2a4a64cc28e112489f959a0d34c2ea8d85f422da893419bfce45581052602c86

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Begin (1).exe
Size 6.6MB
Sample260809-mpqxssaa94
SHA256 2a4a64cc28e112489f959a0d34c2ea8d85f422da893419bfce45581052602c86
MD5 ae5e031b872f4a18e2600d481f032227
SHA1 d31ffa1787a163711fb8f031a08fda238abd1bfa
SHA512 fa35ad73bdfb6d8169d127f5bb2114819b25f60487ab2b48f5937d6047973599f3bf7b4f451cdcfa2741da12a9b8cf35737e6af48f53e6c688988336dad760d3
SSDEEP 196608:JGkK1QaQ2MbSxCA4OCbTdTwio1ZVmDytXeL:JGT1QaQ2soCAIbTJwN1ZYDyVw
TLSH
T1B16623BDB298226CC01AC834D533BC4AF271744E47B5E5EF73D6AAD06F2B4609635B06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	19	https://cheatglobal.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a286227669d2d958	5

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2548	Begin (1).exe
2548	Begin (1).exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_1043207176\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping368_207650886\_locales\uz\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
464	msedge.exe
1436	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307455464646130"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{E04D802B-2249-4D73-9864-162763C39D2A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{31523426-DA29-4CE9-8F51-D3EA0DCAF239}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2548	Begin (1).exe
2548	Begin (1).exe
368	msedge.exe
368	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2124	2548	Begin (1).exe	90
PID 2124 wrote to memory of 3648	2124	msedge.exe	91
PID 2124 wrote to memory of 464	2124	msedge.exe	92
PID 2124 wrote to memory of 6068	2124	msedge.exe	94
PID 2124 wrote to memory of 924	2124	msedge.exe	93
PID 2124 wrote to memory of 6068	2124	msedge.exe	94
PID 2124 wrote to memory of 924	2124	msedge.exe	93
PID 2124 wrote to memory of 924	2124	msedge.exe	93
PID 2124 wrote to memory of 4992	2124	msedge.exe	96
PID 2124 wrote to memory of 4992	2124	msedge.exe	96
PID 2124 wrote to memory of 4992	2124	msedge.exe	96
PID 2124 wrote to memory of 800	2124	msedge.exe	97
PID 2124 wrote to memory of 800	2124	msedge.exe	97
PID 2124 wrote to memory of 800	2124	msedge.exe	97
PID 2124 wrote to memory of 1020	2124	msedge.exe	98
PID 2124 wrote to memory of 4836	2124	msedge.exe	99
PID 2124 wrote to memory of 1020	2124	msedge.exe	98
PID 2124 wrote to memory of 1020	2124	msedge.exe	98
PID 2124 wrote to memory of 4836	2124	msedge.exe	99
PID 2124 wrote to memory of 4836	2124	msedge.exe	99
PID 2124 wrote to memory of 4000	2124	msedge.exe	100
PID 2124 wrote to memory of 4000	2124	msedge.exe	100
PID 2124 wrote to memory of 4000	2124	msedge.exe	100
PID 2124 wrote to memory of 3224	2124	msedge.exe	111
PID 2124 wrote to memory of 3224	2124	msedge.exe	111
PID 2124 wrote to memory of 1788	2124	msedge.exe	103
PID 2124 wrote to memory of 1788	2124	msedge.exe	103
PID 2124 wrote to memory of 1788	2124	msedge.exe	103
PID 2124 wrote to memory of 2576	2124	msedge.exe	104
PID 2124 wrote to memory of 2576	2124	msedge.exe	104
PID 2124 wrote to memory of 2576	2124	msedge.exe	104
PID 2124 wrote to memory of 4192	2124	msedge.exe	105
PID 2124 wrote to memory of 1044	2124	msedge.exe	106
PID 2124 wrote to memory of 4192	2124	msedge.exe	105
PID 2124 wrote to memory of 1044	2124	msedge.exe	106
PID 2124 wrote to memory of 2380	2124	msedge.exe	108
PID 2124 wrote to memory of 368	2124	msedge.exe	109
PID 368 wrote to memory of 3224	368	msedge.exe	111
PID 368 wrote to memory of 1436	368	msedge.exe	113
PID 368 wrote to memory of 3576	368	msedge.exe	115
PID 368 wrote to memory of 2920	368	msedge.exe	114
PID 368 wrote to memory of 3576	368	msedge.exe	115
PID 368 wrote to memory of 2920	368	msedge.exe	114
PID 368 wrote to memory of 2920	368	msedge.exe	114
PID 368 wrote to memory of 5356	368	msedge.exe	118
PID 368 wrote to memory of 4496	368	msedge.exe	119
PID 368 wrote to memory of 4496	368	msedge.exe	119
PID 368 wrote to memory of 5488	368	msedge.exe	120
PID 368 wrote to memory of 5488	368	msedge.exe	120
PID 368 wrote to memory of 2780	368	msedge.exe	121
PID 368 wrote to memory of 2780	368	msedge.exe	121
PID 368 wrote to memory of 1556	368	msedge.exe	123
PID 368 wrote to memory of 1556	368	msedge.exe	123
PID 368 wrote to memory of 1276	368	msedge.exe	124
PID 368 wrote to memory of 1276	368	msedge.exe	124
PID 368 wrote to memory of 3592	368	msedge.exe	125
PID 368 wrote to memory of 4740	368	msedge.exe	126
PID 368 wrote to memory of 1580	368	msedge.exe	127
PID 368 wrote to memory of 5688	368	msedge.exe	130
PID 368 wrote to memory of 5688	368	msedge.exe	130
PID 368 wrote to memory of 2696	368	msedge.exe	131
PID 368 wrote to memory of 2696	368	msedge.exe	131
PID 368 wrote to memory of 424	368	msedge.exe	132
PID 368 wrote to memory of 424	368	msedge.exe	132

C:\Users\Admin\AppData\Local\Temp\Begin (1).exe
"C:\Users\Admin\AppData\Local\Temp\Begin (1).exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheatglobal.com/members/begin.260501/
  2⤵
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x224,0x300,0x7ffb7404c188,0x7ffb7404c194,0x7ffb7404c1a0
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,4930363881360918045,12706086603247667752,524288 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:11
    3⤵
    - System Time Discovery
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,1155630705882021592,12466744171736451830,262144 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:2
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,8905276140972351684,10776717399953043647,524288 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:13
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,10835183540351038640,13623143107240558866,2097152 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,190497251522210420,12054827751263957232,2097152 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,2920829306718869727,15550459903031107762,2097152 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,2128620707414503610,9145343167361120782,2097152 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:9
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5264,i,13665692252886165937,14001867109158759599,2097152 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,5616830576814248567,16221593097077399373,524288 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5460,i,8383416781114420215,14660446973923541640,2097152 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5524,i,4876644254616061769,6532908392875593845,2097152 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,6171145649225382025,11365767025202665364,524288 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,1528252212813051940,9300667282048211913,524288 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,6732994456402773611,12637724703521224920,524288 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,6732994456402773611,12637724703521224920,524288 --field-trial-handle=2596,i,8773510685637651428,10784742498187627600,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffb7404c188,0x7ffb7404c194,0x7ffb7404c1a0
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1680,i,4009646280658405518,7523199311944136896,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:11
      4⤵
      System Time Discovery
      PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,10732941218502047909,4185554710497539577,262144 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
      4⤵
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,12671602115689772884,1889941321438052658,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:13
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,2895679166004141573,18212103220887651490,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,2895679166004141573,18212103220887651490,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,5747698486274353422,6512806917291066431,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:14
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,4776644777676898979,9945106657206424476,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:14
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,17611698617056291738,1983910742178191355,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,13005622059419419039,6535214857187136811,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,15806897201501542725,15817536501533327335,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,6072780805067543765,9810565114828437238,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,14051821926449505657,4418275738714993016,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,16203193821207869166,3663696514966118763,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
      4⤵
      PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,2759232974518064561,8728878864103729279,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,4446641121598931880,17061490296017669580,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,11236564622468752032,13049538110687578552,524288 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5168,i,7320219154352726741,1868248629401594295,262144 --field-trial-handle=2148,i,2512126758247413041,724239472822484335,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44233a8169c5af8b7a94348b48ed8cdaf8f3d9bd394d7b9c60a62acf8f9ab025
MD5 2e2d82a1014816f3df7e2fe0333b44c0
SHA1 971925213dbe137ab0931d140444fea04ca212b6
SHA512 2e2ea64868938cb766a7445275909bb792c7b35a8d9273a727713ff61085d7f1b4ee596d7e31fb81b64e8b8a223e2f31c6d606922d176a4e77b4173c5bf9b1ee
TLSH
T101D023203628FDC1F001613204E03300B1250433745AD74A3110C01CCC7418213F3CDF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4b550f6f4f55afa8a28d9b1a94342b13b8a738cf86fc3fcf6029783eb885cf96
MD5 f71991603547522604c102a9ce333512
SHA1 2ee80fa76f8cc0a061fa2d51e658d2667c20e078
SHA512 21864cba74d86fd59be62e93f6b57088aa43bba0f319fd95f37faded954c9d2712de9498e1df9449189c24136642c4d127d8d91976a062dfe7c307a375490639
TLSH
T10AE02BE5C821EC2718FD5B1A50944A49FB54131B2681555B3B3CA11CCFB173A078681C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 8d0e2593534cd7df8e06f82f5c27a01b7e76916d69b4b0852c98709c9ad10a8f
MD5 e8b891bb37a638ddf6a4890c22059506
SHA1 2f62722942897575356e803c931a26b2ce0b1ef6
SHA512 52793f2377af35a87ba1453adca4cf9a39b6541f2572bb3af29f3a5f9fcec05fb1add1ac64213ea6aaed49387f63845d998969cde1438c652ce514e8d73e1341
SSDEEP 384:umlGWckK+VmfzrkNH1FhJihvmS/VMaoU4p3t0E9dGo:u+GbkKTcUwl94
TLSH
T191132A7F3A188D9DCAC7403C90AB9BB403B0D5B9E0D5A01BD333B21A5A61F59ACCE553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 429c4281cbae1a60b736a0492143ca6199ba4ffd1e537655e29bb8dd10c15f0c
MD5 d8bba18eed40e1a73ff8a48a5df2bb73
SHA1 923910a1ae1565fe6c50c28fb01853584a957fbb
SHA512 7f7a91250d9a9cd6f5a41c23556770e440063e7706803f7f184806398563c37ec443ea7e969aedf73d4ab1d072951a743762bfdf7d0d7895ec052e6c1b5c8a63
SSDEEP 1536:0Hc1PH7lL/ixL/rCv3hmfIcXgEU2H7AcrqrnkuwuS:Z1zlL/uL/I3E4L6
TLSH
T19E444EF71951A01BCBA842F5E2033A3EC177852E7CD1E9E9E17D4C812825F31B6F9A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 3da9e1360f606c207a04232be669165a51dbe54adfd0290a167cead706a1a7e8
MD5 5b39bc5b625c55fc3e26621a369c52fb
SHA1 aacb8aefa78598d246fcb0ac04df6c0676e860a2
SHA512 06c022e95252d824b4b984d5e68a8cfdd61d4c29743a48228ebceea1d3064f874b966be5f4cde45274d87ba1e3b260b266a60e826f245f4c3254459b6b702514
SSDEEP 3072:Ghv9G+9/AY16WiHOI9It70e0S6TtQDkMcQ:2QSAY1NtI8cGL
TLSH
T18C2528EECB681C82CF6B8670B0E0D9077E712183B68CD0D39945C5D997D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 edca3a8d98c723c6015969f1bc541f51d2010f5748f70731f48f980233124924
MD5 a12a5d75fe4f64854a39acc19a4f18c2
SHA1 2c1bb478e4660be7343cf7c4176868b419d9552d
SHA512 c7b52478ef69dae350d2322c1522f9e14c7c66cf9291c3d2cd1f1cb3a94e179022a8c617bcc9c9fa941f1c8a26449e861f8e54f928ff3552f15de910beb331b8
SSDEEP 24576:9HgwdZN1FqKRly+9X1iJlTl4rTeF+imZJhIdZdSH:9AkVFqKm+J1iIKF+5Idu
TLSH
T185167DEDC96858C3CD639A30B4F0E9877C7413C3F995C1D6889CC584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a7fb44930c72649a08be6e4d11951d3eedecd46da74c2ebe932a7432188de45f
MD5 53cfe4f8f0e5b6a475965664d81dd998
SHA1 76022d61b6f388e594d1ab21c7b57796be894458
SHA512 1eb08be296a9a5a6ac81668fe4cbd6857cadd18651a0d095658f68ee103dd6ddb15bedf7ab71d0a3a07fa2a8cec627aef169fd957a5731ae5cff7403f991daae
TLSH
T174514193132259CFD3E159B161F16464B2FEA87C81076E8841676E74CA02F9A50E347B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5924c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5924c4.TMP
Size 2KB
SHA256 9c7d82f8d47687a716a5cd3a4bb8c17724bde30a6a3c7e5420d44d14670f2d63
MD5 531194025f0a8fa1a755984601366e37
SHA1 a70a7a9c265310b97be8aa7d4cac645be2ff4232
SHA512 5770642a20c0f98f732aec8ca80c91774bba00ea2be8e113fd83f752dc31e465dfbec49bb2024aeadb931972244cb095c471fd38eaf3ed49de9787001ba08cf6
TLSH
T1055151D3132259CFD3E159B121F06568B2FEA87C81076E88417B2D75CA01F8A60E347B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 d6f52e99e2d0ae0f2c3586533c03675de704767bbce75e68012a95c8a8c7a0b8
MD5 f101353dc06cad083aeda30220d09305
SHA1 9e912923e48ac6aa1945aca870d329fd145252f5
SHA512 51ca21cc079cdbc9333e0dd9e08b83351a11a00d76d95d606f733c69cd60e81e2644fe757b2965210eaa46815ec22563a99b4b210fa69bb3ef6ffaa85f56b890
TLSH
T123E0D8A85ACAC15D69103483617C6B08C6C1344BEB85ED571B0CC8D0F742005F285966
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 4e2f7990f9982c8d43cdcb011121c0e712569d3e5120006257f7fa3d615d0a41
MD5 5a6e0f1f4652602863a1bbfca73b6b9b
SHA1 3af0a5025d99019c6d7aeb6a175d5eeef63188f0
SHA512 dfc84df2af9e92dc3abf95720486923855051809ab5af812975e55dce8f6930c80d981765d457c5de4aa841f438026d94cc0cb1c0f6f77db3626fc86b6635ede
TLSH
T13DE0CD5807CDC52B941D68979379EB0CC3F1348AFA98FD225F0E8CC4B601645F2EB6A0
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 668981dd33c8af6e65a3e80db81744bc2f958ca716bf4c6cbdede2eecae70c98
MD5 5f9d161ac085cc3c915b6dcac95ac954
SHA1 91494b3e671dbdc6e6cb333f8f4d9c064932fce0
SHA512 f8e9b0c83d1285b87dfdcfd36cb57949a790ced5f7a827265ab175f1f4d5f2a84ef69c72f8141835775dd6be6c59d95099760951b4a1cf717ad77cfd4ab0c2d9
SSDEEP 192:uI7fMg8H+bF+UI3iWGVoWN3qL/6VVV63:ucGIkUI3ijVoWN3qL/6A
TLSH
T1F124531F5F342721CDBD813678EA18A35D6DF03F8B1365DA686114B5CEE2642B02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 421B
SHA256 3e73f1825bb1f58fb4ccf309eb8de61a913efb5744ad23fbd9c0975468fecb48
MD5 c504debf366339e3ead0c5cf1851a38a
SHA1 17c5bc980157ac9b583cba2183988e7bcc7bad90
SHA512 b3c8f2b5dd5e39fe3170809ba3787ae5b07b26d5c8920e39fa2692030f00175571496ce153d3d842fa2f3fbbe24b56d153fd9c5ad86c247b27ef0679f38d8a44
TLSH
T170E02BEF24759E99BA7003F4359531ADD675530D0CCCD2F4CB96904F18B0678846D914
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 6c30b2395c7739eb6ad8af49f04fb3ff79652ce1ebc53551babeae2d2a70bae8
MD5 74b2e6dea030324c434c2b87ba190d27
SHA1 412d0492e3f2e9a2eb3e4be45edd37367220dd0a
SHA512 544922fb42850fa7e8e518d81e3cbc6865fd68e8df9791d980ad5abd9cf5191b40b1aca725215f368e64e276f7e93bebea86e58de62b441aeba7bcc844da5ce3
TLSH
T122E0D87545CDC2696504608BE239BF08C3E0B40EDA8CFA515F099C80B541105A3DAAE2
MD5 SHA1 SHA512 TLSH

Submit Download

177640a3-5476-4439-ae13-f5fdf30c7281.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\177640a3-5476-4439-ae13-f5fdf30c7281.tmp
Size 3KB
SHA256 348b2436f3a971c276aa00bdb50388d5531bac9257303f9da76953fb0c92b2c6
MD5 71916eb2a12a065ccf1c85fabb8c41c2
SHA1 fe01716dd85357cd969a2cf706c01d65a454f132
SHA512 fdcd4c8cae2f86d64b96a5452443106f9d4808d2cc1bc9f5212981932d433b5500e3d782d20c0fbcf5d42f267f5db5d10c7f0c7074c075e96d58a6ca78b1ce1c
TLSH
T1F861ACF383F4C66D8A0196F4AB187E1FCE6D0919436C7C6A89E49F1B93E2471E14198F
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 929731e3f42d295004ebabfc077e12031c62204aa80ac8e35c840ebb712e54b2
MD5 819ac921c04d35cc839808b32e7c3bc2
SHA1 6991ea558a450d2c91a7520a4ff08d011afb286e
SHA512 5e8ca2def7fe0711102b0d8bc5899b8a98203eb4b2456927e1c42acbecdb54f81115ead66725dc7c0f697e9f541d826cc72de806bf49fb0c1544bae3a2708179
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7odwXElB2iDakt:qDeMatha9RA5Lt
TLSH
T1EEB20E4E1F346221C1F44B77EDD085663E7C211DDBB33A59EE1870B2CDA256BF50A066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4ed2effd691185c146f52e5124b3e8f3f4d012e8cdec06bc63e94cdc52041e75
MD5 2f80a5e2b174152b6e4244024bb7e0ab
SHA1 7155dd1354a587e8377d6aa76a03f999d52ac080
SHA512 a224d2f266afeaf7a2554f3e10b9ac1b74168e5cb179bc5f160956673efb320667868b4b30691ab9ad7624901053b6446ba06b5a7bcd7c35b79983aac84b3a3e
TLSH
T16971ADF3C3E8862D8A0196F4AB187E1BCE2D0918436C7D6AC9E49F1F93E2471E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 acba2dd8ef720497d75e729795f964075bcec3a236d6b17f5b7a592a503365c8
MD5 d2594a72bef77ee2f07083b3547cc1e7
SHA1 78acb3e64418e31db195262c9cd8d8a51b528902
SHA512 156be2686ff3657b8638e55cf5baf3969b7d574dda8891f5ac23b0dee60f6e55ffaad9093d616f95061dd5df8eec66c698f0037e65e93b1afd48f18fdeb44d29
SSDEEP 96:OIEumQv8m1ccnvS6OXXT0lf3inFuxpT4g:OIEumQv8m1ccnvS6Omx
TLSH
T106F2FEFA1737A105D99445B0E0046BCEAF16400B47BAB2EC76D44BF3F3920E2B5B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 46eeebf5eced6adc5fd748c43e3bcfddd1dd751521a47a6563b9ea8b4e4fceaa
MD5 b8a96b5dbe8bc92545fcb5cd91e4b2e5
SHA1 9220ea757f36bd1870ca8eb2be41ad48b972b1e0
SHA512 0b0c05ac5da05bfc83af7a3acc23b1432104ce24b4f2e44dd660f74fdbea30e4f2b8675b22a4a0bc1b31e000348d872d3f3d0c6e584b5d20204c2eb8efff1318
TLSH
T1F1C022A381F8F0721434853D4D84E880B638C8300010B4A5CBEA823CA0804FB6A1503D
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e6dbb8fdf5218f68b8ce5c6526eac4e12cb062bf00b00319e14832cf82a3c6be
MD5 af12d1e1cb70e11bd32cc62207591650
SHA1 f7ee69989127d0518c5bb771ee1e72336dc11f30
SHA512 5a731c6c7b2189cda4697cf7be71c490cb77f811792bab8704947d728a37dc450709e0da6204719a8078fa3c744e554afeb77882c9fcb278ad74003cc3a3a9bc
SSDEEP 192:sxRRRosP/f1sWWpVViGZSkLRwzoD8pfMs/g6+WNbbaH/zIGdVuODGDIgvlVlJ:sxRRnP/f1sWWvViwSkLet/5Q/rg3
TLSH
T1C552D7166924AC7B8DC7D21DFB55BF23D6F95032A1911E58E6FC8A1C01EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fbda6b032700883781448eae6544454a1d3c9472ca89bb5854797e0e60bd137e
MD5 ecc9565bdaa32e115d26a700d8364142
SHA1 d06a522066aa314e9e1e86442ed7b468a0a65976
SHA512 483b9ec6aed8842b46ec5fe1d2900688f1561c7a4582b46fb95657147871ab19dba050f877ca780b38a8e60545819b7154de1b8d163914d1ad337abd5bca81b4
SSDEEP 192:sxRKRosP/f1sGRWpVVELDde5lSazoD8pfMs/g6+WNbbaH/zIGd/uOagDIgV8J:sxRKnP/f1sYWvVELc5lDt/5Q/1f+
TLSH
T1CA42B6166D28A97B8DC7D21DFB15BF63D2F91032A1D11E58EAFC8A1C01EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 236017dcf52794692b7e662dce21890a0d80e1c5381efcddd8f09c1ca5c0cebe
MD5 8f764b2745773ba8318371f6f0898661
SHA1 2edef49520e6ece60f58ad22f671ac55f6604b7b
SHA512 281e391a5694974511d4c6bc605d07d24e77d0e53dbf21964a1415e3f6f93793b15ae0aaee18e7f81507dbebf804b9bbef2379a51f5ed5018718fdac73717a15
SSDEEP 192:sxRKRosP/f1skWpVV1GZSkLRwzoD8pfMs/g6+WNbbaH/zIGd/uODGDIgV0J:sxRKnP/f1skWvV1wSkLet/5Q/1gi
TLSH
T11D52C7166D28A87B8DC7D21DFB55BF63D6F91032A1D12E58E6FC8A1C01EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7d96fbcff6ab7afda516c2583c8387f27842d4f39b97f2379659952dd2ac0df2
MD5 92b1f46c69d82f57fe9c70996b06b901
SHA1 2270270e7fbf3196bd63e83451e1766b63f51a06
SHA512 d3a79b94e3c63ded55dec3c8521255b07bbe30150e1e4df278fb0acf95002cfb251129272ef6f9894f688d20fd27a6ed4148b3fc1b41c3b10431000c6f611306
SSDEEP 192:sxRRRosP/f1sWWpVV1GZSkLRwzoD8pfMs/g6+WNbbaH/zIGd/uODGDIgV0J:sxRRnP/f1sWWvV1wSkLet/5Q/1gi
TLSH
T13252C7166D28A87B8DC7D21DFB55BF63D6F81032A1D11E58E6FC8A1C01EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4820fedbbe47f11b9ee12be71e8942357c7335e17773ba3c5adb1067335df981
MD5 f969b1e5093268b2ceed773f58eef8d4
SHA1 42542155f1f2a4d5eab50e2ebb54e230a998fb24
SHA512 567b7f0cc8cc7e5d0bded23af43196f6a16c42670afb27625204ba5917a2d2e776a13ea71c9362525c8c2e9e4b183759f456744da9fd792ec8dfe3055dd06a01
SSDEEP 768:jC+vAN7pLuL7JQWgQ+fk+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjQqceroZKu:jC+vA7E7JQWgQ+fk+u1jaQVc1F
TLSH
T1F1C2F97B240DCF7F4F800ADDAD197E9B6DA802CB5698CD9047FE941C02C6BEE52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 1b96b457f70627929d81da0063a7243d595444fc1eb3f56c8c216891785c0b61
MD5 124a6e878ea3fc8c153fd65d2d7ddf35
SHA1 4def74bcba9f204c8cb1079a035b3fa95c1f18ee
SHA512 6974b9d2a81ac3002efda2f8971e60a197d359acd6183801e6615aea04755f7cf7ae62a935f79cb3dcdb205216c02d2fc68061f7128922a5e1c38d24b77cbb18
TLSH
T1DAE086540BD9C5FDA43621471275EF0CD2E8742BDAC8FD222F5ACE806283948F6DB5B1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 bf77cf01df13340a066117caae332f1057334ecc8eb74be4967f836b86de46b5
MD5 84c95529848a2a3b138b5548d853c66d
SHA1 0c13a1d3a9f44be1364a70fe9ee412a592eb16e9
SHA512 11475d4f82329c613a0fb087a8a956c2ffa5a0cbcef6067c0a501fbb697f04ea4eaac7eb26112d7672f7e92d62613bc6640314fdc11bd5082f6ee4487ca61fec
TLSH
T1B4B012487700F207D6C815F50B45ABC05711EB0670400513DC4E7F308D1D6A83F00C94
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 2423fbdb4dca1a331039be278fe56edf0e406fb0b99a0f977ff2d7d3ceba8152
MD5 ed695095eef6f4e7f91e09e6fa097033
SHA1 d1d32692091ff603ef3726ea4f15d6c7e291d745
SHA512 fa57f3c98112ce2ebd4326f95b523d9efb83098ae8f3bee5aafbf95bbb716a85c8f2de661e52077d9602b643bd7f0cf3abb9c0719747d37945388fcca22893b8
TLSH
T12CE0D8281EC9C66F6546208B6335EB0CC1E27406DAC8FD312F0DD890A306144B287A60
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 0ddf35f19f78586f80b6e0e51bf4ae66e077c175a14dd14cfb14689ca2764f0f
MD5 a726a699c43d500f467b95736ea0f70c
SHA1 1b1c844eab50b7dd03a19ac1405d0535a17cebb5
SHA512 e3ebf0c94adf663364fa0c164f66b13a212b4a94345dfeb3198bbc1b2bb38b650c1f14ddfe891eadf74130fc75500b5c2252e5593e1d66f9ca7d5ee91e1cca3b
TLSH
T118E04FB84BC9C639544568875275EF08C6F0780E9B88BF665B0C9894A201148B2EBAA1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 f07d446fb5dc03824b6460ab52f61d2de608d3482bc27528837ca75fdc98549a
MD5 4f4e07547b94ffbb91d285f8e6e65af8
SHA1 4a83301ce78aea310cf1ac4151639870e43ff48d
SHA512 8b6f1886cf93e530c62dbe828ef7476e5af7d8fa02384874e52a15810949cda5ae3601db76c51a14debe4dea12091e960277898aa44d33d6194f0aff80e3c77e
TLSH
T17D612241307F02503C3EA80D907DC82EDA8530623559F62BBBA995E60FA7E456EFDCD9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8878982a5c5c3152ffb089877d66a9371a8f0a6d14404cecb8a7524e0830d460
MD5 7300ed3c4d241d113e32877b505a8ea9
SHA1 4e0964c268fe4f7a48b69795cd32c6b8aafc6f79
SHA512 84ca1f2006b0235fabafb83200cf6ba36a659305e5a0d8c743e9ec383f5dbe539707a1224a3ef6e0a48de2685cbce5cb4de19ef3b997d9406c155758608a0861
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJO2N2K+IaGOjoMO4YxtsdsLkxKz4Luxfm+Vu:CbEBVj5JAdSp9/EgTK7j6dJOtBlBXJ
TLSH
T1E9A16581307F02503C3EA40D917DC92EDA8630623195E52BBBA954E60FA7E415EFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 4e1f874e0b2f6838dc9918fa36ca5e16fcec6386c0ae35f2eea931b21d0b5461
MD5 aed1fa7fe40a35bc5819385158423e2a
SHA1 5cb54052f0ab9b0c3709070adf11ba4d7cada8cc
SHA512 32206bfe0f2f4a0481b46b49b504ecd73f9aed5aa617b467fc9cd606c9cac0d55be619e3e81af967faa2984f6eff38d8800316a96d2aee10ffff6dd7903f222b
SSDEEP 384:DNrRZyCSDnxTICBMEhIKyll7svbFKfk7:xFZJSDniTyI1l7svbF9
TLSH
T13D44850A7B747001EDE6D9725CB080771E3C716DCF22A6916DA254698EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 09e772cbcf94099dd6fe57b94a1b434924de3c2eae2af80122a3435b9b766537
MD5 271ec19ece98d52d358e1b4e53c45923
SHA1 5216a1263535a6b5d580a8db9b77339891eeeb66
SHA512 2a8a51522b6bf4e690491054073b8c944eb5f6c0617d1e4e09901dfc03ad502d3d5888b31b572f3e572aea12ce49ac821e4985e8e8ff9e29baa9130d02765653
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBgm+xGt:DEK3tjkSI5IUltGhp22iSBgm+xW
TLSH
T14252879BEE342212DCEA83318AC001E17E7A903E8FC1EB0254D610211FB4691A31E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 248B
SHA256 36f1147d5b13ead7973ea9fd2dc76a8287b0784889b3f041926043fdc02e1e39
MD5 86a3869897460483479c62306312e2c9
SHA1 a1151ac117a45fbfdbdbe09f917c3d59f0dedb6f
SHA512 0003f09ebf039ae7889db46de1ad332c497a5860ee6081d7aed31bcb5c8ed1e0306a9b785cd3b8c35e5c7c6d208352c0732947fcafbe588d9f05a038a9c127d2
TLSH
T1BDD05E92376F30E07A8EC944E1293807F88C3D51A7899461BB4A69C887848081D2FD32
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 b96d4f9fa061cad8b95fd90c56a632c702daeed0f4f4daf827d0375ef0699dc6
MD5 b79f5eb5783f49873bb6f7d2246e6f3f
SHA1 392e4c40f1a10ce5abb6a3630d4a95495ccaf263
SHA512 28c3819894645fff46ae473c15b26b3931159b9645ca87996773b231edff67d53eca79add47c8550167906c67511f9cf9ddc0e32819cc16fd8cb567a37e362ca
TLSH
T1F0F0C2C76E021977CC12547150336783FF6189CB0424B46743CD246B5A2D2F1C9CC0D2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 bace590f57b6142960c15c253a0a24bf42363cfbf01232742c88f0b231e41434
MD5 afee29ca9695b4b6d6c789503e381d4a
SHA1 801e72ded7cda2f809dc7557e298f9271cd6061f
SHA512 c061ad379de35b8a541a2175e2bd5d59ade80194bd513a1a42e6b2a97fe2cc6b58b231f500ef26f7cc52b3cf8b7ef2e2057b70739139d3c450142792b7c8a76d
TLSH
T1D0E02614ABC8C96EE415209B61369B0CC2C0388BEE88F9265F19C8C4E601200F2FB5A2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 10b21b480034e8eac106b865a843cf6c407173b92fac4e961b05f3f1c424f494
MD5 085a476b1fe8420f86bdbe1bdb10ac29
SHA1 d3f3487c7f968c9d993458911e9a43c8bea96136
SHA512 f8e6a43c14c1dc29bc2651e29d0fca93c97b949b69927422a556a3e94bd4d6f2a5df6b8b5dd49e782581d2a52989fa0a75c56a4e8488a65f9a04680dc245a21f
TLSH
T1A7216D56F320C008E25E867A506E9B351738E8528FFCED0F85BA20756E72B181D4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 322f482d077b82e4d70108ad88457a9fbf26d81f4c427c64e7f14e5ea906d1be
MD5 c18b8d8a007cd0c9f99f381e0ce0d8e0
SHA1 4170a0dc5698d775384a5ac7935c049955a29341
SHA512 2c1fca0099652df3940875199f501b4a4b5ef1c39f4ceb33af2c83ec62d6d8e0a94c46b1291719397003c5de50077766f12a94d97c59b487a243b7d9034c9363
TLSH
T119E02654AAC8C1BFD01024C32176E788D3D1380FEE88FF2A5F09CCC4A601145B2CF5A1
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1454.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1454.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 7267f3231e29512c53542a09b0e5b183008536f4cf51eb7512a139acc3c57776
MD5 405788aa5304d6db94eca4fda61e59eb
SHA1 08ce0d3c334e8dcc44d078889e8f2ce8822ae0df
SHA512 bd5edfd869ae1601ab644ec4bece758fbd26dbc35e6cc2a3fc2f9acedac76f97cbca24773a2158bc3170a60d59c5395d283a87a47bae10c09d77b557f1e654e8
SSDEEP 3:MsEllllkEthXllkl2zEflSQvhs/ll:/M/xT02z/Qyt
TLSH
T10B4404447FD0044DC70010744051C3501371D4110531574734D104335CC75550C000C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 02eeb911c3c068d0f50b8f737c1183049c4a6c6ae3102eb5024e8d5b8fd1f435
MD5 cdd81a86ccef94acd6df4ccb7be003e7
SHA1 16f001a774c2b1d89d710355f1e0b95efc2714e4
SHA512 a46e302cd8111111c010086f5c5aacb576ac3d4892183bbd3ecbfe8beace9df828f92b0e260a90754d7861d70f5379f482a538148e152649ed1e9b4a49efc493
SSDEEP 3:MsEllllkEthXllkl2zEflJR+/l:/M/xT02zmR+/
TLSH
T138440404FFD00C0DC50030704151C7501371F4504531575335D304337CC75510C10400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 14bb988068969ac365693dffc2257050eb13c5251997455ef0885f831a2cf5da
MD5 8682e0404c8de2d11f6fdb5eca295a74
SHA1 0f11dc1608cc68442d3590724e775b475d646d74
SHA512 4d1567c067cfa2e73f0bff276eb2cf8b6f50b94ef7edb41a71d516c77723eaa53238e6c6d7c3d42c34ae186907faad1331aed94ca1d29714b5627aad3b2d6847
SSDEEP 768:833ZCf+utp8+p3bd66j+4BRv86aLIFCE8E:833Kr8+p3Z6n4yBET
TLSH
T1FBE29EB1ECA9DD339CE9D644B29637839EF4117395C00EE4E8DDBB1D015716D1B0B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0fbc378dc3e39b9b19d8f6a16d9f55b4155b60ff5260672261dd2ad9eafca387
MD5 059de93d218f9c25b490d3241127fd0b
SHA1 880f22ab8feacc6f0feaad700d27416cf0acbb86
SHA512 e85492043dbeb5c6039e02d1ee9ead7acba5ad6133f5a8b5360e6c1cf04b132f2b93382fdfe4c6578a32b1d4b425905332f0ca3837bef9d6896aa3f3b8175b0e
SSDEEP 768:v33ZCuCop8+p3bd66j+4BRv86aLIF0y9mr8E:v33G28+p3Z6n4yRjrT
TLSH
T1ADF29EB5ECA58D3B8CFDE744724A36035EB44137D1E01EA8D6DC6B0D41771ADA70B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 719421c78ff33ffa0c60c034286a74b68552162f1f34c5d78348cb2f0b84df63
MD5 1b69f2b09620e0a5ad2daec424e84c03
SHA1 68d319a1a55a9f2edb17c69c24057a55ca243b93
SHA512 f8096e7a3f99d8a0c406a8337df2980ad0cf340b636b0bb5ea4e325b5919e5e8b0838c77500a43af917d476a0343b0826cbdb9eb83d4e2609fdc201b266e11fe
SSDEEP 768:Irv+4UNbdD3CcfKNp8+p3bd66j+4BRv86aLIi32bwCl1:Ibsbp3sL8+p3Z6n4yZ0ww
TLSH
T12503BF33E8A899739CF6C648B24677437FF851A396C10ED4E4DD2B4E415A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 aa4692b9c9c5513b74b47ca39fc7e59533e41069aaa84d003980d4cc31a3c213
MD5 4730aae783b445946e40417ca008512e
SHA1 b2a3ffb190c8af6c3603009ce650a8e77d7b6ee4
SHA512 4ff13ec0436fdf809b6db82d0cb456abeb333461d675effc86fead4670a330199387b9300afef9e449aca1cfceed6a4f7a4d5108cbd74eb22a33b39f283edd43
SSDEEP 768:Srv+4UNbdo3rCf+uap8+p3bd66j+4BRv86aLIWA29NWER:Sbsbu3AE8+p3Z6n4ym+WER
TLSH
T1E2138D79EC58993F88EEFB04720E6A176EB81177D0B00DA4D7C96B4DD17609DF306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 59KB
SHA256 bc5a806b45ba14e685258d83b2faf1daadab71bff007038543335ad2fceae934
MD5 9fb903dadf0ff7ebdb0af50470caa23f
SHA1 3af16d16d8c1100feb153b88c0ef9f30aa9dbe79
SHA512 33482a3ebeb7cc7758fcd1da6fe649084dfe9b80d47db7f43eb0842241101f7159296d653dc9d4fdfbb7ee393d32b6bc12ee2ebeeb2613c7cadd687e8defa5cd
SSDEEP 1536:O33r8+p3Z6n4y0o8oABYI+z7ldP9qPZj4T:OHz3cnx0xoABYI+3XVCZg
TLSH
T1A55359F698D7893BD9AD9743A37C2E068DBCC123B5985894F7845E0DCC621BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 13580bc4cf77f07147531703aedc0f9385f48205a9528d114a20b7f0774aaf72
MD5 f5113e63807dab7bbcef5067caf855a8
SHA1 7ef42fe3b5c1913e5feb0f68f1add1518c5ba7d2
SHA512 567a70bafa202c660c671fbc7a72b3ef637fdd1c0849f0ca0e1cac3f2bc292724e73b37983badfbb6c3d6540bb9fb2248ef0605adc05a132e45a4436fd5346a6
SSDEEP 768:233kCf+utp8+p3bd66j+4BRv86aLIFCE8E:233Rr8+p3Z6n4yBET
TLSH
T1E0E29EB1ECA9DD339CE9D644B29637839EF4117395C00EE8E8DDBB1D019716D1B0B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5b1428111f6acf7f35cd08d964d3080e7250dd02e8f0b0a85a88fbaf72fe4081
MD5 6378d43f00b40499781a7ddc029f9d91
SHA1 b806ed943b578e0f21926667564ccd11f34382ef
SHA512 0ebaa5ba7e42c76d68c5e85e0994b899581647115ebfc0462af110d775c42eef7abb000fa4539f2dcd8e1d3a1545b52e2a0adbfbe5a546084b8d9af7962ab5c9
SSDEEP 768:mrv+4UNbdD3xwf+uNp8+p3bd66j+4BRv86aLITx2bwCl1:mbsbp3kL8+p3Z6n4yA0ww
TLSH
T11D03BE72E4AC9D739CE6C644B28677837FB811A399C10ED4E8D96B4E015A19E370F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8063e68131496501c18087750c78630f97d725ac2590d0b64d12fc229674d84d
MD5 975270d678ebff3c5589f7ebcc5292d6
SHA1 90f0529c3fabe08c0809b8785f7f16580c0c20a7
SHA512 9279b8b42925dca3fe3e6de260cd6097ed34d1f7ac59f5eb010ea3eeae30f78e2bc74b48bb0eaf9b3d3a4a5c95f0b075522a82c36924272e1a0125659950d9a8
SSDEEP 3:MsEllllkEthXllkl2zEflp5R+/l:/M/xT02z+5R+/
TLSH
T1B44404047FC4144DC5001130D053C3501771F4100571574334D114335CC75401C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

8c44ec64-bf00-441e-bee2-6b50ef9b35ca.tmp

Path C:\Users\Admin\AppData\Local\Temp\8c44ec64-bf00-441e-bee2-6b50ef9b35ca.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 87da4e2ec24a8c351b1b962eac1ccd686bc1b8ae13861806229b46673bc12f54
MD5 7fd3ec773d119bf22073a0768c9f6a1d
SHA1 c73771a5e8fdb9edd950917ca3a78a328c47b19e
SHA512 b15179787354ebcef296073d36db36dd4bad86b0b63e2dbf3fcd3bc64691cae7a691373ce3977e8d5c37cfe2515df4ba023c2dc8aa1490c8bf8187815b95288f
TLSH
T1291127E53532227B46C34BD4E0364CD49960B896433F269CEA575474FE6CEE0972E389
MD5 SHA1 SHA512 TLSH

Submit Download

ec642ede-2b0d-4182-aad2-3cfc613312d2.tmp

Path C:\Users\Admin\AppData\Local\Temp\ec642ede-2b0d-4182-aad2-3cfc613312d2.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir368_1217726202\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2548-2-0x00007FFB967C0000-0x00007FFB967C2000-memory.dmp

Download

memory/2548-3-0x00007FF7149C0000-0x00007FF7153DA000-memory.dmp

Download

memory/2548-0-0x00007FF7149CB000-0x00007FF714D92000-memory.dmp

Download

memory/2548-1-0x00007FFB967B0000-0x00007FFB967B2000-memory.dmp

Download

memory/2548-317-0x00007FF7149CB000-0x00007FF714D92000-memory.dmp

Download

memory/2548-4-0x00007FF7149C0000-0x00007FF7153DA000-memory.dmp

Download