1f26e17282ea5662f6d87
TLSH
T18FE04F5829CAC1BE701A204306A5832DE6A8741BD6C97BC26F48DF956142995B7E2191
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 8a9763084e610c51bea1dd6395df78a25891c897dcb2b932a20c17585c4f946f
MD5 d2c27bbfb5faa4ed18e5dc28d2cb1a6a
SHA1 f5f1156d59760585e7cd87b3b1291e4ae8c44bf8
SHA512 c3a6ce7c9a7dc3aeae40fd143342ec18f6011ad58c3b6ec35be4d3eb821ee2f7644ca582e7dfa58873a8ba7b1d018f8e8df450fa148e7d6c5dee9892b1fd3ce5
TLSH
T111B0124437407169C0DA043242D65BE8A203F00610560463B898DF204DE82BC3EA6C81
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 55210c06ab73aaedb7fd6e041952634de4f5abf53b39b4c1d45ac29f567b27aa
MD5 103a099f620423d55e9ecd0e26e30c41
SHA1 866fe295d4ed50af84a7d85313e4aa3e7afef838
SHA512 230802543dbf353348c1a502dcc79a8a38c5200547816bac2bc990e06951401998e800f3179d3535ff2703eb3cd350a9194b32be8340ba17c13e573b9ee678cc
TLSH
T1E7E0D8343DCBC27F7147208B4255E71C91E27407D6C93ED1AB0CE698720664073D3140
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 06e97b536001eafe6f43e19f7c06e76bb569b1a394939d2c4c8af5a787c96231
MD5 0ec46136c0cefe187f6998ae6976930e
SHA1 70a48d089cb8202394351755d2c180793ec125d6
SHA512 d63ac7a6e04ee556793744e22792c68755c013128f6d4611b16bb6f5313398274bcb9321fe7800dffccf879486ec0f81967a9b328d991a7275f3faf0af23342f
TLSH
T1C5E0DF788DCAC27E6008609343A4972CD3A1781FD3C93AC2970CD88DB502111B3F6190
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 849f1303b9f02f82213aceb4aae91a9e26910e0af8c87c546a51e481a13dde18
MD5 f42b92fe1ffc7a88f790b06716c1dbb7
SHA1 77f7ffc64a8270ec54b1c5b3418d7622e90fccb2
SHA512 19a800d0731b5b5b9d2f7c8f42732d679ae256f858405e7005e81715459c698de222c0453a91c5dfa1eb2ab9fe10cb268fd6c82cd301f2144d86b574be617939
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGg:05ppxnY753RNBvRJJdt7p5J97rpS
TLSH
T1EBB2595A703A0212397E2988B39696364F4135A37058E4EF7FB814A54F27E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 fac7987cd8a9346de849002939ac8465c8e268e1d092f2903ea31fb7bd33d1be
MD5 49c2aa0c395b98e3db1ab1ff00cbea59
SHA1 c847f4cb4e7d78edf0f220a0592fab0b104a88a3
SHA512 174964948602f718cd2eefd2af5228ed35fceefaebc69c190b6858bb313abc2c950c2622f9f4c86f2998d64317787386ed6385822795d199145e91d410a2d504
SSDEEP 48:T3j7dojKsKmjKZKAsjZNOjAhts3N8g1j3UzBukSF6n:f7doKsKuKZKlZNmu46yjUP
TLSH
T1AE03108F5A7890F3D0F2C53BB9828AE6FCB9111C9316BEC089F903B68E5D032F119195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 d1226ffb99c5c3a60da058a3243c22e7a13bb6070461f74b717000244d2ad899
MD5 9561472697ee0cee2f7b5b8e756b757f
SHA1 e290fa7e98e4af12ad0de5724ec4821ef5d14a9a
SHA512 ef6796315bb0da610cae27e609a489dc42390a16285c425a7a8f8b1de2870053737d4ff255537185090377955aee207b82669be48ba472bba1f8c0b1bbe1e993
TLSH
T1AAE08654ADCBC16FF61430C70A694358B2957A0BEBC82ECA2F0CC859A102555B7E6586
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9e72a48b3bb2f1ba346703a2f29a6e0cd440630caa078ef9bbe2e36b2bfeb664
MD5 9902aecfb8c02490e757eae2dfc7bc94
SHA1 3431d0b700243264392ea8624dedecf95716c8fb
SHA512 8c5e0431b8f2b63b3cf35aebf7e479cbcc056328c9158472240e7a0ab071eaa332a7ea2e23c15633f96dc78955b28917cd948442d526ba0ebfb82aff117d51b7
TLSH
T1EA219D55F320C159E18E863AA46B9B261378E8129FBCEC0F847D24352D72E045E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 9f1e7da8202c72ada99717ea65c70c251a3eea070a6b61e4fbaab17aa30d71f0
MD5 54df48eb254d3d2243905ef748c473d8
SHA1 ef9dbe9a44f99eff54dd8f9ecc8fea63c6380825
SHA512 0a638e71d2cd81855198cc747a4fed7f97a29e037747e2c1e8d90c045ff1ae2b244d0f834b425b77115bea15d7599601d377ebb3378288769bcc4086b91734d6
TLSH
T172E02054ACDBC15FE211308307B98388B2953807EAC43FC52F08CD4C510254677D6542
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ce493c6c1d4ffeecec723b027574498ebdf17e12954ea125bf258a6f7ce02bdc
MD5 072111cf894755e13590976fb02182d1
SHA1 712211d32d19f3df7affbbc3bd8b42368cb2541e
SHA512 5874750c7d4945a98a2726881fb21cdb6e091c9e661d5aca6d00d680cad56104e40ec3cd926e74a51249860676c5d87b13997cec4a7e083bad8218cefbc71593
SSDEEP 384:ngiF/ZcIitsNH8TUNTUlI4TQckCrMgMpvBftGJXfhT9J8dL30sAuQwo1n90dMTqB:7FXAKwgSkIajGzT9J89uum1n90uc1jCI
TLSH
T111F22A71D8549DEBA9E6CEC9A749F602AEE40233C98C999CD6F47D6D309F0FD0306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 c6199d9ec5d039c5fae68873962e33ae0fcc0fe484935041beb822bed64c3c5c
MD5 e527fab43f5e1705074ee51944dd6ba9
SHA1 0a3261c0cbdeb90e0db08f98800d297f3085d310
SHA512 7a0d40f8ce13c42f1aa471ae15c34ddcd266b18d10832cd4b3c09b94fe04ca0d55c097d2b6aa7b6c3b19971e40037c5bd6b0761450366608c816706a46146583
SSDEEP 384:npkiF9CcmyWCs3sNG8TUNTUlIm2QckCr9leKpvBftGJXfhT9J84Epye4KV8p0/HZ:p/Fccps3HwgbkUAkjGzT9J84bI8p0/Z
TLSH
T1E6B25D36EC68DABBEDE74F89B74A7A03DEE0526785DC59E4CAD85D0D00931DD030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cca196770530bd2a3cabcc6b5027cdc6a83ce4d02f3dbf0cd20a0241c1fa6ec1
MD5 74c464e49a9278862685adb82405b5a3
SHA1 9c97a3ba809e850399ae56cfa93a704a327a01e9
SHA512 7fc0c7a70dd696bf053154e4ab051d26737ebcff1f7aba1a4ab07e7690a231703462d86992f3fbb90bd852d3b2a20b2c1a1b55bf4e536d0cdd00e81baf5c3df1
SSDEEP 384:nmiFiZcIJ3sNH8TUNTUlI4TQckCrM4MpvBftGJXfhT9J8dLAwFScjmw+zTty/7I8:NFQJ3KwgSkQajGzT9J82wF1jCI
TLSH
T170D23B36EC68D9ABEDE74B89A74A7603DEF04163CACC9AD4D5D85E0C01971AD030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8bd6f29803637c7aafd8d25060d79f9a90d4ee8b706da24ad1f6277e14a21ea7
MD5 2ed57d3cda35cc58a2c497a51c57953f
SHA1 87f057d4cd96f5d427871b9558f7ea8a70484d0b
SHA512 9176eb58403bacee575fb52e30b472f1a4d1c014658868c9e40e075853a1c65cc1d43b662c3f3afe9615e4ef162aa9ef7b281b9bd6d3a0aab41bd82fb415bc27
SSDEEP 384:npCiFiZcIJ3sNH8TUNTUlI4TQckCrh4MpvBftGJXfhT9J8dLAwFScjmw+zTty/7v:pJFQJ3KwgSkLajGzT9J82wF1jCI
TLSH
T13DD23B36EC68D9BBEDE74B85A74A7603DEF04163CACC9AD4D5D85E0C01971AD030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 45eca18bcfc0a2e6bfaf3cc96236f0e44388c640171cad585f18b6e717031ea0
MD5 136a9570f297f7cdb8309efb74c89974
SHA1 610571c9f6dc3c8362bc5c8811deedef177771c0
SHA512 8f2b7f2f63f1ffe5ff870476f68d04622316d33460e15eb03561286819e60bdcb737091d9251f7fcc08b402bd5dd93a69d18959b964c6bc776ca97699e0aaf91
SSDEEP 384:ngiF/ZcIitsNH8TUNTUlI4TQckCrM7MpvBftGJXfhT9J8dL30sAuQwo1n90dMTqB:7FXAKwgSkjajGzT9J89uum1n90uc1jCI
TLSH
T149F22A71D8549DEBA9E6CEC9A749F602AEE40233C98C999CD6F47D6D309F0FD0306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5c3b10e95c86f5d4494fca4574cd7b51a2589959692524595a9a5d6bdf66bdb2
MD5 6a8eee0080d005ac0af435da56f7793e
SHA1 7526df600b2d2f7676820de8109a154639f54f86
SHA512 e4a4110b0553f172c92f7109e85f3a08b40f85b31fd0bd1a11cf059bc89123fd2d521d7333834fe2b704d37a4931eedb2f54f627b5dab780371f162b9010219d
SSDEEP 384:npNiF9CcmyWCs3sNj8TUNTUlIm2QckCr9lIppvBftGJXfhT9J8dLhwFe4KV8p0/5:pEFccps3awgbkU2XjGzT9J8bwFI8p0/Z
TLSH
T121C25C36D858C9BBEDE34B99B74A7503DEE04267CA8C9AE4DADC5D0C00971DC430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9796abd3d514eeb685daca7d4c42cf64447ee4c3f2c101e0fec22010ea472d67
MD5 5a077d491221585492c3d9ad4f81c3af
SHA1 877dd24035c6addd7ed6e8ba59b97c4a4a026724
SHA512 bfc68bc5b88db9ae66448d04ed9a9370f0f6f7e5f0146ff16f55e2a612194e1cdeb1906a5ed0f854f2e96236c88aeae0acb3783206cad15a8ff4149e3cbeb007
SSDEEP 384:ngiFiZcIitsNH8TUNTUlI4TQckCrMqMpvBftGJXfhT9J8dL3wFScjmw+zTty/7I8:7FQAKwgSkiajGzT9J89wF1jCI
TLSH
T13CD23B36EC68D9ABEDE74B89B74A7603DEF04163CACC9AD4D5D85E0C01971AD030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 d8c6038e06b577b44aa6f111dee22df44faec4091ba4ece9e93fbd8755ce7146
MD5 80a22475067e621ee883c66417570be7
SHA1 039d7198baf7dcfe83a17bd9aa1b76a83bb4f222
SHA512 8e1b4740aed05a390cc08ded31fcaebf144a45afd73e7f919f0551c224fe3ea7ab7982754672b3b4c603d6111b810fef5633cd86c5f6501ad45c5f43b422b383
SSDEEP 3:MsEllllkEthXllkl2zEPT:/M/xT02zGT
TLSH
T1EF44041C7FC00507C54070344071C35003F0DC11D51157C73C510433FCD57700C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dcfe87fe42519066bd27a916896461ed116c499d35cd44cdaf9460a5ef6fa301
MD5 f23ce70397c0e47c1b4586346c0b3043
SHA1 26c248074903ed88bc51d01b11ce1f1193f4a812
SHA512 02c5477dcd56174ce6d03e0b35631ec4d670d01bcf4d8627945fe8da4314da8a0c527ada648fd31d02d2dac3e0ccd9360a9de93fcafe52588a35b4262461ced3
TLSH
T11D41F458B6F91148B3B76F5AABF6A86D487ABC772F46D45D00110E4F0626B40C8A1B33
MD5 SHA1 SHA512 TLSH

Submit Download

a84d5ad4-de1e-4e6c-a62d-f875142fd90f.tmp

Path C:\Users\Admin\AppData\Local\Temp\a84d5ad4-de1e-4e6c-a62d-f875142fd90f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

bb2efa1c-5125-42a2-b940-86c7ac1374f8.tmp

Path C:\Users\Admin\AppData\Local\Temp\bb2efa1c-5125-42a2-b940-86c7ac1374f8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cba38702-b978-4851-af5e-95237cc9453b.tmp

Path C:\Users\Admin\AppData\Local\Temp\cba38702-b978-4851-af5e-95237cc9453b.tmp
Size 2.1MB
SHA256 efdad7555293ec2d14399c2c2fc9d07228de1f6e3746b27da621b76fe5ceea07
MD5 4cd67032e35fa92f5182df10df289906
SHA1 9210bfc66bd808ffcd7c6443e160dc8d6754c416
SHA512 f3d83f6e77e4568d2dae539c95acf0a886926a001b4d80f0ea602387530fc333f688ac031b3057e1c2b0375426cf47ae33315f7da9ffaec601102be0bb7221cd
SSDEEP 49152:ykR5Xz/3zNOm3NOHF4+n/UlfmCSJdm8IKXmiQeujzX:DVEkNOHJQOtICGb
TLSH
T166A533BB93AD6C15F3A88C67DCDD498641C2798E6161B7F619837C282ADC07CB47CE09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4424_1552093657\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63e65385-385d-42fa-98c1-6fcd0412f86a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4424_2092106932\63e65385-385d-42fa-98c1-6fcd0412f86a.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4484_620568561\CRX_INSTALL\manifest.json
Size 658B
SHA256 fea905b763b26db02673c6ab14f422b21eff64de59351f0818b501dd4e7f9430
MD5 2cf796650e5ad5bfb6c4a421d81734be
SHA1 79298d3cdd584b290d825d6fff4b857012e71992
SHA512 1ee7604bd7293d6296cf1368ed0dadaad7359f4d00be75e7730a9704b2205438a06ba7361554437b3e6ef352482011a90500769ff713949716c24355ee742e33
TLSH
T17A01233A268140F238347640087155A4F176620B9100F8053835E36EC460BFDBD79A6D
MD5 SHA1 SHA512 TLSH

Submit Download

1e2fbb06-74a3-4fc3-854c-dab677cfe275.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4484_648552225\1e2fbb06-74a3-4fc3-854c-dab677cfe275.tmp
Size 3.0MB
SHA256 2d69203739eca77886457d27c0df44eca47da02810061a7f5e15288c2e643f23
MD5 06f47f5ad37fb94be87982adc116d012
SHA1 4899ca7b1be75f8607b00b59b8469c8072f514ef
SHA512 b9ccbc3f2c45eaefcc4e157fb19eafd10eb54465f514ad16ada25e81390c3d577fa52aa6fc03461de6726694cdfda15ea96c5420609ac7a426e7b5afa43cab46
SSDEEP 49152:nqSGYpZHVTcorMCTt7OQvYilFbQ0NyNLvTAIPvWcfbcFlTfTGquf:n5pXTcoYCTYQAybMg7cfbcFPc
TLSH
T159E53395F69FF0F4D9A5F3317F8C765F16AAD387A30091D84283204A7BA9E210A5DF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/360-370-0x0000023025D00000-0x0000023026D00000-memory.dmp

Download

memory/5304-201-0x000001CBB9420000-0x000001CBBA420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads