ad9be61bc241cb8c267ed6177a0d0eac4f07992e41e04e6e0372b506e3b894c1

Analysis

user interaction
yes
max time kernel
202s
max time network
207s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Manuela Picard - Kozmetika.html
Size 826KB
Sample260802-dg9khashmb
SHA256 ad9be61bc241cb8c267ed6177a0d0eac4f07992e41e04e6e0372b506e3b894c1
MD5 6f01100da1e250c503a76cc6b85c6c84
SHA1 49ae0feabf5c8b71e05975e25740676916c1ed8a
SHA512 90e6204209dafb2123e42bd592f9ddc00b3630939f6a3f5079ca1736fd769582940ecac9e156c49868f356b2b9e0bd3d7d5bb1581f0cd0cbcc314f6d08b6e7b9
SSDEEP 12288:up7NKT3kQiIA+gQVVQiIA+gQVTexeqhizj9Ias4iXbaHSQYg3KT34Ygts:upBakQiI9gQnQiI9gQ7Yg3a4YgS
TLSH
T1B2056C9056C078AC220BCFF7B226B3C8E1668995F15401CEF579BD58E2E7D11F5E22B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Donut .NET loader by imphash — stable across all waves/branches despite per-lure SHA-256 churn 6 IoCs

resource	yara_rule
behavioral2/memory/3136-311-0x0000025417C00000-0x0000025417C45000-memory.dmp	SL_V13_1_2_Loader_Imphash_Pivot
behavioral2/memory/3136-316-0x0000025417C00000-0x0000025417C45000-memory.dmp	SL_V13_1_2_Loader_Imphash_Pivot
behavioral2/memory/3136-315-0x0000025417C00000-0x0000025417C45000-memory.dmp	SL_V13_1_2_Loader_Imphash_Pivot
behavioral2/memory/3136-314-0x0000025417C00000-0x0000025417C45000-memory.dmp	SL_V13_1_2_Loader_Imphash_Pivot
behavioral2/memory/3136-313-0x0000025417C00000-0x0000025417C45000-memory.dmp	SL_V13_1_2_Loader_Imphash_Pivot
behavioral2/memory/3136-320-0x0000025417C00000-0x0000025417C45000-memory.dmp	SL_V13_1_2_Loader_Imphash_Pivot

WinHTTP downloader by imphash — durable cross-wave-cluster pivot 2 IoCs

resource	yara_rule
behavioral2/memory/1552-310-0x000001CEE4710000-0x000001CEE471D000-memory.dmp	SL_V13_1_2_Downloader_Imphash_Pivot
behavioral2/memory/1552-319-0x000001CEE4710000-0x000001CEE471D000-memory.dmp	SL_V13_1_2_Downloader_Imphash_Pivot

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
108	1552	powershell.exe
109	1552	powershell.exe
110	1552	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
110	1552	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6040	msedge.exe
836	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301132283423924"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{DDA808AC-B68F-4717-8DBA-4AC4C3A43412}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5528	msedge.exe
5528	msedge.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 4992	1932	msedge.exe	89
PID 1932 wrote to memory of 5372	1932	msedge.exe	90
PID 1932 wrote to memory of 6040	1932	msedge.exe	92
PID 1932 wrote to memory of 5372	1932	msedge.exe	90
PID 1932 wrote to memory of 5372	1932	msedge.exe	90
PID 1932 wrote to memory of 1092	1932	msedge.exe	93
PID 1932 wrote to memory of 1092	1932	msedge.exe	93
PID 1932 wrote to memory of 5264	1932	msedge.exe	94
PID 1932 wrote to memory of 1028	1932	msedge.exe	95
PID 1932 wrote to memory of 5264	1932	msedge.exe	94
PID 1932 wrote to memory of 5264	1932	msedge.exe	94
PID 1932 wrote to memory of 1028	1932	msedge.exe	95
PID 1932 wrote to memory of 1028	1932	msedge.exe	95
PID 1932 wrote to memory of 2676	1932	msedge.exe	96
PID 1932 wrote to memory of 2676	1932	msedge.exe	96
PID 1932 wrote to memory of 2676	1932	msedge.exe	96
PID 1932 wrote to memory of 2608	1932	msedge.exe	97
PID 1932 wrote to memory of 2608	1932	msedge.exe	97
PID 1932 wrote to memory of 2608	1932	msedge.exe	97
PID 1932 wrote to memory of 3884	1932	msedge.exe	99
PID 1932 wrote to memory of 3728	1932	msedge.exe	100
PID 1932 wrote to memory of 3884	1932	msedge.exe	99
PID 1932 wrote to memory of 3728	1932	msedge.exe	100
PID 1932 wrote to memory of 5916	1932	msedge.exe	102
PID 1932 wrote to memory of 4680	1932	msedge.exe	106
PID 1932 wrote to memory of 2320	1932	msedge.exe	107
PID 1932 wrote to memory of 2216	1932	msedge.exe	108
PID 1932 wrote to memory of 3692	1932	msedge.exe	109
PID 1932 wrote to memory of 3692	1932	msedge.exe	109
PID 1932 wrote to memory of 5528	1932	msedge.exe	111
PID 1552 wrote to memory of 1940	1552	powershell.exe	114
PID 1940 wrote to memory of 2016	1940	csc.exe	115
PID 1552 wrote to memory of 3136	1552	powershell.exe	46
PID 1932 wrote to memory of 1628	1932	msedge.exe	118
PID 1932 wrote to memory of 5532	1932	msedge.exe	117
PID 1932 wrote to memory of 1628	1932	msedge.exe	118
PID 1932 wrote to memory of 5532	1932	msedge.exe	117
PID 1932 wrote to memory of 5260	1932	msedge.exe	119
PID 1932 wrote to memory of 5260	1932	msedge.exe	119
PID 1932 wrote to memory of 1352	1932	msedge.exe	121
PID 1352 wrote to memory of 1288	1352	msedge.exe	122
PID 1352 wrote to memory of 3000	1352	msedge.exe	124
PID 1352 wrote to memory of 836	1352	msedge.exe	125
PID 1352 wrote to memory of 3000	1352	msedge.exe	124
PID 1352 wrote to memory of 3000	1352	msedge.exe	124
PID 1352 wrote to memory of 2608	1352	msedge.exe	126
PID 1352 wrote to memory of 2608	1352	msedge.exe	126

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Manuela Picard - Kozmetika.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffe9cfec188,0x7ffe9cfec194,0x7ffe9cfec1a0
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,3402184471274751242,12412768486423403226,262144 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:2
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,16669200587366813567,526057131984570395,524288 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,11161840328786839771,12303178049827351618,524288 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:13
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,4755207701282994478,13502520386294584028,2097152 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,6457493959842992371,13749137913033654793,2097152 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,6420048466212263028,2370430456018516138,2097152 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,16971956659342666617,13665992998902787834,2097152 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,9902261910208775836,3842666632166661162,524288 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,7803308940750498827,18331980423110972727,524288 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,16631147269024159323,8321079729281947733,524288 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,16631147269024159323,8321079729281947733,524288 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,8652056897461979470,10403461283357002480,524288 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,4740828412841131644,11531549754274065280,524288 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,9456334534919555139,12957312642993742346,524288 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,18223068015767149243,16269984515504415867,524288 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6432,i,11391299673067836816,4168707590751872094,262144 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,5654273758425964438,11156685786764450896,524288 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,4488800560879081084,5143372837911778360,524288 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,13049373652027431510,6850826110880236580,524288 --field-trial-handle=2688,i,9892929582070966396,17045740991029219201,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffe9cfec188,0x7ffe9cfec194,0x7ffe9cfec1a0
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1936,i,7619080056360641073,18049293182869897606,262144 --field-trial-handle=2528,i,16433923133228797312,13415730786844205401,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2060,i,12587746093790271745,10257206514308718255,524288 --field-trial-handle=2528,i,16433923133228797312,13415730786844205401,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:11
    3⤵
    - System Time Discovery
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,14451054569269803384,4030549997031481930,524288 --field-trial-handle=2528,i,16433923133228797312,13415730786844205401,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:13
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,13792077346611971861,13771306325411817633,524288 --field-trial-handle=2528,i,16433923133228797312,13415730786844205401,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,13792077346611971861,13771306325411817633,524288 --field-trial-handle=2528,i,16433923133228797312,13415730786844205401,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,1260245212656973923,16865085642199397042,524288 --field-trial-handle=2528,i,16433923133228797312,13415730786844205401,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
    3⤵
    PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,13704380584059566586,16010620121553218439,524288 --field-trial-handle=2528,i,16433923133228797312,13415730786844205401,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,5128151927382519586,8692199243907353413,524288 --field-trial-handle=2528,i,16433923133228797312,13415730786844205401,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,11419333230518845419,7778395533826268527,524288 --field-trial-handle=2528,i,16433923133228797312,13415730786844205401,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,5118690964816120245,7495994009634777743,524288 --field-trial-handle=2528,i,16433923133228797312,13415730786844205401,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,12959046708964101838,17249552139274942445,524288 --field-trial-handle=2528,i,16433923133228797312,13415730786844205401,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,14381865287130697579,16778794270539943782,524288 --field-trial-handle=2528,i,16433923133228797312,13415730786844205401,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
    3⤵
    PID:3288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l2zzp5k0\l2zzp5k0.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE27.tmp" "c:\Users\Admin\AppData\Local\Temp\l2zzp5k0\CSC562D0AB540349CEAA6D9BAEF73B2CC.TMP"
    3⤵
    PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b12b6aaacc3531e2606fa5eb280ae4929c75f82670a5fc331990dcf5f4b1e81
MD5 e293a66f886f80f5eeb21878c0c77530
SHA1 3926f358e61777fe2c930dfb5287451f962a40a1
SHA512 dc4bd1283e4faac05fed23611e49d4a83971a25110ee2bb1461701323edbedf609baf8812ae633d8648747b3b817f886edfcd0604af5ed76bf6c8a9f9a75924a
TLSH
T115D0A7A4BE25B290C519503548600600692A46A2396B968660A5941D9974080A297EBF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 405921cb2c4a26fdc1ebcd78fdd857b816ddb4bcfd8b9e2fbd8f7c03eef095a9
MD5 7f49ee869e6f1a246caabee4b1485042
SHA1 a8307082d06be604118a5ca4e89a7a99828046d7
SHA512 3df84cfc86544ab1528ba1415cacda6ebf5b003174c7730e4be0710e8fdea13faae283c6f0c8e9efdb0c2b7b5d6ba9a8a1088cbf44422677e4c558ad536034f1
TLSH
T160D023F4FB10E750C50E90315C5063103A7742B0347FCA6350B5A41DA9A8084E3DF56F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 94a6ca7d6f208e509538c2bf5ba83974bbffaa63759cc94c6f820c910daf6f83
MD5 2fd31af9a2e99a66038e31227a49a854
SHA1 e1e8ea17fbbe574b023a5f461e289837ce9cd50f
SHA512 aa3434d1c420cb6550b8b302234eefbe013d111fcbff69b6adee77dec1d0c8c9d973594eac04860d2e8800127aea9cdbf1887870ec141c8cf8003541b938f00e
TLSH
T16DE0209404F5C21E5B43648762EC930C82D0F60FDAC4ED252714C448B50A0447292963
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 22e5cb01f6ebdbed715fd7b45bf1de3bdd39fa15dba170453b2932f400df1a22
MD5 7a7aba2207949fbb266c16f8c880ecd5
SHA1 1e4dd328622ec0368fdc3b58d4cbf647195dfdf4
SHA512 e94a54dc479d3215732e3e1a748750d3a8d4962ab2d38a7e5c00a7c1f199a7c7da9b01fdc9dae1be5f3bf6fef18b00b4f10f8e87ec7dba25024269398ebe097b
TLSH
T149E02BB9C831DC6B1CFD57AC54914746F66113672E80594F373DD1188F7177A018685C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 e0bc898e91afbf65543f74e90492e0ff94047258093f7c4001f49518c301ac22
MD5 536010e05ce964157ef9b9ed1fc01a44
SHA1 5e1c265da10a72d25d4c74e92a5cd4a0a08aa304
SHA512 2d61ee77e04451d037098ab4190d32e8cc2657972b2d23256f92f1109d887fbf718d678bcd992ae8110bdad8e960395bf0359a8c4e8ed4462f86374a9b151a8a
SSDEEP 192:/MN+xe1YviO+o4oRdXPDdLx+Tx4nPFCp:/Txe185b1xF
TLSH
T1B513E93EDB058DA6CBE3707C010B1B72577AF484C3F418639DBAB0296651F0129EE0AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 1156de5aaf6bb60606efbe4bce5ad2339975eee60750077547845338e1c70591
MD5 f4e7d122005dd4dd676628b723e1ffd8
SHA1 d5b21618c3ecfe0b04b06a24ba298a36243716e4
SHA512 d55b3a5793dad6a4a37f662c2e3f7bd8d68739033c1b76da7e66d87ed0e5d5dc5eb208545007c75615ad709ff4b0f6b6e5ead3760947b67390e14a1b7527cd18
SSDEEP 768:92NPKK8L/grL/g6/enGQwU42w0SR/gn4YjbXj6KFQ1qSpM:+KK8L/KL/gNAV/i/jxQ
TLSH
T1E7444FFB0951A41ACBA822F5E6033E3DD177450E6CD1E8E8E67C4C812825F35B2F9E95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 33d5cf8a89d5a1a2ad49aabce54d711a35d280435d5e7fdeb73da17cbe5bf6b1
MD5 5681276be799570b1eca087418d7736c
SHA1 00467b607017c97320ac21159419e72794628ab0
SHA512 3db89a738498ada9ef7d937e2ea082051f3397c0eabe6bfb739f1d10186d09ece27d3020e4d5fce3fae2341864950211c87b479c03aba59452272542163ed674
SSDEEP 12288:wKHQbAFwS4Bb85U/crR1/da9lzExbFHZuSqAqD36lrNiqdCfihkJRid45kSAuDHg:hHblZF+KSK7Pzv6X13JflRP8
TLSH
T183167DEDC97858C3CD639A30B4F0E9877C7413C3F995C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 368271d1df2e66fa28a56d60288484b0567081f313ea6592dc6c3d731f1962e8
MD5 8a747fde9a1f87353c8793bfa59aabfd
SHA1 8b6e3f4628e7f8656c0cf9726892061af775cd11
SHA512 79b7648a69ec01df636547b6bfc650cb0e7567bd907c6830233a3838a8b05eb5509fb407ef57fcfb79e03b54b9b9fe41ffa59db7b6e01f9ed9fa8dfcb40d93ae
TLSH
T14B31A8740BA539C3DF6567B267C7E48971F4646B25336E4209116D7487C2F2C5AC0033
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 a3ee7de65cae4e624051799d2359f358c573f16315d140711397c5c9a88cee85
MD5 8216c12e1b860cadf7f380c86ce9e4c2
SHA1 b61a639fcb6b2280c025d4567fbaef1cb41f534f
SHA512 13c26b2f16849272344e7f3b3385afe9054beab48328c15cb012c03b7694b4faf11411c0117bf60cae49e12a18d026b9f2ae203108e11ec1e3d04320f7d32c5d
SSDEEP 3:MsEllllkEthXllkl2zELRY:/M/xT02zw
TLSH
T17C440414FFD40405CF1510345417C3D00370F4100D1157433D517433DCC55400C04001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 c016f6db9a805a8b90610f566c4d5389b985d76288a4050b420feb720c7bc2cf
MD5 b9579c6541c5e32615c21d24c1572dd2
SHA1 38aa40dded72bef1d5537e2d4a4155e4fbf73897
SHA512 c60372ddd3cb8f679cf08ba8caef303a1c4ead3914d8c3b3d6ba6f3a60155c6b1e7800b309d6d6cb3ff1bf5757dc03c79e47b2f4876bc864bf5d5700dfd5921f
TLSH
T13DE0D8A464C6C56E696638836268770AD2CC7487DAC6AD031750CCC8BA4A005BA51A57
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 fb2a85f1cd669b283bbee3a70c1d9cee9ecadd268be7144cadad9bab5f13a821
MD5 e3200b9601241702136eb749082f6a6d
SHA1 8b7719881f20cc9fd2c71687a1989617761572e8
SHA512 d7e2420bbf2ce8ffb5080a8b147a5b248f770af4684a5a92bf273347c6f11152935aaa83ea5da04a543da5fb4296006f5d182371aaa17ceb40a6cb52cb27f408
TLSH
T113E07D7448CEC12AA5176893B3FCE748C3D0B50BFAC83D02575CC888B102289F3A6791
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 e693e8f4625c9db43dd397991fdc14cffc876c77f8b3244c9be52eaa9ccbda8a
MD5 1343a8fb08f82738fada78a2e5597c47
SHA1 5c2cb685754a36d4406b6a1b05cbb8cd78688404
SHA512 881b63bc7a437e0b64b102d086c2dca3353d8134e1b64ab2c885a96c427cb98064dc7396e120884b385ddd7818a2bb541dc83520a522396b77db6a091d593223
SSDEEP 192:7McXT2H+bF+UI3iWGVoWN3qL/w7ndUVVV63:7Mo6IkUI3ijVoWN3qL/2ndUA
TLSH
T14924221E5F353722CDBD813669E744A36C7DF03F875326DA686114B4CEE2642A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 134B
SHA256 6aa22b718c85b6feb2cfe5b0ed722a13d07dac2519f4b77e25c7e7907e832119
MD5 09e51da989da77ca646a80c1b3054f7c
SHA1 31fd9ee5e53a64a5c13b09f86df42640ecadafd6
SHA512 4203bbd5ca4f5c252eda1f99b98e6a6d1d8bd5ac84b9278541a1d94e13dd844471744f7455d773e91d74a6568a3e14bb7ae8b03520e5d5058e83805ff0ca404f
TLSH
T1ADC09B560573B56DE6144A32114417CA7E1BE010214CB3D5F35155005C514F551C65D5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 e17c132151579be6d584b3dae4ae8419c08b8ea17f1fd20fc13dda8a6376ae70
MD5 ec31d4077733f9d315e4980e73c2a966
SHA1 54aadfb56f4f6677b01b97cd0eac7eb1d26c74db
SHA512 258ce19f02012667308e83006020bf2183b0b5af797273195b2aea628676d20ac226428eaa66bfde5054811adeb3ce1c4bbc66fb981c8a8f8ee6c904a5327fb4
TLSH
T19EE0D87049DDC199550B204B639C7708D3E0741BEAC8BE171B44EC45F449484B2E25D6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 8119e919fcdd6382a0b27d1bedfce577cf4a2c99bf5b368058217151f713d361
MD5 7fdf6b8bd672811ac4fa5b2ec0c9cafd
SHA1 3c276bbe682d898dbbe83f0b90192df671307c20
SHA512 536f4d6958767a819ea2599a910e727367c1ca2517e340cd76ddee7498fc161c6143a2cddd5ca8309e87733671150d6562806c46e26f418f5bb6ff4eccd56976
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7oPw08vMx1HrU4Um:qDeMatha9RA7BGMTHo4Um
TLSH
T18BB2114D1F346121C1F05B76EDD189662F7C111CC3633A899D5420F38FA3A6BF60A076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 abac25340e5c2264521283da32f32c68544e23656321a64bb763ca1631ffe4b6
MD5 542c4d0c5b8fafe2da0f537206cd6ad3
SHA1 fc0861ed07a4bf36f922efa05438c0e4d40edc92
SHA512 94f959e687ba487b2917be51e4dceb2b40936cb317ada3aa97c2bc95f1621ee621507f08abf39de1ef7ddd5434c6dfc4f8a29ef5bdce502aaf3da86d8611fbd0
TLSH
T1D551F1F7C3E5867EC90156F4AB147E1BCE1D091A432C3C5A88E4AE1BA7F2471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d8ccd2561d16fbb8d5fd93edc5e3b194d31e8562b429978c1794bafd8c8d5f79
MD5 f103b2e0d06cfbbb8926be41c74f79da
SHA1 b4aee0f5dc917b92b6f6c179fc6598bc5a2b115c
SHA512 98edff89a8d6c5bf2ceaaa836b3181f10461f91cb4f10fb5669dc267443a1cc7e1e0a3ee3cc5c3362875e26b9ad98f141d8615dc37e66074b99ca41dd1202932
TLSH
T1F751FEF7C3E5867EC90156F4AB146E1BCE1C091A432C3C5A88E0AE1BA7F2471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4440b281213e45f584bef70116d8f76698b35c3a35d0b411a7b5a49943722396
MD5 bf4491cfec90b2e806ad657eb6ab1fb0
SHA1 4be04684115018e8b89372567ff6a107b7b38d80
SHA512 b66783bc62df4921b4f95dbb27c24fd704a50cfb22b07acc9044489e8cecf00cde642bb7002897ed27373c3e4122548eaea9c3f1155d75867cde2f971105e25d
SSDEEP 192:sxRbRi7bJ/flsRiKrjD3zoA8p4j/g6+WNIYEE/K0+G1IgDfJ:sxRbEJ/flsRijS/5ICJb1
TLSH
T1AC42B7166928AD3B9CCBD21DBB55BF53E6F95032A0901E18B6FC961C05E7BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 654e17b48d5a7b9ab2698b1f2391b681b3b37c1e2399cb9538f227ec5deef522
MD5 8d82d91ac3ac08039ca4d11fb6946928
SHA1 644f098e45007749eabc4385a2e622163037a49c
SHA512 f31b2c83fdf33e23bcdf98f52acac388b4fbe95a8be9bd3e7ecfec1aeff7aa113e8d7125ed0b11af6c590b5bb1b97283eb46498964523700b106df01f8a9f495
SSDEEP 192:sxRgRi7bJ/flsj4KrjD3zoA8p4j/g6+WNIYEB/K0+G1IgIJ:sxRgEJ/flsj4jS/5INJbs
TLSH
T14632B8155928A93B8CCBD21DBB55BF53E6F95032A1901E58B6FC961C04E7BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e955fef8d124e8c1cf4c99ad4f5f0e612dfd258afb22592b2080b5532492727f
MD5 604db45be81753ad16384de676e8f98f
SHA1 6558c3d5161ad6678325a6903d785ed2ae1346a0
SHA512 3cf89c23de967b883178534c934c986d2aa2d8ae68068d336be463054e6ea78d96b072b3e1bc080b10ae740070e7c68bc78a270f4374ce704e777ab2c73b4730
SSDEEP 192:sxR/Ri7bJ/flsRiKrjD5UzoA8pen/g6+WNIYEy/K0+G1IgDBrJ:sxR/EJ/flsRiAg/5IgJbl9
TLSH
T10B42C8166928A93B8CCBD21DBB55BF53E6F9503260901F58A7FC961C05E7BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a0d5466241195ea39aa907f7672a2afe4477e1c253fef1042e3648c10f1ad0c4
MD5 cc98565139e0e6801fb9d7d3767297db
SHA1 ca9e51bad856a3deadd716426cfe8188cb315c00
SHA512 ef0f439bcfca36a2963ca4ef6f5fb819014aea0afa0f84649c0b865c31fa17f1bc56fe29a3027329aaf53c5ca6d9f66602bb63c7adae1207859ef10f90fda10a
SSDEEP 192:sxR/RiQbJ/flsmWpVNiKrjDehzoA8pen/g6+WNIYMG/K0bg1IgDBrJ:sxR/rJ/flsmWvNiUg/5IcJil9
TLSH
T18F42C7156928A93B9CCBD21DBB56BF53E6F9503360902F18A6FC861C05E77DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b38bc88c5d4b0b0dabb4d2c337854fcec5b42bef7ad0c16ae6537a0efae43af5
MD5 f68adb05a6df5c7844a0b870528482b0
SHA1 b80356c3b26c3eaef19ad9871f6e3163ab1e8b98
SHA512 aeb754f905e945308fafbe792f7a6622c61b85167c6c451d0d085d0c0e25430c1c82c4ca2f1ad3fcbf1fde507acb0f56f6acaa0f27015ac316838c77860c3c82
SSDEEP 192:sxRbRi7bJ/flsR4KrjD3zoA8p4j/g6+WNIYEB/K0+G1IgD5J:sxRbEJ/flsR4jS/5INJb3
TLSH
T12E42C9156928A93B8CCBD21DBB55BF53E6F95032A1901F18B6FC961C04E77DD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 8037117c2c8f37262230336bbbb3b1322fa344732250b048ce5f8cd7a388cac8
MD5 43444d60f54bf8d73492c375c4134aed
SHA1 2604c508303f2109d2a484c8dcae039c9e067ca1
SHA512 3d482ac943629de58a47394b5b6347c1e997e68f7d35b1c684024f3887d6672d7dd0353133f241c6ed7a31f3591b41b5351ee999a9ad915696791baeed41dc96
SSDEEP 384:0OhQi3gfCtgHZFfeQKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVwY9VHRAIroZCR:0UQi3aWgH7feQ8F1+UoAYDCx9Tuqh0VM
TLSH
T15FB2FA2B600DCB7E4F801AADEC196FD76D9802C79A588D4087FE994C03C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 d3ced1c27d582a44b9dc785925cdcdbd40443f9a80d4fdfbb01eeb8953d2c23b
MD5 040159a4098bd8f8875e872872630574
SHA1 7cfd7ff92ec0c6c186766d37d173385a474ca88c
SHA512 5a78616fdadb7ae9ecc958ee1c68416ccdae5c231b2e862220622d9810e93d857a2f66b85ff3c6a34fa6815da0ce60ce8abfe3ddbd3543d56297f1a4df23894d
TLSH
T1CCE026B485C8C27D705B608723A8AB0882E4F81FDEC83E472F08CC48A986604B1B2693
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 4775374f073769ce5cdc35cebcedc0ac2987d2a5ac7d9128d984d6ccd764c45d
MD5 3a1cf9ab5ea5de0f092c7a73ffd4a6b7
SHA1 2cf43e70f734eff02843b2d296746a1663065809
SHA512 668b4e30fcfdbd0b3d04aa0a7fdcfd7f21e9e0cfd5c871fd60e6d0b3e40e5205a886182e8f78108f1d349035a4100e37e236997524189d51146940407ea2405e
TLSH
T1F0E0D87055CAC63E654720BB6368F308C2E3F807DEC86D222B0CD484A64B250B253A51
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 d7c08f48232bb0565b5b13dd13163295dac96607d62a4e16760b1c227d5f8897
MD5 7a8e14760b6f260cc18f88e209db99c8
SHA1 b2197a3ae45d38856f40f8e9d6b759cd9354d635
SHA512 4d4696f42af5879214a45358d043dfe09a47110a4a573608546f9b66e259af815574f27066bff417704d1abf9881e76059d8e88e38af5d88e9e143dd7802e9d5
TLSH
T14AE026F046C8C2799603708753A8BB0D82F0F80B9BC83ECA574C9844F501580B2B6991
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7614ede421caf513b684ffce902a46ee0dac17d7caefd68c3bb9aeb2d34ced20
MD5 86d22dca0b0c85b3aa29c9a066565852
SHA1 ce5ffaace93f13a8e7edb0e3abfaf231d63cf9e1
SHA512 48704f4edd8832c807fb6f50e86386706a3ba8f20873f3af52dc283c899090046ab5b646a69919c00de37aae6443008b3efa3649c33615bef953e09b2f57fc4f
SSDEEP 96:KRinOiU0kiWs5RgSiK4HgIicy6hAiLHwBUAyeSIWWLbgIIK4Ng6Icoob6vBOK6EQ:CinOiU0kds5ySaHgIpy6hAiLHwBUAyek
TLSH
T1D5915B1171BA02803C7FA55C86ACED2F5283B4663419A97F77AC02665FE6E124CFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2a069af5917d62eed24313e9c31b405989c69c07604e1662276a4818253df68f
MD5 7cc14c6f2d520c78e7ea1c75f108356e
SHA1 e8d64bcc0c73e259a081ec92d664f98725b10551
SHA512 04b03750c7237dfe7f6236ee7ac68594fc23f3aabcca88568a6141bbf1cc35662c5666c010f838a5d1a5465e2327e5541421fda9e4e0fd9fa9e3ff450c15d7e5
SSDEEP 96:KRinOiU0kiWs5RgSiK4HgIicy6hAiLHwBUAyeSIWWLbgIIK4Ng6Icoob6vBOK6E9:CinOiU0kds5ySaHgIpy6hAiLHwBUAyep
TLSH
T10AC1551071BE02803C7FA51C86ECE92F528374663019A92F7BAC05A69FE6E155DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 1c2fdb664dd0c533792eea94c62b6f10ee09c67e70262723181f50f104b98c2e
MD5 4bb0646e44a285ecaa49a55b979ca9b7
SHA1 996239e00c7578154639e66e2e1cc9d682d65f2b
SHA512 ba9d8faa3d997cdbb5d78ab1d652bb9ebeab6774c5cb5e0e9f05386d85d0d135a840c9fc068d663360921927ada61eedea6ab8c53b7411a4e71d4d06ae465f4f
SSDEEP 384:DNrRZyCSDnxTICD0ZMEhIKyll7svbFKfk7:xFZJSDniAyI1l7svbF9
TLSH
T1AC44740A7B747001EDE6D9725CB080771E3CB16D8F22A6D16DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 8107b445012f0ac42252e51dee16cb59bc5bb63bc214251db9995097c576d6a1
MD5 a27eb4106290e59af4f6b0363eb7d734
SHA1 c030a715426ebebdb0936af706b9b34b91f85c19
SHA512 76adfe7ef0ab2a4d20ce261e44009a7aac7782a83815bf7e2bf27797cf72f47456a559b2c07e6fb04dea218716c1d89b1b8b55f2e9b8aa44b6e95c1be17e67ca
SSDEEP 192:r95QkIIIbbLMIMNsYcYytOzNAsUlrNTssax:rQkIIIbbLMIM2B+zes+ms
TLSH
T1724285AB26012B77C05E5B76136387949BE849820072662D73926D1F8FF3F9787C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 9b3b5ab73d19ef985bc047f3fa318c64f67d69ed3efa5437be85aa3416355783
MD5 2eb89c04a306fd4760d001754aad0df5
SHA1 513f37793dce07a60fad15f6b0cde1f41ae4c35d
SHA512 40eb5089315bc2a0933961e93327afd9872fce03bf76baccbadd414e77406304ca48751b4a7cb6adc8945d28cec03b1f894836d6d9ed07975e1d6614b75159fa
TLSH
T175E02630ACCEC16EE557608732A8578DC3C4B84FEED82D061F11C48CF406189F3AA592
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 5a4b277608e96212cadea2926011123b8fa4e0e1c3590c29747ecbd9c9b5bb3f
MD5 c0fa3c54147ca0c15f90fde18d613bf4
SHA1 5b21d34623fba97f5772040737e180a696a20fb9
SHA512 1fe5bb61bfc237d2202469b273193f2857ba62cfcee7ccb86a3446e9beab67efcec423f269b4d56f1dbcebffb86f1a48cfd356f1ee1253cd3e648e2844bdb112
TLSH
T153210056F330C148E15A867E90BA9B361734E8168FBCEC0F54BA20346E75B040E8B2E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 2883f273e41be9f41c0502837c40af20747f7352aa8c724c1ab460bdbca01ef8
MD5 a55713b2f554eebddeb2ac93cc5cac8a
SHA1 8874f26ee55bb55ce8dab417560c54608c3fd18a
SHA512 ac6dfaddad7fd3d725e0e4269773181e4ff0054f73979dca5fc6b3474c099e2eede91442e2ac8931b0838ce32099550aa00f2dd021f3c92e486986a06cae6c14
TLSH
T1A0E0203068CDC19FD153209332A8A74CC3D57807EED42E021F40CC4CE907185B35E552
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a256b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a256b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 8168e19bfaba3815fcc294c8a329e29df7112dc24c536dbe8722ce1141f25acb
MD5 e0e46d0d16ca1ed4a3ddcdf27f3b947b
SHA1 106f5412c13d9b9b2f193c665c2cd5c6e75d911c
SHA512 5dabf622764de23fb9fe23050d6866be34275d93adb2e54400f4f267d17cea2b9288a90ee5cd448f7597f6a238f332407c795b6840cc6424a104beae2b6b5429
SSDEEP 3:MsEllllkEthXllkl2zEFllKMV//:/M/xT02z6V/
TLSH
T1E44404047FC0041DC51411304011C7D00370F4100D5157C33C713413FCC55410C14400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ce15026b4c367b0e62f81643865df85a62d77a58b6341d6ab27bfbadbd0d1b20
MD5 b2a061dc83b89927f01cba318eda9a6f
SHA1 2ba29f232cf434ea85fda42cbfa49e97b17ec078
SHA512 44e75f2fef4443a59cced301ab3990efc4c2d1b93dfbeb474989c26137d3e93f5fc4d6bce160d1204fc3507dd6ab08e51f48e6d50a2b0a851b20339ec742c7c9
SSDEEP 768:tFH13RwgiqGWDDXHK48dHeByERRFzjK3Yg2ewBKZOkr:b13jGaa48dHSyw/a2evZlr
TLSH
T1D303AEB19C989DB79CABE789BA037207EEF04163D5D4AA7497DDB90D41871DC030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cba806ed7212912f5c2e8051ddb27c31cf6975743b188ca558a4092bbb4807e0
MD5 99787af158eed5054effc4a5351efe07
SHA1 bea46bd4808ae43247c0e107b51779cdd2bf9717
SHA512 bab1329f43edef4fce5b0bd6a580060833a62ec285dd8ceafa5a4ecfc0c1dbe4da9a8caf7b873e311dc4997f0eb531ac16a2004fa706e1b6a8f343b93e4a1c0c
SSDEEP 768:hH3zqGSDDXTK48dHeByERRFzjK3Yg2ewBKZOkr:hH3uGOm48dHSyw/a2evZlr
TLSH
T148F2B0B068686D734CEBE249BA037707AEF04163D1D86B7496DDBF0E45866DC170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8f4e3bc545ba8f87b8afaa30fb08941154330ec5d809b7f8ebd27cffffda51f4
MD5 b7fbb613bc52b008349b9cd80e54c7d6
SHA1 b9076543df267f48e3246c35e24045e42c217f1b
SHA512 7ab983fb99cab633157df08b2c5f8ac5510996a06ade2e6fbff444d21d391d75881f8bf00de6ca2932956918b74f5cda06862bd3e8e36debab460b91785de1c9
SSDEEP 768:Frv+4UNbdk3DqGgDDXTK48dHeByERRFzjK3YgoN:FbsbS3eGEm48dHSyw/aoN
TLSH
T15503BF70B8A86DB34CABD289B603B643BFF0411386C45B74C5DE6A4E458B5ED170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5fff644a8ab9c2b49e26718d5dd22ad96dafdcd73c032d11183f7d15ec89a7e9
MD5 83791fb010b74e856bc4a801dc112348
SHA1 a6025e7696144cdfc5995771d531533e476686af
SHA512 a51cd9279fae7812ed123a3f2ded0d11fb1927f47bf99d90ab2c5fefa85ab00f57bf5bd0049384163c47b668ed151c0d514871492c91083e98721f952762f1d1
SSDEEP 768:Qrv+4UNbdf3SqGvmDBK48dHeByERRFzjK3YleVH1SCj:QbsbJ3DG2I48dHSyw/jEH1Z
TLSH
T1C803CE71A8A85E734CE792897643B657BFF4411382C41BA4C5CD6F0E868B0DC130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 7f1f1f7e2331f624d42e527830d70e713ff66ce8acba3a1bd1f9650df7e36f25
MD5 6f798cd8ab8515a1fedc63b903933a37
SHA1 47db5d91f604575a9699ecececf3c399b7fff4d8
SHA512 3c6bdc08b8284c69043f437053ec1c64ee48dcf60a61a2b898acaaf59007bd5cba2617de2194a59cbfb6aa9dcc01ea44f57b519e17a9415c0977ce0bec064e49
SSDEEP 768:tFQ/3bwgnqGSDDXAK48dHeByERRFzjK3Yg2ewBKZOkr:8/34GO948dHSyw/a2evZlr
TLSH
T15203AEB158989D779CAEE789BA037207EEF04163D5D4AA7497DDBE0D41871DC030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 686e7ef8a127ad320f4f1c81e0f9499a0af9f82bce9b81e865f8af15314db36b
MD5 c039bbd8ffd4dc3e1580c33b945bac58
SHA1 d2f965fdb3507ea5d4096837f4c56e5dc18a4955
SHA512 139dfd071a5b5e8c00bfad71e29f4d97879b988cf3637e7fb8743dba1538a6ca6675b934e33effa198f5c6ea94d221b62a49fafd033d90b7c3e27e33d06229a7
SSDEEP 768:tFH13Qwg3qGSDDX1K48dHeByERRFzjK3Yg2ewBKZOkr:b13DGOs48dHSyw/a2evZlr
TLSH
T1A103AEB158989DB79CABE789BA037207EEF04163D5D4AA7497DDBD0E41871DC030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 68f3a38db7d3568311fcd4b73658148f35c970738f3de26c7e830ff882e7534f
MD5 9b37710b892664b8888eac2a1d7c74cd
SHA1 4fbc3833cb607e07c68e324b2bfd658bfd96e55c
SHA512 c5c76fec855da72de2693bd5730cd30ba6b1bda2801c341922ab02bc15d8ebaa76ec1795d76356b2c4813c8cd347acb2694715702a917bdf6b01ac85e204e449
SSDEEP 768:tFj13RwgiqG+DDXHK48dHeByERRFzjK3Y1X9N62ewBKZOkr:n13jGSa48dHSyw/7f62evZlr
TLSH
T1BC138CBC9C58597F8CAEBB09B60E6616AEA40177D0F05978D3CA6B0DC07259CF306C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 469745bf92c57271c8424dfb97b712cbedbe7209c7108da6d47490a7a4cfe315
MD5 bef64026e27b73ed3def6e31ae925e64
SHA1 4f2d7d6a7ee48ca7ca679f6bcdd50a389aa17b56
SHA512 3636baad4a9f40083c176b8f0df2ded24d67bd40fca60ac1d8267acfd48fcddebce4210fab76009b96896bb4d46071f4cdc7bf7e60254036178f0cb5d3614c68
SSDEEP 768:7H3AqGSDDXTK48dHeByERRFzjK3Yg2ewBKZOkr:7H3BGOm48dHSyw/a2evZlr
TLSH
T14AF2B0B068686DB34CEBE24DBA037707AEF04163D1D46B7496DDBE0E45865DC1707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 785030114f21687c2105aab1cd470a7baea42338e2ce3441891d6e0f80e559fd
MD5 84fe2bd195adcf9b65397a79133756d2
SHA1 e5a8e75f62e8d33792e73b7b4633a389250c3d7b
SHA512 727ff42948636d49ca5d21ba57a96338f3a63c0656e59ff29fc8335bc7c05d0434dca415268e50818b68244db24504d021207f313412f7e4836929dda60c7d48
SSDEEP 3:MsEllllkEthXllkl2zEFllNq:/M/xT02z
TLSH
T1BB44040C7FC00415C51C10704011D3D003F0F4101D5D574334511417DCD55410C1CD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

RESDE27.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDE27.tmp
Size 1KB
SHA256 ed088255f89189d3e11c395340c4ced8d61fac897a9460dfe204305cdf675e91
MD5 3e704fb2be1041df3c04a1e54bf7abbc
SHA1 2ab5398bc0cb4aad1c4355a78912bfdcc76c2eac
SHA512 c5c7edf820b7041482c88aeb61090c640949ce224eb1c243099a3af640e3e99bde6a946d88799dfb907678636684051283f13d917a7ebd324de7d41d47e81c74
TLSH
T18221890593ED471EF0B7473169F6172FE628FD64DF62935A858042282C52504EEA1AB2
MD5 SHA1 SHA512 TLSH

Submit Download

aadd078d-2c5c-40d6-bcd3-6d2d727a715c.tmp

Path C:\Users\Admin\AppData\Local\Temp\aadd078d-2c5c-40d6-bcd3-6d2d727a715c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

l2zzp5k0.dll

Path C:\Users\Admin\AppData\Local\Temp\l2zzp5k0\l2zzp5k0.dll
Size 3KB
SHA256 13c111c6fb7b50f6cddcdff90407193fa363def0e6b59a1e92305ed7cb83ecfd
MD5 862ce04a1caae809c62dc4cbad1c0cd1
SHA1 7337d15773e67e4a28e12ba032b2242de394c5f1
SHA512 5eaf5d5df4b86c66a0c2e11cba7494b69d66cea05e1299c2166bfe74b2ae26c4b6e465c7322d810a72ca8b38177de7d9b34c6286e9e8c544e3b786bb563e1409
TLSH
T1A071EF1A9BD9426BE46A0730BEF3071367B4F8945B73972E498083296CA16242D71BB5
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1352_1640510615\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC562D0AB540349CEAA6D9BAEF73B2CC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\l2zzp5k0\CSC562D0AB540349CEAA6D9BAEF73B2CC.TMP
Size 652B
SHA256 ab172af86413400444715aba90908e74b83db523c68a45faa2d4f25faf32f55d
MD5 b6459b254c2b4784f447d1a199da5a30
SHA1 ea42dd41b6092314f53e0d94d14aff16357dc2dc
SHA512 09093ed601c739af3180ed47fb75221fbbd47240542176f10e1f92e5ad54a89c9a7d9e9adff146331988aea83c90b7d077ff59a79acb1763e46b512be3fee004
TLSH
T102F03A0963F8130AF4F74B30BDF643A391A8BC64DE3293ED648043192C645109A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

l2zzp5k0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\l2zzp5k0\l2zzp5k0.0.cs
Size 600B
SHA256 5c9cc444b29ec82a87eb13eadf29d9f64f484e69ca610c3562a462a7994840a8
MD5 c59e1b1d339cbb68fd9713aa4e3792d8
SHA1 8d2d50d97a257bfc1357b9534f1ce9c802dd5806
SHA512 16adbb64415a4f3902b32224d92913884bad75a1ae7087df579375fdd779b60942c41a22b2c19337af6e2ecd92aa0bdb78d784b38be6b9df5b0be7127fb1bbf1
TLSH
T167F02254275297A2A423943E4987F4ADF213807322FE2C00EAFC2722CE47141E23A66E
MD5 SHA1 SHA512 TLSH

Submit Download

l2zzp5k0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\l2zzp5k0\l2zzp5k0.cmdline
Size 369B
SHA256 1f44fbb7a98026f4c3ed7fdb02d3247e9064474968a1fd2884275879a8923ca2
MD5 e24c7665266ab9b3576e34882919fc69
SHA1 e898c80e032a43a949f058321b00ddd5a26d8927
SHA512 eb63055ecea0d2f39e6d0c4a9e28a88e56ef065cd182b51f1b300f72135214c70cd425eb5aada3b9a0d9f13644377f92bbeab59e4c8512910d192ebf8f00bb67
TLSH
T12FE0C06A424EC27E12EDB007226AC5BCCE7F4F8B2B507F849250448DD01F00127D1776
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1552-296-0x000001CEE4A10000-0x000001CEE4BD2000-memory.dmp

Download

memory/1552-294-0x000001CEE46C0000-0x000001CEE4708000-memory.dmp

Download

memory/1552-293-0x000001CEE42F0000-0x000001CEE4312000-memory.dmp

Download

memory/1552-309-0x000001CEE46B0000-0x000001CEE46B8000-memory.dmp

Download

memory/1552-310-0x000001CEE4710000-0x000001CEE471D000-memory.dmp

Download

memory/1552-319-0x000001CEE4710000-0x000001CEE471D000-memory.dmp

Download

memory/3136-315-0x0000025417C00000-0x0000025417C45000-memory.dmp

Download

memory/3136-314-0x0000025417C00000-0x0000025417C45000-memory.dmp

Download

memory/3136-313-0x0000025417C00000-0x0000025417C45000-memory.dmp

Download

memory/3136-317-0x0000025417C80000-0x0000025417CA8000-memory.dmp

Download

memory/3136-318-0x00000000002A0000-0x00000000002B9000-memory.dmp

Download

memory/3136-316-0x0000025417C00000-0x0000025417C45000-memory.dmp

Download

memory/3136-311-0x0000025417C00000-0x0000025417C45000-memory.dmp

Download

memory/3136-320-0x0000025417C00000-0x0000025417C45000-memory.dmp

Download