dd135039cdca3c1577df860983ab9e7959dd18c64dfa228bccbafc6f23b95fa8

Analysis

user interaction
yes
max time kernel
34s
max time network
44s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ultimate Sniff.exe
Size 97.7MB
Sample260801-e98z4sdg49
SHA256 dd135039cdca3c1577df860983ab9e7959dd18c64dfa228bccbafc6f23b95fa8
MD5 ed929a46f5c0f945333ce75d8207011a
SHA1 3c39ea7ffc583120ce98f40bcf6b865f29a926ef
SHA512 ad66510dfb58bcd5cb67d34badce0c7f535c4781bf4b661bfd61dd09d17c9ff6c208cff82584d67318810670ab40c1055a14127f75a622cd4d72006739f832f0
SSDEEP 24576:PnzGYsKvc1Bss+b9R8OlgBcqqAVWubSNQjG5:P1s6c1mtb9R8OKBBWrqG5
TLSH
T1CD281213FF5190BCE442C4788215A673A5B6B89B8B212EFB43544E307D25BF46F3DA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3292	~$0e593704.tmp

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	~$0e593704.tmp

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
29	discord.com
40	discord.com
59	discord.com
73	discord.com
84	discord.com
113	discord.com
28	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl	CredentialUIBroker.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
5676	Ultimate Sniff.exe
5676	Ultimate Sniff.exe
5676	Ultimate Sniff.exe
5676	Ultimate Sniff.exe
5676	Ultimate Sniff.exe
5676	Ultimate Sniff.exe
3292	~$0e593704.tmp

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5584_250048757\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5584_1208490791\_locales\uk\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6804	msedge.exe
4480	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CredentialUIBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CredentialUIBroker.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300328314987849"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{D4670C59-BA0A-49E8-9EBA-3D3431E8309E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{AF0A89B3-55CF-4FB1-B887-197C7CB74F37}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5676	Ultimate Sniff.exe
5676	Ultimate Sniff.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1828	msedgewebview2.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5584	msedge.exe
5584	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
7044	CredentialUIBroker.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 5676 wrote to memory of 3292	5676	Ultimate Sniff.exe	89
PID 3292 wrote to memory of 1828	3292	~$0e593704.tmp	90
PID 1828 wrote to memory of 5124	1828	msedgewebview2.exe	91
PID 1828 wrote to memory of 3956	1828	msedgewebview2.exe	92
PID 1828 wrote to memory of 3956	1828	msedgewebview2.exe	92
PID 1828 wrote to memory of 3956	1828	msedgewebview2.exe	92
PID 1828 wrote to memory of 3956	1828	msedgewebview2.exe	92
PID 1828 wrote to memory of 52	1828	msedgewebview2.exe	93
PID 1828 wrote to memory of 236	1828	msedgewebview2.exe	94
PID 1828 wrote to memory of 236	1828	msedgewebview2.exe	94
PID 1828 wrote to memory of 236	1828	msedgewebview2.exe	94
PID 1828 wrote to memory of 1768	1828	msedgewebview2.exe	95
PID 1828 wrote to memory of 1768	1828	msedgewebview2.exe	95
PID 1828 wrote to memory of 1768	1828	msedgewebview2.exe	95
PID 1828 wrote to memory of 1768	1828	msedgewebview2.exe	95
PID 1828 wrote to memory of 1768	1828	msedgewebview2.exe	95
PID 3292 wrote to memory of 5584	3292	~$0e593704.tmp	96
PID 5584 wrote to memory of 3972	5584	msedge.exe	97
PID 5584 wrote to memory of 4224	5584	msedge.exe	98
PID 5584 wrote to memory of 4480	5584	msedge.exe	99
PID 5584 wrote to memory of 4224	5584	msedge.exe	98
PID 5584 wrote to memory of 4224	5584	msedge.exe	98
PID 5584 wrote to memory of 2448	5584	msedge.exe	100
PID 5584 wrote to memory of 2448	5584	msedge.exe	100
PID 5584 wrote to memory of 3128	5584	msedge.exe	114
PID 5584 wrote to memory of 3128	5584	msedge.exe	114
PID 5584 wrote to memory of 3128	5584	msedge.exe	114
PID 5584 wrote to memory of 2660	5584	msedge.exe	103
PID 5584 wrote to memory of 2660	5584	msedge.exe	103
PID 5584 wrote to memory of 2660	5584	msedge.exe	103
PID 5584 wrote to memory of 5528	5584	msedge.exe	104
PID 5584 wrote to memory of 3272	5584	msedge.exe	105
PID 5584 wrote to memory of 5528	5584	msedge.exe	104
PID 5584 wrote to memory of 5528	5584	msedge.exe	104
PID 5584 wrote to memory of 3272	5584	msedge.exe	105
PID 5584 wrote to memory of 3272	5584	msedge.exe	105
PID 5584 wrote to memory of 3532	5584	msedge.exe	106
PID 5584 wrote to memory of 3532	5584	msedge.exe	106
PID 5584 wrote to memory of 1984	5584	msedge.exe	108
PID 5584 wrote to memory of 1984	5584	msedge.exe	108
PID 5584 wrote to memory of 5048	5584	msedge.exe	109
PID 5584 wrote to memory of 5048	5584	msedge.exe	109
PID 5584 wrote to memory of 4360	5584	msedge.exe	110
PID 5584 wrote to memory of 5316	5584	msedge.exe	111
PID 5584 wrote to memory of 5316	5584	msedge.exe	111
PID 5584 wrote to memory of 3380	5584	msedge.exe	113
PID 5584 wrote to memory of 4648	5584	msedge.exe	116
PID 5584 wrote to memory of 4648	5584	msedge.exe	116
PID 5584 wrote to memory of 808	5584	msedge.exe	117
PID 5584 wrote to memory of 808	5584	msedge.exe	117
PID 5584 wrote to memory of 3288	5584	msedge.exe	120
PID 5584 wrote to memory of 3288	5584	msedge.exe	120
PID 5584 wrote to memory of 2012	5584	msedge.exe	121
PID 5584 wrote to memory of 2012	5584	msedge.exe	121
PID 5584 wrote to memory of 6556	5584	msedge.exe	124
PID 6556 wrote to memory of 6580	6556	msedge.exe	125

C:\Users\Admin\AppData\Local\Temp\Ultimate Sniff.exe
"C:\Users\Admin\AppData\Local\Temp\Ultimate Sniff.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Users\Admin\AppData\Local\Temp\~$0e593704.tmp
  C:\Users\Admin\AppData\Local\Temp\~$0e593704.tmp
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=~$0e593704.tmp --user-data-dir="C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3292.4280.17111942105220743626 /pfhostedapp:aaebebf3c675f9b7b91b42fcd65ef5de0317aba3
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView /prefetch:4 /pfhostedapp:aaebebf3c675f9b7b91b42fcd65ef5de0317aba3 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd8b815fd8,0x7ffd8b815fe4,0x7ffd8b815ff0
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView" --webview-exe-name=~$0e593704.tmp --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,17264751453626209141,1955885186462451135,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:aaebebf3c675f9b7b91b42fcd65ef5de0317aba3
      4⤵
      PID:3956
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView" --webview-exe-name=~$0e593704.tmp --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2032 --field-trial-handle=1752,i,17264751453626209141,1955885186462451135,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:aaebebf3c675f9b7b91b42fcd65ef5de0317aba3
      4⤵
      PID:52
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView" --webview-exe-name=~$0e593704.tmp --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=1752,i,17264751453626209141,1955885186462451135,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:aaebebf3c675f9b7b91b42fcd65ef5de0317aba3
      4⤵
      PID:236
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView" --webview-exe-name=~$0e593704.tmp --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3472 --field-trial-handle=1752,i,17264751453626209141,1955885186462451135,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:aaebebf3c675f9b7b91b42fcd65ef5de0317aba3 /prefetch:1
      4⤵
      PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/api/oauth2/authorize?client_id=1529962196405190686&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2F&response_type=code&scope=identify%20guilds.members.read&code_challenge=342tuQdXpc-ALtUXhNYIkzdf30Mys-fvPPxrIAxZwIw&code_challenge_method=S256&state=47ZHTfNafSfOwK2ajSzClw&prompt=consent
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd8959c188,0x7ffd8959c194,0x7ffd8959c1a0
      4⤵
      PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,4481452738040504915,12504863616525129370,262144 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,2686363776960730273,9732696208729232203,524288 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
      4⤵
      System Time Discovery
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,16556758561920376478,5534040015179432031,524288 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:13
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,16120491819240273507,12398400752321444872,2097152 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,4520420459847439736,14265310977010167831,2097152 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,4511423827917976843,18088776967547313924,2097152 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,9591697503041430882,16107783859485417818,2097152 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:9
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,1375257671961583111,8530909137205344775,524288 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:14
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,3178464231971791958,17882879239341301419,524288 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:1984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,2714530808824605384,13953667159651968828,524288 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,11647429049738822178,4344771579603501285,524288 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      Modifies registry class
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,10737865505289642007,2769038547183196006,524288 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:12
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,11372783324754354470,18188140518209112079,524288 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,11372783324754354470,18188140518209112079,524288 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,11390650852833029406,5645738312268421947,524288 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,11648334962469681688,7513305623959896370,524288 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,14270373800268426239,5225732887199943333,524288 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,16067670642190941153,7968390284486124237,524288 --field-trial-handle=2316,i,10083946631651526441,5276847675451512100,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:6556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffd8959c188,0x7ffd8959c194,0x7ffd8959c1a0
        5⤵
        
        PID:6580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,13321178011095185583,8463845985256202379,524288 --field-trial-handle=2924,i,11781098460577600579,11552343770717802293,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,15065470165391865890,4901238639551682098,262144 --field-trial-handle=2924,i,11781098460577600579,11552343770717802293,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:2
        5⤵
        
        PID:4448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,4911967022561818039,4051765421361860482,524288 --field-trial-handle=2924,i,11781098460577600579,11552343770717802293,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:13
        5⤵
        
        PID:6064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,12172268120081400667,2302027692374624780,524288 --field-trial-handle=2924,i,11781098460577600579,11552343770717802293,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
        5⤵
        
        PID:2740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,12172268120081400667,2302027692374624780,524288 --field-trial-handle=2924,i,11781098460577600579,11552343770717802293,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
        5⤵
        
        PID:6152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2768

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5604

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:7044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2923c1222ce49db187e097dafa5245e107880e380c2d4c3c042ec4c5e21d98bb
MD5 da1d8185397a8ac0bd44a31e4155fa93
SHA1 7c2bea94dea010a070c12a44a8464f7b1c541abe
SHA512 87ca63d88bf02a3c244ee505ed09f102c1f20a53c8d7854e1a9e11961db009f99bf7a7a5380ad49ee5b98c2e3c4196c803c521d754b64bb9070c4a8694487664
TLSH
T1DCD023317929F3A0CA1C013040100A002126447171A3435138E6180CCFF40C047CBEDA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 651be877889335a4ad7198a3507e3930ef716ac9998484096808162e5a711a96
MD5 1745a08c06e165957f34b3d9192f62f7
SHA1 c716e9b951730b0e1d8021f0dcd30da5b8b60857
SHA512 3424db9f5b119014f7384e2240c729411f703bc2e259553479022878fc1cb6089a7995fb50a5299710a6f412569129b8aaab29e2b3f773b2bd37afd65e447a75
TLSH
T1FDD02375B345D720CA0D55305811E7512273457070B7C77268F6644DDAE80C893DF199
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 649dfda4789315087985829ca5e1964752a4dc82be26e71a870c70ebae451c01
MD5 b220faedd985fb98753502a3a5a30dcd
SHA1 4ed28c5352b876331ee0e1eefc454be617a213ad
SHA512 6c9b0b0e1c25a988f0ce0cab3bea5bf3f1b6146122d054692886905693d25713e08ded8ce6682d208bb6e1bf52293385da11c1a9cc897744515ee4b0bd7188ac
SSDEEP 768:fWubV7ET0vud8WTcNYaurubZj/AeVl6abhBU27iMw:fWuhgT0vud8WTnauruV7l6abLd
TLSH
T16813093CB1464C12D0CB62FCE75B4A7DBF20EBE0E7D4191F322A7029526539F845E26A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 a14a2e5f1fe7d9e389b995ceb5cd4197d36ea261ab479d2656304da79b57fd0d
MD5 bf1d3be169010779ed7c8b77aa086d5a
SHA1 9e42491350249d177d12cfb36de28350f2c57427
SHA512 3164100c752e5d88c82aface3c7663491ed625c815079a2d63d246f995a4818e2c8d8f01a4495b4509a824bb58a8aae06cc1d3c2bcdec907510a1558f3162120
SSDEEP 6144:3L/qL/lu5fK4J5xqwGy0kIPQqB0/s1n/8vxIXluMjbjt9GXuw1OD:3L/qL/54LxBl0NPdBkqei/Tt96uw1OD
TLSH
T102B4B3F785005829CB3C12F95343367C9337418D2CDAE9DAF5765C99A829B33B2A4DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 4.0MB
SHA256 47db92621632019f17f6016a7562f16c6376ca06750b75452ff1f5c7e2b400a6
MD5 9de989168afe48276c515ee352e3864d
SHA1 fab1728219ec0b0b0330a468bb1cece26aba109d
SHA512 3cb1dcfcfd525ead7c66fe117623bb65ea7987932d4e5568dc6ac3e24e22b3e02ce8cc9ec71c7e2e597023334dbe0b73f98f6be6760fcc26e671c0bd7def8d82
SSDEEP 12288:uQmjx3CVT8Pa8XoAzNmm/uWcodvt7uwJtaqHKJtGV:BwPauoAcm/D9duwJsXtu
TLSH
T12E163ADB47787A92D7A6DEB0FDC9EC6D3EB411C2AED6E0432102C67910837C23A5558E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 dd5b35ba87c66297037063927a94511381d32b614a18328719abc7f353c18a6c
MD5 4dad45df02f3d125a64916261ee24941
SHA1 49f251b25b9e4c8619f37e441c8a38bbe997cfdb
SHA512 ab3a13ee5fa9520d0dec544d87646871884a9a224a878fb1cb1aeaf3027dce43d0ce4826a2a5d15779c0efa9616ce21a64307093aa7fba6dda26770ce39f4aca
SSDEEP 96:72/28TVflgAnVHxkzXoyFcOKDYEIFzBvS4NjD9iQsAIJCOwF5Oe5wWLTVE9bmvhS:oNRRLObSyICUeWWLhE92hx/AdV043
TLSH
T1A1F19852A75786EAD72A04F293FA24DABD7E03804E4B9FDDB248393A4147363584CE30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59b106.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b106.TMP
Size 2KB
SHA256 a3fb77bf6458a5a3185f6561522439b12dd6d9be41a3393033efd8c14994f697
MD5 ae010c19b350db2a1b9ac8dff693a8e3
SHA1 392b362ded993e4ba0a868d900b50ef56630ce30
SHA512 1f736b9b1f5b1767d339cdfd6cb5ee60087fe9d0b0b7243a0475776f5fffe46c4229bef3578248a9c31028de662a47e956f711de0a5544685fd8a3ddec35b592
TLSH
T1F551A5537BAF8AD2E73D49F192F240CABE7D94560E8F2A5D11442173DBC735BA100230
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 ecb56290db9c6f65af1a95756792cb0ffd0cfa7de5201f9c36b79dcd2d0b8e30
MD5 b89d26f0eaffe74cedd0d9bc5fc0705e
SHA1 2d4b7e0494fbc92489490b241d04bc808a518ceb
SHA512 f2931909c119f5f04ba3790e14a6af02c5d4626f503aa3ca74c0cf5e785a8565f488ced4fd00c9d7b42e97084f936420150b8a3da326320204fa0c03971dbc89
TLSH
T1D7E0200409C8C119649474D3C37D5708C3E53407E6847E45A7189CC8B14119563D9D61
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 56KB
SHA256 cf256ce16907cd0d6954403af407122c0152e21feb8d8749b8092c2606babc07
MD5 a025b3f70befae160a692d6f706dd699
SHA1 9d09607a068cc42c6891e22fa287d492b7518148
SHA512 2df708b7fbe1708f4d77b6109e1cdfb5e94282fe2e4fca1f2c4542eae1c556b1de0062ac4bdaf8ec1e9a0b868a8d661c80bdca206253d399337721c17c32c5e0
SSDEEP 768:9cQ1RQSEbG+Q3wJMHTFcyg2Yte5pbEbGnP3w+MHTFcK+G2YEgJ5Cs:9cmR8i4kTFcyg2EeTwiIpTFcKl2dgzC
TLSH
T18543C0289E3130C3C3590BB52B5B14BA1F5853C79C5C8EB3384781BA8CD966376AB65E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 40a5060218cecd81255e0f03bf4e751c34a5ec69f2f1e8c609882a0be68d9c8e
MD5 44a30f425684bc61543ae581622aeccf
SHA1 746bbc3dad131acf1c806a5d8805de852ffdfe29
SHA512 e69ce19baf9b10e45421b16ad00fc2027bb2694ba78fb9d5589fb3cae389176f008050b4b9dc3f2c3c12e9a7c9e391ad629fd3f6e6e169b220fdd77bd45e9b49
SSDEEP 96:IYpvW9EXe0TZtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/2fSYpv9mEDbbEOVp/:Tu0T+H+bF+UI3iWGVoWN3qL/6DVVV63
TLSH
T14924424E5F603612CDBC42756ED604A76C6DF02F8B5766EA2C611475CEE3682702C8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 13KB
SHA256 1c371fd6385c5208b37e6876b5fde682b7a9ea9c5cca68a5d95178b2d02866a9
MD5 0aad3cb542ea966049e33e9c4337917d
SHA1 85e3484e217db2a329c46c920c1ee5e742ffa0b8
SHA512 83108cd5d34dcec81858c1d0df828f5fcbb884e55f20784d78f5fcfba088545a09ba98e6368c1c4ac3d45ecb59dabcd5c42a9b74ee065bf3ad050ed5930fc11a
SSDEEP 192:EGjQsOX9wWJuU3Rlnzyi/oMChWjv2Oc8GVSs:fn+uUhlnRoY2O9GVV
TLSH
T135520E7FD40889BE472B83679687352DC7B726BE184DF59EE0C61D0C01AE26E22059DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 8d87383eb6ee85cc7adf14a28717e4e30d46c02573335937b60d256e4cba7663
MD5 8ae235beaaa7939476baf43141f87bce
SHA1 d50298f4e91ce3f7d61bd5a847693573da373713
SHA512 14143e5e4196c2a111008b0806f1c808d8f996305c3255596f73810c8b354f230449cc21cb9d3fb85e94de652d2c4109b68d60885bd031e7069deebe45a1c63a
TLSH
T1F1E0D86049CDC119690420879368670CD3F5740BDA89EF59AB149885F005094A3E6DE2
MD5 SHA1 SHA512 TLSH

Submit Download

8a783013-f674-4b62-ba04-691a855d1107.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8a783013-f674-4b62-ba04-691a855d1107.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 ebf1d760603d448b7e796d03f8597754bb598c60004db4e36add4c15cc7cc826
MD5 8f9b89c8a75bddd38852dbd2e239b668
SHA1 c7ff84325a2c1ddfcc617782ee2ad47b3591a395
SHA512 d7940e1fff87e9e93443c8039fa6712f027da45e3d28339e594e0473f62584627ab5a3928e61068419bc70824393d7db6c31ee6f03d8e960c69d65b3da399140
SSDEEP 48:Txk/LopFMaty423w/a9NUuTTdw+h58L9WXP4t9kjZ7HN1M2cB6HN1UeowQAL+o67:qDeMatha9Vd5XsgJjJ1cAUcMeIrwGp
TLSH
T135B2C80F1F306212D2B99336C9E188522F2C212DDBB36AE6DA09B0B78D656677A454D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1087009ffb62615d249b44ff2c9cc27f84b8818d891cad1cbd37b630d3c98e84
MD5 0642625a8fb17efb9d7c0e5a2d41f28f
SHA1 7f6cfb8016ba646baf7b898ac73bc5b91fc4bbb2
SHA512 ba1e42199fa05025ac07453025fcb2b21253e76ae37605722307e784d5b6fa4133baa52568cbcdd720e1c10650616a7168b6e7cbd3c875205669049291b442dc
TLSH
T1D66170F3C7E8862DC90156F0AB147E2FCE2D0955432C3D5AC9E4AE5B93E24B1E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b0ea1ed43acdfdaa61a8979fda56637f1ee227624a4e830c225d9cd211c2ace6
MD5 c53441cc4a289f984a60af26bce52553
SHA1 980006a32f3e97a9ac3593a4d12bf88f8d220fb2
SHA512 2385047cff03c214ccb5be5c68565a293b2e834caacd89b95a23037ce551134567be48b7a94ec98c343b8a154ebfb3fa0c01dd5f63e5045bcc00026e5b14077c
TLSH
T1A821CDF3C3E8567D890181F867182E1BCE2D0815832C3E5AC8D4AB5BA3E18B1E24095E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8684300df8964e5cc49df766e50e46f41a1dfcff33794e74a2cfe26a96f2a98d
MD5 6b2c1c073bedb872de372febdc65965f
SHA1 d3e2042a90c87624eb283f5c06208807db9f35b1
SHA512 ad60bb6de8e171ee92a3224f7258cdcee450e075c9b61347426d16f8ec52a576c8a6d433af814d0d16fec3590d2bf43afb22a23cdae61459b7df19497979b60f
SSDEEP 192:sxRBRaCa/ffstWpVAsleZlwzoA8pld/g6+WNjNw/XYD9n6SYgNhIgDdNt8J:sxRBPa/ffstWvAslYlpH/56XNSd2
TLSH
T17742B716A9286D3B8CC7D21DFB56BF53D7F91036A1D05E58A6FC9A1C04EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b9fa4fdd57fd2bfa4762674e94f6d6f7055475b56d7f7b8f87901051c5c1c57b
MD5 cb26938f6835424ee5db2cf469e802ad
SHA1 99d30f23f4c5970bccdc5c180ad9f133e53ad104
SHA512 d037096579daa86c3645f710227cf5e84bbf5750f81e924e8b01b841c153c9bbaefbef07960e93d6eafae6d7d9244f7bcd0e641dbeaac0a664583e389ee03766
SSDEEP 192:sxRGRxCa/ffsYslKCA94/tzoA8pld/g6+WNpeE/YD9W6SaGNhIgViJ:sxRGaa/ffsYslZ8JH/5T/2SV0
TLSH
T11332B8166928AD3B8CCBE21DBB55BF53D7F9503361D01E58A6FC961C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c2d4ca6b8eac802de202012147d9260da77eb317f0b887f283a4567a5f24e54b
MD5 d58f92374a51fe69ddbe164dc7f0437d
SHA1 018eaae417d3983779303b76246158fcbf3c7c0f
SHA512 627e03f51dcc026ed5f53675e5caa9d51b74cd1a5aa7cafc873d0c4673d8a54cf08e376f521e3dc41181c9aabe1e4db8e573356fe03923f9f80ab394d5b3f509
SSDEEP 192:sxRBRxCa/ffsrsleZlwzoA8pld/g6+WNpw/XYD9R6SaGNhIgDdNt8J:sxRBaa/ffsrslYlpH/5SXvSV2
TLSH
T10842C716A9386D3B8CC7D219BB65BF53D6F91032A1D01E58E7FC9A1C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 f45dab504f3262664baec6069237cbe532a9247a0a90b389085ea6fd6ed6fe59
MD5 062df2e8f6425abd62635fef3edcd591
SHA1 85c2bcd6cededb7f34851b0e23d3bc58730ddf6f
SHA512 8caefdef546139b4535337f91b95d2840b9a3f597c0da7e702c7de930b38d253bdc7cf0511554609289d20a2414547691abfdcaa969a88d3e727f90a3dcd7da4
SSDEEP 768:azfWt+7pLuLf30Wg/Xf7f8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsmYc16oropFi80:azfWt+Ef30Wg/Xf7fu1jazmYy6TpFm
TLSH
T1F2D2EA7B640CCE7F4F800A99AD197EDF6D6802CB9698CD5047FE981C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3e3ef9c6eb15748fa7a6bd19ba6fe1d161245b6c85ebdea5c5275a8d4404cb56
MD5 75fb95853eac1b046ec301b7327f563d
SHA1 8a6bcf59b715f5d58cae260cb847f35f46784e6e
SHA512 965b71e3605d228a46dda65ae803466ac34f65eb7f14e9d2b9a71088410b8b8841d682e4605e4736b4eac204223e00d5d3d17bdd75c4ccdc5ce4badfd29ae5fd
SSDEEP 768:azfWML7pLuL7J0Wg/Xf7f8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGc16oropLin8xZ:azfWMdE7J0Wg/Xf7fu1jaNy6TpLF
TLSH
T12AC2EA7B640CCE7F4F800ADDAD197EDB6D6802CB9698CD9047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\bf10dc03-2fb8-487a-9562-9fbe9ea43019\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 58ff3d5811c473f53c6bd3a2148def28a8f4d92a3c91c002d1d97c3e42020abe
MD5 120170ca54a05948dd52c81cb8a23b89
SHA1 f8d8d496f8d064a25fdb6af9b3c50a74c4331909
SHA512 7021b45cdec68741e0091e7ed89c6af492d848117a57bc0f29fe0b0618f8d03f181ade4ea1e7bdf8b544ba978c316809daa1b63cafa85ce1e25abfa8fa44b778
TLSH
T121D0A767E4554451FAFE8B851E35009E4725AC886489E18D7A12093458A5F52A212ED3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 9720334b18355e423443dfd6769a3818dc30175d9c8b157cdee4325bb121a1d8
MD5 c68904750e07056105f90b2472302521
SHA1 d1e44dbfd5c2b2e5fbf5d87fbd8472b5033d8b6d
SHA512 b4d04a28300d8436725e2af299fde518945fdacaae26ca39948430cee4e4b173a121d1542a8ba8d44874f1433534c0486e5fa470c9c9347ecd143ea9a25bfd4b
TLSH
T1CED0A767E4650451FBBA47865E31009E4761AC8C6889E18DBA13293858B5F42A311ED3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59525c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59525c.TMP
Size 138B
SHA256 e26e4c3d866279cde28768d96dd5077eb5983f53c399cec370ce6d9078ef455f
MD5 85b86c3612fa6edd15dc3fdfc23df75e
SHA1 e2e37c2b9f10f4d587c0f4544055bc67cb87a371
SHA512 9d69ad007599f0d1d6b20b1b3c789ab7f7a3f5ed326677b042d71103015bcae900be99ce3bbcc3d8e9fcfe4b93009f92bb513b2e59b3d0233e3e77c08aabb04b
TLSH
T175C02B63F0440402F73807800232005E47126CCCC88AD08E782338242035F137202ED2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 a59aa1dbb975b6baa24bcfaf7a1e70eccfd39fabfab3db2bd2fa0e207a4d9198
MD5 b5e549a8ee854da984862c6f57c0594a
SHA1 ca512c33929c6c1ab3e6d96c87d02ce500d5b665
SHA512 1d004f5e02bf62ddc310d9bb6bb005bbd8ee69d8438d2616dbf5db7c37408d24c021ca4fedf423c01ddfa8ef5206c55e0a2283b5da7bc3d0bd221ddcf797155c
TLSH
T188E026304FC8C17D6017208B4338A708A2F9B80BEEC83D876F21C888A182604F2F7D90
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 7ef5a376ed2523b8bdd10eddb87eba4b94fc7d667718d4958f8282c6d3424409
MD5 d844e76eb80b5703353b1b724deef8d0
SHA1 57986ed94977841180141275d672d4dbe9a095b2
SHA512 a7fee26bb54b30a5ab4ee2443860e307a4cdee892d2e34911de9fee6daca80e7ad885c726e840c70ff3843c23b2e056d862f6f42a764456aac06e89ef96dbd24
TLSH
T1EFB012943B31CA1AD484053317F8C7E06704E01210959503D848CFA21F066983E81CC0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 e39ab74eeda8871448859b690d74bf279f668c3d583b67c084f68a1aef93f169
MD5 8598630ec8caa272e54df21f2f24d0b6
SHA1 03f19da8bef60cab9375395b079aeaa8cdfa9381
SHA512 5c5099d07c2b6d6f92d864db0b6e1ab2f2960c76180045d61717e6a6b7c896f0476631440035989a98197fd0b12331b7fdd5e893026947a03451c12f6e994836
TLSH
T191E0D1305FC9C23A514720CF5328F70891F37407EDC85D566B149488A245260B3A7D50
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 5eb013dbfcc77f7aa06f996ffd2b177c0d2fe1ad5ba1dc9d36fc5985ded80916
MD5 5f7e286515c2b35feccb43f923a7f9c9
SHA1 fb01537bdfc1b8ffd706f8e655d524dbc92d19b2
SHA512 3d2b32b49bd56027972f77eb6e132fd5d0538a303e720e98c70e00923d89418508dd0baa5d092ec1b9062523bc64355365662f2f1ae505bc387562450a25a795
TLSH
T1E6E0D8708AC4C239644070C383A8A719C2F1BC1BDB857E96A7186CC8B14125473F9DA0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cfa21f3ab809f8196c9a24f1d2c28795c33a5e84ed288c58d388d14c98360a42
MD5 5e5f90287349bc237a27b9c38c5b2d92
SHA1 74816502fce9d480e9b8b7104498302c1bcf0548
SHA512 65ae68e0ab038eba2adaffd4b892e197e99339cb63ca4d36b9d35828d007e7f80a591b42efe80ebca85838b910b8790776604458a6498784faa8800ed4cc514a
SSDEEP 96:KR5WnjRzHDW3EygrDK4aglDcJh8fnAU84KRqyOb6KgA7rg:C5WnjRzHS3EzrZaglwJh8fnAFn9p
TLSH
T14EA1E312B27E02503D7F655CC5A4E5275282B4673418AC3BFBF901A65FAAE025CFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 f131449c60891db2068574f353cafbc08951d556197e7cd8ec8b53425e61a618
MD5 fd1c8783c12a620560adb9fc5c7b6291
SHA1 031d0fb15d0ab66e6ba39561cba6cf6bf4b484a4
SHA512 a85c7ab7b278f4995672f0ed5d74aa90c63442a15a38a54aae53c92d0755ac6930380e9e0e4b7892151427a73ec3dca12a441ff58e4087ba1ebcf8ea2a159cef
SSDEEP 384:DNrRZyCSDnxTICaMEhIKyll7svbFKfk7:xFZJSDni+yI1l7svbF9
TLSH
T17244740A7B747001EDE6D9721CB080771E3C716D8F62A6916DB254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e69e068c-b1ef-45b1-aac4-7caf0b05ce00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e69e068c-b1ef-45b1-aac4-7caf0b05ce00.tmp
Size 414B
SHA256 e9ed62bfd19e6128381fd50af22821e9aedd57f4fb15b9923a414990aaa5b7e9
MD5 8e6505ef9fccfdf021bc44af8ce8c420
SHA1 7ac8169626d91cdcbeb039a3bf8c730f2ab757b4
SHA512 bc42c95d6e743792d8b34218156d67a113c8ffe42a77d4e2bd5f948ac27f716b6e29d16ea6a48d97d8a74f79f1c75f02ba29061a180421b9b93663fb31897c0f
TLSH
T1B3E02B79CA35FC3708FE071960A40686FA1017172A40495F3E3CD20C4FB5A3B5586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 fb2e4b9bf374a68f45f1e06407c4d7969c8427621f583c3db56f5d9b24f32783
MD5 d2339108c1c65ff1fa245514229079d3
SHA1 294b438f964b44610ddae7bcdee1183be456bee4
SHA512 83c19f00a10fedd3e3056cca9d9ff12e29af1943116d95258d5ad383b2ba821421b4f45450a3fcb8f496ed11830091a86163be55acb178beab10f2c12168f7f9
SSDEEP 384:bkUQDxIIIEbkMIMqBqlZ4staF2st0rbure:gUQDDn0V6
TLSH
T1BD42959A26052BF7C25F5B3653639640ABD848820477227D31762C0F8DF3E9793C5AF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 68ee76f5299c42167e4fe5b11b9ba5547cd8a4c28e4d452d69a25011f0cc5abd
MD5 018a147eac03224851acb1eb44cdc2bc
SHA1 e15ef64f7606fda621c7648589df2638c28cfd5e
SHA512 a8dfb196400031977638744d5ec2efb79ae20b9498d3a110ddb8df7fbb348d81c7cac5889b4ac80fd5947807aeec584464dae3eb0c7fe3c4d07831ac7dad9c88
TLSH
T1A8E0D8116AC8C16F641620C7A2284308C2D5340FEF852D499B1484ECB006100739AD52
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 b209c05fae49bbe418be6d279a1b025a2e4ee9617373c068c20d72e63c99055c
MD5 d91c72268bed47ae714153e5d6082bfb
SHA1 9a8f8587d2a1950d8b4bbe7915cce2f43788e9ec
SHA512 d10bbda6469fe505658ed555efbf29eae62bb3f045a483b7ba23317a269348dcadae2d984b46848248f79f3163492789fa3ef8b5f86b8c5c096017b99b656729
TLSH
T1C6210495F330C208E14A863EA07E9B291738E816CFBCEC0F447924256E72B400E4B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 e72c66319521a2e8c4fdf089867e501a05f84162f1ef4eca5a19aab5546f9094
MD5 70557a7785639e0f334c2f0a740c6a2a
SHA1 278ca69eba891d583a28997d8d633123f3d7c182
SHA512 e1a286ac9e7aaf2ce0aa6bb16891d8a37b4e8d98f1c8dc100f3bde0758c026ea75e6b9850e53d1468ce8d8c6c880370edd23174753147ce5aa49c5da080f211e
TLSH
T1C6E0D85069C8C15F905520C382689748D2EA3C0BEF842E459F10888CA546195739BD52
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 0f7cf2881b859a9da3ca0c98226a4eb480a0575ea2e1a58fa1d11c1f4a9157a6
MD5 832e1b345efc760b4fa93546f50f0c0b
SHA1 41f6a7f20d4ab3fd509b7366d1aa56541ee4a9a2
SHA512 3cce49317ff7640857ee6a4cf10467a5192252b18103feec71dcbeb7bbbfc176e0c3b08e018da6cc72ede29b36ef7d57a3ac60ce89268a324a7e4804765cdbfe
SSDEEP 3:MsEllllkEthXllkl2zEflwFhRKlt:/M/xT02zRFHKl
TLSH
T1D24404047FC0740FD50010304073C3D017F0F7100511574334D1043F7CC75400C44000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 0fbae1515dfc4e7b00a3e57f0c98af9fb77480b845a0b14df72e2a77e5215a87
MD5 683cf7797540eea39d09601ad0b04a45
SHA1 5d1edf13f833dde4b1311c0de8a11e78d4bfe2b6
SHA512 23ae527f29ed2f641793db82e5d0a40801c2b9f6ad2e85f11530fe616c69f98340503465501436469f933143cbd8ca148e0fd993280c0964857e1af99db11625
SSDEEP 3:MsEllllkEthXllkl2zEfldRKX:/M/xT02z9
TLSH
T1524404047FC5140DC514503050D5C7501371F415051357477CD1043F7CC7FC00C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 6579ca6558f9efe2ac6062a59a315bd9f394fa4fd8e0f3fbd215a907d6105005
MD5 6f3d934d95e7969ea505415224aea42f
SHA1 d0bf909587322c60c9c0cd7a47ad2c0e8f1c7832
SHA512 4036ef8453d3bda1c0c5ec132e2693dfc6b960b60470c7d60ed21797851f6da47cd4f2ea41abf0497097e67dedcf28bd34a50ee752572c582051cce88dfcfdaf
SSDEEP 768:Ws3Xf5i0aSrEnjN3Gac1FGO98r52ewBKZOA300:Ws3XPHQnjManxr52evZ5P
TLSH
T18B139D7C5D249D7F88EEF345754E3A626EA80273D4F409A8D7C96B0CD072598F70B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 87c27bd21ecdfeb906d9ecc9eaffb57d87773afa0fd1f3fd4cfec13e0c91aee3
MD5 cbbf9f6ba6b157494a97dd46ba334c15
SHA1 32fa1c408cc0ec5260a49f9c2a783e3e4f228275
SHA512 570b3e7224a5ef8baa61f28279eb611552177c062688ccb60207e8794d1a0c50e9804f9fa834cc99fd9d15b0400feef12c4b5fc83669766c505e5657dea695f7
SSDEEP 384:nQsrv+89zHqlDNP9oidS38NGP8GFURO2YWZlf8hyEG2dUGyfbFwy2rEoajo4cdRR:brv+4UNbdS3LM5i0arrEnjN3Gac1Fioh
TLSH
T13503BE316968DDB38CFBE385B1437B537FF4269384C50AA8DAD96A0C05875ED270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a571c11b80854175c5de8a6161e46b4f1f41321f4b5d37bde511b22b0e5130d6
MD5 3e6330d8ab10f01a184801ffa670f430
SHA1 b9300848f3514232dc4471bbb1c632cc4972f84f
SHA512 56739bb4e45e89e3295c7cc2d7c42d57057efc55b843e9bdf55d2e2fc251b85e45f3e325843a9a55b188a375391377fac3b13281e781a77b2e77d5894df3ab57
SSDEEP 768:rrv+4UNbdS3Emi0aNrEnjN3Gac1ZEeVH1SCz:rbsbg3D0QnjMaXEH1V
TLSH
T10C03CF3669A89EB38CEBE38571837A037FF4525385940BE4C6DD6B0D069B5EC130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2372e868b734d20caa40f2bdcf42c33d0ce4bcadc3be4a6bd9b6aa32d412c2d9
MD5 d032773de068bd940ba4c117b6a7940d
SHA1 f66c6fc1cf75aaed60eedbbc76e11bbc37e157b0
SHA512 6413cbf68fe43ccd08d819c3bf2826c4e761705f025e0ea669f10aad81677f8bf4db1745e07959c18703d5ceabe81d20bb0a7f5b9722bc7291b2b48f11b6d0ad
SSDEEP 768:lr33E5i0anrEnjN3Gac1Fi2ewBKZOA300:lr33AWQnjMad2evZ5P
TLSH
T13FF2BF746D689CB38CEFE345B5437783AFE416A394D40AA8DADDAB0C058369C130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 6a20d295ffe149c34adff8d547a12601d8c6f9ef36f0f3abe590c7720af41a4d
MD5 73494b8ef32d60acdcfbdbcdd68740a2
SHA1 5def056080a6310498255a231f1011581d21b3a8
SHA512 5c2641770bdc31df87eb61976ba281295a81d71028bf6aeabb8a967def927197d60bc60b37edec9ce1314ee8e80f51e84e471d8e01515f113b20e301c3acbca2
SSDEEP 12:TLJYJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isQQQtydlUssMzA7W:TL+j0afDdWec9sJVUOp1s1jzq7+jy
TLSH
T12892DC6669312033ECDB4B76B89389900EBD065E89A77955CED448210EA1BC2E2552FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 2d70ebb6bb784970a691ffd5d3f44402939c0fd6e3d81a833c05cbc42e1b5a07
MD5 1f42ca87a7ac03c444b15b5139ffe08f
SHA1 410624c4b4ae4e537616c9346ed71ba837f8ce12
SHA512 4ce60fe1080abadb58a80cc18c68430c1a55c33d06ad2dddd813e29142afa94db7638fe7594af322046b88f9b60f8cc52aba9168bec747939b4b37a647b06852
SSDEEP 3:MsEllllkEthXllkl2zEflQH+l/:/M/xT02zlH+
TLSH
T11C4404057FC0144DCD0010304051C3501370D4101551575734D304337CC75400C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

343691a8-4b44-47de-8bd2-69873dd16631.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\343691a8-4b44-47de-8bd2-69873dd16631.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe596930.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe596930.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

818f7ca5-5e7d-40ab-bb0d-eac513c54846.tmp

Path C:\Users\Admin\AppData\Local\Temp\818f7ca5-5e7d-40ab-bb0d-eac513c54846.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5584_1731722156\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~$0e593704.tmp

Path C:\Users\Admin\AppData\Local\Temp\~$0e593704.tmp
Size 515KB
SHA256 7e7c0b1d7a8b1d00af84e2514adbbea65c1736b5087b3a5a83a54e216537ab0b
MD5 3a24795d7e13f9cbbabab348e6379e98
SHA1 c34f1e31ea80c4fffdbff975e033a6572efd3d64
SHA512 8d18727330712b88092b0f76d67aeda354e8be445edd041c5c5ea98c9f660e9d7d289ad20cc05d09f25a0b7509d0e392682870a828bee47106756710d2088f26
SSDEEP 12288:T1SftplXLKvrHTsiKz+Obyb9mbvxbD1M7uabzbqEXbdmb4Zb7bMbKboyv4NbFxb2:5kHiHTsiK3eNNQjG5
TLSH
T197B49E1EB59905BCE16BC57CDB5BDA02F276748E03218AEB13A007322F576E5DE39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8c98f21b5ab7f96716026bcbfb110fa727c77ffb435ea28c7bfd286b7445c33d
MD5 beba78e20838543020d76871cd1a9932
SHA1 23cb637b63caa12d049d865eabb77aa40b1b333e
SHA512 650e36345513c9c9c89435a959cdd5dec17957c4813dcd38b4a280129955878463adda30305da45f033dbb106a4213b5b91f8e91847f665a14b10492824a7792
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a9ade6bb6ee94eb341383a6ccfaf2eb18b4df98bf520211705f1ef720ed30414
MD5 4c2f021b70641304372325877e1d8966
SHA1 8d711e25b327b7d2454a449530e2411339c40108
SHA512 80ec7199a970bdcc2f0b6f80257b1091c8f0c66248df84139da4a874110291594953502ede1a29e7230df86c9ede5c4f55f638fb33c8ee46042acb07bba7eb24
TLSH
T1D4D0241733D1017CC03030330043714C0D40C30F411541435C7CC55D3FC40500D0F451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59be35.TMP

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Default\Network\Network Persistent State~RFe59be35.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Default\Preferences
Size 5KB
SHA256 ebb75922430b8aeb9430d02890b045f3a9a3152631c7b70859696c8d6239c35e
MD5 5432d4fd28283d78a42eb906dd0bd740
SHA1 8effbd605cf8662ef733b06b4a913b0e4b61e0d1
SHA512 d8c3715c0b567de11bcf796320bdd18b315caaf5e22ef622c76db9421219f5fbcd591ad538ee77fc257727ae4d253a37a40777cb20e0ba7067b986b4ed1bcc58
SSDEEP 96:sty/dR39M+pb99kQo5h16ZZs7/x+6MhmuecmjeTK+gFUF28XM1C7K:stKT9xpo+sV+FijxbwG6K
TLSH
T115C184125E28797B4CC7E619BA29BA43E2F9603231D51E58EBF8462C08DA5DC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe598ca6.TMP

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Default\Preferences~RFe598ca6.TMP
Size 5KB
SHA256 a0cc8859fe6a29dc66ba6caf2a278ab5357c9f59ce95bae77bbe06a3c35979e9
MD5 b92021cb085f04fba9da889d7cfe7395
SHA1 b0e0e01a1f11581714c94b8252f229796830eb88
SHA512 9878eff961927b58939ddb10deaf477b79e623cf441d07de0505e763ead9da95091c9cf2d1cbad3233f6ee96082e66310803845cd93bcd7fa8da88fe190b0821
SSDEEP 96:ry/dR39M+pb99kqdo5h16ZZs7/x+6MhmuecmjeTK+gFUF28XM1C7K:rKT9xvo+sV+FijxbwG6K
TLSH
T10BC185115E28797B4CC7F619BA39BA43E2F9602231D51E58EBF8462C08DB5DC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Local State
Size 2KB
SHA256 abbef27646311f20fa1a64f75a048983380edf564b21ceed52a015c167783142
MD5 c5e8b25e3eac06beccaed261bc3a199c
SHA1 3bc8bfc86e5a3a05d54e226e498d96992a965b67
SHA512 e90cb5c7bed28121b210f117cb4f29651f16dadd83dca52c8be1dc48facae679137f613fc6e753b571431b324b216cb201f5576528b0e032b040da11c5c7683b
TLSH
T1045194736C20967789F30B4878977F238F7A50AB95623FA096ED1B1C02DA15C1302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Local State
Size 3KB
SHA256 46b57a221262aa3a96c5636a57715d0fa08e5fe1e12f10f9c52960ad87d46070
MD5 15e26a4e3342cb7d620bab183ab3fbcb
SHA1 68ee48dbe714a445c963b146ad7d644240522fde
SHA512 57f75dfba4abde3533333e639ec2f4cb8eb5068c7f0dce0af69a39bd2e0649db994365402429aa067ed5875fbe374d7293d56cbf341c5be387a124ad43433b20
TLSH
T1DB6172776974A93B8DF38B45B8862B17ABA65037E4913FA8D6EC1F0C02D728C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Local State
Size 15KB
SHA256 23233bf9e3e9ea352dadf6fa121fd8202d677b357ed26b4e154e0e5c7436688b
MD5 4c8a5f4ed4bb92c2e8d8b0a9bfa647e2
SHA1 3d41fc86b6a3d32474f042ca6c7d99e818760c15
SHA512 9433cf2f4c1864d6eb4c593354098b06b9ca80a626f1b5677fc656fbb76352c8dfd4246a0ca1f834e833ae77af71d850bcc08eaf38d3c308689d0c4b1952272d
SSDEEP 384:7+aQikB+z/xvxjg/qhEwNBSzYr72j4nAVdp619zp:a/UxvxjgC+ArnUOFp
TLSH
T13F729F3798792E2795F3AA05795D1B8BCBF984B390C17EA84AB99F0D07872980302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Local State
Size 3KB
SHA256 4ebd1d809d1022e671222679a7e8163b7d8a214f1614e6ca93bd51fdfefffb29
MD5 56867c80b7b055b2448aa7545966961f
SHA1 7880b15a1db9be4472d8f169faf28f5f4a0b4aa3
SHA512 856e29e4f32c4df725ec97de1bbf3b9b95c0e59f7c6a4ed77147e6a5b1fc38f79c51022e57c197eee23b7afd0f9b25db33f5b52f9dccb5c70837a03d2aeca8ec
TLSH
T1FD7196766974A9278DF39A45B8863B03ABB55077D5953FE8D6EC0F0C02DB28C0342C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Local State
Size 15KB
SHA256 7578ebf3fdb05cdb1dbda4fd0e92f459a84b7fa405383b23592d607d13e1fa0f
MD5 842928a263b231501ed4c1d56205b274
SHA1 11b477c92a542dd1421bf2382a5bc065bf9c4298
SHA512 6c85b3d1b8746759028e36304fd2da5b6c514dbcfce0ecd9df74ffd20f92a85be7d78d9927fc7c5444b7725ff69da34db87ce0725233315ca9afa5a0c0deb23e
SSDEEP 384:I+aQikB+z/xvxjg/qhE13NBSzXA72j4qAVdp619zp:H/UxvxjgC+1PrqUOFp
TLSH
T10A729F3758797D33A5F3EA05795D5B8BCBB884B350C16EA84AF95F0D06CB2D80302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Local State
Size 15KB
SHA256 7afec48a8233ad1efe86b0af4ad9f754e69f1371fb85b230c57981f3f8c23654
MD5 d4f43c7685bbb9e4c30c7e9d7762e98f
SHA1 1c97b5f326ff782181ec48c204cd4122cc22a42f
SHA512 5821f56c9c072c2ec8ef55502ffe1c5d67ee1cabd738a655dba584e75f36ef907cd63553db5bc0fbdb47e003fd2da54adc4a15bbe720bcf1173fe854d3184d4b
SSDEEP 384:N+aQikB+z/xvxjg/qhEONBSzYr72j4nAVdp619zp:Y/UxvxjgC+KrnUOFp
TLSH
T1F4729F3798797E2795F3EA05795D5B8BCBB984B390C13EA84AF95F0D07872D81302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe593bc7.TMP

Path C:\Users\Admin\AppData\Local\UltimateSniff\EBWebView\Local State~RFe593bc7.TMP
Size 1KB
SHA256 d6b94a0ad643e0808a261cde5e4ba74bd37d15cace70a26f8827b2e927be57a0
MD5 2f8142c6910fbe437ee1ac6452d1cd3f
SHA1 085624eb80baa4a6d2481e05334c1dca02068de6
SHA512 5cb5710eddabbd0ccdc23c14569b120334ec01e72a10c3cbe6ffb0f106f877b23317a98bd872f0c529cb32beb8a2ca5248b880c196c79137ded99a00c8d50c1c
TLSH
T1522162F3E9B04B729CE21B8A71937A175F7640BB81116F8461ED9B1C02E614C9A16C33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1768-108-0x00007FFDAC900000-0x00007FFDAC901000-memory.dmp

Download

memory/3956-762-0x000001CCC9170000-0x000001CCC919F000-memory.dmp

Download

memory/3956-30-0x00007FFDAC900000-0x00007FFDAC901000-memory.dmp

Download