d14dad8f52b87c4b0b6e0a9fdd11d5a17949fe616c7357723c89d38e2c5378f7

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KryptonPlus-zixvy.jar
Size 5.0MB
Sample260730-tyjcmssbnf
SHA256 d14dad8f52b87c4b0b6e0a9fdd11d5a17949fe616c7357723c89d38e2c5378f7
MD5 bf0c81aeab6115722f545f7dda5d4095
SHA1 ad07860f00b5a14429849d9278081631b4ee0f9e
SHA512 b48547b0520bbcfbc27c6749cc40ff4ff2d93851b168cb1ec3be2b236af68e5592bd2d8c64cc3c84503cddd02e93419fadda89c2cd194f3295e9403b9f7ede15
SSDEEP 98304:tb6FR4hcf8ymjEg2tZtQj3lWqloTFVOAqT9ZZckCvxgUTRKdOAdvu8:teR4mfD8W/FHCCvxvTRK9d
TLSH
T1EF36332AC79C67336C2A36FE7DD147CB093CF14B4E5F628EA48429EE3C499892563471
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4324_1030024804\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1913039974\_locales\id\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4228	msedge.exe
1924	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299025806582016"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{D6532847-C01D-4A74-81CC-E66A61FC9DB0}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{D1A4C8E6-BD3E-489F-BCD0-8CB4C9CFEC8A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
856	powershell.exe
856	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	856	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4984	4324	msedge.exe	93
PID 4324 wrote to memory of 4228	4324	msedge.exe	94
PID 4324 wrote to memory of 2092	4324	msedge.exe	96
PID 4324 wrote to memory of 2092	4324	msedge.exe	96
PID 4324 wrote to memory of 2092	4324	msedge.exe	96
PID 4324 wrote to memory of 1900	4324	msedge.exe	97
PID 4324 wrote to memory of 1900	4324	msedge.exe	97
PID 4324 wrote to memory of 2012	4324	msedge.exe	98
PID 4324 wrote to memory of 5824	4324	msedge.exe	99
PID 4324 wrote to memory of 2012	4324	msedge.exe	98
PID 4324 wrote to memory of 2012	4324	msedge.exe	98
PID 4324 wrote to memory of 5824	4324	msedge.exe	99
PID 4324 wrote to memory of 5824	4324	msedge.exe	99
PID 4324 wrote to memory of 716	4324	msedge.exe	100
PID 4324 wrote to memory of 2972	4324	msedge.exe	101
PID 4324 wrote to memory of 716	4324	msedge.exe	100
PID 4324 wrote to memory of 716	4324	msedge.exe	100
PID 4324 wrote to memory of 2972	4324	msedge.exe	101
PID 4324 wrote to memory of 2972	4324	msedge.exe	101
PID 4324 wrote to memory of 3444	4324	msedge.exe	118
PID 4324 wrote to memory of 3444	4324	msedge.exe	118
PID 4324 wrote to memory of 4140	4324	msedge.exe	104
PID 4324 wrote to memory of 3308	4324	msedge.exe	105
PID 4324 wrote to memory of 4140	4324	msedge.exe	104
PID 4324 wrote to memory of 3308	4324	msedge.exe	105
PID 4324 wrote to memory of 4668	4324	msedge.exe	107
PID 4324 wrote to memory of 2128	4324	msedge.exe	108
PID 4324 wrote to memory of 2128	4324	msedge.exe	108
PID 4324 wrote to memory of 4792	4324	msedge.exe	109
PID 4324 wrote to memory of 4792	4324	msedge.exe	109
PID 4324 wrote to memory of 1152	4324	msedge.exe	110
PID 4324 wrote to memory of 1152	4324	msedge.exe	110
PID 4324 wrote to memory of 1812	4324	msedge.exe	111
PID 4324 wrote to memory of 1812	4324	msedge.exe	111
PID 4324 wrote to memory of 5188	4324	msedge.exe	115
PID 5188 wrote to memory of 1224	5188	msedge.exe	116
PID 5188 wrote to memory of 1924	5188	msedge.exe	117
PID 5188 wrote to memory of 3444	5188	msedge.exe	118
PID 5188 wrote to memory of 3444	5188	msedge.exe	118
PID 5188 wrote to memory of 3444	5188	msedge.exe	118
PID 5188 wrote to memory of 1328	5188	msedge.exe	119
PID 5188 wrote to memory of 1328	5188	msedge.exe	119
PID 5188 wrote to memory of 5468	5188	msedge.exe	122
PID 5188 wrote to memory of 4560	5188	msedge.exe	123
PID 5188 wrote to memory of 1988	5188	msedge.exe	124
PID 5188 wrote to memory of 2092	5188	msedge.exe	125

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\KryptonPlus-zixvy.jar
1⤵
PID:592

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\WriteUnregister.htm
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ffe99ccc188,0x7ffe99ccc194,0x7ffe99ccc1a0
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,15595450578790981605,4411188662520923361,524288 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1920,i,16608518267045446177,12132601878428293926,262144 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2668,i,18102533060140877740,11479186559364847275,524288 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:13
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,12026557093484667862,1023542305287110264,2097152 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,6514041935167084001,11360372358170212676,2097152 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,13990513699147744103,3696101717318002236,2097152 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,9177814027623665055,9854499257124875212,2097152 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:9
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,1600915561929859450,18373465781022578262,524288 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,13415410947364265817,14090891016278880189,524288 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,11720223072037854793,2358663216087930204,524288 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,10620496616607582390,2243887138620946932,524288 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,10620496616607582390,2243887138620946932,524288 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,3855917796514561629,16328421114428219536,524288 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,4376899223579885500,13049401740670967351,524288 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,9898646372987147247,4977118268168693052,524288 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,15741465283628479912,6741009420157109929,524288 --field-trial-handle=2288,i,14293781469717513577,12793985700281151599,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffe99ccc188,0x7ffe99ccc194,0x7ffe99ccc1a0
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,9449169897182354168,15645179387044140364,524288 --field-trial-handle=2592,i,14604073015797989235,7622310743328241081,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,7682857799035975860,10629460324563732813,262144 --field-trial-handle=2592,i,14604073015797989235,7622310743328241081,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:2
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,13868773568311973891,5569103935558486281,524288 --field-trial-handle=2592,i,14604073015797989235,7622310743328241081,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:13
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,221456917926715049,2552297330308722787,524288 --field-trial-handle=2592,i,14604073015797989235,7622310743328241081,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,221456917926715049,2552297330308722787,524288 --field-trial-handle=2592,i,14604073015797989235,7622310743328241081,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,8936827267379227787,15885212356505664750,524288 --field-trial-handle=2592,i,14604073015797989235,7622310743328241081,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,15248330014961037097,14326283746190074525,524288 --field-trial-handle=2592,i,14604073015797989235,7622310743328241081,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,533054243056015227,10135509888651354654,524288 --field-trial-handle=2592,i,14604073015797989235,7622310743328241081,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
    3⤵
    PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4252

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9bb02e5c3df0fe5da83794bd9fdfc835234bd8051ebd671dc536fc72b521c60f
MD5 1518285c968ab72392c86c75a8ac2a2a
SHA1 8fc3874d30c34841870f1b306694e5b4ff0ac295
SHA512 908df4f740c1becb3f92cf0fc9a04e433e63c9c814f694281b9aec9b65eb60564d14d427617215ecd3564122c459cc98464217d15b9dd5cbf115803275a43a97
TLSH
T12DD023B07529EB80CB0D003540245A00322A82323CC7032399917C0CCD7D800D3DBBF7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b5b369bc5b1f0e5824a13ba2eb0e1fbad23bc2955074bfae65fd624e5741ca27
MD5 adccf9fdd0a90036d28cbd2af59d8799
SHA1 d5ed64b41be7f0ef983466e210499c6b3782c7be
SHA512 e586880eb5a7e33a92a27b5fd690ac4d3b9889bf2fb1ab933f8a011dd0f06234889156192348a5729b8009027649db6295f4f2d470a1ce1a9a246d783d4f0583
TLSH
T117D0A7B476299901CB0B11315514D661335683647C8B967385A1740D9D7A850D69E1A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 dedaa476b6800f46cf048b937e36fc96375a1d0ea2f6b44dfb4f7aaf5dad90af
MD5 f77250967e4cbdd3e27a1b42bdf70b38
SHA1 197e381e05f6b910bbd79b9b2f0bc29b3e9a2946
SHA512 17d5f64d0ed43d9422b54f160333dcb876ab9841aa0649be9f67c5e7f5a0f64eaca56a84ac560eb2ab554c1c79d8738734da2c62b7affdb5333721f2c25c5458
TLSH
T1DBE02B96C822ED3729FE0B5C60414746E74023673A50895F3B3FD2098FB063A169E91C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 76fa7fa30006d05e87a996ccb8c3367ae7215ac5879948c9cfa0f2736d29cd5c
MD5 aa3459f11d823418f5a549047eb8ab16
SHA1 3ab2b4e1064927176d2f1bba12000419a58b832b
SHA512 b9a0de265b9fcd494d800ee94162d64b1d1942da7290bd2d7aea9dc54b62dd73cf1d836b7f1ae961ed9c33d82324e5c3940d4c3f8899804824322c163191e5eb
SSDEEP 192:W+4cRmvu8CtKB3B4Ca5Un+f9/G9/9/x/i/yHfM1DQSCY+HGKtHBTO:6ymvJ/x4C2JGxxNCwM1DQSCBHGKthS
TLSH
T1ED131BBEB6165C82C7E702BCC05B0FB08B75F585CAE08A235E38B0462A59F519DCF957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 1d7872cc66949233c9b81a952e4181d020d12021eab8ac00f691457ce95d627d
MD5 2a95f51cf0cf7c454e34ff8d957d2545
SHA1 70174f396ec9dd8c6ee2a03449cec972d9590a1d
SHA512 36c29af06cf94adae99ec1c8990403ebb67a75cc615fdce8b03ade5c0fb86603878ca04ab723f5a0826bed8c80c06aa12dceb89f9bf0042d5e95b075ace271be
SSDEEP 1536:ZSYMgL/O5L/j31iaL6ikPp09Y5aoD8lzC:NMgL/mL/Bmv
TLSH
T197443DF71961601BCBA812F5E2033E3DC17B851E6DD1E9A9E57C4C812825F22B2FDE85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 304f40c94c6ef6bd7aedd5e37e25479f6a721c09ced74721dba90f44cf0930e1
MD5 e5434874d23e46f824529863d9a684c3
SHA1 f29f27cfe91ef4f6745c89a2773eaa819826bc76
SHA512 cc6eade94e5130e7f6c0f31be0ff8e3cd0a22ddf98da236cd4dca19fa138b86bfb4d01fd226fff63afe63cba7a297fe394916988c4d2e4075d7a0b70f3c78515
SSDEEP 24576:DHciZaOkXifejCmlADOdZuJqXQxJ/74k:D8iMvXcRD3JqXQxx74k
TLSH
T139167DEDC96858C3CD639A30B5F0E9877CB413C3F594C1D6889CC584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1c14d5ab530104c290b4ee686ca5de6dbdf33c004c9521384bca4e89c39e6044
MD5 68bb5fd777aacd3acc307dfb5cb036c1
SHA1 ff1d34713e271759161df6f0a9322a10d1871afd
SHA512 1e23c203d1887e80692a4a9640994d68e328b3b60f026684db7ecfd46f22f9578cd47ade47e6c9ebb71d5962f5ba55a3ad62f832505c049d0a4bc6c7389a025f
TLSH
T15C6109615F141A93D72351B6D1E3836B37F6B76E420B1A235C60BD38980AF9494D25E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b2cba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b2cba.TMP
Size 3KB
SHA256 61998944e1c348bc47d058720425776eae644a569dadd9a8034df70099fef263
MD5 c1c73bb439c58b07b772847df45f1127
SHA1 99bad3c667b8f47c127067bd1783509257c3efea
SHA512 821fbf0a0966e7149199068c4b47c7fd372333871dc6548e07be63922b0f608fba254e8da67da7386b96f7056b9ccc5ff3d087bb52d407c387059937f547f806
TLSH
T1C76109615F140AD3D72352B2D1E3836B37F7B7AE42071A235C60BD38980AF9494D25E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 ddd9d3fd3e9407d9aeae427c71c0bbc91cc4db2ea6111ebb0ba8e34e547838f6
MD5 2882e1deb2635a4ca7f5dc60e428749b
SHA1 85c30635ecccd98fa752c92126760e8d4cac382e
SHA512 c3863e1d5b900b16fb1b22397b405e1745b2af38aa986ac2d0e3bb9f959cff66907c923cb43d931d115b9212a187e1a06252f5b2a9dd1d88224f5aead5f4252b
TLSH
T198E0D8D5D4CBC25DB51C34874264A798C3D57447D6D57EC3270488C07642041B7C668B
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 6cd12a8fe182a0ab95bc79eee5e9de48cd26e4000cde8750336d7198e0c8639c
MD5 cdde50b738c0839a82358dc2e60407db
SHA1 39cfa3c2a7d17a854e174f23edfe19e3033a0d1b
SHA512 40e53c213b78071b6e8d729bb5d89513b16a36409a910b44029ec153c006ac1dde0e39a23c75a51718b57819334f59d7546f6daddcefe7311242cbdffd4235e9
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj2ZQN:TdD4jJ/0UC+lf5KY
TLSH
T11AE2A04C3E21F511C4ED733CA0D2C5D09EBC647C478DB67142386CA68D52AA2F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 aafe910f6bc383e185e9769de4c5bbd08869d6ac7d046bc8a60c417c8d04f01f
MD5 fb40385caa16cd4fba77213932e43004
SHA1 cfaefbb596143e4fdf904a1b287b5b2a294718b0
SHA512 eef5ac8c3f8fa3bd0ed4379d530695d9e006fe2a48e55c28f59768944169dfbfa27543766524165dacd22e95851ab465f33b83bf243c773f3a6a00e8edc87310
TLSH
T18FE0268884CAC22FF15C689783BDA748C7E23423E2C83956170E88507202241A3973C8
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 851856412d23324b45f9405cce0e6b522d35d4bcda5e66ae3ec2a319d0a2ced7
MD5 790ba64660d5ee9ab6714246190a102e
SHA1 3a6f6276fc1a98716d6baa830bab850945582092
SHA512 fdd48a697b860978b73e6622a525afe0734583319a0321c996b9c0319ef28ca46c5ddac916706ceb6b8613c160c5c655c555d46339cf411cccbf402c75a4b680
SSDEEP 96:r94kDUt/VtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/VbubbEOVpZf24JkMfXSq:r9FWKH+bF+UI3iWGVoWN3qL/5oVVV63
TLSH
T1FA24001E5F352722CDBD913668E744A35C7DF03F8B1326DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 336f0d2cc467339c5d4695ac9a976316f36f6685c0d2444039d07f701ba1ed4b
MD5 bcff71de2dd2e26c4c8cdf705c49f1fd
SHA1 9f3fb5a70930b102c2035d04ad6e27816ee86883
SHA512 d86d39437e6d7fe32d7377b9d28567f28e29a1d6c1f5aa6f52d48ef9949fdd0df624dc7c4afe40c040223f0f623d03dbee6ab44a7e3d420ccb878405c68b2777
TLSH
T1BEE0DFA884CEC22EB20C209BC239774CC3B03487E6C86A929F05A941FA42104E3826C6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 db2a7ef902dd492d13c0d7772731bb42a878f461dcfb726d33f40a524703789d
MD5 581f36300890ce7f04c6fc9f30140373
SHA1 5d7725e5de402ceecaa9f4ca3a77764d4c148e7b
SHA512 3997e084aa69e9ad49ce37afec5328451b4af4839a39dfa01f2c6a2941e10fdb7623dffea07100b78f8e406f5115dca2f21c6e50cf5b1cc2daa4d1effe1538ac
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7oBwqL/1+phD:qDeMatha9RAtXL/14V
TLSH
T1A8B23D0D5F307221D0F44B76EDD1856B2E7C210DC3733689EA5420F2CDA2AAFF90646A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0bc3e0c18251aefc7b07bcde5ad87ce1729e51243eb5cc1eda9292cb73d1f033
MD5 330d9ff0312edc8d633072bf17d41e0b
SHA1 ea059f404ae9501f9401df7ec69c223ce6ca457d
SHA512 001a97e935349cd06bd6744399754cf35551b992787b07a947d328aa5c4a7322b8f738dca6fc0e2b5fd0a0f0b0c23104f7aad200b14cb616ff7bbe12af93bc08
TLSH
T14241ADF3C3E8856D890156F4AB186E2BCE2D0915932C3D5AC9E4EF2B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 997785655a7a683f5581f6f356b069a72310776642a7d43bb256151e6bf15ded
MD5 634b5c064e1dce50c11acdfaf4cac87b
SHA1 feaf1dc13999e67abd62a7c4c83a3ed85461378f
SHA512 db42345b9f95095f8f55effa3b7d79c17ed5b7a521bd7f83adf35db05f80b1c60a15ef566b7145cebda4cd72d37f3846ad1b0c2b31e6a0bf9731c3d8cbc7d2ba
SSDEEP 96:OIEumQv8m1ccnvS6EeRj4tgbb6f5nFXX454g:OIEumQv8m1ccnvS6EeRVAy
TLSH
T1F8F2DEFA07276106D99484F0E4009FCEAF16410B47B6B6EC76D447E3F7A20E2B1B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 186B
SHA256 f515401030a083958bb22453e2c354b0696d41916f86b81fb487168294d293d1
MD5 7a742be01cc057e4d88501f374f72dd6
SHA1 358499d0d92b1dde51cb59de8911c2ec00dd2835
SHA512 e7effb31148371a59e657b876ed44f5b6103e6e3bf871e992f091a8271394dfffa1926292ec5670a367e59e7a99e2e36ba18f5ad36c3f63319f159d9a1f105a1
TLSH
T1BDC0129284FAF8732038497D1A8468816A79D839108154B5DD99833DA0904F75B1103D
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ddc629a3892f96ada320d71f5bef0f847859ed8c4511dfbebd40da1244948def
MD5 fe3acf2f492a6f984fab045d6dd2378d
SHA1 59858c74ad6f1872da2e30bd7a2e7675ab9d73ba
SHA512 5b8cc62ddc03e00b41889adbc44a0aceffdce968fdd6cf173a1ba4387480cde35d4c3dae7007d53932a107ca4e3ba20325d84e2070455df9b2bb7133e3d1e349
SSDEEP 192:sxRyRqCE/fNs5WpVVfGZ0by4r58zoD8p41/g6+WNIYKjxnkZGKIgV+qLJ:sxRyjE/fNs5WvVfw0+eUI/5IALL
TLSH
T14052B81AA928993B9DC7D21DFB557F63D6FD5032A1906E48E6FC8A0C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4ad913ae134a1567d09d4ef910deabc3785d6c5e2803aa156e6d943261c426ed
MD5 600a6cc4722f05f0de69041039040c17
SHA1 fa72bff6a492ede814f0680ef02087f2c5f40ff2
SHA512 4a70ced0f98bc5a4968f6e1fa8fd39d6f3fbc78af151f96a183dbe2f926c4bec774fd77208d52dd7dd2b3d3658d5b57c2a7e502a84ab0126d4ac6b9a1ee73426
SSDEEP 192:sxRyRqCE/fNs5WpVVI8GZ0by4r58zoD8p41/g6+WNIYKGNkZGKIgv+qBHJ:sxRyjE/fNs5WvVI8w0+eUI/5I5LZp
TLSH
T11C52C81AA928993B9DC7D21DFB557F63D6FD5032A1906E48A7FC8A0C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e4d30be595f9e35b80bd5476436cd43564c771f97686bda0b5256e0378dd0d64
MD5 bfaab1a8a6e1a2b73e08fd8ce1e15c65
SHA1 f6a8c75c54d1b8c0b0e3954193acf99b5063825a
SHA512 afffadce5d66b864c26c9523894e65dcf5bc2f57784336b9d5ce9284a2d2f3b1dcc8c64c9c82b70b83b5158682f25d4438a5b3f56a17e7759b3e84974481d117
SSDEEP 192:sxRRRqCE/fNsTYWpVuZGZ0b/8zoD8p41/g6+WNIYKjxnkkgKIgV+qLJ:sxRRjE/fNsTYWvuZw0LUI/5IA0L
TLSH
T1D142B71AAD28993B8DC7D21DFB657F53D6FD1032A1916E58E6FC8A0C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bc82a1feb415b36635e5a7c7269f509e4547f2b5677928e3382828ea34b8689f
MD5 ba2d4310e9151a0765d857b8ed891e7f
SHA1 d549c94f273b3c27732feacba9ec4193b09e2364
SHA512 6113bdb7162e12220657df0431c642d5b5582cb9154795a67be2f478c04374b89a29f3ccd8478a3393bd9e4a1d410e5f0a85d2f3f06a976bfb0b2758adfbfa23
SSDEEP 192:sxRRRqCE/fNs/WpVVfGZ0by4r58zoD8p41/g6+WNIYKjxnkZGKIgV+qLJ:sxRRjE/fNs/WvVfw0+eUI/5IALL
TLSH
T1B242C81AA928993B9DC7D21DFB557F63D6FD5032A1906E48E6FC8A0C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 defd92bd0285825815943351a3782ad78c4db9baef4d6b0e81218ab398183baa
MD5 9ca377def0ecd393425ab3858bedcc72
SHA1 d83c5caf303d522474afb9ca5141bf872176e3ff
SHA512 377d999cb25012c4bbe378bccb049135a9011b1a519e7ad32bf3fafc6e177cfaaea25a6ec64a60b7fec819e1da4f9c0c3230e8a45f62db1cb58aee119cc02d93
SSDEEP 768:UQYi/97pLuLfONWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcj5pNKmroY:UQYi/rEfONWgv7fxJu1ja/j5fKdY
TLSH
T186D2EB7B640CCB7E4F804A9DAC197E9F6DA802CB96D8CD8047FE951C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 7dabad1ad7be178d0d2ff31ee773ddcd0cd2c6ed0dd6896edd26ae27f9104fbd
MD5 9c59877cd58519f3dd4f61304ac91f78
SHA1 adcabd0ac252f5f7262ea9eaadd21e5b65cecbe5
SHA512 b2f956bb39d40e470218f0f009d576c321ac2e3bb3e04f50fe3eb999a836ad4bb887d2fd290faf3d74be20e8d6a2493743b1f19469dcd6f76ec3deda9f1b3e38
TLSH
T1BAE0DFA486CEC27EB05D70870235A34CD3A4B40FD2CC3E822F05CE446283908B296282
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 02e772a38d008e60cc7310d224f2695f6497bee4ad52987230659daff2c292ef
MD5 454521570615dd608ff1d9d311074bd9
SHA1 492cb6ff7675352c1a6c714e6f1d263ed5514971
SHA512 84944e801ac43252236b757af808750de9655d57d09d843533f85d74dec4d582de45f68374442c161b545a3b754df4e7ac35f1a708d0aea4052a7b6c8e468bb1
TLSH
T126E0D86457CAC32FB14E308F4335E75882B27407EACC2A612B09AE407347540B34B2C0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 843a830c81118ac1f2bd2fcfeb01bc40517270026562baae25ae6dfa8e2984f5
MD5 ff2702b5c499f34ec28a91c0fdab8c60
SHA1 a414bc611eabcbe716d79fc5b0609a93aace5d36
SHA512 49774cc7c9cd743a5eb59d293e8c5434e3828a770335d13365027c7e98666dfcffc0df2418c7df4d64847569a443687b46c112b71b265f975b3b17a5132144c6
TLSH
T175E0DFF486CAC3BEE00C70C34276AB5C83B07807D7C83A865B0C4490B203500B3AA2E8
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dfe7292ce850914606d8677a15a677c43e8c95a70d6b4d41606726459e71b7d4
MD5 179715028b798668fee67ba04abb088e
SHA1 8556d32f8b7133221b7520a705138566a427b8be
SHA512 514d3c5241adbdaff1033788c8d71fc232bab6cd81e4b33f29ea6d008c7d3639854950d0fe99a165f0a1303a188974022308b0ef5806cd1117ce6379921916c0
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGl3gYK5m266UKry1:Cm7KmgIIJ4tWGm7g09OGlQnXI
TLSH
T1E081DC55723B0384383D798985B6C52F92D27063B018A57BBBB850BA2F27E064DFE5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1db56e1a1d34b135c264f5829e6926a39b9f6232edc9248eb4d1b306d0f9046c
MD5 0df95c255e7358f5e181a9bbcd1d4d4d
SHA1 c808a17052965f5dd3c26b3c58877d1efa94e5dd
SHA512 59a7dd707d4955e20ad7e9989a6ad97f18129a94d0644b98bbd5bdd8f46d1db7c0f99256c24a27cd9360ad224aa9372de19aa97fdcb50d678481cdc2c7b0475d
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGl3gYK5m266UKryy4YK/:Cm7KmgIIJ4tWGm7g09OGlQnX8
TLSH
T187A1E045723B0344383D798985A6C91F92D27063B01CA5BBBBB850BA2F67E064DFE5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 9efd9bed5da1aa27f75f783bf771610b9f0062777dbacde4e1a9d1dabbb6b204
MD5 ee65186ea08ee95d2f4ba97eabda0813
SHA1 60c174d407856338903861d8bdebcde3d39fc2ba
SHA512 aa70517e51c72db1f3160a32dedc27c1f110e6fcf01373c540f7a09b4811b2b1828da247ac4098041bbfae055873f8713573f4ffdd4fcb885be1c7659ffb8a5a
SSDEEP 384:DNrRZyCSDnxTICNXMEhIKyll7svbFKfk7:xFZJSDniMcyI1l7svbF9
TLSH
T10244740A7B747001EDE6D9725CB080771E3CB16D8F22A6D16DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 99b45c0e9019884b44853d0b047c6dd4304471e996c5658ba39d0ac5ad9e2c64
MD5 d66fb76c347171149f1f2035e41e9e96
SHA1 61be9e65bac5cbf61fcd843bdd12af84f9d212bf
SHA512 357bbb7944752e1bb52c2e9efe8eb5425ac5a4772108926074093f999bfa8278ef8dad2dcd18058b7924dc42e32b19a9b999054cf675fbbbd1d3f15f6713f676
SSDEEP 24:LL0OGxhK3thdkSI5QjUsEGcGBXp22iSBgm+xGt:zEK3tjkSI5IUltGhp22iSBgm+xW
TLSH
T1A452579BEE743212DCEA83319AD001E17E7A903D8FC1EB0255D610115FB5691A71E59E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 337B
SHA256 07251b5f89616df15f9f61e260a4742e1b6347624e96b260e0cf1b3f1d811fb9
MD5 327f9395dbc70c0eaac16910ccbaf79c
SHA1 2623d471f95ae6efe2214ff6639b0014cd940ae8
SHA512 25efe60a5a8a3a0001211e23b4fd18426d751d605d00f75991071a8f92ebee30d886f5b2dea8173fb399de6e572c5a90a640d725944a12542607756c2d8c2fe7
TLSH
T19BE0DFC0232B21C97A8C9A82C6166803A0E47E62610D04F1772984BC4B4980E0AEFD3A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 11e334f34698de11274ba3a52b6be0bc9cad2c8f45106106413c5df53b3705c1
MD5 d745f1dd018f6460787c1bee6e079c2d
SHA1 f6de9f683aa9c08853d246a15166c00199cd1059
SHA512 ecf2998760ac02517f92d0e992bf6f6fd5251afaa500b746d794179480b7183f8a0fc927f46556dc78efb904ee3d88c2a1f0d0f9c719ba9dce235e3268161845
SSDEEP 192:VQfIII+beMIM45YcY/06O5BAsQl9hNssU/2/:VQfIII+beMIMSBTx5CsS+s
TLSH
T12642746E1E111BB7C46F9B37136682449BE848C1447232AD3193AD0F8DF7E9B86D52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 02d1473c0e4f32f66131d4db91ecff5bf93aa39aebfa325cdb508c6ff8f8c88c
MD5 665afa9f72047119be783d1f2aa103ec
SHA1 da1c505e0453b61c7ba5e9926f205a8dee6a6456
SHA512 b281b1052cd3cf251f871ee0cf80da532589c12cae7b4095aa87751bc61de662e0eb8c40ff3e14020c776fe29ebafe0f1357b93bf2e7d58b886300a9fcd5f7fb
TLSH
T11EE02694E8CAC2BFF01D208B01B9D78C83A63853EAD829E69F09C444B206100B3876C9
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 6c46f98f322c24431d358abbc9c3bf7633e4450290b7ab10d43832d9615fd0a9
MD5 b62f59bfe0f7797c0a1a17c7ee23792b
SHA1 f286a17d893ef167a86257126657f920798565ee
SHA512 574f319ab1b54330ea8225accb3f1e3a2ad30bdff9a59de115ff6ad20b81e912768d63b7af43a7c1eac3573a2ea6488d7923ca76784c45d0a0e4d51959f338c6
TLSH
T1A121D695F330C149E15E867D943E9B3A1739D8568FBCED0F447920346E72B040E4B6E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 007c6b3dfaeac0bc06338970e20653484860de50bc3805767e6090f7d4723c38
MD5 15f6f3089faf573c866927782918bf2d
SHA1 c9e70d44b813785299f9cc739dad212f13dbc1ca
SHA512 147b2132f1140f32b72079e59e02db908bd4d49d477c4bf4f1bad88135e1c30bb359f820e29800badcd0edf0662dfd17e0b80201c8d651b5d39a17e020278a5e
TLSH
T102E04894A5C5C25FB428209317769398D7A13847EEC42F573F0789546602185739A295
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b2f0e4108833c0333b828de3878fc651d69b8e3d3afcb126eba4f6bc1fff0414
MD5 1f708d796e62b593e340148008f3d2f4
SHA1 bb90475a782f85aa32b582c926a0bd36207e4289
SHA512 777640b89ba316db50944d29dcf9a2ae7a11ebb118958b2829c3e68044e34c9661047cec954b7874296bcdfcb77210435d6a5d21a4fc5d9c9a14954e247f498a
SSDEEP 3:MsEllllkEthXllkl2zEfl4hqlt:/M/xT02zVhql
TLSH
T1364404147FC0040DD5003030F055C3501371D410051157C334D744335CDFD504F10404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 aef8800d1ebd44f3ee83c011666936eca065db1bfa65a6f307c4d122f08d37d1
MD5 c84ec50a8bc41a3ee5060e79ca6ad202
SHA1 e0f0bd1132db957568889821668c492e7de83fa2
SHA512 1b94b543754f5990367dfb4d8947c978e7fc880e97030805119fe75aebc44a3ceca35465dea31e2df2487ef76163edb370d840b2f9b5cb509cd7fa2dc46d68a1
SSDEEP 3:MsEllllkEthXllkl2zEflEUt:/M/xT02zM
TLSH
T1704404147FC0040DD54010304051C3701370D410057157C73CD154335CC7D404D04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a1781b4a12aad9e2ea73b14964cc7c14c454615a86f7a3155d73a41c2580132a
MD5 268e04225086345fbde2707d17972726
SHA1 d62252add1058385d23084e35c9a51c8d93c48c5
SHA512 666692b6fd0616b54031adae1c7744d741b8d6038d6c1ad5abc5948ca9e9616c55c4c4f3e098396f6dd1d76a4cfd40d3f62ec0bd7288b0e39a56e1c7d8eec764
SSDEEP 768:rdF3f68qlYyr0B7Hucys6BRvi82oP4/z6himoxBb9MQ:rdF3Syg3imOz6Imofb+Q
TLSH
T1B5F2C035EC558E72DDABC295B18A3BD27EE0127396CC4DC4E5EADB0D0583A6D071B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 be02f8652a7d9710260f59798193147e569c5157690c67b9a90508de1d90dcd8
MD5 ca5fe789c42f26ac7ea5ff5fd105c77e
SHA1 9e95d17917860b6e4df54eeab93eb809be1709b7
SHA512 31a44964066f2de501a02214b278d392c958c1c36d1bfffd200b54b991979bf2f44781d7b58a121e8db9ca1426952f6ebbbc70503ab27232cdfaa8223e3bf670
SSDEEP 768:xGrv+4UNbdS3CsplYyrq7Hucys6BRvi82oP4/z6himo+p2bwn+h:xGbsbw3Cq3imOz6Imoe0w+
TLSH
T1F503CF36E4188972EDE7C188B44ABA937FF4526345C95AC0D6DE6B0E428B95E130BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 68635a32ac9fcd559d601fa062c61decfc5dc6752a91d715cb22c91787e9a1c2
MD5 000c9b3d170493d0c4b1942708e7ae0a
SHA1 459c1a742e47779f49b128b6ad044360443dbe0f
SHA512 30f9514cce1720d482f1cd6888e0b811920d7cae540cd20c9923563f2a2afb76b25950e2690bf152a86521f8940abf23e05a809442018f668b012e515132ed01
SSDEEP 768:gAc3p6/qlYyr0G7Hucys6BRvi82oP4/z6himo6gb9MC:gAc3kBT3imOz6ImoHb+C
TLSH
T19CF2C034EC158E72DDEBC259F18A3BD27EE4127395CC5D84E5EADB0D0583A6D071B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c71c36c5e165710725ba17d0d63b5ea9dec57190b5f45dc92a9c706053752407
MD5 3099714b2fa7ae31134152518ae0f955
SHA1 34a8362fb98d9ca8bad696ceb6315d0517926f40
SHA512 aaca9c23c9f2a7754d5912917954c6482f6134580720a082cd32b2f3178ed0efeeb62bef32a22a4dc5df1bddec60669b0776e094af3b599de2963f537485f511
SSDEEP 768:gdF3p6JqlYyr0G7Hucys6BRvi82oP4/z6himo6jKKRobKb9MC:gdF3kzT3imOz6ImoyKK6bKb+C
TLSH
T173039D3CEC518D3E8CAEB349714D3A626DE44233D2B85998D7DA9B0DC1B796DF306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 2e561e7ff03ca49ef502e29b6a598c362477aff611277c244960345e3d0ffa07
MD5 cfe8314e7c99e8dbd2263f7db00b3917
SHA1 d578dc07b9957a3d692767faba32db0024333db6
SHA512 73d45a21d14bfff4ca105f46e34598850a9646d0ec1d5a8e4266c6adb3425092fef909e2778a6e4f09ad0174e3205875afd8c4a867ed505bf8dcb492768f420e
SSDEEP 3:MsEllllkEthXllkl2zEfl3eWKll/:/M/xT02zT/
TLSH
T1F84404147FC00C0DD51030344071C3D01371D4100511774335D104335CD7D400C05440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json~RFe5b2cba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5b2cba.TMP
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

d4c18d92-cde9-4bc9-a673-1b3c225f036f.tmp

Path C:\Users\Admin\AppData\Local\Temp\d4c18d92-cde9-4bc9-a673-1b3c225f036f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4324_1598484922\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/592-11-0x000002468F900000-0x000002468F901000-memory.dmp

Download

memory/592-12-0x000002468F930000-0x000002468FBA0000-memory.dmp

Download

memory/592-2-0x000002468F930000-0x000002468FBA0000-memory.dmp

Download

memory/856-21-0x0000000005D20000-0x0000000005D86000-memory.dmp

Download

memory/856-732-0x0000000071050000-0x00000000713AB000-memory.dmp

Download

memory/856-19-0x0000000005490000-0x00000000054B2000-memory.dmp

Download

memory/856-22-0x00000000743D0000-0x0000000074B8C000-memory.dmp

Download

memory/856-25-0x0000000005D90000-0x00000000060EB000-memory.dmp

Download

memory/856-20-0x0000000005CB0000-0x0000000005D16000-memory.dmp

Download

memory/856-26-0x0000000006260000-0x000000000627E000-memory.dmp

Download

memory/856-17-0x00000000743D0000-0x0000000074B8C000-memory.dmp

Download

memory/856-16-0x0000000004FD0000-0x0000000005006000-memory.dmp

Download

memory/856-15-0x00000000743E2000-0x00000000743E3000-memory.dmp

Download

memory/856-27-0x0000000006290000-0x00000000062DC000-memory.dmp

Download

memory/856-731-0x0000000070E10000-0x0000000070E5C000-memory.dmp

Download

memory/856-730-0x00000000066C0000-0x00000000066F6000-memory.dmp

Download

memory/856-18-0x0000000005660000-0x0000000005CAA000-memory.dmp

Download

memory/856-735-0x0000000006700000-0x0000000006720000-memory.dmp

Download

memory/856-736-0x00000000074A0000-0x0000000007543000-memory.dmp

Download

memory/856-737-0x0000000007C10000-0x000000000828C000-memory.dmp

Download

memory/856-738-0x00000000075C0000-0x00000000075DA000-memory.dmp

Download

memory/856-739-0x0000000007630000-0x000000000763A000-memory.dmp

Download

memory/856-740-0x0000000007870000-0x0000000007906000-memory.dmp

Download

memory/856-741-0x00000000077D0000-0x00000000077E1000-memory.dmp

Download

memory/856-742-0x00000000077F0000-0x0000000007800000-memory.dmp

Download

memory/856-743-0x0000000007800000-0x0000000007815000-memory.dmp

Download

memory/856-744-0x0000000007840000-0x000000000785C000-memory.dmp

Download

memory/856-745-0x0000000007860000-0x0000000007868000-memory.dmp

Download

memory/856-747-0x00000000743D0000-0x0000000074B8C000-memory.dmp

Download

memory/856-28-0x00000000743E2000-0x00000000743E3000-memory.dmp

Download

memory/856-29-0x00000000743D0000-0x0000000074B8C000-memory.dmp

Download