7414ffc3b6a388f555ed4562b7560e75a284ff4c3fd73b5af6eee1dc0515e549

Analysis

user interaction
yes
max time kernel
72s
max time network
68s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
phish_alert_sp2_2.0.0.0.eml
Size 32KB
Sample260731-j9bf3afd69
SHA256 7414ffc3b6a388f555ed4562b7560e75a284ff4c3fd73b5af6eee1dc0515e549
MD5 6cfd1f240e2c28281b84b604e46539a5
SHA1 49dae81b6df236a2d25b260538f8f597d2541e24
SHA512 02bcabacc2400ca81f03f2ceee0d6a33f821ec2911bee5d08d89b539de22dfcf7c33dc7b914da1836e5113c41eb243380f181da36ca0b062d50f23e53150a75e
SSDEEP 384:OcOH9xs1bV3yKs58yKxRP6fzs5G1LQopeLzde5680qHPMLKaB2uhSo64GyU6f4X2:VEW15/yt26pfMS4HlXujUB
TLSH
T123E21AB5529590DF1933036A71737A8892B28C4DD7A379E4EC33AA648DCD8120F2D7DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5404_1814900318\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5404_489736703\_locales\lo\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5340	msedge.exe
5368	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299597766491049"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{3811825B-6406-4BEB-9D91-0E28D9FACC39}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{ABAD1A8F-C78A-4915-A159-73E9430532D6}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe
5404	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
5404	msedge.exe
5404	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1608	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE
1608	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 5404	1608	OUTLOOK.EXE	91
PID 5404 wrote to memory of 2540	5404	msedge.exe	92
PID 5404 wrote to memory of 5368	5404	msedge.exe	93
PID 5404 wrote to memory of 5644	5404	msedge.exe	94
PID 5404 wrote to memory of 5644	5404	msedge.exe	94
PID 5404 wrote to memory of 5644	5404	msedge.exe	94
PID 5404 wrote to memory of 5840	5404	msedge.exe	95
PID 5404 wrote to memory of 5840	5404	msedge.exe	95
PID 5404 wrote to memory of 1388	5404	msedge.exe	97
PID 5404 wrote to memory of 1388	5404	msedge.exe	97
PID 5404 wrote to memory of 1388	5404	msedge.exe	97
PID 5404 wrote to memory of 4852	5404	msedge.exe	98
PID 5404 wrote to memory of 4852	5404	msedge.exe	98
PID 5404 wrote to memory of 4852	5404	msedge.exe	98
PID 5404 wrote to memory of 2920	5404	msedge.exe	99
PID 5404 wrote to memory of 5024	5404	msedge.exe	100
PID 5404 wrote to memory of 2920	5404	msedge.exe	99
PID 5404 wrote to memory of 2920	5404	msedge.exe	99
PID 5404 wrote to memory of 5024	5404	msedge.exe	100
PID 5404 wrote to memory of 5024	5404	msedge.exe	100
PID 5404 wrote to memory of 3148	5404	msedge.exe	101
PID 5404 wrote to memory of 3148	5404	msedge.exe	101
PID 5404 wrote to memory of 1880	5404	msedge.exe	103
PID 5404 wrote to memory of 1880	5404	msedge.exe	103
PID 5404 wrote to memory of 1880	5404	msedge.exe	103
PID 5404 wrote to memory of 5744	5404	msedge.exe	104
PID 5404 wrote to memory of 1496	5404	msedge.exe	105
PID 5404 wrote to memory of 5744	5404	msedge.exe	104
PID 5404 wrote to memory of 1496	5404	msedge.exe	105
PID 5404 wrote to memory of 6048	5404	msedge.exe	107
PID 5404 wrote to memory of 4136	5404	msedge.exe	108
PID 5404 wrote to memory of 4136	5404	msedge.exe	108
PID 5404 wrote to memory of 3620	5404	msedge.exe	109
PID 5404 wrote to memory of 3620	5404	msedge.exe	109
PID 5404 wrote to memory of 2760	5404	msedge.exe	112
PID 5404 wrote to memory of 2760	5404	msedge.exe	112
PID 5404 wrote to memory of 3892	5404	msedge.exe	113
PID 5404 wrote to memory of 3892	5404	msedge.exe	113
PID 5404 wrote to memory of 1396	5404	msedge.exe	115
PID 1396 wrote to memory of 6140	1396	msedge.exe	116
PID 1396 wrote to memory of 5340	1396	msedge.exe	117
PID 1396 wrote to memory of 5136	1396	msedge.exe	118
PID 1396 wrote to memory of 5136	1396	msedge.exe	118
PID 1396 wrote to memory of 5136	1396	msedge.exe	118
PID 1396 wrote to memory of 2032	1396	msedge.exe	119
PID 1396 wrote to memory of 2032	1396	msedge.exe	119
PID 1396 wrote to memory of 5768	1396	msedge.exe	122

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcustomerfeedback.ups.com%2Fjfe%2Fform%2FSV_bC2kQlNfK1b33QG%3Fz%3DMVpWQTU2NDcwNDIyNzYwNjEy%26locale%3Den_GB&data=05%7C02%7CJASON.LOOSLEY%40NKTPHOTONICS.COM%7C62b4581d51604e6c393f08deebb00843%7Ca0dffdfb71d149d98f0015e03257d706%7C0%7C0%7C639207338476440606%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=UyzuISqKRZRu%2BTGYiJZdHCgR2GMbOBY5iDeQIoO6lIs%3D&reserved=0
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffee7c4c188,0x7ffee7c4c194,0x7ffee7c4c1a0
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,5297055234454225863,2720664597513270710,524288 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,12405663406355204781,15729452871471364535,262144 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,8980884291301680429,13377666795685560020,524288 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:13
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,2390971673040814067,526265211141338666,2097152 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,18450295019855571,15291649671377701116,2097152 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,10478467831112081897,14617327971883515007,2097152 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,15684255956309574155,12941733831677126962,2097152 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:9
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,10756028489584015681,17385924292020039299,524288 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5472,i,11069311937585438198,12465933917068178569,2097152 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,10135705379324889348,10882340536094979173,524288 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,15689460947567536563,13785607498470875356,524288 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,4066834027831120579,15315330496865551435,524288 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,4066834027831120579,15315330496865551435,524288 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,668489496097349816,8699477141412924248,524288 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,5427335702039944282,11687740688776203472,524288 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,2462090423882972389,12330354796898616001,524288 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,9107391367571230164,13762273744883893148,524288 --field-trial-handle=2300,i,8085286318783944797,17454063664610694387,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffee7c4c188,0x7ffee7c4c194,0x7ffee7c4c1a0
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,11481322794541231287,13724969909904480790,524288 --field-trial-handle=2264,i,6058220915113210327,16079994838906923011,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
      4⤵
      System Time Discovery
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,6569890514241736803,5285084314781302488,262144 --field-trial-handle=2264,i,6058220915113210327,16079994838906923011,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,9531947984126750444,17030831216914293947,524288 --field-trial-handle=2264,i,6058220915113210327,16079994838906923011,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:13
      4⤵
      PID:2032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,12404767988819796254,1274227655444158920,524288 --field-trial-handle=2264,i,6058220915113210327,16079994838906923011,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,12404767988819796254,1274227655444158920,524288 --field-trial-handle=2264,i,6058220915113210327,16079994838906923011,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
      4⤵
      PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 5979511f17d9bab4aa926f0c20b164d6c33492308eb56a9942fcd4bb675f480c
MD5 9aee5a984729e6ff5cd90b109ef28087
SHA1 b2d02c5451edb3bdc562ddfb460845168df5af4b
SHA512 90c9d2f8b87cc15ace21ce502e85a8a09d1e380fa85c648aeeb4b756fb3f21386e81654a0dd95871d349bac1e628f18cb17d279a9eee0a0340bd3316162a7633
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T139B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b12b6aaacc3531e2606fa5eb280ae4929c75f82670a5fc331990dcf5f4b1e81
MD5 e293a66f886f80f5eeb21878c0c77530
SHA1 3926f358e61777fe2c930dfb5287451f962a40a1
SHA512 dc4bd1283e4faac05fed23611e49d4a83971a25110ee2bb1461701323edbedf609baf8812ae633d8648747b3b817f886edfcd0604af5ed76bf6c8a9f9a75924a
TLSH
T115D0A7A4BE25B290C519503548600600692A46A2396B968660A5941D9974080A297EBF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0ede97a988c51938c30d0d7e11821b93e0463c279ece52eb885ee482bfdd4d31
MD5 3f16c73fcb5fcfd72f4ac9492cfb8d1c
SHA1 9eda1cd163b8f73a06f8fa77f4c298bab7e364a6
SHA512 4778cb8a055b8fef4acdba4506f8d9d6bcb259340db4995b4992cb9fcb9762d56bf084816bc0160e3f7e96e1204dbb419b0107852402558779a6abe53a5e1abe
TLSH
T1BDD0A7B4BE74A904CA0B603118508251376643A0295ED5A250B5601DA974180928F5AB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 673986afc7b818516b9da6d8b55c77ba31d2d2c01dc6a092d2e5f8432031e36b
MD5 7b4c95e930a53a64e034e0551dd75e71
SHA1 353c89396d1d33f0899da86c58436b2302fa383a
SHA512 82181d212350b8d2e884d4984c40b1e3571aa6fc903eb68ef805871681aae97c0b56f0cb3ea0a07cc692806d5a5dfd20696ea419b72189001198c1438300ec4b
TLSH
T12AE02BE9C861EC2B68FD0B6860580B45D75013572781498F3B3C820CCFF063A4285C9C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 8b81e05d0f28c4bc3aca59e0eb10b4a5456b92e4d8838429880dca9b4b440fd0
MD5 210b24e1b646576e1ddf3426487ea477
SHA1 5ea0dffee1b764f008f46af908e280ddf6623247
SHA512 f6479c14dced84575ca39cf69028fa61a92807259243581a2d186379f79afc9da77d1ffa1ac9cbaf972f708580db2c7f5646f97239abc4343880a09b2b017288
SSDEEP 192:dJcxFNiALjzsNAK0NicUmX5u3JKWGYg6GR+dS7f2oeQutjZr:dWxFNiuzsNAYDmX5u3JpBZS7OFjZr
TLSH
T1E1132C7E7663CD45D6E7A53C12279FB587B1E19DE0F40A278BB7B84093153801CAE318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 556f1ec7d5079cbf2528a9e0fbe694e253f8acb775891147ee8d3af9a5640516
MD5 7eb97e773035324017e9b0ee3f38f2b2
SHA1 b8d62234343c09e1bd972b0442f3edf33f1bf60d
SHA512 3dc8e9d7bf9b405cb36512bc1523a507e84afef0a2f38e9763f86153b1d0a6cb8083f0a5bc10d45c4d63adef462b17dfe5bc79800589acbf4c53dc375e6aaa96
SSDEEP 768:8ANEspL/D2L/uJfenp+U4WSwgcFUpDgZLRLZbbvFVWsKnduoNAuHL1iBRU4R:8spL/aL/u69BqyRLhv/W5dLzHsB
TLSH
T10D445FF71952A01BCBA842F5D6033E3DD17B455E3CE1E9E8E57C4C852825F25B2B8E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 b51b7313e3f40ef25a6c81e990598e40a9d8f269377fbeb40691f36449133b5a
MD5 58a872439ed5a124d2d35090bb3df10b
SHA1 b71053a7dca86e7ec5df0c26b0cde7054983e5cb
SHA512 b8cdedbf43dc8e6098f05c6ce6b7b6bc964d6f0734d21afdd6bbd68de0d20781a0d951d954755f0cc2b5f26421be05225b140c425f209254d8c4d09c79a5046e
SSDEEP 3072:zv9G+HN4JHbmykHIV709xAODk9pyT8C4:zQ8u5mykHYsAc8
TLSH
T1092528EECB682C82CF6B867070E0E9077E712183B65DD0D39944C5D897D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 46118661f32f0beb11e8b0c054a22795de1723d0578f83217d4991d1b2baaa64
MD5 71483141c415afea531eba0eccdc59d2
SHA1 e9afee47a03889fc577c3fe93f5032c07bbcff9b
SHA512 dcec56544541bfd442994998f222d6319f4bac73de4ea6a0748c9939ba1845b4e492106deff9308dded1f9f791ed7eafdecf8d10eb99f86f31e9e959953192b1
SSDEEP 24576:6H+lZF+KSK7jtxxd9XpvSlVGQloZs/r+IAFV:6elfhSw5Z9XpvjQn/UF
TLSH
T18C168DEDCA7858C3CE639A70B4F0E9477C7413C3F994C1D6889CC584026B7C5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 04091391f7cc5bf2e23fc123e0906f1e792f842cd160adb775995065833d4445
MD5 344cfd434b272250cf0a06984b2788bc
SHA1 85673da45341b33697e4a56438d93504af598083
SHA512 2c4475f19898e371d4540ccf95f8b66bacde73d5f362346ead39a75c47060ff10126d692784221f5beff1bd68081ed68c93ce45e9dc53115cac8b154e71837c1
TLSH
T15551CCA223FF05F1DBB841BA61E946143F78AE5B79735F62500A23BFEA27B08145B410
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a41dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a41dd.TMP
Size 2KB
SHA256 90d6863dc2f96524832a4ee74ae5c20edd9fb8fb1de53a0b5538b6c7879845d5
MD5 43486e9854f1798a1a3414654918b3fe
SHA1 20d70f2219326579cd4b0bb833cd56d2cca193a2
SHA512 7c16426a9db7729a3abb83764adc23aa04babf079e7f00020ec7fadb1fb1996ac7b6a85078a6f797dbf264fe2bcd567c4c20467bb33f84b7fdd7bf1b78437d02
TLSH
T1DB5188A223FF04F1D7B845BA65E856543F788E5B79336F52A04523BFEA57B0C241B820
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 a02abb2a62828dcce46ac679089d6dc980b5c2eb04b6dc09c5fea4196d25e247
MD5 2ba44dec25fec606380c265d6234e3e4
SHA1 8623a987d723dbedefb705776ae58f074798811d
SHA512 716395f5dc23889238c20635ad67e5698f5c9ce8fe3e821d8b94742345a4fa1d3d3545c5937ae8a334533c1566f61835edceef08f58b4ae7678efc678c1eae84
TLSH
T180E020D4E5CEC16F559874C7D1786B5C91CC3456D6C56DC32B01CCC47A02001FB4A75E
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 6cd12a8fe182a0ab95bc79eee5e9de48cd26e4000cde8750336d7198e0c8639c
MD5 cdde50b738c0839a82358dc2e60407db
SHA1 39cfa3c2a7d17a854e174f23edfe19e3033a0d1b
SHA512 40e53c213b78071b6e8d729bb5d89513b16a36409a910b44029ec153c006ac1dde0e39a23c75a51718b57819334f59d7546f6daddcefe7311242cbdffd4235e9
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj2ZQN:TdD4jJ/0UC+lf5KY
TLSH
T11AE2A04C3E21F511C4ED733CA0D2C5D09EBC647C478DB67142386CA68D52AA2F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 a027ed69eee26b7f896f0a2ff5127ac7667adb845b1c7f2190e29ae47bfd66c0
MD5 833e91e0862e88abda85ce6f7e5793a5
SHA1 5fd684012b937097629c9258ad259bff686f9892
SHA512 47cec9f67596cb87ef9568d7f4afa902c2a8afdf1785818355c228d65bbd2a2bff83773c28963186bd6045f0ffa60d652ccff237e22e30b2a908a44126d6609a
TLSH
T16DE0262444CCC92FA06868D7C7ADB74C82D23423AACA3942270FD8887141B42A38F7CC
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 579baa4d777b8350b7bcba4e3d7746fe8f7388322d7c087bfdd80f1735d7fb4c
MD5 b042edc5010ec12f71f48d85bedb631e
SHA1 3da64a109b7fa47f764b7021787f57cfe6e0f8e2
SHA512 f00c46507d76c4317eefc103b810bfa41574883b74ffbac8d0183568d114f0aa42716086b56b8fe9a1f08f2cf7471415b5a343842f187a260693da0f862eb590
SSDEEP 48:FzBmw6QU1Pzyqy7EllkCrnPgWlqy7EllX6D1r303w4z4c4Ey8pAwwIMpoluleqkO:xBCxyqyofTrrlqyoW5r3od4ErAYqTr
TLSH
T15CD209530F31352BDB531D3A36694538893FE54D2F62AEC934B580113CBA0D1E0A2CDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 6386281ed4cdcf354fd237983143b03f132de647568dc77c8bfeb65c77b6ae9a
MD5 2e9111dc45b639c8debc49ab01fa8324
SHA1 d54cbffa3e9b8e51b1617b6794e6e94b132ef43a
SHA512 8fd739fe58e15fed28fde759e8a992d907460bd6b8c23a7513d7b650387354c2ae31b9839fd99828101130ab869a60b88b22773cbc41dd717400ce1f019e3a22
SSDEEP 192:VZUTrA8H+bF+UI3iWGVoWN3qL/IZUTrZVVV63:WxIkUI3ijVoWN3qL/rdA
TLSH
T19424435E5F313722CDBD913669E744A35C7CF03F8B5226CA786114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 ccff8e580409108b55fdee0a1052c65b5ef043f7c972c92fc33ceffe8c26055b
MD5 a844a1a82f80f95eb1c7cad2befad6d3
SHA1 eed83bc53eee1c39142db19e3f9cb65df7df73c9
SHA512 68e2819c0f6e63b28dac923db1b425f1407cc96092b46a6bb3c049855cc6c8f8f13021b6a01e7b969713daaa494f732518cc63a4534cdb950285f00b8e105ee1
TLSH
T11DE0D86099CDC55F5248208BC25DB74CC3E07407E6CC2A456B06E848B841508E7DD3CD
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 da23736cdfde6a14d710f4219a01d9f71af042ff5c845041b7492df71533c8f2
MD5 696d68e323eaf9fdcedb0c5cf16d7847
SHA1 277c0f49a580282bdcdbaa352d8ee3e3fe4f603e
SHA512 ffda372adc0c9a61523412509d37f6a9842daddfec6f8fc69c83cbbc432a93ded645ce1e7c48c139ec24401802452a862cfa803d1cb3579741d79d6ed1265ebe
SSDEEP 48:Txk/LopFMaty423w/a9NUuTwwDoPcbhcxzWlEGS9j+oRwMazgTu:qDeMatha9CDclWWlEGORezgTu
TLSH
T1A9B2830D1F202121C0F05B76EDD085972E3C011EC7A773CEAD28A0B2DD92B6BFA074A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ee3e542376d2b4c935348755a36f33119b75e27e962b073802ca1ec189efbcbf
MD5 7afcb426d983e7633f57a4f485a9fb3e
SHA1 fa22bd828b2f5c8c9fd49fe5c28a9898ee902097
SHA512 5be18de8fb6998b21821430b73178e66c41e7cb44f0bc817c97e7a743c59a9b351c864d26ae4b623e473185a1d8f9fbec931a5ff6cb76c89eb0edc63eaf0b209
TLSH
T11D51AFF3C3E8962D8A0156F4AA147E1BCE2D0954432C7D5AC8E4EE1B93E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 4d9fec35ee8d9dfc1468ca21fb2ae82e3c0d4390a86908c2c14db37773415987
MD5 c787b8b1db2c0b17725055fe2a582d3a
SHA1 49c6debf5f9b560a4765f2535dcfc6d27c2dbc3f
SHA512 21d9aee656fb43d9642b1ed95b7e9fe42ad4e2c525f46ca71a3975ad0d3af5d7f09c8d07fba7eb491b60833cae666d9ed0aa056304d4f2e7188045d04e0cb75b
TLSH
T1F2F0E9A7D4FEF422907548FE1D44FC4A697ED9368141B8F0DE57C27DA0A24B39702167
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 82fca35b37d386b0f441523214d4c00b8e6749b25be88e2d73353a04204a5985
MD5 49c81c179fa3122ed430396a4d509080
SHA1 484ee15034e5a9fa8c511b2a64fcc9e461f33f01
SHA512 06596d9ab4898d6d08ea8c1bf6a6b7d377ec1737c26f4b08090e61b373a2b9fcd74bf415c01fcde07713876bda60c9cb0396c005dc0934d30c5176e8adf2da87
SSDEEP 192:sxRkyRMCt/f5stWpVo6eZjmgKzoA8prI/g6+WNvsWl/YM8iK5GPIgVNt2J:sxRkyxt/f5stWvo6YjmgHM/5j/Jv0
TLSH
T11452C91A6928997F5CC7D21DFA567F63D7FD5022A1D45F48BAFC8A0C00EA6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c55b693c632fc55224bf23c472c3a9ca5f53ec68be8967ad8e57951776861463
MD5 86ec210f65f41502e9ce965ff7f9d07d
SHA1 eaa51b1dea4b42fb598dd83a514ac33a3222dac0
SHA512 a32243aacda4697c94fded4e81c07d02d49c675979ec7273dba6fccae679548a850dc3fe7c299ad0b550c2be39a080fc8c56007156a12ecdc691ff294f4528fb
SSDEEP 192:sxRkyRMCt/f5slWpVmmeZjuzoA8prI/g6+WNvsWl/YM8iKBgPIgVNt2J:sxRkyxt/f5slWvmmYjTM/5j/JV0
TLSH
T11142B8166928997F5CC7D21DFB65BF63D6F95022A1D45F58BAFC8A0C00E66DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a080ab109c2ca066d93191d48638591cf9dad319d000c006d92b1041971eb304
MD5 9ce5abf7a0d6b9d1b056a475544cd4c8
SHA1 400501ca1ce66b2b29e1778f6ccca6334dd2bfbe
SHA512 7a4bad5e1e5e2165060af2b736d4fe9023cc906ff8fe54b95e40275cd81bc298ed0fd4d33787c6d8d8f4c51ddf74d42daa1a06b52ebf0beb6dd0c7316d3611ec
SSDEEP 192:sxRk5RMCt/f5seWpVo6eZjmgKzoA8prI/g6+WNvsWl/YM8iK5GPIgVNt2J:sxRk5xt/f5seWvo6YjmgHM/5j/Jv0
TLSH
T15B52C91A6928997F5CC7D21DFA567F63D7FD5022A1D45F48BAFC8A1C00EA6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 d171690350d7d5a321d2ef09c6ca6ef372ed6c40e16af75df90142a65bb398bd
MD5 4cc4b9194169487b185384eecbff7410
SHA1 47fd89c1f13a9884aaca6b322fcd0fe1e1e7b419
SHA512 f3cdc14b7cc55da97d29e749c4a6123f106acbacf6bd7befb7f3b78b162c79e85b44c9c90d990f54433a1e1456eb39f4ff8dac17bf9bd086ec1abb3e0ad816ca
TLSH
T1F5E02610C9CDCABF619D20C34229B34CD3E87417E6C83D463F07C9887942B88F79A288
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 194c08f0e787333b4d071cc3f6c8441a54966396bbdb76e5e12a06b09f05d029
MD5 77107ef3b7db209f35560640adb54854
SHA1 a3dd889400efe9b05a48b5afe6a135c7843d778b
SHA512 7a43a9a735ee1021533ff4e114cef0814384a0881a712ef8301475a174f79b5afa886b8e5335d635b5cb55fe1c886026a8453f8e5cb32b6d8db0ba9f0637d879
TLSH
T118B012193700424FD08B4571C3944B91A320E4525080951B8C549F1A4C467E53F88898
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 d2a9f55d79edbd5be09b9481b824e6d17f7dec72d055c4374bb4ed38a9f3275c
MD5 cdb78520ab8a4d2cfed25ef39804ebff
SHA1 e1e4427af1da0cc7fcfd726f5a399ca31a99c6c9
SHA512 edf46a9fd16d2a3e151f525ca1f6c7f914388355be41a9a0d83eca8636cff7c44083eedb1750f06fbf422c217e64db49b385987b8c986d17e2ce2144059603a6
TLSH
T150E0D86095CDCA6F618A20CB921FF78C81A37417D6C829513B0BD8887306680734B248
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 444120e6a9fafe1fc8f15682bde97052353d960562d33f428be8bb0e3cd76749
MD5 490206921bfc3774513914810bbb75f4
SHA1 f5547737caf6f3a76cf518157a46907ce3f5265a
SHA512 62be7b899ae7889444a6fed0cd4fe00ba5dca66f9288b2673bdee06d8203967bde6edd69787ec9066e3ed36e699d6f627958fb23a11b4fe927a835ab3098bf6e
TLSH
T18EE0207889CCCA7F555460C38278B74C82F0780793CC3D81670AC45C7501648BB6D2C8
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 4f6ea29de4d1690946a1a5cd75a69aeb7a8767e2d557540fb3d98ac2805e7816
MD5 708e39bb78e885ffb7ad203875d32b60
SHA1 ec7e2361f5246b1802db14b352ea2579047494b7
SHA512 001be5b1fe8ee1ecfa9688bef1fc5a83512b120b8babb419cc2684f818982225695492e718a7f4e2a34d1d93c0569d50e69a0d87f04525d8050dd4c834fe94fe
TLSH
T14E812309F13E2AC9397E2809C895945E83C1B0A33278646B7FB940AA1F66F411DFCDCD
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d5ccc507c622b36edd28794f305750c4ef96447343e085a3430151252f653727
MD5 7db84167fca69645976570b355702417
SHA1 393a67949320b0f3d6bb3d0bf0f1cade4ea5b89f
SHA512 ae6cc35e145fff957892123c2315ff1fcd9b82517cdd1274eb05c759ed1404d94a8a46eac1703db04cf930e8d67474f9077da4835b727f2911b633bd274adb1a
SSDEEP 96:KWx8dR3ff+Rvalnx+K/Lnj+b5xSTBfWdiKesddjA3TZFxkBFmPXLkKfBXRk7zTGu:WHRz/W
TLSH
T1C6912209F13E2AC939BE2808C8D5955E83C1B0637278646B7FF940AA5B66E411DFCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 2cee8fe446b074005aeddd77afa9413d595fc82aeae2547d606251c1bce9db5a
MD5 e9807769cac569f3a3dd78f869e10b5a
SHA1 1cdb6f8fb45053c973d2e4eb5c7bcc3d56504c0f
SHA512 761dd1828148c3deacce46fc7e65dfca73a3770c7cd546f614cb70ae5654109b74eada6bf060605ba4cebfd2d4a7681a7fd3fd43301494502cd576273c940592
SSDEEP 384:DNrRZyCSDnxTICkMEhIKyll7svbFKfk7:xFZJSDnikyI1l7svbF9
TLSH
T1EB44840A7B747001EDE6D9721CB080771E3CB16E8F22A6D16DA654694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 fef96bd52431d8cbe2463b904b778a930a75f84d6addf2001a3238a2d493e901
MD5 47513d0920bfb11fdc9ab0ce3c77979d
SHA1 143a8caea9eb492d5570d7522d976bb5a17e5ca5
SHA512 cc7a759116b35fc331676c84e80436f3ed669fb5d3236f89ea21df8812191a79458344d6bdaa18deda00727684a75dc0f2bd8c8a3e2c859c4b334b57ef3df5f1
SSDEEP 24:LL0OGxhK3thdkSI5QjUsEGcGBXp22iSBgCBC9aIlyCODUMzvBJEBC9aIoGt:zEK3tjkSI5IUltGhp22iSBgq7cW
TLSH
T1BC52336BEE743217C8E647719AC002E16E2A602E4F81DF0268B350110AF4691536F96D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da3971d7-52cb-450e-8c54-bc2adc69a0c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\da3971d7-52cb-450e-8c54-bc2adc69a0c8.tmp
Size 29KB
SHA256 f67b082313c177e73eb5db8ad28e8414ddc8e0ead37ec4ff258be4300a93fb09
MD5 a1f6fc139095f3a04ce963bed8255ddc
SHA1 b419acca29eb19f9fbc1fd5a8da7c9c8283a886e
SHA512 9c38d3bcb146370f77d1d0302e0b972c28187e9b45fb0df2516033e5be2bde2b314a09057f334a9736b7edeab256d91b380d1926b40a46809324de63dee07ccb
SSDEEP 768:0UQiVM7pLuLfJaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwm2OVqBro7n65:0UQiVwEfJaWgH7feQu1janm2Iq67c
TLSH
T139D2DB7B640CCB7F4F804ADDEC197E9A6DA802CB9698CD8047FA845C03C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 4eb2f2b6442dbdc454be7a62f071365ca06d61284658c3350fcfcd55d6799e13
MD5 57cb9cb481efc04af2d86b9bfa805f81
SHA1 6bd84b33dc9b85de9ed877159477ab168e0e48d7
SHA512 53a64d30e5269ab4df1e16faa90af80e91effef6dcce32c32974f2ac7e1d8e658a017266e2409c4e33688775655c5b93aa0ba7945d60c864e153d959e377740a
SSDEEP 192:IQuIIItbtMIMfGYcY+zODlAsll8MNssEh:IQuIIItbtMIM+BaDWs/Es
TLSH
T1AB42745E17061B73C05E6BB613A2C6949FE448828076296D31636C1F8EF3E97C6D53F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 0952c868fa9c6e58c8fd8dc1caca56ce32c4dc0f378359909edd4c92d599f653
MD5 9cda6dfe5216d9be32037726c1c69eb5
SHA1 c0e3445e7561aa32456ff2a7c5acb57be35a2904
SHA512 a14c67119d683fe1be1673ada603d35853c44938f38adb6e8da48d6e3070e98f23bd191e6068bbcfccb2dffcd8b7a4664aa528dd64a674e3fe20c98f07c455e6
TLSH
T13AE0D81894C8C55FB06C24F74159578CC2C53803EAC42D852B06C85C7401740774D245
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 458ba97c2f44990083b60773154570413ac2fe6a5ab68785d7f6fa3aca8f361c
MD5 ecdf991596c09d172c417ed3b9fa476b
SHA1 3307f86baff06bf4fd43d4e7b731a9de25138a56
SHA512 64e9844a0362b90d60d40a90ec57410d0dee142212752ccd08c85dc002f9af7b4abe1c823b241670c7a4aed24751aacb26f4af5f293040eba8758499eed4ce58
TLSH
T1D1212655F330D108E159827E907E9B3A1738E8128FBCEC0F547920346E71B440E4B2E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 ac3717cfd97dfd3154c949277d2c96e06fdb7d6de79f3f78adb30611f10f0b37
MD5 ded31444bb912ec5b67e7205f8c42950
SHA1 a88c189b767bf50e84aa86131df09d19a6d26a9f
SHA512 2087a593fc3f599669cbb5a7a238d4b3e9fdedc2201a9744aec7aa0c8199a2ce60c0aa72b0b4eb6c66255281e9ce34c39e8cf0e629b7e9bb6075d5d4aa3f5562
TLSH
T1AEE02024E4CCC55F506420F7436997CCC3963803EAC46E412F06CC9C7501741BB4E28D
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 13f4559d46e180b3d2279ea248fc60c63423cd000e169bc6ecb235b213757016
MD5 dd00033bc260b9f714e88fa3fe0af812
SHA1 f0c27444e5c5a8784f8422b06d59ac5d07de179c
SHA512 0d20520470143d035cc2d3b8017ed3e2e7bc67cc161630e8eacd5e233b54faf09b9a1bb601fce1d40cded63b4ee1eff536e506dead68eafde30d3d05450d8c15
SSDEEP 3:MsEllllkEthXllkl2zEflhKlt:/M/xT02zTl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 e5b5975a98df2ece7b358aa2658300d35ca4f1e9cbbfe126d3bc621f73f1d727
MD5 2e83c5e5d5df8bc362c57ca845a93623
SHA1 64283cf4e23b4914bf9afb50225262779a828eef
SHA512 1ad2bf14699b9817a2ce26f7fcb0c653024b8e3a1664d6f5122c54123d7cd1550c11f076bc8b6a6fe9beb9e2457f5ae4702c68748917a5e68acbf3648f330b5e
SSDEEP 3:MsEllllkEthXllkl2zEflmY+t:/M/xT02zVl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 290c8c57b8294e7ef4479d788d28071062913f5a220461ba8dbdca5e0bd23e6f
MD5 74d0a1c073b1e9bd93ee3283ea0c95da
SHA1 d61385890d27a5b56135e52d083b6e5e8145decd
SHA512 39345c18069804435adb7e60ac3e0a3f6398cfb86933d5cd3e6fecd5ff1a4063456dd0fc490c7894e04c153d1f6d8c8b7348f04320b02bcd9ff86364167da15a
SSDEEP 768:j03F2qGOzDHqRtoK48dHeByERRFzjK3Yud9nvb9MNI:j03FvGqHqh48dHSyw/EPvb+NI
TLSH
T1D5038CBC9C244D7E88AFF309354E2A2AAEE44237D5F45958D3C99B0EC47249CF706C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 12c429ff8f0563d549dd76fba0a459380010ddb247cc3ef427cefc9abf12130a
MD5 5c7c625d893feb3e2a567dfe244dd0de
SHA1 39cb78ba7ac882f0f97af3103c7f5b194d17c77c
SHA512 32a421258827a5dd1bd93faab1fe10e3e764a09a843afff469f6a78adde16fe71e5d404feabfd442f87fe66e3f3250fd3590d7bdd55797c9788f81a15f564ce3
SSDEEP 768:Qrv+4UNbdf3eqGovDHqBK48dHeByERRFzjK3YveVH1SCj:QbsbJ3nGEHqI48dHSyw/BEH1Z
TLSH
T18003CF71A9A84E734CEB92897547BA17BFF4411386C41BA4C4DD6F4E868B0CD130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3f0c9b65d99a0bacba98aea32bb1d6e26b79794223fa1e966f03bbed14451758
MD5 5d0264c77c848fa4fb8ff224d4da4283
SHA1 4ff2906b731f45afd7c776a2c7f5d929bc09e9ba
SHA512 c961208f10126e19615dde932254af8edc58ee5020040c11d1aeea0e9c185fa0500a50ced706d00eae164af5c3486eb79aabf10b90551f810c06c2fe51873171
SSDEEP 768:G03F2qGEzDHqRtGK48dHeByERRFzjK3Ybb9MNI:G03FvGIHqD48dHSyw/lb+NI
TLSH
T198F2BEB06C644E738CEBD34A7A933B67AEE0412395D85A58E1CDEB0E488359D1707C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 094a5735bdce7ecd49ef3a9ea0a3c3776dd2c38cc5d5c94e493fe124fe304829
MD5 6cc101f980e374207e74a2860c3f37b4
SHA1 336edcd20d83a4ac6cfc6965f88d575990747b17
SHA512 a9c0d206f1a92b91e9fa667c804940235dd703e5adafd949c96cb056fb341db8aeb2a781f256ce8be37d4292adf033c67b7a59b8b0414e1b823ef823e31ec692
SSDEEP 3:MsEllllkEthXllkl2zEflft:/M/xT02z
TLSH
T1BD4404047FD40C0FD71110304071D3501370D4101513F74334D104337CC7D400CC0004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d85ad37-c8cf-4f31-87b9-ac789f383e7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8d85ad37-c8cf-4f31-87b9-ac789f383e7e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5a41fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a41fc.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

5754f87a-df40-41a7-82c8-7cb37bf0e1b6.tmp

Path C:\Users\Admin\AppData\Local\Temp\5754f87a-df40-41a7-82c8-7cb37bf0e1b6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5404_2042587773\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1608-11-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp

Download

memory/1608-7-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp

Download

memory/1608-14-0x00007FFED6620000-0x00007FFED6630000-memory.dmp

Download

memory/1608-12-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp

Download

memory/1608-53-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp

Download

memory/1608-10-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp

Download

memory/1608-9-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp

Download

memory/1608-8-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp

Download

memory/1608-5-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp

Download

memory/1608-13-0x00007FFF18900000-0x00007FFF18B63000-memory.dmp

Download

memory/1608-6-0x00007FFED8A40000-0x00007FFED8A50000-memory.dmp

Download

memory/1608-0-0x00007FFED8A40000-0x00007FFED8A50000-memory.dmp

Download

memory/1608-2-0x00007FFED8A40000-0x00007FFED8A50000-memory.dmp

Download

memory/1608-15-0x00007FFED6620000-0x00007FFED6630000-memory.dmp

Download

memory/1608-1-0x00007FFED8A40000-0x00007FFED8A50000-memory.dmp

Download

memory/1608-3-0x00007FFF18A5F000-0x00007FFF18A60000-memory.dmp

Download

memory/1608-4-0x00007FFED8A40000-0x00007FFED8A50000-memory.dmp

Download