65c312db371bb85e8f5e9d55c7f3d9df7e44c5956715de82260095138496da53

Analysis

user interaction
yes
max time kernel
959s
max time network
924s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cr-keygen.exe
Size 500KB
Sample260804-pe2yeszcpg
SHA256 65c312db371bb85e8f5e9d55c7f3d9df7e44c5956715de82260095138496da53
MD5 28dbb8f2bf8c2d79aa91deea5a3fd3a9
SHA1 a9a9b9c058e221466341976ca84ef963809362a0
SHA512 249c6f696816048e9a3c08093d0b777ab2ad5caf72cfe7151bd15798c94521b999bb3eb1de8afc4b2b9b9ad4ab7a9424017fe963d3383867f14ae8253ea92388
SSDEEP 12288:8eCsFgfz9neCQr3UISA5CxlDh86m0CedzKYa:8HsFgteCQrkISA5C7DFieMT
TLSH
T1F3B423418025CAA4FD71C63B6A40B7B86C982D175EDC40B9E3E7DD9B1943E992FB012F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_900603001\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_937064595\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1752494590\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1752494590\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_900603001\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1217040246\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_900603001\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_937064595\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1752494590\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1217040246\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_2145910496\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1891074256\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1622721338\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1752494590\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_900603001\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1128956409\_locales\gu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3364	msedge.exe
5380	msedge.exe
5704	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303194555570779"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{598F74D8-7238-46ED-8B0F-1A3428399C36}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{CC6ED505-0884-4619-BFBF-31F43EEA56EF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{46817E2D-28DA-43B9-B8EF-686B201ED58F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5364	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3580	msedge.exe
3580	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5364	taskmgr.exe
Token: SeSystemProfilePrivilege	5364	taskmgr.exe
Token: SeCreateGlobalPrivilege	5364	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
3952	msedge.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
3952	msedge.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe
5364	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 5804	3952	msedge.exe	93
PID 3952 wrote to memory of 3364	3952	msedge.exe	94
PID 3952 wrote to memory of 1728	3952	msedge.exe	95
PID 3952 wrote to memory of 1728	3952	msedge.exe	95
PID 3952 wrote to memory of 1728	3952	msedge.exe	95
PID 3952 wrote to memory of 5056	3952	msedge.exe	96
PID 3952 wrote to memory of 5056	3952	msedge.exe	96
PID 3952 wrote to memory of 3320	3952	msedge.exe	98
PID 3952 wrote to memory of 3320	3952	msedge.exe	98
PID 3952 wrote to memory of 200	3952	msedge.exe	99
PID 3952 wrote to memory of 3320	3952	msedge.exe	98
PID 3952 wrote to memory of 200	3952	msedge.exe	99
PID 3952 wrote to memory of 200	3952	msedge.exe	99
PID 3952 wrote to memory of 2520	3952	msedge.exe	100
PID 3952 wrote to memory of 1916	3952	msedge.exe	101
PID 3952 wrote to memory of 2520	3952	msedge.exe	100
PID 3952 wrote to memory of 2520	3952	msedge.exe	100
PID 3952 wrote to memory of 1916	3952	msedge.exe	101
PID 3952 wrote to memory of 1916	3952	msedge.exe	101
PID 3952 wrote to memory of 5016	3952	msedge.exe	102
PID 3952 wrote to memory of 5016	3952	msedge.exe	102
PID 3952 wrote to memory of 4228	3952	msedge.exe	104
PID 3952 wrote to memory of 2268	3952	msedge.exe	105
PID 3952 wrote to memory of 4228	3952	msedge.exe	104
PID 3952 wrote to memory of 2268	3952	msedge.exe	105
PID 3952 wrote to memory of 4756	3952	msedge.exe	107
PID 3952 wrote to memory of 2708	3952	msedge.exe	108
PID 3952 wrote to memory of 2708	3952	msedge.exe	108
PID 3952 wrote to memory of 5732	3952	msedge.exe	109
PID 3952 wrote to memory of 5732	3952	msedge.exe	109
PID 3952 wrote to memory of 4384	3952	msedge.exe	110
PID 3952 wrote to memory of 4384	3952	msedge.exe	110
PID 3952 wrote to memory of 4384	3952	msedge.exe	110
PID 3952 wrote to memory of 5588	3952	msedge.exe	111
PID 3952 wrote to memory of 3428	3952	msedge.exe	112
PID 3952 wrote to memory of 5588	3952	msedge.exe	111
PID 3952 wrote to memory of 3428	3952	msedge.exe	112
PID 3952 wrote to memory of 3580	3952	msedge.exe	115
PID 3580 wrote to memory of 3588	3580	msedge.exe	116
PID 3580 wrote to memory of 5380	3580	msedge.exe	117
PID 3580 wrote to memory of 1148	3580	msedge.exe	118
PID 3580 wrote to memory of 1148	3580	msedge.exe	118
PID 3580 wrote to memory of 1148	3580	msedge.exe	118
PID 3580 wrote to memory of 3600	3580	msedge.exe	119
PID 3580 wrote to memory of 3600	3580	msedge.exe	119
PID 3580 wrote to memory of 4832	3580	msedge.exe	122
PID 3580 wrote to memory of 1784	3580	msedge.exe	123
PID 3580 wrote to memory of 3492	3580	msedge.exe	124
PID 3580 wrote to memory of 1740	3580	msedge.exe	125
PID 3580 wrote to memory of 3416	3580	msedge.exe	127
PID 3580 wrote to memory of 3416	3580	msedge.exe	127
PID 3580 wrote to memory of 3416	3580	msedge.exe	127
PID 3580 wrote to memory of 3828	3580	msedge.exe	128
PID 3580 wrote to memory of 3828	3580	msedge.exe	128
PID 3580 wrote to memory of 3828	3580	msedge.exe	128
PID 3580 wrote to memory of 4108	3580	msedge.exe	129
PID 3580 wrote to memory of 5068	3580	msedge.exe	130
PID 3580 wrote to memory of 4108	3580	msedge.exe	129
PID 3580 wrote to memory of 5068	3580	msedge.exe	130
PID 3580 wrote to memory of 6132	3580	msedge.exe	131
PID 6132 wrote to memory of 3412	6132	msedge.exe	132
PID 6132 wrote to memory of 3664	6132	msedge.exe	134
PID 6132 wrote to memory of 5704	6132	msedge.exe	135
PID 6132 wrote to memory of 3664	6132	msedge.exe	134

C:\Users\Admin\AppData\Local\Temp\cr-keygen.exe
"C:\Users\Admin\AppData\Local\Temp\cr-keygen.exe"
1⤵
PID:3744

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=dllhost.exe COM Surrogate"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x378,0x7ffd295ac188,0x7ffd295ac194,0x7ffd295ac1a0
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,14026098790434783362,15917330296096977881,524288 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,18318771576524638567,6620154295629177278,262144 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,15239991330211561972,6755892903422785136,524288 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:13
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,7429597356442137378,4890370365311674218,2097152 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,12888863421113232545,12673354707602521276,2097152 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,8206866302835100273,10429766865572635209,2097152 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4132,i,8709673050275610155,9351630382778972961,2097152 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:9
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,16672562527445958734,6728377326158309869,524288 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,7195080055309021863,15774888993630575512,524288 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,14672948995554349668,7882120169397328623,524288 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,10067348364581791273,16603519247902413940,524288 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,10067348364581791273,16603519247902413940,524288 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,4553101911108635365,4678749707284364805,524288 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,3816029410967544708,3809914458021226040,524288 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6440,i,2880147633292443603,4171067295093613123,2097152 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,3603099995650618860,8472788674602380865,524288 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,18231005854222092038,6652313993190447969,524288 --field-trial-handle=2280,i,5121022867769419376,12051844322783279622,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffd295ac188,0x7ffd295ac194,0x7ffd295ac1a0
    3⤵
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,2970611163365910337,12025487298841351820,524288 --field-trial-handle=2308,i,12773074406096507756,6489048651909115749,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,5469436859386432709,9370414532118358378,262144 --field-trial-handle=2308,i,12773074406096507756,6489048651909115749,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,4229279935471898498,6791137018077647501,524288 --field-trial-handle=2308,i,12773074406096507756,6489048651909115749,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,6973483598306055692,15371266829288899362,524288 --field-trial-handle=2308,i,12773074406096507756,6489048651909115749,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
    3⤵
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,6973483598306055692,15371266829288899362,524288 --field-trial-handle=2308,i,12773074406096507756,6489048651909115749,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,10529334777629957232,2783453748585685840,524288 --field-trial-handle=2308,i,12773074406096507756,6489048651909115749,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,2182460406704568953,7498833528934134562,524288 --field-trial-handle=2308,i,12773074406096507756,6489048651909115749,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,11609315027941346179,3026143090008405521,524288 --field-trial-handle=2308,i,12773074406096507756,6489048651909115749,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5204,i,2095491372976077936,2726106360861588133,2097152 --field-trial-handle=2308,i,12773074406096507756,6489048651909115749,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5164,i,8371826640409024343,15822028932529915426,2097152 --field-trial-handle=2308,i,12773074406096507756,6489048651909115749,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,9588565953161625815,7106926466354245740,524288 --field-trial-handle=2308,i,12773074406096507756,6489048651909115749,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,10676567070689578248,7860990540403328251,524288 --field-trial-handle=2308,i,12773074406096507756,6489048651909115749,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffd295ac188,0x7ffd295ac194,0x7ffd295ac1a0
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,7308243110434694249,13427202484279907779,262144 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,16288763022348811521,14448634085302208814,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:11
      4⤵
      System Time Discovery
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,7621703950731081490,7469113359218580499,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:13
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,16958881399959201018,13270262279418619579,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
      4⤵
      PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,16958881399959201018,13270262279418619579,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
      4⤵
      PID:920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,8181431362366820233,5652620735440943366,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,5550950113999105792,15160805626233206875,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
      4⤵
      PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,3619289254082397139,6126920400213969335,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,870556235623711930,14159620149313397374,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,10118488642802649411,7482126822156213437,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=836 /prefetch:14
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4720,i,10099348294345582734,2324309513138824531,262144 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=836 /prefetch:10
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,9391042617603653571,7986210415649442035,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,13641118758063339302,10238296619632768717,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:14
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1364,i,8444627138101788140,8432511617064524454,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
      4⤵
      PID:3312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,15907151292635311018,11039435143855729514,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,10167226115786446601,16367098850347321681,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,9797042879337433012,8137145818528950058,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,14207700275269774422,8556615871639590226,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,2038054126023526290,7764802752678294006,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,82672109834368930,5143479348136107411,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,6169468275922162386,3752708621875347792,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,14498463951205088586,1400931160325233029,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,12628992411170990111,4434355097990477698,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,16084465988246439653,3662897664845132636,524288 --field-trial-handle=2464,i,6703935448178015384,3805180101353994404,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
      4⤵
      PID:256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=ctfmon.exe CTF Loader"
1⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4104

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 17d500b4417e92837c05a8187f43f060e09191612c25892f2c54e786bd254c36
MD5 ca52a84f03e904e79c2a5651b273e5fe
SHA1 61ddeaf1850d81986389db97ff9470b67eb8cb1d
SHA512 d1f489b74d4da21280e354fdfd91d6569edfcb1abc7f4f6740756bbe744f02bd51136d5ea47c7a6a1842683dc3eba0d2608d4d46e5eb8ffb5035ffeb98f9c788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1B9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe2d1a3fe4e125a20450a80b65338ae68752f44903f85c5d2d5e731ae3d70183
MD5 ecfbcc3efd6c00edce689f1146aeaa68
SHA1 a6a0173a3f8b7dd0a0d89d6dcaee185d8b60cb80
SHA512 08461dcccefc71f7839c3071c69f8790daf8e792e69a9831c24ccd3f8cd8589f942f098920666496b0fe78f07a5032ba3d3fea47ac1a59dfb3a3079f1f8fd197
TLSH
T13ED09734A826A3E0C92A017188203200222000B138E2078210622C0CCF70042A2DFEDA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4701939ddabbe5a161c571a6f8cfbb238e6d5a9380c29ac1575b77ecfe494baa
MD5 a3829ef5f86ac9e186a0be4a4a0e0096
SHA1 001115b370ecf7ed7c158d94122f0cfdf1ca719d
SHA512 c416de008291fbd422e75396e2434d7422455a0e334449fa258f9f0f521eb7b21fd4e283e936ff33598bd1756071a968f72299567ecdd11734d549e6c63449dd
TLSH
T1E4D0A774A65593A0C91A45719C6073112671417034F78B635072680D9A94069A3DF5D9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f3c3d04da614650b2c93fcaad47ddb75d8ade74dcd970efb79ccfed642069b56
MD5 0818e87ce8bbab713bd53acc25543a03
SHA1 be10b7a56b133cd6cc2358cabd4c2b650e4a3a51
SHA512 bab9a57798cacc5e7eb3118082f5f763697c8b8ab14347a9457c3d84f061f59dee340dd7329bbabd20ee9472ec06629d22f24444b35276137773138d2e4e3cb0
TLSH
T178D0A774A65593A0C91A45719C6073212661417030F78B635072680D9A94069A3DF5C9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f4f0fe4bda859faa9eb63226d8684946112b749c28e8a0177017b5ecc0321cf9
MD5 eae7b5c3b7083fff40534d0103ed9119
SHA1 a36afe4d1ac36303bf418da221a85ddbb6c9e7d0
SHA512 5dcd1d50cb1a1a5ac5cfde85c6ed1d90285efa0c0b8e73b87bd227bae944d04320b38f4a9acd0d717a0d8924293364c300eacc0839c68c5ff44a83f4379c1121
TLSH
T166E086DD09D9C67EB704758765BC674CC6D0370FDEC8E9CE1B14C888F145944B29AAA4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c582486df9d3620c13fa55662317d7a9966ab953a949b37f2142c76466e5129c
MD5 dc6a9ac8c50957184d061523980d2b81
SHA1 15c26dcba4c8a07327361bf5506fc28ff41812dc
SHA512 af96bba4841a3607359c8a3ed5344913dcd05e12c66008594367a14c4584ff036d1a4f5cb90ca606367efc0eaf2c8429b64f7a47e03579b941cbb0d7278ac810
TLSH
T10DE061AAC925DC7B18FD075954444745EAD013572680555F373D520C8FF973A01CBC6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 788859bffd4e427417d4dfd3e2a3f11a52e4f25d309886cf8f380f7d3c900788
MD5 d8b187422c7a1a4e723e39f202afd3c1
SHA1 2791c5b1002eb3f7a5d6d679b4cd99af9b48e44a
SHA512 7cac0a8066c9c6a94d74f02f07aa3116ebcace657fe839337c952ae1ba59f0ceffa1d1175771b6ef42b20f63c2e9f5cf570410ea4d89cc752c1ffad6a03e3dd1
SSDEEP 384:Lcdbv+cmXbGBHNvccwn6bwqiLMgcThwwCUMBsOYJc:YBvPmXbG0H6YLOThZCU4tYJ
TLSH
T1BF133C7E7A6E2CD2F6D3297C810F1AF6A778D8B5E0C0210393F635D58325F1A895E909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 273b4bf11962d816028eef4f0fa50e15639f6729f7377efd16653f2f4c8c0da2
MD5 db169a5b7e7d7219724a1af185ea4db2
SHA1 6a581ba5800f1123163cef6da8ce101f7f4cfd63
SHA512 d041f11f5e98e31de7dc44b4afd33dcbaf9be58f140a610c18ad4bc3e7768076d675e77787da6789f603907809cdd2d252f35848ce05bb47f796175cd35de61c
SSDEEP 3072:BqL/+L/LZfLWLYTrVHw/Q11UJe3VP+bFUDeyyBi:BqL/+L/NfyLY+CKwWhUlk
TLSH
T11CB4D7F31652A40ACE6D02F692163E3DD277460C6CD1FAEAD1781CC06B3DB7356AA9C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 8941c878ec2a1fdca0d0934ce49ccc0d9968d53f459119ed0166f66556387434
MD5 3668d4f626722a7437a1a846c8725402
SHA1 b2ddf61a9b809d8063a42fb500cb2926b9f8f59f
SHA512 30e936d8df5c2fd2d04a6c676577972f35f6473bd1263ba2743b5fc07fa1593ab426cdae5a5c9a8a86d13535cae7e3643c9543b148de819f4e650b61735f6a4b
SSDEEP 3072:Gv9G+HzEuHUVv9yzdW90mHR7ajv7V3EXrXl+rvsL3y4QCapHsuUOVCPvL:GQ8zEzv919Lu7V3EXrXlry4QHpMu1VW
TLSH
T1B9256BEEC7682C82CF6B877470E0E9077E712183B648D0D3A944C59997D6B8176F82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 cb89fc46a02ff09bb03fb3fe7c80372b10cd4af5c48af0f23edd02eae78d8888
MD5 3fc7aaa0831a9b7bb35ff3b7e371feb4
SHA1 e29f3eef00630b503d9f7b1750e3eada7b90d8d8
SHA512 5cf84bf70f5f718ca47eb638fea7d26c8eb5c343eda91acc305164021f0667680e98378ceddb1f1e9a226ba901e45ef518c821ead1c4c80bc8f8e24fc0dbd940
SSDEEP 24576:FHk0E5BGb2RGrrl9GLzTjzCaZ4dwciZEUa6E:FE0Bb2q6+aZ4eq6E
TLSH
T13E865BEDC9785883CD279A30B4F0E9577C7413C3F995C1E78888C58402AB7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 33612edb1114a84bbf3d09c5046e60b126c29bb29e7abd02c43399bf3cf291b4
MD5 57a91685ab22236fef30a741c6cf8620
SHA1 53c5d6f41000e25281a6e5501f9c4bc5020b9ae1
SHA512 4a43fb6dcea2a46d31cfd7feee7025d70702bc8b1a637957df1bc063ddbc59a8fa8d9bd73d98d4fb64313ef7e33c92c8bb336e33b80c9f4b8b4e2d93f3daab5b
SSDEEP 96:HqYaRGTOFXhjg0A22jbQWJFCGvKfBLH2TnBwag:H7aRzFXlNxKFEIqCTnuV
TLSH
T106A1A758172D8DE8FF23D6B15CE04CC939FB68654543FE8202F6AAF007DAF682250621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b2ba5a9e45d15f8c47af20bef8694c3619679e6a7430ada8a599d088f17c9368
MD5 b63d06f98d877211cf0f4fea1fe28a69
SHA1 28396530a285808263cb1385e7e28d953207a0cf
SHA512 e875a3f2b762cbf42fb57d6eaf8c18b162bc4118b54342336df11fdef925ec0aeecb7f9bf294290813e35efa9376caaf173cfe79a6fb0fe653df9c452ae7dc7f
SSDEEP 48:17GrT31GriTlE468lycEJ34kWvZXOl3p2JKdIE1EkYlQw7KIjBCrvlJF3mh8N:QTHTaqgBuvop8KdIE1EkYi0KINCr9f2G
TLSH
T157A1A658072C8DE9FF67E6B15CE04CC539FB68254643FEC202F69AF40BDAFA42210221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5ac044.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ac044.TMP
Size 2KB
SHA256 5f0e993f8f098cd63616a78fe01b9b07c3e4b71dfb31e4cf5a8ccea597be98c7
MD5 d16dc96bdec1338ff5e76e70b6924168
SHA1 794c1e7180d53efac13102ee23940413f7cd3d1e
SHA512 073938bf5ee0db8df560caa161cda094963a42d9a57ca4d519a3bc98fdd81f44bf3a90246d788089c80a96a213376640d17b61c478f515e436381430bac03a0d
TLSH
T1E651C95D5B6CDDFDC722A9B664E040D93EFB8CB905875F1302FAEA78491EFA82311211
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 4a87dda02cae50f77afee52464578f4a5454e0a336baee80e8a504d38641ca80
MD5 d00df8900fbb88b9711d80541df3b3f5
SHA1 d18b67cec467a67e3a9021f316264719a6568530
SHA512 5e4df9dc51caede013ee40a3c241872f8d9f3d875249d74c73f24e016cfc0e0e548a124bb09855f39f74e80209fe687a44e5f131f7ad702650ad060a10b79275
TLSH
T1F3E0D89859C7C52DA95034836138A708E1C83487DE95EE871B0488C47A43211B74599A
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 c0a8238739183f3f1b0b505afa49abddcaf4b57662ea954bddfc27982758962b
MD5 67c39de99671af2862722b4435344599
SHA1 8b23a057730362f50c9c0d1e9e012113b284d6cd
SHA512 3fe41cb101878c2b7e1b4fec64b8d0ab145791bb7ea86d3bbe13eea5ca706f2da3dee2b11ba83a46228cfc06527b8bf974b94edb34fc4b0fe9cbfe74b25f3d17
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfjEW5LdFtIYNVqYpa:TtD4jJ/0UC+lf54WxdFOgVTpa
TLSH
T115E2C08C3F11F511C4ED733DA1D2C5E09ABCA82C8A5975B0923C98718D526A2F49E24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 0b7111cf479d50ba77f4b9d1f272acb9179688f345b6f7f138b8ce94c9cc2260
MD5 b3d3a5f214a0439096f8c60ee7f2520e
SHA1 7294c81eb82cc6be9905a4ee34c60a29bc6c2a69
SHA512 10fd726bb7fcc0b9483a830749062df1f456bc5f888b7c1d1d57b77548541475de9173617d20d6c7118c2e0382b3da27af8c890b09920aa8301bf4cf641508cf
TLSH
T162E026A805C8C13DE65868A7926C6308C6F0388BAE88BE4A1B4C88447142241A3C7AD4
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 ee7310db45fc38283bfc37c177c25819122bf19956de5926049c85e3d546c334
MD5 3411f8798e51913f82eec4ebf321784c
SHA1 6e76a89f1c1c93e493357cf6ddd65157fabbbd73
SHA512 e71b5b1835999cac542e29f1be2621a525041656e80939703dd8b5e9f7410cda10fbae968f784decb8a29a5b71aaa59ea03c800be7915c442aefedf87ce8f77b
SSDEEP 24:LLBQJY90+mhh0GY/l1rWR1PmCx9fZjsBp6UwcECjzOwolJIkzh++HHILuemNB4dR:uzBmw6QU1PzofNILRNdGNw4V6KdmY/DK
TLSH
T10192B65B4F34B812DB951DBA366E1C36CE3BD15C6FE6DC96391150222CF884394315ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 d8d621694138370ec543d3038f58947ec4894ae2a7bb52278c8cec993d756f88
MD5 807830e3ce1f69e6388aeab3cbe9d1c3
SHA1 fe2ca691063c9b052298a2ec57fa9f77f9f5b945
SHA512 ee2933bd8ca28205f75a208c5e2edb78703d78a643b5ba95ba6989eb8e5a91ec11eafe220e436195bab9f78e9c4c2c258d4016302c22f63a24f9a66864bbb4a8
SSDEEP 192:P3lJH+bF+UI3iWGVoWN3qL/5SIxVVV63:TIkUI3ijVoWN3qL/5SIxA
TLSH
T1B724411F5F353711CDBD917628EB48A39C6DF02FCB136ACA68610474CEE2652A01D9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 645B
SHA256 206e32c316891a7433c59e50da3225d28bf7a449462567b5298540ad8d005f7a
MD5 5ff58ec094b75d54f241be49ce4b397a
SHA1 b314d0874288ab33766bbac1eceb7e6f2693e350
SHA512 15b168a393c70cee2ec00312395b7cec334f16b99d91cc747d04416749e5bfc748bbcfa6817964917a85f28fd0d47a1c4d2906cf835579f35b757c0ea888b98b
TLSH
T10DF0DD77160AA908E64A95F5663AFC5DC36E102E98D0DEF6C0801E0459E90797234CD8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 3b090e6bbcae8aeb17301de28895af480c0247937c1b0339329ac3b111c82853
MD5 93049c81a1f65c6d3f9b1f6356d2b7bb
SHA1 15464380fb965d5bc4d0a46a43d685145862e9a5
SHA512 9c376e6526d8c6f62519167794aa0b300efebd98ea8d8458097e0b09a849c4e1e0fd67642b1c2af2c8f17a556b79e4aa4238700175f01d32e63d24563a932c2f
TLSH
T159E0206146DDC13DB54F305B6218770CD7F0384BDE88BE461F089D45B046404A3817DA
MD5 SHA1 SHA512 TLSH

Submit Download

7011220c-341c-42a9-afee-589d9173d26a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7011220c-341c-42a9-afee-589d9173d26a.tmp
Size 690B
SHA256 bf53280ff1d2936768cc7dfab7e50facd0d42d0430f096444aed225c471bd6b0
MD5 f57501851032988743d5fa3236432cd8
SHA1 d03c8f440b42673420e39f364e46357b09b94434
SHA512 07644b321ca54f1203bcef30be4fd846996787961b821399c78bf06936e902d8b65c8e48d7e003d0f924d4f82015cbf9b8ec515eb526960fbd228d2e2923c4af
TLSH
T161019EB3857FF82B20285D7E1E87B9452E3C9835524964F5DBE6827CF0825F70702027
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 28KB
SHA256 e7affad3d0ac7c86e02073d489e965405b656071a77874f83e14db2b8b698d1d
MD5 5d4fcc2a2c9a655f4f46cc796e1d5eb4
SHA1 8a65a9f0d1f4aad645128c7355cc9a58b5b692f1
SHA512 184ae832502d624462cc444b1ebe96f9f2517584939a17ad2e4cad559d4ffe2e9cd1d8ac2711f7b8d74ca3e24ca6bca4c1f348017e546f687995a655ad603e7e
SSDEEP 96:tDeMatha9HsaSwJMIwmX958ZouVf1hKCb/6Az8aWGFzJMIL/scO9bJtbsUW9:tDLaTaTVR958Cup1hKeiZ8LVAb7wUW9
TLSH
T1EED2095E0EB21504C3BA2B366CE59C91692CA295C323F4EBA65490318F3E6D727133E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 efb2ab9a55fd9dbeb83326dd3273a1031b43de7914e173d9e18edb84c3b8732d
MD5 a8b6e75cc6ad1cd8c5294121fcdb293d
SHA1 eb8a844260d43cafb38f307be76899eeb5b3ac48
SHA512 06cb41c230c6548d7bc8773c7a976911b927ea8d3861be7b41c3bb8623c90bc747bc0d3e5312c44475ef081868926cc4457c9e051fb9f56f82544c5bb15afc8d
TLSH
T1D2717FF7C7E8862EC91156F0AA187E1FCE1D0955832C3D5AC4D4EF1BA3E2471E181A9E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bd1839226c4ccd9110efa879ecd5e781ae4ce78ecc796705fcc5c8b72152233e
MD5 55bc48754adfbd1da71d7df4d2cce8a3
SHA1 ce84c729da36d49a15a990f3f7997c02b4da3f94
SHA512 a16eef437f96629f5c55c276640e8e0678a37e6013e7c01d77d126ade4058983820b854b81cc7922e0177fe13bf7dbb1944dfcdeffb70f61f62a65abe3a62fc1
TLSH
T13E819DF7C7E8862EC91156F0AA187E1FCE1D0955831C3D5AC4D4EF1BA3E2471E181A9E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 663d169c2bd7c0d592fa8ebb5674a22c3b3f15cdd1a790d9ecb63440bd3de142
MD5 c6308e25a514635ab4de00d9c9690e16
SHA1 1baeae3fb0129e28022714992385c8514377eba9
SHA512 50dabd0988bbbc624f5b285dbdb2c7f2e8cda86297994037097f0685e7ac6f28551a09997c23bbbb994daa5ca683ab1f1896b4f148ae828a4aafa4d2b5574265
TLSH
T1E7017BA3857FB82B20285D7E0E87BD451E7CA836519568F1DAE7827CA0859F70702027
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 5131fd0168c5246cd11772dcc1a4127873dd7d0a9ad2f36664c90c373b9446a7
MD5 41e759d603488dacd727b59aef482cb6
SHA1 875f271375e16682828c0048927104f1dfb95ab8
SHA512 cad90f88e0eab03c514b64168b9c06b891c400130ce31fffae3a60682062fac69b06868237237d0e3e6f558338d5b54ec959bb29b5bf650624c7adc30793dc68
SSDEEP 384:sxR7qKm1w/fhs0Wv1RGUpMWN/5q/7/uiv:sPzm1w/f/Y1YwB/5Q7/vv
TLSH
T1EA82D7166624D977CCCBD20DFA617F13D6F91463A9914E48AAFCC91C00EE6FD221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 0a59c7b9991e94bfceb007873dd331b8be4af04aea102dc3bd9272d3f7131516
MD5 2830b32734e2d0a36c91cbe1b5defcab
SHA1 f9b893ed078bf1017c85f25bf32e137da9c7148d
SHA512 2d8ee31518ed1313b6b05395d82c8d1931404333c799f625ea654a25208b55534d8eb1ffdff457acfbb3602e7790da98a8bf3f86d08129f0ff32babcb2cd4126
SSDEEP 384:sxRkTDm1w/fhsRWvjRVUlUydWe/50fq/WlMcv:so3m1w/fGYjnGx/5Cq/WFv
TLSH
T1E992E715A524C977CCCBE60DFA617F52D7F9146399814E48AAFCDA1C00EB6FD221282F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 5ed82794b4be998bba1d95333b06e7422a4bc64c25ef83889faf8fb0c4582fb5
MD5 d010da8e3620f60287e7c4aa1b1a3877
SHA1 a38c2b147c7ff6abe476ef50477749be12e7488c
SHA512 40aaf9c6ac70b9eaf63c61e0edf9ea836dced70f67b83084c2774bcb7658560b51c16da8e0ae35d57ce2cb1c72fb4c4330bd8f984bec6e823e42a524f9606cd4
SSDEEP 384:sxRkqKm1w/fhsRWvjRaUlUyMWN/5q/7/WZiv:sozm1w/fGYjIGB/5Q7/WUv
TLSH
T1A882E616A524C977CCCBD60DFA617F52D6F9146399914E08AAFCDA1C00EE6FD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d7ad75ab69f01f9dff7928dfc6aebffb297364869ab3c9972c90d0c1fa420910
MD5 026787a414a3bbeeea232c78ec464bc9
SHA1 5a7f8162dbff82d3b41c2b6964fee4da5091aa91
SHA512 89d0ee6063417870f7b0fc3e7735982c9a272eb14b600edf52ce9f46fd5d972e4701357e845554d0e8ae177470d7f696dfd8f08758d739db90203f94aadc5b28
SSDEEP 768:kfISNE7pLuLfIvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrZtSV2X5roHh01:kfISNIEfIvWgd5fWbu1jaQZtU2XyHh01
TLSH
T18CE2EC3B680CCB7F4F8049DCEC297E9AADA801CF96D8CD9447EA850C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 613e725e49f6a5c216e45a5e5c64f1bdf30c78cbae95962a961281c4319a3f17
MD5 2071da2b7ec5f7ae23c683228da3752c
SHA1 f29b98140d6722c4027811aa34b743df45a8a453
SHA512 13f05ec1d2850299b7ada6a318ce98fa2334b578938fe60376362668786aad845dcc6acee8e4c85d3cb140d83507785902d19d4b3f5734ee2aec86e9ae64be2d
TLSH
T144E07DD485D8D17DB26560A35328970883F4748FDECCFD462F80CA4471C2505B3A3AF1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 51400504416b0d93751d7d502b3062db1b8c0fdd1731e1aa1be483364bc76b80
MD5 52376a97d4aff85d671bbe8cb26d2eab
SHA1 a1c35fd3c8a9cf35f367082796f45fe99f06e96c
SHA512 c63d371f3777b3ea9b0ae2522d1085f1a98af1ae2eb0c7ca5885dd82a55802c88b284e29b0bcf8acab184ab8e858bc3dd688d96d27cc59cbea5c46680b42d22c
TLSH
T102B0120077506BA6C08B493213A4FB806B40E6411430480BC84CEF500E867E93F038CB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 edb8cf24ead7eefc2cb76aac0124984ecbe5eb31f4921a63f948c8c856c264d2
MD5 bb1b2907a5f96179edafa7d8eadd2082
SHA1 3a6e7678487c57d97af5126b783fcbf73c9e979e
SHA512 51068d71d9789a6faec064a76ff95500d70e7998be4ab508a8e566657a857737e95c61f745ae024fd8fa1430ab0f2e43b258ce21a9763085b16ffd79febe753b
TLSH
T19EE0D86455C9C63EB3C920876364E71CC2E27546DEEEEA562F089A84B2061407347660
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 97509cf25c6afb27cab466951910b57a27a27a440466c60b0f3679332521d9c9
MD5 8ab0928d8764480a5bf38c51c844a8f8
SHA1 00246169df88936903edac7006540047ab75b4ba
SHA512 0f3ddf00c4ee61654829dc55c1f19eb2c60ecfe99ec4c11dcadea588eea641c5694ecf29ddfe3f83622db1dc253281ce33cba66871b26eee40255803720ea68b
TLSH
T198E020F485C5C63F664060935368AB1CC2F0794ADFC6FB49670C8444710154573E96A0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5240472afde25094f0b2a9b5f775383f0af9fcb86f6e01c443506ca15ce124d0
MD5 7020b8e866b03778dca14b6ecf29e8af
SHA1 6b03ad2b8042641350f7de5b8f27deacdd15cb89
SHA512 782e2c40e4564c1d51ad226c6701c3b569b98138f5972f1d8db7a0d61e02576b49c511f1e113fbd27c8d5c89776f1b86a4d370cf0f9e75cc494998fbbd17cf7b
SSDEEP 48:KcuI/KvK0jyJ8IjKN6cb52Vp7vjkzv4PI4xkKNB1DkhJ0GY7J5yy:KcuIKvKSq8AKN6q68KPKuV
TLSH
T1059145C2B07A4245297E250D9162CA26DA86F0A3341DE47BFBE941A21F67F110FFCDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 33e40145d230426194ac891a29f04978121ddbedb72046bf2254f58d3689b2f8
MD5 22338ba2c344dd4ff07363cb226d6efd
SHA1 e80697d482f24a62dc03612eea6b3f3f3627ac21
SHA512 d8cee027526c0270d8c46e6eba8b8834b3f3f1aa696c707dc8631f49acd640b6e1ff17745d00febe28bda28427b8b0ecfe0df06a85667d7e9216497dd6891d11
SSDEEP 48:KcuI/KvK0jyJ8IjKN6cb52Vp7vjkzv4PI4xkKNB1DkhJ0GY7J5yJ6I/KTCcSl:KcuIKvKSq8AKN6q68KPKuK64KTCV
TLSH
T1F7B123D2B07E0645297E250E91618A26DA96B0A3341CE47BFBE941E21F67F110FFCDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 8602f8172a98ea7e666a0b5003a4c6e8d6872f97cccdf8dc97ac678ef80b3adb
MD5 fd837466bfa7ac9a33b13b86c847e20f
SHA1 28f55473c78aea069441fec71b810ba729480b73
SHA512 cc50050af11126c02b9aa1e6f47d41314ee8cea616b2c9aa8725f6a39f677512cb7c8b5eb9083cf039caa078b50fd7525a6af4c3e4a1ee2ca0991afb9784d80e
SSDEEP 384:DNrRZyCSDnxTICwMEhIKyll7svbFKfk7:xFZJSDniEyI1l7svbF9
TLSH
T1C244740A7B747001EDE6D9725CB080771E3CB16D8F22A6D16DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 7b5653973f93334b409d8d8fe1fb3d660a27dd9c2678be553889c055476cfa5e
MD5 0c4e8a9c5e6bae2e863239bb9bb1d9d3
SHA1 c886dc51d6476bc4385c931f06f225cd378d3687
SHA512 251af720e0633258c70315998cd6e3cf91174e88d9df74234ad13c4d1691ca7935d04bb516e656b00c60993f9d9862977c87aa3e9f98606bc1a26ac8c32285db
SSDEEP 192:wQrIII6b6MIME1YcYPdqO4ZAstl8+TssYb:wQrIII6b6MIMiBIf46sHcs
TLSH
T13742726A16052F33C29F5F76136286949BD88C824132252E72623C1F8DF3AA787C53F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 d8d69d4a9bee6c1fa959704bd98946dc26a2f196686aa9b92a17ab9210f4322f
MD5 ca10936e22a298c3747739e5cea80dd9
SHA1 9b327050d4e6840832e0518d4ad95de05806545a
SHA512 e4ceaae9a1bc0b36f7462c8ee4691a23f08697a99440c574ec5c84c281907688e478351c617bf035297c2594616c493467d12cec689be87780d2e743a760a5ed
TLSH
T1D2E02652A8C8C97EF45D208B21285718DAE23C9BEE98EE8F1F08C458B002100B3C699D
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 2369cead46df4ee6683a4dcb0d0ab68ca8aace3150466b98bcfd6e6a96150554
MD5 8c7d71fd0993260fdd131bf7ec898e9a
SHA1 e87c509bc442c7a656736f42ba7dda5e534c6c8d
SHA512 8c998212e61ef70386ed7b08a031d8f90de15f3bc48203d3a3e2a71d4d95649fe26d36bdc5474e9c5658ebcfb2b04ba098aeacf04698511f09f7af66c36632d7
TLSH
T1EB210456F330C109E14A867E907B9B291739D8028FBCEC0F417920746EBAF040E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 2b4b46de7d57060bea8c0d09dc661b23900caa8efd2791a716c856707d2a67ba
MD5 1c37a1c2f9f4feba912c900870e0c2f1
SHA1 a0b12b66c32bc6224b8864a035c706a3aa249316
SHA512 42f28034bb0a5f0b6bd7dea96872f5ab5335de8676c1b85af3941dff72b617b0b414a2f25f988627600afd67c6b8164dd477f70164412e1fcceb09e8f841e69c
TLSH
T19EE0205164C5C5BFE051208711699748C7E23C5BEE986F4B1F04CD58B103145B7E7555
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5c6818.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5c6818.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 582106717625d0f74d6ece5e25753443a3e0b8a1e5d589c5af98f66698889698
MD5 fcb3dcd1dc60ff715a7aef4d53add11d
SHA1 1eed83448da0060420415072f54da44422843997
SHA512 8654e825d226e37ee25e41e661968ddce5c05191578cb05ea5c47f45fd1f6370f2ec215e061794148264e7fe9e989138e9606c9bce5f751daaa50bdf3188d1b0
SSDEEP 3:MsEllllkEthXllkl2zEfl29K/l:/M/xT02z/ol
TLSH
T1EB4404057FC00C0DCD005070C451C3731770F5300511574334D1C4337DC75404C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 4c6f141e178862a2aa94fd9b5157e58095cbeccb25dcbad888f2a0e1bb51c280
MD5 ca71566300e2b29741b15092b94806a9
SHA1 d3153125bf8dfb33815c5b7cffc9b44602491ee3
SHA512 ac8948a4b60e513b143f58bafc0a1a1ca28709ec5df958c9f37ba014aae61b54475eebd052b2877ead12b73308c48675418856d41fc9b94dd0d65f176f34b304
SSDEEP 3:MsEllllkEthXllkl2zEflUl:/M/xT02zbl
TLSH
T13F4404047FC00405CF041471C151C3531370D4300575574334D114335DCFF400C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 e813f5aead5de33bdccd343d669b09d06735ea3690841f80772a84f67fc64d9d
MD5 3c32eafd5a72155b9328c9a3ef298752
SHA1 f6515f3613820c0f7c01866c365b6352169072f8
SHA512 49b8b2ee505cec26383229a768d58877cadaf17dc572b491e87d7a0481f5c191fd2a04ddbaa3fc2ee72a3d05ff35a71cba5507941bf75ebc5844e5f6f297c38b
SSDEEP 768:xw3uY0mA6RqsLHLcJAam6aQMGdjWca4Ghfe5XF:xw3r0m707maME6pEV
TLSH
T1AAE29F315C64D8779CABE295B71A2383BEF061B388D84E44D5E96F0D029758E370BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 fc8dcc47fceb86607f87a72786da09d75abeda0ec20d7c91e2654fd724a09184
MD5 0e1d17626cce3ee98fdb515825c4f0b6
SHA1 801441b4e4241089f686369834ea027b7a0bf20c
SHA512 cf0664f6a95b9d276a22167f454fbce8ff1143d67a99ffcb512454b2c96cb34fbd899d6d0d6eeb9d043c1a9a2a0285749b5b8bf4c4487650063972680e1024a0
SSDEEP 768:pcuYdtl6RqsLHLcaAam6aQMGdjWca4GhfeOd9CI1XF:pcrdtA00maME6pdqI1V
TLSH
T12A037C3C9C68597F88AEB789B31E26566DB41277C4F88858E7E91B0DC27244DF70381A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 373053846d76dfa57c5429e1edefc790fcd89e00a6d07e4c003cbbb8ad26ee3a
MD5 ea8ac84106844a7d2ba630dd93d5b552
SHA1 c5e358e35ae696a2c4207d44a82f570ca5ca5611
SHA512 f701c1012ee60b18f85b4fb8a351ee04d14e4eeb753bec11a605d35412a4bfc3e077dc63ebcf29b448a4579cfd2901b46dfbbfca8678d0ac6b17f165409cac9d
SSDEEP 768:RFic4wgfYd3l61eLcAam6aQMGdjWca4Ghf/qH3ZqJBrF:ycHd3AnmaME6pcXZOBJ
TLSH
T1C91319F588D7893BD8AE6787633D2D02A9BCC163B5984994F7D81E0CCDA60BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 56dbbe89790a07216e6d55908ab8225e2ba4a3cb539ba17a8cdd79f4d3949906
MD5 3785865aeede2889027fde3d272ab417
SHA1 85cf32f543f4c41345f28d10c6e6155f6225727f
SHA512 268187b4a58c2335141c571c367bd34b781b5c8d49dfdde9eba027cc945012443e0b1c66ecba15cc0104583cad761cb5473b13ca7fc98460c73205d46ae317ec
SSDEEP 768:/rv+4UNbdq3I++GqsLwAAam6aQMGdjWca4GhfBJlPeU/:/bsbc3I++KmaME6pxlH
TLSH
T18DF2AE31A8689973DDB79A99F21B6787BEF021A384D40A84D9D92B0D43974CE3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 73ac82ec91b5a8d1daec6d6b8368ab04aaffcac22a9c3e2be845f1e78b0cc479
MD5 56bcab24a4d88ab1d23b1f9ca3b2ffed
SHA1 42144d6b8e2eb0ce5a946e6c4569cc3f18f90c24
SHA512 04f877cfd30857161621927ae5412eb58103094e260cc8fba10100196dad51262fc7c41958897e9555b943169f134e47ae09a8e98a9fb2827c0762b22a6f6491
SSDEEP 768:1w3UJYVD716RqsLHLcfAam6aQMGdjWca4Ghf9JQTD:1w3UmVD7Q0pmaME6pJQv
TLSH
T1CEE29F315C6898739CABE295B71A2787BEF061B388D84D44E5E96B0D069718E370BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 1c1bc09694d1e1a9b156cf594d3017247ad643c74927036fc8d1150b76ea75a3
MD5 289805920cf2bf3278632ff39de293cd
SHA1 6d7d328ca4cbbe6c48e888bc11813c38db10d159
SHA512 f47b929bf9d1da036f5659a36d8cf7c5ce093ba664ff68cd0d9ed4a25bc76ede74472c28ef1e934bde39e576a98c087e7f6373f35c511a88c5a67b1c6d48db34
SSDEEP 768:Aw3UJY0pA6RqsLHLcfAam6aQMGdjWca4Ghf94WKso9GTD:Aw3Um0p70pmaME6p4WKH9Gv
TLSH
T197037E3D8C64593F9CAEB789A70E26266CB45237C5F84948D7E91B0DC27644EF307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 6287af6581090c3c6a8e1483c44bb5d10557e57351af2ddc63e3cb94e5d1fc1f
MD5 d71512ffaca4f68f3ea9a011b0d61ba4
SHA1 e6a108386c43f33be719c22b132cad297dc50123
SHA512 4edf4589d7b83496bda54e88a8334e9eaf9cf383bf122c9d6fa5447d2eabf0072c97c34846a0b91edcedcb0465dc7685b1ba94df81817d50e48af988eca958f0
SSDEEP 3:MsEllllkEthXllkl2zEflT:/M/xT02z6
TLSH
T1034404057FC00515CD4050714053C3517770D4300511DF4334D504335CCF7404C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 5be498428de88bbb212353d993b1b9af940b1cc783f0f6ef62fae887c02a55f8
MD5 a4eadd7d054b1dc64cba9f13ccf60062
SHA1 8c9866e85700676725650189b428a3a9a1cc8c6a
SHA512 c57b766d89e5ce2e5bba5e74891e856954c8264c8147ff8bf1eacc65301276e952c349582010bc479806296edbf8de7d35bb91f7cc3b28f37abcccf57f66654a
TLSH
T191513A450AD112BB6BA7BBF04E4195CCA33B3A0FF2E994CF54D04CB465B389356844E8
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
MD5 54b0cf5610d4cbeadf10f35941bea007
SHA1 8bcec79787775ec6c2625b88611eb0de385e393b
SHA512 3f6d82da490f1b52647d9f376be4aa3159f57072ad2b52a048895bf7f53255d860bc12cc4b5af53cf9d9ce8c76cfab722e47cef3b58fa776a8ffd7e991630253
TLSH
T1841184D00C7F1AC7C6BE0E6FA0872AED40C8A622F09830381CCCF964917901D3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 68dd4a6a0b1711003690c2995fd0b77ba3c9ae6c27dd853ff492b52bd7701bc5
MD5 bc900814bda342e30ca622ecf6edf1a1
SHA1 58549077a989da91156012baf9dbfc98ecfe429d
SHA512 c918bfea1c94a06e69e13a1edffa87e69fd698fc8ddf310fc5545d1e2a80613e7617e19110e5496fa91c8e8037bc67a81e300b571bebefb407ab16a384d97fa1
TLSH
T124111FD11C7E1AC6C6BE0E6FA4833AFD40D8A622F4E8307818C8E964927951E2451C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0dcbd641392011e3042d4affe27de6b54e3bfe1fed2f238c1326586e38dbfb80
MD5 5791c60bac582e1f169aefd7494e8b65
SHA1 fc220a11a5357f3b3134686ea018f8327ad6720a
SHA512 7ea314ea2431da694bb2d6ab59852e9e0458aedea4693b1d78718c5a54c1c97849afbf8992b044f2295319673c112e8e40e08f8732d473893c556cad7c1d8183
TLSH
T12A2111E11C7E1AD2C5BE0EAFE4833AED50D8A616F4D834381888FD68A63D51D2551C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json~RFe5ac063.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5ac063.TMP
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

904005ee-1008-4e76-9e92-6d55cc893b74.tmp

Path C:\Users\Admin\AppData\Local\Temp\904005ee-1008-4e76-9e92-6d55cc893b74.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3952_579391076\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6132_1217040246\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3744-3-0x0000000000A00000-0x0000000000BCC000-memory.dmp

Download

memory/3744-4-0x0000000000A00000-0x0000000000BCC000-memory.dmp

Download

memory/3744-1-0x0000000000A00000-0x0000000000BCC000-memory.dmp

Download

memory/3744-0-0x0000000000A00000-0x0000000000BCC000-memory.dmp

Download

memory/5364-14-0x0000020246E80000-0x0000020246E81000-memory.dmp

Download

memory/5364-11-0x0000020246E80000-0x0000020246E81000-memory.dmp

Download

memory/5364-12-0x0000020246E80000-0x0000020246E81000-memory.dmp

Download

memory/5364-13-0x0000020246E80000-0x0000020246E81000-memory.dmp

Download

memory/5364-15-0x0000020246E80000-0x0000020246E81000-memory.dmp

Download

memory/5364-16-0x0000020246E80000-0x0000020246E81000-memory.dmp

Download

memory/5364-7-0x0000020246E80000-0x0000020246E81000-memory.dmp

Download

memory/5364-5-0x0000020246E80000-0x0000020246E81000-memory.dmp

Download