hxxp://[.] | Triage™

Analysis

user interaction
yes
max time kernel
899s
max time network
898s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://.
Sample260730-nphf4awgla

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1800	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_270178332\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1641240894\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1375373908\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1329942408\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_716971576\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_327911093\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1910266009\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_398754537\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1375373908\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_927889541\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1014555134\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_143073305\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1755860863\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1329942408\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1793540804\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_67153431\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1329942408\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_398754537\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_308186864\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_716971576\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_716971576\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1910266009\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_308186864\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_716971576\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1449350591\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1449350591\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_716971576\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_716971576\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_398754537\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1449350591\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_327911093\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_67153431\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1449350591\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1793540804\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1793540804\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1793540804\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1329942408\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1375373908\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_327911093\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1014555134\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1755860863\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_927889541\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_67153431\ct_config.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4504	msedge.exe
4108	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298848742973467"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{EE631895-EC7A-47B9-8B8D-820129495FAD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{F67B5D8E-2279-4BB9-A7CB-AF379D9ADA1A}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 4748	1836	msedge.exe	89
PID 1836 wrote to memory of 3088	1836	msedge.exe	90
PID 1836 wrote to memory of 4504	1836	msedge.exe	91
PID 1836 wrote to memory of 3088	1836	msedge.exe	90
PID 1836 wrote to memory of 3088	1836	msedge.exe	90
PID 1836 wrote to memory of 4424	1836	msedge.exe	93
PID 1836 wrote to memory of 4424	1836	msedge.exe	93
PID 1836 wrote to memory of 4972	1836	msedge.exe	95
PID 1836 wrote to memory of 364	1836	msedge.exe	94
PID 1836 wrote to memory of 4972	1836	msedge.exe	95
PID 1836 wrote to memory of 4972	1836	msedge.exe	95
PID 1836 wrote to memory of 364	1836	msedge.exe	94
PID 1836 wrote to memory of 364	1836	msedge.exe	94
PID 1836 wrote to memory of 5408	1836	msedge.exe	96
PID 1836 wrote to memory of 6124	1836	msedge.exe	97
PID 1836 wrote to memory of 5408	1836	msedge.exe	96
PID 1836 wrote to memory of 5408	1836	msedge.exe	96
PID 1836 wrote to memory of 6124	1836	msedge.exe	97
PID 1836 wrote to memory of 6124	1836	msedge.exe	97
PID 1836 wrote to memory of 5104	1836	msedge.exe	98
PID 1836 wrote to memory of 5104	1836	msedge.exe	98
PID 1836 wrote to memory of 5104	1836	msedge.exe	98
PID 1836 wrote to memory of 3064	1836	msedge.exe	100
PID 1836 wrote to memory of 3064	1836	msedge.exe	100
PID 1836 wrote to memory of 3064	1836	msedge.exe	100
PID 1836 wrote to memory of 2388	1836	msedge.exe	102
PID 1836 wrote to memory of 2176	1836	msedge.exe	103
PID 1836 wrote to memory of 2300	1836	msedge.exe	104
PID 1836 wrote to memory of 2176	1836	msedge.exe	103
PID 1836 wrote to memory of 2300	1836	msedge.exe	104
PID 1836 wrote to memory of 1604	1836	msedge.exe	107
PID 1800 wrote to memory of 4840	1800	msedge.exe	108
PID 1800 wrote to memory of 5472	1800	msedge.exe	109
PID 1800 wrote to memory of 4108	1800	msedge.exe	110
PID 1800 wrote to memory of 5472	1800	msedge.exe	109
PID 1800 wrote to memory of 5472	1800	msedge.exe	109
PID 1800 wrote to memory of 3628	1800	msedge.exe	112
PID 1800 wrote to memory of 3628	1800	msedge.exe	112
PID 1800 wrote to memory of 1672	1800	msedge.exe	114
PID 1800 wrote to memory of 2952	1800	msedge.exe	115
PID 1800 wrote to memory of 2952	1800	msedge.exe	115
PID 1800 wrote to memory of 3964	1800	msedge.exe	116
PID 1800 wrote to memory of 3964	1800	msedge.exe	116
PID 1800 wrote to memory of 2904	1800	msedge.exe	117
PID 1800 wrote to memory of 2904	1800	msedge.exe	117
PID 1800 wrote to memory of 5532	1800	msedge.exe	118
PID 1800 wrote to memory of 5532	1800	msedge.exe	118
PID 1800 wrote to memory of 2432	1800	msedge.exe	119
PID 1800 wrote to memory of 2432	1800	msedge.exe	119
PID 1800 wrote to memory of 748	1800	msedge.exe	120
PID 1800 wrote to memory of 748	1800	msedge.exe	120
PID 1800 wrote to memory of 5392	1800	msedge.exe	124
PID 1800 wrote to memory of 5524	1800	msedge.exe	125
PID 1800 wrote to memory of 2676	1800	msedge.exe	126
PID 1968 wrote to memory of 5284	1968	cmd.exe	131
PID 1968 wrote to memory of 1524	1968	cmd.exe	132
PID 1800 wrote to memory of 1296	1800	msedge.exe	133
PID 1800 wrote to memory of 1296	1800	msedge.exe	133
PID 1968 wrote to memory of 2264	1968	cmd.exe	134
PID 1800 wrote to memory of 5984	1800	msedge.exe	135
PID 1800 wrote to memory of 5984	1800	msedge.exe	135
PID 1800 wrote to memory of 3368	1800	msedge.exe	136
PID 1800 wrote to memory of 3368	1800	msedge.exe	136
PID 1800 wrote to memory of 4156	1800	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://.
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff920ddc188,0x7ff920ddc194,0x7ff920ddc1a0
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,10166209544207569530,7425084158697267852,262144 --field-trial-handle=2276,i,8096184576820072294,7486841422286881045,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,13474992581064369227,17315525801863808435,524288 --field-trial-handle=2276,i,8096184576820072294,7486841422286881045,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,15618015108883017970,4980204657415690898,524288 --field-trial-handle=2276,i,8096184576820072294,7486841422286881045,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:13
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,12235227093004282897,3244451891739717330,2097152 --field-trial-handle=2276,i,8096184576820072294,7486841422286881045,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,12516803715815811281,6340564677798235346,2097152 --field-trial-handle=2276,i,8096184576820072294,7486841422286881045,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,481381301073357547,1438792530429838661,2097152 --field-trial-handle=2276,i,8096184576820072294,7486841422286881045,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,15570110974339744375,16522112372239899807,2097152 --field-trial-handle=2276,i,8096184576820072294,7486841422286881045,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:9
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5420,i,12191005367908947401,6835008991017241580,2097152 --field-trial-handle=2276,i,8096184576820072294,7486841422286881045,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5512,i,9750205051066341781,740920666192304740,2097152 --field-trial-handle=2276,i,8096184576820072294,7486841422286881045,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,8310038169078822369,2508638172995067008,524288 --field-trial-handle=2276,i,8096184576820072294,7486841422286881045,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,8310038169078822369,2508638172995067008,524288 --field-trial-handle=2276,i,8096184576820072294,7486841422286881045,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,7624143579163654109,8500901045827580065,524288 --field-trial-handle=2276,i,8096184576820072294,7486841422286881045,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,6465368832205877772,7442602797099603987,524288 --field-trial-handle=2276,i,8096184576820072294,7486841422286881045,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x32c,0x7ff920ddc188,0x7ff920ddc194,0x7ff920ddc1a0
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,8560162493710049558,5123351897657146282,262144 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,17913793859814567347,15646034533454082564,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,5103124017831613897,5163744308073528876,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:13
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,5911504354571831961,6619921057631935634,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,5911504354571831961,6619921057631935634,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,6331177604207965170,3649546935476436308,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,3186098522974852155,8318193429179711389,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,12132270018352136146,4700735895320406109,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,11219099739430455017,11742340367833309902,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,9708539518767647896,16422297878854556954,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,7797060236636154461,7383558971550112036,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,5021224172878187109,3559036813063817072,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=1240 /prefetch:14
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1252,i,11559984257379420517,8269869389995877282,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=1352 /prefetch:14
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1256,i,5323134210039473173,15120076547990804107,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,5132354538356807687,505702959865018817,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,4510611550149479079,16130614028787760743,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4660,i,2434775674500371467,14602569186658629850,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1248,i,4869853857325140497,9316373931027178086,262144 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,7441118730345185723,15212474415200006343,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:14
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,1394184122391466826,4479797426197613586,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,846539190683485854,12979005082421588879,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,2222773513450820621,1867937738364802758,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,15609767791406869574,3574707478087391156,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,16925862877589726982,7358406242710702627,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,16913469781460860887,11822905115544944628,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,14035279376108777109,11805986836755973214,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,7970153865414044216,16525148155239285089,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=1552 /prefetch:14
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,6080009965813475754,13928772342787639179,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3988,i,18219750182053541132,7546276236780530941,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,11599963199436022867,17457338768273929527,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,11654970083791608089,14484004968650590979,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,14970200112980937176,7731483269324182416,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,14566828200356445615,6327696265708991104,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,7910155335628283923,3798062741390747009,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3236,i,15843322255452607367,5846168319153109863,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,18425230088360009889,4918385036377947117,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,1307877874099925527,7537924503822143972,524288 --field-trial-handle=2400,i,3711465752724169538,3836748494882034197,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4832

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1164

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\help.exe
  help npm
  2⤵
  PID:5284
- C:\Windows\system32\help.exe
  help
  2⤵
  PID:1524
- C:\Windows\system32\sudo.exe
  sudo install nighty selfbot
  2⤵
  PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4608

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4df8445a-bfbc-4e08-8c56-d0f72c6254fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4df8445a-bfbc-4e08-8c56-d0f72c6254fc.tmp
Size 32KB
SHA256 523ce06e11c2ff9c1cd332ebc788a6f15e26fc3029dc745f037b13127fe9a5ec
MD5 5735aaadee5988d9c8ba06eed184727d
SHA1 2471d8d164f5f3a7ca7394b63dabc75b735c45cd
SHA512 e7414cc06c861ac35dbd0ec3daebc6262415aa7e862913f475b97feee7a413dc239803a2c60ea3a70f57d0c84af83e3933164d11830b9aa0a5f411df3b54b825
SSDEEP 384:nZZcIb38Nt/Vg6OoLbvzRfY9bYJAvH5etCQPlLJQXmIkdP9IimIMWEfMbc+0sVFE:xb3qvVjiJ/vH5et5NHXmTWTbc+0sOt
TLSH
T1CEE2BFB1DCA68E379DFF9A84B9467B525EB90173D5C80A88C9DCBB0C018765D031BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6fb1480ad12b08150f9b3ac124b733d8b2ac0bf9ed197c5f88e07cab78b86522
MD5 384a8c1042d427c714ffe16fa52e91c7
SHA1 7a932055d18c874c97c0b79eb358ec465858df92
SHA512 22a166b0d57153347b7fc6a5052a4e2e6cf1e3676148f4e06de17bd2224d5b80c8801cdd82f838aa262888191a3401946d43ad110e8b83824c41680e77363d7a
TLSH
T15CD097603D08B9E4C084203121A013006A211062AA69430C2010E51ECC34082B3AE9DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 60ca145314cc65c708c3cf25df7cdb49a74877709da1a5eda8038ff86aebc1ec
MD5 e34de1f8986f52ce0c0916326c937e66
SHA1 0598650d7d0e5a6150622a95043369e468330068
SHA512 f429ccae6e11f1334b0a206396309c5ffe489650ea9c8802b0a42c7477e88db1c2834dcbbb1350ebce9c48dff5ddbb0f6874b15d1c8f5194f3d86a514ffcd30a
TLSH
T1DBE080DDD5C9C3BDF12D6597817453CCD6B0360B96C4A94517048454714354477B1DD1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7f91b68e65d92e051f113d4ca01c7e82a4fb90e92df77261a037f803c051c684
MD5 c1e1cf60d07cff2d1e5e9eefff54a20e
SHA1 f91a6eda5b5b21d2555d1ec1b941fa4777740b6c
SHA512 41aa2cd7a64e2c8c34798e887f23eb13b515098617e30bd0ecd9014397f0d0f87bf9b3f46d88c4bae831437016ac99bf269c96dde2f1496e2420e0cb02ec3089
TLSH
T1B2E07D84C4C9C3FEF218A4D782F9678C92E0360BE3C8E94A2700C8897403448B7F3AE1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9f9feb5af02b61fc0e81987ee3f0dcb08cdf51ae0eb21edb6d9e360af2f991f1
MD5 56c2af01fa96df28a5ac2b5ab5b7667f
SHA1 f8e4b869a40a67d2125d8f94c06f6a7527b6ffd8
SHA512 420df399f0063b66a7cb152585b72e3323e94444e125a0f4998f349ae4df42d58024a5f911aee3242f8de6e08ea84b1ff83f6717a69f34b15bbcfcef3ce9f3b3
TLSH
T161E02BAAC910EC3708FD473860544689EA8023375B60895F3A3D92088FB163E42D585C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 cc36807764017ef4c25db4e8f8489d690750b67bca11b202d7922413a4edde18
MD5 35657b03b678b825e4c6a59a45d34d75
SHA1 9a0d6de6ebe34a5dcfabf77ae76478cdbd0a7e6c
SHA512 047074871caa8f0dd48ca7854debe205ffe7c53e0cb0dd90035260aff76335126be9b670be5c0f56d904ca9a2c5bd9611c9bafcbeee74a02f5ef15a517fc1e64
SSDEEP 384:dt+2IPTM+TaT7TVT/TZTrTxThTwT3Gm2Z9IuJI:dt+2ZyGm2Z9bI
TLSH
T14513527D969B7E0BE3D6847D0A9BA7760737C281C1C1B78722B13A3158467647D3EA0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 f51ad67e54cbe597ee7ef215f2043026d9106878f13f7ed721df31df7eedfac4
MD5 d738c56e22826d5762f34d0efe841617
SHA1 0ed4b7d647a4540e42ac59654190eef4ca37b725
SHA512 a36861e5634b3f389fbb8b871dccce3e4660915b0bd3aee09b5b335d632f189eee9e03a6cfe62837b0aa09e42ace89ab63ce84d07baf0dbb28b4771da1f6668c
SSDEEP 768:1EtNoOp4L/XfTL/dxInfpAKaZl6t5xBHgb3yOrIWHVCdsr9TdKOlHaBtp:1JU4L/XLL/duARZl6t5xBHK3rI6sSB
TLSH
T154441DFB1951641BCBA852F5E2133E2EC57B455E3CD2F8E9E5784C812825F32B2BCA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 2d4bfa5a5915896b46c6a42884b93ce2a56d28f7f1df6d49bb3a7d17099d57a2
MD5 e32deb7c6bbdd0a52dd3c91f8f28c21e
SHA1 7947e38d19e90d144a23510992732205a7d3a428
SHA512 4e967357a3520e0e9aed5b525f1085ab2adb626970663f3f5563f4e39d70b114439d56cec37a61173b992aa92d47b9fc87346330c71936a0bb6d0ab41da066d6
SSDEEP 12288:o0HvyTN59U+jUj4U9MUPYIdjajQ2R7FHfRq8olK4Qbafl3PG5Gu2j36oLKd45FBG:zHquupeVgowZllx8RFPzJk7hZ22Vo
TLSH
T1DA167DEDC97858C3CD639A30B4F0E9877C7413C3F995C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 06e3340b29d78e3e55de1b0104c3f99119db435a60cf213d65b4f0861a8619b8
MD5 3b2e456af3bfe20227180989b3d211b3
SHA1 8c3de9a3e0ecda3acb00717ce0e62441272b9205
SHA512 34ba000704828cf7f50aa41d4d3197b5ef8e36e7db11a9e3b546dccd3f36d554de131a5202327c09aab623aa65103fc80ec1bad4f8500c80ee500136e83dcb7a
TLSH
T164512298832FFDCDCB64F2B220EDBA89B6B3D459694FFFC04450977449013462372221
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59385c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59385c.TMP
Size 2KB
SHA256 00fd822a70ce22a32a7d8829380ee8c2570c973851a121f4199245157ff675fe
MD5 105820d81599620b1dd0cee7d3fc9dd1
SHA1 b39ae9ceffaf2d4fc89831b6094dbeba71bb2b68
SHA512 3f2c89bddfd6ccf3714a0412753752610df73259d9fa98bd494345fa7d0f2a3fba6a239f65afad482e1663de68b8195a74704fc1339b53485ab240f52c58c672
TLSH
T1EE512298832FFDCDCB64F2B221E9BA89B6B3D459694FFFC04054977849013062372221
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 2c1bda0d266cb6499311d884d71bc5120e7179cf19ae16faa79c844d81e6af17
MD5 cc81690d7418d95c51b055e786d55cfe
SHA1 a697b5ea7cdff52ef936a4fbcbf302cb1fad8478
SHA512 8d9c7cf8e6b5f4a0efbb22b25dc84867102e9744d126e429609e8356f01a922935e8774c9710bf87adfa31ffb10af913268396f28d15182a856103100c249f4b
TLSH
T16DE020D8D8CBC27DA53435C391796758E1D43847DAC6AD431B00CCC07643505B7416C6
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 6cd12a8fe182a0ab95bc79eee5e9de48cd26e4000cde8750336d7198e0c8639c
MD5 cdde50b738c0839a82358dc2e60407db
SHA1 39cfa3c2a7d17a854e174f23edfe19e3033a0d1b
SHA512 40e53c213b78071b6e8d729bb5d89513b16a36409a910b44029ec153c006ac1dde0e39a23c75a51718b57819334f59d7546f6daddcefe7311242cbdffd4235e9
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj2ZQN:TdD4jJ/0UC+lf5KY
TLSH
T11AE2A04C3E21F511C4ED733CA0D2C5D09EBC647C478DB67142386CA68D52AA2F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 6a1d8a80c2eff4ce7eba955aeca8c30ae8e8085400a75e91f40145f34230e2a3
MD5 336b00377477021785b0d2e0f32b1193
SHA1 2cea76889f7d4b5abc0b6046d58528918d08e4a4
SHA512 f6c6ffd7dfde3cfd15eb000b33a32c0e4cbfe58f5653f82687ac2223aa7fee96eebe8ef4c641baa5a82fd4e6a6e577c7b5cc2bb2b90bde6ba2903e82a35a2cef
TLSH
T110E0865898C9C37EE5286AA3C37C63588AF53846A6CC7917674E8C50A141645E3B67C0
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 96c09ddcb81b696c8e9b5cd6d99c8932b3a01afbfe0a0c151f81c01579828622
MD5 0d803b381470a329b49b7b9639c631f7
SHA1 21ba50c5dcc94226931db6719f718f6fa6b233a2
SHA512 5388099c434ba4fddc9f472761e61a901baa7b2dd7a06eea4660cb169a7629b3b86ba3ba96d39d28ba8ab0c3fe5ffc3b02e65af0c0c13d595694a49660c148a2
TLSH
T10FE0D8B4D4CEC2B9A219205B83657748C7B03847EAC97E019B0DA8A1B402104B3C15C1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 f990c08f59ea2437f854ea9b73bcedd1dbdd585bad8044e8cb5119e9201d1cea
MD5 5d22440dc583f967e8195599ed0c547c
SHA1 02d165675878173a6c3e5b7416b23d3314e46f65
SHA512 47abb6258a18abca5a4ba94ecefcc4d5cd9fac5aac287e73fd98042655cfcbcdb6374813ae12b3bb7511852c3881255fa299e3eede7dd7aba807251af9e04495
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7ohwdYITQ:qDeMatha9RAFQ+
TLSH
T13DB20C4D1F347521D1B08B77EDD184632E7C100DC3737A899E1860B28EE256BF60616A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8ec635b457e3d6336c4fb1c9451bc1e0747f8ba720541e55964b24fa5c81aa5b
MD5 823a5339d112c66c3f800702a36ab771
SHA1 53ac4a349153820775b9a5ebe4c818ee74701cc9
SHA512 d53126b779f5d9d53b6613d84927e14544287adea41abd4b2ae36f5e067a9d7e5ea8691c2f8d7caba2ffa7a75aa61af1a35d8d1f8875e65af7ab8b585ec148bb
TLSH
T13A41DDF7C3E8863D8A0186F4BB042E1BCE2D0915832C3C5AC4E4AE1B93E2471E14088F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b6d60fd9523859884a8ba0adda8656722180b16925c4dc8684b03168090fffbe
MD5 ba3b9e0595526e07368693b711fd7702
SHA1 81ac6e90610392f274b554752bfd0f1a0fae56fa
SHA512 f48de1cd02eef884499170acc871009dfcc3ed34704616eaf2b59a8a88490015f65f4f466ddb65591288fbf349ae01c769d01f34bf7baf11cfd8a34705eedfa8
TLSH
T19D51CEF7C7E8863E890156F4FA147E2BCE2D0914932C3D5AC8E4AF1B93E2471D18195E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 aa0732254313b4fe3965e39715921ec5368b9123dc29a3343e71df146e38f92c
MD5 577b9a9007fd9cc24f7addec26a79590
SHA1 e0049973a52831c7d3ca0e7fe16d029883c57d79
SHA512 d6524990ddb8e9f96bb2db35ba19c731cfb28f7c49d47081fb54703e83cff11c0b9cf655b1e45478384a39e4a0ff7d3e6873f70db9740e491448be476467b42f
SSDEEP 48:TKIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBklI:eIEumQv8m1ccnvS6hhsGcf6CnFGALA4g
TLSH
T127F2CCFE07276206C99484B0E4009FCEAF16010B47B6B6DC76D447E3F7A21E2B57875A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 f6b679b513893fdac51c915bbcef31ba8c7dcd874ffbe962f16fa6f20873c42e
MD5 a77a61762e91393995a413463c76de4b
SHA1 d071dae655231ffb0b9e40493f5f531941dea2b4
SHA512 c4e2a04586405acba51c6616e7086274809eb7e486a6187a01488cfb44541e5abffcff6d64b4efd91703ed2de552588d0a8c06f9534f2454de5d30a3e6721a04
TLSH
T185C022A280B8E8332029453D0F84A980AAB4C930800280A0CC98837CA0808BB5B12429
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 495127d929fdbd62dc2bbdae4a8d13bb50f8aea193f96daf21e345de3a1a3e9d
MD5 6e75f82994acda870bf3ac64b52f7d8b
SHA1 b253a4d880be28824e5a9e608c53a61ef7dd976a
SHA512 eb7283bb2ca41e26e4c500deef28ec5db8374d539a725578ea7a965d7fff8dcfe2281252201df7da17af3443d1b1f8b37fa2dfcec5dedb1eabc5d1da7ee8f906
SSDEEP 192:sxRmzRvbs/fNs1WpV5Kc8bNzozoA8ptM/g6+WNIYJ9iorgnIgIJ:sxRORs/fNs1Wv5Kc8zx6/5IDoWs
TLSH
T11342B6166A68AD3B8CC7E21DFB657F53D6F91033A5E06E48A6FC860C00E76DD121781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f27d279a74246b214a1454d008adcd5bc9c903b679db22c48a2c2306c859d27f
MD5 492ab2ac6c310d909d8f208024926c67
SHA1 080c7699a6818c914845e87c7cf90a53b1adf417
SHA512 705669108ca8f8ac72206647ec64ec810f9c44cae783fa130be8ef67e11d2ce0acd8e47bf7c86821ce23960e943f189796d316f82f8f60627945a696caa186a8
SSDEEP 192:sxRmzRvbs/fNsxWpV5Kg8bZde5ozoA8ptM/g6+WNIYJ9ioFGnIgtJ:sxRORs/fNsxWv5KfVde5x6/5IDo63
TLSH
T1FE42B6166A28AD3B9CC7D21DFB697F53D2F91033A1915E48A6FC860C40EB6DD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9f055c8a3db9c6fcc43d626e6c6ec89d67cb2996b2d60b8f121b959a74a95e95
MD5 164c1f6089bf05b0895ef3392ac93202
SHA1 d08b0bf717c6748c317e63f34721476c7949834a
SHA512 74a27bd554931dc46d47e9d19bf3760c0786be5da09b512d1fbb2c88f341e0f339c11a3a2225b86a7635e2cbc745b9a74663ea48ed5de972629d08becd06a147
SSDEEP 192:sxRmMRvbs/fNsTWpV5Kg8bZde5ozoA8ptM/g6+WNIYJ9ioFGnIgtJ:sxRFRs/fNsTWv5KfVde5x6/5IDo63
TLSH
T1AF42A6166A289D3B9CC7D21DFB6A7F53D2F91033A1915E48A6FC860C40EB6DD221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 39f703c6ed9096d6649f6604e481f03c9cbc217d53c2fef4428c688c5402dbda
MD5 c9f2f4edb4085a93c463af785303407c
SHA1 8969f2124eb0f38afe028c294308dd2528dd71aa
SHA512 52f5735b91100ccb7b1ceef0ceeac0ed91d74188179766cd3e12aa56de46aa79975fddb6df63084b6e732952f8211d969a56c4ab01f640176e1737f1d218c922
SSDEEP 192:sxRmMRvbs/fNsTWpV5KgMbZde5ozoA8ptM/g6+WNIYJBioFGnIgPJ:sxRFRs/fNsTWv5KLVde5x6/5IJo6R
TLSH
T1FE42B6166A289D3B9CC6D21DFB6A7F53D2F91033A1915E48A6FC8B0C00E76DD221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 b17cc3b9c2017ca07237d7ddfd1a3173745df7ef6c6d4fd457181a306b5bac8b
MD5 190ed7c8b0e5257e6d53a5ae5f942f24
SHA1 ca4e276880a331c43ddd4d5e74496c8cf844d923
SHA512 400ffff4c5e3a97b3b6fc92ad39c2bfb467d309385d27bfeb4545ea552cc906b80f6b27ebd75a4e0c3c7a4e54360a583c2b29e16673a93290ec2a985a0f60096
SSDEEP 384:dpCfAo9fCtggCFfJJKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV//93VRRiroKM2:dofAoxWgg+fJJ8F1+UoAYDCx9Tuqh0Vd
TLSH
T181B2D93B600DCB7E8FC04A9DEC19AF977D9802C796949D4047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 03ed59fe917ad7bf6f53de116f357d5290ce41d9865d110441f22e0e299fa64b
MD5 63a93aa8d60a1993afae9645d8b3dd7f
SHA1 a47719e199e9ae1a42ad99e65045b4ca6ff3e3ce
SHA512 00c77609a0dbd87ed2958e992e9c1086ffac360ea99d829a93aca374ebf38436597267cdd86e92b6b958bcf7b498d1731eb491c9c3c5eca56950f1a6a0bbe64e
TLSH
T1F7E08654D5C9C2BEA1292243437CA75C9AFC7857D7CC7D123FC5CD50B146544B3A25C5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 f62e06b79d2f1a750467e1d765ae52e1994f6d8ff4e099ff2ff64bf458bc411e
MD5 d84014b31336d1f83d4aeb04ee4bb587
SHA1 6e772fd5e3edefb72742782502df7e78d8fc31c4
SHA512 72ae3238cca7742bc9faa35cf8ebe41377354398cc07127166aad2205be8071f5d5c423a9a82bd81fff1c6be19f3d2e2c8dadd8246d9a2f9b092b11a82caf8c9
TLSH
T183B01244FB84830BC1861A303F9CCFC8B231FD02005144A3CDB58F198D065F82E45895
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 03cd1a82337585b0213eebae7049711d4c008518a8ba39edfc8bc1ba2d55c09f
MD5 eb49e56d40f39af15a5cf6271d011d7c
SHA1 8908f16e7be55d0d4288ffabd8e8c9c4d2f28a6d
SHA512 cb5ad4d84c0bfcdb65a5038e9a87956e54f79b598fa84f49de6da9f3420a6fff0dffe43ee9808269a43594d72cf4831a8aa99b8e8543974edf361e0c07cd6c72
TLSH
T192E0D824AAC9C37EA25921878378E35C85F27802D6CA69213B4998407206144F3676C0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 d1f06ca60ee71f16c28bede42943432ac414b5352eea9dba64143396c63c2936
MD5 ee0baec265b7d4474032ac6af35f8075
SHA1 8ee57ecbf9ca3aee20cbac0612c92cb2bac3ff2c
SHA512 e39e8a87724de3bc357fff0664b16954b92f3a1c55ef66e14e4cbb7d88398c2e3c20d2ebbfad76b9d12cb193f2d10e85f0580129996e836cab4ef2ce25e18aa3
TLSH
T100E08674D9C9C3BD911862838378A76C8AF47C0697C87E6667484C54B101244F3B7AC4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 e8562b44d37f720a6e5605090f61eda64744f77baa9a53bef32446718d9f4c6f
MD5 791e3ac6761f605d1c5e5c231ea7cd92
SHA1 0b344e43a8abc07eb8584de2469fb53aca745b65
SHA512 3504882fc796e8884227ae4ab4673c70dfb76e8ef8be2b07eef77dd1670727107f8a00b51849a342aa66650bb6f1b81531a0a09b085edfc9503ef78d01d45a16
TLSH
T15551CD58323A4764387E290CADB4C43AD6D17C627118E83B3BB804B55F67E125DBCCE9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5d38d9d502a7089e7f5966adef896e6da7c17b44c43aadfc0b4899e0a37e1342
MD5 18534a7d77fa1f5c2ab13e43ffabfb91
SHA1 9fd0f48d6181aeda891dc643782891ef5e86c1cf
SHA512 ecc72df0f4124ca5da06b1e5a60190e7247f38a2bdc0ae4a71d6f16c483f4c79b8001b5ae91dcec3e19d71926e1505432c4da1c9937ce6b2af60e26066ee5ff9
SSDEEP 48:KdkRwUG6eku67PI7MkKYBQ+k800hbG05y9JIRKaEclrIpKkgknyg:K4LyKMcO+JuKaEKr+KkgmT
TLSH
T130910188723A4660387E690DADB0C42F96D17C637118E83B3BB804B15F67E511CFC8E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 4e3af0f3cd1aaadc9ca28cf866341bc53ed60bc34e95fc266a6bc36ff0abd0c0
MD5 477b2226a627f58c44f671d54ec9d726
SHA1 94d5a167c59ee40fe15717c9c4f33ce34fe4692a
SHA512 d913a2e9172239f6f6cd100b58b2f8a3d95a2bb5457e1641c3b059300c4f990a3ed11989db26a9bc5358e0f2ddce9544c2cd3158c86f3775f8e7bdc81ac5cb7e
SSDEEP 384:DNrRZyCSDnxTIC4RMEhIKyll7svbFKfk7:xFZJSDniFmyI1l7svbF9
TLSH
T19444630A7B747001EDE6D9721CB080771A3CB16ECF22A6D15DA254698DB2853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 99b45c0e9019884b44853d0b047c6dd4304471e996c5658ba39d0ac5ad9e2c64
MD5 d66fb76c347171149f1f2035e41e9e96
SHA1 61be9e65bac5cbf61fcd843bdd12af84f9d212bf
SHA512 357bbb7944752e1bb52c2e9efe8eb5425ac5a4772108926074093f999bfa8278ef8dad2dcd18058b7924dc42e32b19a9b999054cf675fbbbd1d3f15f6713f676
SSDEEP 24:LL0OGxhK3thdkSI5QjUsEGcGBXp22iSBgm+xGt:zEK3tjkSI5IUltGhp22iSBgm+xW
TLSH
T1A452579BEE743212DCEA83319AD001E17E7A903D8FC1EB0255D610115FB5691A71E59E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 337B
SHA256 654f975f0b294d1d53e473c69a73e1a05fde7783e8c4af5a5db748ab855f55f2
MD5 8e3de2b81900e0c4ca9785fe662e122a
SHA1 d7e23dedb09a9a1df36867643476345916c33c9a
SHA512 185a9a4f2fd75db99d17640550915e392f612e997e73a4b4ae8d1dc94fa4bad7ef71348c00fafceff0ce6eaffe7874a353020593bbbfd1c45fab2b4c739b67f3
TLSH
T112E026D4332AE0E4AAED9954EE28A813E4E47D56130DC432332D08B44B4580A0A3ED36
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 8a55c348faae13a370f759719931476d8f8dd66c5b65be54495b7b6a0bcbbd6a
MD5 d0ff6e391b43250f25e5481cd21005c2
SHA1 c3b5ff2eb569924d4b3cc64acea39798d6140165
SHA512 2ba2802b5e86be8b4817e9c1c0bd57daedacf8d87238d42b7b7bac5f88a39f351f65256f3646eb36876c6d9c362e0fcc0a30c1244c7279e3185a187017fb626d
TLSH
T167F0E5D76E421977DC52943144336782FF2199CB4464A86743CD256A1A2E1F5C9CC1D2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 8253266b96b829c2e40de5064212cf5d15d9b781f83c29eb71052979e959d7b4
MD5 e8c6bd59b4c5b19453468d94ff33873a
SHA1 0f3d7935b2807c15e96d5a9f57cf8d22059a651f
SHA512 9b8d4f354e8f6b9f4d0664ecb110ca4991f76fc4abbc176096b2e03c49f36fec80cd0f12208473236147c083139a576e08b20f2db2f9f5e1fdd1e04ca7ecd5b5
TLSH
T1E8E026D4E8C8C2BEE02820A741349788C3A73C0FFAC82A065F09C48CA402100B3862C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 8a3e5bdfd87844ac821f925c29fd867bfeda002d4deae3c47c3c8783141aefa3
MD5 a80aa0acc586063f0f0b8aa47770dde7
SHA1 75ebdea66c814bcae9d262320a83c677e6b7a965
SHA512 14cbb26d3dd0b30cb90662d69b4f6c99cbc857a48d9102d4d8936451e07aaab0d1042d54fe1c8774757f373753c021212b12e934cb69b2661353a8cf4a540b1e
TLSH
T152217556F330C008E15E827D646F9B351738D8568FBCED0F85B960756E76B440E4B6E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 c9ce43928f2eb33e7e474d9aabbe5738a306a158761763f76fa717c0b62040e7
MD5 e20be7c6155e26bbff1bedabbf563a8f
SHA1 6bf780e3d9406e87770af1f1c1fb5a707f5d64a1
SHA512 d809a4eca274abe287fa2512058ca48b4f8bd257893b8f4e86beae014d70df3806a9511ba318ab970bf1a2a028940fa6ba43e9b4e07ad9445060d0ca421b57f7
TLSH
T154E04894E4C9C2AFD02420A34174E788D6A67C4FFAC96F051F458958550215577562C1
MD5 SHA1 SHA512 TLSH

Submit Download

752ad2f9-28d0-49af-ba1d-3e7f35d59c70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\752ad2f9-28d0-49af-ba1d-3e7f35d59c70.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 2155e3b49638b9a9b2856c52d0234f6b32c5c6ca43d448cf17f919f6c8b0bca5
MD5 f814d9b5df5a8c0d4c11ef667d661763
SHA1 fc6e9f6d49dc7f6485d3cf692dc87a77f6a33a51
SHA512 4017674ffa5016cde03f983e98d8efb3bfd44b23f7c4f7ba5e9fd2f9b411115ad03ecd365e709d920558f57bb3b74a81f6cdad1d3bc3f22a87a192c467213c26
SSDEEP 3:MsEllllkEthXllkl2zEflUrhRa/:/M/xT02z5rH
TLSH
T152440404FFC0140DC54110304151C7D01370D4100731574374D144335CC7D400F1C000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 96bd5827da2ae4db926891387a651ba436acdcd160659b2412ea2cf6979de004
MD5 41fec80ac86f2edb51360af50079589d
SHA1 5c26344d817200625fec217a0620ceaef659a64d
SHA512 0d13b10c4e8acfadc21f8585fd82ecaf4f9c807a7627b3e82b2c56b54d5e42d6cc20ad40331ece5a6d058def59a10ba83c279c8925089c84be2ea4b5d89dcac5
SSDEEP 3:MsEllllkEthXllkl2zEfl+3M/:/M/xT02zp
TLSH
T14A4404457FC0041DCD0010304051C3501370D4140557775334D554335DCFD400D40010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e03ae0e2e8c0f3c8e4c6adcb43e007d7904239d0365af8ced11f45b263ea420b
MD5 7cc1c85dadd1d6394806cd3ff2c0d947
SHA1 8d8e0b260fabcc1cbbe9de2181a64020a4825bfd
SHA512 2ced6160e0d67fc3142435c8b0926ce7c330b25858c4650d1daa25d2eb5f49fd472fd38b7f5cf5cb687c1c141f19aed5430d78ef52eca20b903d6f925873931b
SSDEEP 384:niZcIb38NtKVg6OoLbvzRfY9bYJAv+QPlLJQXmIkdP9IimIMWEfMbc+0sJb96wFE:Qb39vVjiJ/v9NHXmTWTbc+0ib96ft
TLSH
T1C6F2BE769CA18E3F8CFEB784714E7A121DA94133D5E81958C7DC6B0C81B655CA31BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 693d50f27106589aebbbcdc85e3d7b3e1f6346aaac96ed344b5b09dc2c9db061
MD5 16c585c7ed7de9eda017e2eff9359c63
SHA1 535b4a4fe8794b8205fad5f6f3d149c5b0e5876b
SHA512 4452f0db63bc9433dd04a1403802aff41532b9604459e254c8c12b317b6baee5b521a4d378f234418b939e870349a6cbb4c822fa24adfded1ea8739bfbe9d9bc
SSDEEP 768:brv+4UNbdk3M9jiJ/vH5etNNHXmTWTbc+0sG4:bbsbW3+WvZ87eWn1RG4
TLSH
T16C03B071ECA98E379DFB9684B44B7A537E7811A3C5C40B98C9C96B8C418B19D131BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 79c5e3e008caa44b79f2c9c5a885d8be8ccebea904d0728571257f8dafc979da
MD5 1ed8ed15414d25e611a80b69ef10eda7
SHA1 9024ff32ef58bc28e2a4ac226932737e10abdfbd
SHA512 815854bb6577a61cb554c72dc877c8fcf59998b1fb2ce2c4743a6fb197352fe1a54c65d0b7848e584bdf70ed7902e5894b773b3aa24a37b0866a5ad3d9954ed0
SSDEEP 768:frv+4UNbdk3bXjiJ/vH5etsNHXmTWTbc+HMZ9NDyk:fbsbW3HWvZ8keWn1sJDyk
TLSH
T1D6139D7D9C689A3F8EFEBB48650EAA262E680177C5F40598CBC52B4CC17744DF316827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 61bbf39ce5bc7f9cdc9caa30256ec1e893776abcdb4f1aa1f648b9d87bf11b72
MD5 fb302040f9ca3d7f4bd4cbb9a4476060
SHA1 2e2c611df79f7193d33609fe6da1ce5068752099
SHA512 4ee43d8fd39554f3501d5c30b4e7a03dbf74da5162a41713fc479a0c45fbd50df3bc8c84bea4116a28e47da7104293b32d89bcef77a448865f8f19e5fa19b509
SSDEEP 768:arv+4UNbdM3MR1iJ/vCNHXmTWTbc+/PeVH1SvyZ:absb+3uWvueWn1XEH1dZ
TLSH
T18A03CF329CA98F37ADF79688748BB6573EB9016389C40A84C9D96B4D428748D170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 c1fc01724b18cb892f10e06e6adeea9a8485ab8db308c9b17e47cc4eb3254905
MD5 7d7f23fa4ce1dda6d27b649c34d1472c
SHA1 f4abcc8fbc49c081c6bfdfb43579c0240f07456a
SHA512 c9d0ba8534ef42ca6f67f0dbe586b5ae7dc302de00b3b8893b80922517da20996c9950ec853747f0528fa235119ffe02377e398d109327d343503bd11825caef
SSDEEP 384:n6ZcIb38NtKVg6OoLbvzRfY9bYJAvH5etCQPlLJQXmIkdP9IimIMWEfMbc+0sVFE:4b39vVjiJ/vH5et5NHXmTWTbc+0sOt
TLSH
T12AE2BFB1DCA68E379DFF9A85B94A7B525EB50173D5C80A88C9DCBB0C018765D031BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 54KB
SHA256 49674dc1216c1951dc3da78c95e80af6f776671a71421be21764b45034d6bc08
MD5 185ce0dae86260a8e1602dff982d55dc
SHA1 bd1d1d55bc0b0fc2cf22f1437379bb41356bfab5
SHA512 c773f1767270a205f7701b09571986d0dcf4975ad6eb47f23950df16ea625db77fb47b69609112974cc88c8db8491be8845424b37449bcaead772c4f25c94571
SSDEEP 768:lFBb3AwgEvVKBNHXmTWTbc+hDFk23wIgWGg6mWYWtorOIozMASuxib96/lt:tb38eWn1hD223wmgmRWiToFoE7
TLSH
T1CA43BF76DC64CA3F9DFB5B80AA497A0A9CE64173C5EC99E4D7DC1F4C00A75AC830AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 889aed2dc507a07518f83eedd883c422417567a00d6ef02bf9c2a9e41a7e0bbf
MD5 c355cba6733235d8bc67278a664fd5be
SHA1 c28bdad4c20c6edf6f1fd98b9a3f229cfe58240c
SHA512 5a1f7e2aec7854636e45ad806b97cd29bee04d3c134de86ff7b2fada9f6fb51b51efe61e0662b1dc563940f2fd2b3a58c8e0995e400a878fd3ddf6e493c460a5
SSDEEP 3:MsEllllkEthXllkl2zEflPK:/M/xT02ze
TLSH
T17744041C7FC1040DC50010304051C3501374D4100511F75334D1C533DCC7D400F04040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

0e73a471-5ba6-4aee-a4c2-4e007dd15d81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\0e73a471-5ba6-4aee-a4c2-4e007dd15d81.tmp
Size 1KB
SHA256 8bbdde884f76a239161544bdc5dd38be45fcd38b4172bbe8630dd3f69056c302
MD5 bc4b668c701adc7329247ed782c1bd46
SHA1 ebe3892787b431850782dd1a2d4b5638859a4845
SHA512 23913959b3ba221f4eb9dd87ce08a8dd49eff4e204107e1b5ec8a1119d6c33a533fdece0909b21f80ec9f35299d0ceaa0c3f040332f3101b6a955189a380ac25
TLSH
T179311DE058391AC2D4BE0DAFB48B39FC84D8D326F5A430386898E968563E65E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 15d589c36d26b879ab9b6778f60b9708da588ead5d56887eea839678186b9c93
MD5 4f07be8d4ba4d971cab71ddafcbe2b70
SHA1 6b8f42628a5a5c3db81fa91582701e76515de3b8
SHA512 2c411a14d28fec7bc9545e9221d04287e99da7781dcb97ca1dcf40a8ebba498aeb75f2232eeee0851cdc4a254934c31244648cd3f0051c71edfeffe0192349b2
TLSH
T1D2411EE058391AC1D4BD0DAFB48B39FC84D8D726F590307828A8E958967D65E254483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0f4851d2d08fedaaf8104a0fbdc543c6f5a7c82fd67345db7d671b449362cfbb
MD5 77f71a1a262c4e86361de3a90207fc3b
SHA1 1c96628f1863ecce746b8e03e244004ff89393c0
SHA512 d32e215753da8220e7f2c1bd8d9b9f882706314869fa45afae698cfc032947bf8759f3f403076a1d8f69bb591edca53da629484ac186d9fd0c6d98d19b36c6c4
TLSH
T19A111FD1183A1EC2D5BE0EAFA0873AFD40D8D626F2E430B918C8ED54567955E215187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 756ef3483952cd4f6f9b80821083dfbdf9bccdec392e28a2854f00ab9fd415ee
MD5 a5d8f3ba10a699f2b50cc8c1ed38bf37
SHA1 6d425c4f51f9dad92dae1d394bd3ee6fc81d3e6f
SHA512 8f5ea964e29453421e34eba8b37e4acc6dc0b4b7c5f89b5fb9aebe6b034a36a6e8a0373193f023de0a7f66ab8862ad8ffd7ce6177cf2d479f623e035d2160c44
TLSH
T1512111E1183A1EC2D5BE0EAFA0872AED50D8D216F1E434791888FD54963E55E215187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3a81a4eee729978393cff7718a9d8a74fd3f6f122297e9c12a11b4658834411e
MD5 fa6015a8dc98e735976dc38a0990672b
SHA1 5f2e6427fd32691058b5ae21d18f6695efe6fe87
SHA512 d3f3db3b730235d6df3b555174dbedf1b51d5b0f5b0dba88e7a6cd2e8de59ade2baabb191a30d0a6b914411256972c8663b48057a0b017df2de09a08c241d930
TLSH
T1FD313EE158391EC2C4BE0DAFB04B2AFC84E8C326F5A434382898ED58563E55E214083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 51fa2add3b372e4d932d6926ca9be223a98d6ad3b63fcf099338f199d0a4ad28
MD5 0bc15719fed893a50e7e1a0840cebcc2
SHA1 b6b38e62996bd5e878b8bdb423c8908c2c7952d9
SHA512 e8025d1cc226ac64ba4fa534aa9a692475cc6f90a825329d6a12e01c23821f5e08fbdc188e3ec58612b5fc7bedb6f5a7f294d0f22467098763b8949281bee090
TLSH
T1D9011ED158391AC6CA7E0EAFA0472BEC44C8952AB2D834B908CDE8A4957985E304183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7f131d386f527dab6f8a4235038935e733d69317d35dc5eb69c52d96bf5b75d0
MD5 dd06dac0059d3cf25ad6de81afc96289
SHA1 38918b3e27aaa6d6adbeb99998847d2ea5649c09
SHA512 2cfd11f573eb223b18eb9882182d481ed6dbf7ec2357286c8210d4285f689d38e1e6cdce4e81f7880da9e59d1f0a7873374a7a32a0d86f20fb288f86fad7ac5e
TLSH
T1DA2142E0183E1EC2D17E0DEFB0472AEC90D88216F5D434792898FC64963E51D214087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e56e2e8c12c30aeb3647379105e6cc00fb874ae60db91a7e65912c81acd272cb
MD5 4fd39e59059f75a9ced12b25de6be901
SHA1 d942bc4fe9fe1f73e1bbe6647bfa093ce7449556
SHA512 23ee132546b4ee2a51fa5a3c985b815d25beaa211114e7bf11bd3d405e3225c8d2f048f8c898338119b29d18f39f785fc26810ae2e4fc11137d14bf0526a1121
TLSH
T12C3122E1583D1EC2D57E0DEFB44B2AEC90E89216F5D434382898FCA4567E51D254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 6bbc409c6c8e5287723de210e3463bc9873d0adfd3542a753ad8169fa6342edd
MD5 a4942446efe6c44ae76e03f049f85743
SHA1 501f2a79ecaee0f14e1e17bbd93516fc73cb8cf7
SHA512 b8cb3908d88cca44b260e44c81f0a093cb6b4c92d9225a93390f336b886fd571202edb51f98654dcb7c80c411f600f090de5af458ffd3adcea3b636210b7b69f
TLSH
T18F1150D14C3A1AC2D67E0EAF60472AEC40C89626F2E434B808C9E854517945E314183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 4064f883ab03274d942d9669bcd8d2fb6cdbe53cae07e7c3c45eedb4fa0ce127
MD5 3d7f13d024e13960d589424710ae35af
SHA1 84cec1f45f7181378af3169fa664f2ef1630e695
SHA512 7fc51183bc0811cce4f00965b6c8a3874b0fc32432865df5d92b419cc72889a834c7d01b69720d627448553d9bf07e1f20998b00e93d2170e102da3db578bf2f
TLSH
T1443120E158391EC1D47E0DEFB05B29FC84E8C226F5A434392898ED98567E55E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f02a7bd3b771879961428f883cc74267f62795d12233237f35bfd3c4c48dce64
MD5 720cbaa1daf0bfa34c779a917c251458
SHA1 9a1b20164d36666ec94e22b20126dd9575b62556
SHA512 0164a6059883ed2f1bbf4e316e5808af07034fa8105cecf6f0e3fcc82f35ae4b4d501b06f2759e8b2f3529eead2bd23618f463372eb60c33d1e955e2903b6780
TLSH
T16B4141E04C391EC1D4BD0DAFB48B39FC84D8C726F5A4307868A8EA58563D65E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

91445eb1-c5bc-48d6-a884-97700b6727e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\91445eb1-c5bc-48d6-a884-97700b6727e4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cf5e5a1-97f7-420a-8fcb-0f9e3aa0f114.tmp

Path C:\Users\Admin\AppData\Local\Temp\9cf5e5a1-97f7-420a-8fcb-0f9e3aa0f114.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 9d9e4390ee2adc4ce9a8dff71680c41dbd1a697135ca8cfcf31dfd321b9b7526
MD5 1f3cc9df487f91f1a9af117a2b8ee487
SHA1 04b7f3ee66c0beafc409d7af377d178a9c2bbe30
SHA512 dbfbdff01a4f8aae2c9eabc3f971e68143607a7c82502285c85b90b496fb0f4c4bf167669384a0e1c2bde854b391c99b084a4dd3fc42c6da9162ea98d23d4fa5
TLSH
T15A1165E03936727F53CB8BD490224C845960F946036BA66CDA5B5030FE1CDA0635E3CA
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1800_1765578280\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_107665555\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1800_1449350591\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download