hxxps://release-assets[.]githubusercontent[.]com/github-production-release-asset/1268272870/196ca60d-6c9a-4050-bf34-6d82e47efc6b?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-08-09T20%3A46%3A43Z&rscd=attachment%3B+filename%3DAllsa[.]0[.]1V[.]zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-08-09T19%3A45%3A59Z&ske=2026-08-09T20%3A46%3A43Z&sks=b&skv=2018-11-09&sig=Di8JPV3JX2XodmkjF1TrCQ04x%2BF77uqY2PpQTSdkvg8%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9[.]eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4NjMwNjA2NSwibmJmIjoxNzg2MzA1NzY1LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ[.]16ayx5UKCFdHy8K1XjgAO83KkTbhMP42A8q6Kmr8vq4&response-content-disposition=attachment%3B%20filename%3DAllsa[.]0[.]1V[.]zip&response-content-type=application%2Foctet-stream

Analysis

user interaction
yes
max time kernel
1048s
max time network
749s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://release-assets.githubusercontent.com/github-production-release-asset/1268272870/196ca60d-6c9a-4050-bf34-6d82e47efc6b?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-08-09T20%3A46%3A43Z&rscd=attachment%3B+filename%3DAllsa.0.1V.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-08-09T19%3A45%3A59Z&ske=2026-08-09T20%3A46%3A43Z&sks=b&skv=2018-11-09&sig=Di8JPV3JX2XodmkjF1TrCQ04x%2BF77uqY2PpQTSdkvg8%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4NjMwNjA2NSwibmJmIjoxNzg2MzA1NzY1LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.16ayx5UKCFdHy8K1XjgAO83KkTbhMP42A8q6Kmr8vq4&response-content-disposition=attachment%3B%20filename%3DAllsa.0.1V.zip&response-content-type=application%2Foctet-stream
Sample260809-ys6cfaveme

Score

9^/10

credential_access discovery execution ransomware stealer

Malware Config

Signatures

Renames multiple (3080) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_536690095\surnames.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_936578163\shopping.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-notification\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-shared-components\fr\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-tokenized-card\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\shopping_iframe_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\wallet-webui-925.baa79171a74ad52b0a67.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_293924722\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_1127022810\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-eu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-ec\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-notification-shared\zh-Hans\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-shared-components\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-shared-components\id\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\wallet\README.md	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_1127022810\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_799968495\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-notification\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-notification-shared\ja\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\Notification\notification.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\vendor.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-ml.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-notification\ko\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-notification\pt-PT\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-shared-components\th\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-de-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_511104828\adblock_snippet.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-hub\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-hub\pt-BR\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-notification-shared\fr\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-shared-components\pt-BR\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-tokenized-card\zh-Hans\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-af.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_536690095\english_wikipedia.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-sv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-mobile-hub\sv\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-en-us.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_511104828\Filtering Rules	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-et.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-uk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_511104828\Part-NL	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-shared-components\pl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-shared-components\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-tokenized-card\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-hub\id\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-notification\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\wallet\wallet-eligibile-aad-users.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\Notification\notification.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-sk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_1391494733\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-cu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_511104828\Part-FR	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\json\i18n-tokenized-card\pt-BR\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5324_222877884\Notification\notification_fast.bundle.js.LICENSE.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2840	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
116	msedge.exe
452	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307794424248212"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{51D9BA8D-D272-40A3-B3B1-2CAA277128F9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{8C27A9F1-73E6-45DC-9DBB-4E827E8607B0}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5316	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe
1944	msedge.exe
1944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4484	4464	msedge.exe	86
PID 4464 wrote to memory of 452	4464	msedge.exe	87
PID 4464 wrote to memory of 2992	4464	msedge.exe	88
PID 4464 wrote to memory of 644	4464	msedge.exe	89
PID 4464 wrote to memory of 2992	4464	msedge.exe	88
PID 4464 wrote to memory of 644	4464	msedge.exe	89
PID 4464 wrote to memory of 644	4464	msedge.exe	89
PID 4464 wrote to memory of 2288	4464	msedge.exe	90
PID 4464 wrote to memory of 2288	4464	msedge.exe	90
PID 4464 wrote to memory of 2288	4464	msedge.exe	90
PID 4464 wrote to memory of 2480	4464	msedge.exe	91
PID 4464 wrote to memory of 2480	4464	msedge.exe	91
PID 4464 wrote to memory of 2480	4464	msedge.exe	91
PID 4464 wrote to memory of 6020	4464	msedge.exe	95
PID 4464 wrote to memory of 5484	4464	msedge.exe	96
PID 4464 wrote to memory of 6020	4464	msedge.exe	95
PID 4464 wrote to memory of 5484	4464	msedge.exe	96
PID 4464 wrote to memory of 1172	4464	msedge.exe	97
PID 4464 wrote to memory of 3660	4464	msedge.exe	98
PID 4464 wrote to memory of 1172	4464	msedge.exe	97
PID 4464 wrote to memory of 3660	4464	msedge.exe	98
PID 4464 wrote to memory of 3660	4464	msedge.exe	98
PID 4464 wrote to memory of 1112	4464	msedge.exe	99
PID 4464 wrote to memory of 1920	4464	msedge.exe	101
PID 4464 wrote to memory of 5324	4464	msedge.exe	113
PID 5324 wrote to memory of 1156	5324	msedge.exe	114
PID 5324 wrote to memory of 116	5324	msedge.exe	115
PID 5324 wrote to memory of 3728	5324	msedge.exe	116
PID 5324 wrote to memory of 3728	5324	msedge.exe	116
PID 5324 wrote to memory of 3728	5324	msedge.exe	116
PID 5324 wrote to memory of 3772	5324	msedge.exe	117
PID 5324 wrote to memory of 3772	5324	msedge.exe	117
PID 5324 wrote to memory of 2416	5324	msedge.exe	121
PID 5324 wrote to memory of 1668	5324	msedge.exe	122
PID 5324 wrote to memory of 1668	5324	msedge.exe	122
PID 5324 wrote to memory of 5960	5324	msedge.exe	123
PID 5324 wrote to memory of 5960	5324	msedge.exe	123
PID 5324 wrote to memory of 5064	5324	msedge.exe	124
PID 5324 wrote to memory of 6032	5324	msedge.exe	125
PID 5324 wrote to memory of 5064	5324	msedge.exe	124
PID 5324 wrote to memory of 6032	5324	msedge.exe	125
PID 5324 wrote to memory of 2164	5324	msedge.exe	126
PID 5324 wrote to memory of 2164	5324	msedge.exe	126
PID 5324 wrote to memory of 5288	5324	msedge.exe	127
PID 5324 wrote to memory of 5288	5324	msedge.exe	127
PID 5324 wrote to memory of 760	5324	msedge.exe	128
PID 5324 wrote to memory of 760	5324	msedge.exe	128
PID 5324 wrote to memory of 4164	5324	msedge.exe	139
PID 5324 wrote to memory of 1640	5324	msedge.exe	140
PID 5324 wrote to memory of 4360	5324	msedge.exe	141
PID 2268 wrote to memory of 2840	2268	allas loader.exe	147
PID 2840 wrote to memory of 2164	2840	cmd.exe	149
PID 5324 wrote to memory of 4460	5324	msedge.exe	153
PID 5324 wrote to memory of 4460	5324	msedge.exe	153
PID 5324 wrote to memory of 5320	5324	msedge.exe	154
PID 5324 wrote to memory of 5320	5324	msedge.exe	154
PID 5324 wrote to memory of 1084	5324	msedge.exe	155
PID 5324 wrote to memory of 1084	5324	msedge.exe	155
PID 5324 wrote to memory of 1944	5324	msedge.exe	156
PID 5324 wrote to memory of 316	5324	msedge.exe	157
PID 5324 wrote to memory of 316	5324	msedge.exe	157
PID 5324 wrote to memory of 1408	5324	msedge.exe	158
PID 5324 wrote to memory of 1408	5324	msedge.exe	158
PID 5324 wrote to memory of 4124	5324	msedge.exe	159

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://release-assets.githubusercontent.com/github-production-release-asset/1268272870/196ca60d-6c9a-4050-bf34-6d82e47efc6b?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-08-09T20%3A46%3A43Z&rscd=attachment%3B+filename%3DAllsa.0.1V.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-08-09T19%3A45%3A59Z&ske=2026-08-09T20%3A46%3A43Z&sks=b&skv=2018-11-09&sig=Di8JPV3JX2XodmkjF1TrCQ04x%2BF77uqY2PpQTSdkvg8%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4NjMwNjA2NSwibmJmIjoxNzg2MzA1NzY1LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.16ayx5UKCFdHy8K1XjgAO83KkTbhMP42A8q6Kmr8vq4&response-content-disposition=attachment%3B%20filename%3DAllsa.0.1V.zip&response-content-type=application%2Foctet-stream
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa7507c188,0x7ffa7507c194,0x7ffa7507c1a0
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,4831354402638310540,17599470191476824070,524288 --field-trial-handle=2836,i,13019885530479178518,3849600846680205689,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:3
  2⤵
  - System Time Discovery
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,11123777647183913437,630058014147685943,524288 --field-trial-handle=2836,i,13019885530479178518,3849600846680205689,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,3538884359810868084,11476120078125149298,262144 --field-trial-handle=2836,i,13019885530479178518,3849600846680205689,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:2
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,17250527892298750654,1079468183363407025,2097152 --field-trial-handle=2836,i,13019885530479178518,3849600846680205689,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,3645972091323269998,7575288424858610346,2097152 --field-trial-handle=2836,i,13019885530479178518,3849600846680205689,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,17425619044795542428,4878526620635620494,524288 --field-trial-handle=2836,i,13019885530479178518,3849600846680205689,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,13338166094036742967,14213401407335603285,524288 --field-trial-handle=2836,i,13019885530479178518,3849600846680205689,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,4941886932319980422,8479101000237491874,524288 --field-trial-handle=2836,i,13019885530479178518,3849600846680205689,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5516,i,11292238004201873525,17398472633135508587,2097152 --field-trial-handle=2836,i,13019885530479178518,3849600846680205689,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,1173129939532625897,1523628932607791564,524288 --field-trial-handle=2836,i,13019885530479178518,3849600846680205689,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,6446332977057366527,8783968126441967818,524288 --field-trial-handle=2836,i,13019885530479178518,3849600846680205689,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,6446332977057366527,8783968126441967818,524288 --field-trial-handle=2836,i,13019885530479178518,3849600846680205689,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x25c,0x7ffa7507c188,0x7ffa7507c194,0x7ffa7507c1a0
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,7813888246471168288,14974258931329518280,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - System Time Discovery
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,10885888117883941475,16301403379707621950,262144 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,17149403252885651385,5447916523627257769,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,12130973664170073011,12748910332414559858,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,12130973664170073011,12748910332414559858,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,18368946914809756028,13517590017264006685,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:8
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,1092702542252926159,2540791515783392506,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,4991072372935835106,16724748272041661804,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,9513336257340554191,8230074822160683802,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,11810315032290608099,1578493453208226007,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,8412225716045020615,6255169548204462991,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,4644629626976625721,4014784001460149083,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,7449012129539618668,11985029501324364823,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1556,i,14372073124307377292,11714110532461025376,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,12916243752181196795,10342871129704160620,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,14683555581086001282,2065017431271676182,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,4060367518091255028,16355278624048798736,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,17419634290263701850,4845447301184281752,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4484,i,15031707020071247952,8528375330176526408,262144 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,7251199012178303838,9505254898153259717,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
    3⤵
    PID:316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,1206060056767745659,17962861553163983533,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,9518077414341548748,2687373862718495489,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,7177732507361809931,16121165329882339872,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,14915935911392028444,17683973510968189452,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,6755044541535333834,4119329505334643483,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4092,i,2197769452159484278,3268835558643407956,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,17221518599639668594,18223059778343307529,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6411171166465406775,11859749969000090865,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,16928043865372800974,10148286855650607439,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,8789475067115038635,14234681785119233484,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8
    3⤵
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,652297094326362940,5980699789750343994,524288 --field-trial-handle=2292,i,11441070752185961560,18113968820248494828,262144 --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:8
    3⤵
    PID:336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3276

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Allsa.0.1V\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5316

C:\Users\Admin\Desktop\Allsa.0.1V\allas loader.exe
"C:\Users\Admin\Desktop\Allsa.0.1V\allas loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k "C:\Users\Admin\Desktop\Allsa.0.1V\allas loader.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Users\Admin\Desktop\Allsa.0.1V\allas loader.exe
    "C:\Users\Admin\Desktop\Allsa.0.1V\allas loader.exe"
    3⤵
    PID:2164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_1127022810\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_1391494733\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_187830570\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_293924722\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_351350275\manifest.json
Size 118B
SHA256 a50a524184b2420fa2d050e10c7ecc90ff3ddddbc1d39dd7f6ee65aea7e89904
MD5 0839dbc235945a441183b3b1c54e7cff
SHA1 7d50cc09092601adbdfb99927ad0cea8f9b5be01
SHA512 5ef438077e1f23aa36d9abd6639769eedbdffdda85ee368f386638c288893a1b80c8ecac9eb9659b5559296a189c77fc24a7b716bb7914868e6744a30e7bd50e
TLSH
T1EBB092B00C0AA03B22819B60ECA0668683F81218E8029B1A088036482F8817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_482098368\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_511104828\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_536690095\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_799968495\manifest.json
Size 53B
SHA256 551c5f7ed9a2139eab8089f6fd9724b0b38d226b369209cb2ac295b3884571d3
MD5 1bd4aa2766777b47a4fc061677395793
SHA1 5e88d6015511963e10083771e9747459117b0eba
SHA512 0d7d7b5d8f5ea16308268e5ac5986195d5238bf5f30465fc541c70de8dcf8b3f87bb1e2bc38e837119df1d52a78072088d5c822836d04490027a8e071f52db0a
TLSH
T1519002604424951716C10F5065B0BC819391765995850D1D0545155902A546CE054298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_857501389\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_936578163\edge_checkout_page_validator.js
Size 1021KB
SHA256 4bd84a271e6aeee39cc614bb6fa9e60ad465f61b6a305f9f69b995f9af910219
MD5 84017bbd252b4e3da14c6c6f7966da0c
SHA1 619a6e18fddfe2003aa3799e48a30d4e4d1be2ba
SHA512 719563802aa0f7154333295cad12e0184c2da0108bcd5e009e0828326094e9d49fe16b1fd5de874ce583896c32a85659d554d1816670ba17bc07b4f7a97f657d
SSDEEP 24576:j142AzAtsJvGxkVKA8nG8O4cELKXnhw5BD6Nc6U2y8enpBtSLVzhEiJsfaWZPS6Z:j142AzA+JvGxkVKA8nG8O4cELKXnhw57
TLSH
T174252B80E1E2253466D74CB960B7D2C4B5DC04587399F1E8FA6C68CADB0F94723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5324_936578163\manifest.json
Size 146B
SHA256 7e765ccd9f7f89bc111ef17d12194e83940dace4320e67bd582211969f117da1
MD5 ec88e92109abcf84de7911dd22725ce2
SHA1 b8a7b83f5ec59289282350824653b73712e89896
SHA512 b8f7e86d56f579a0b2b2c7b852e9322fa0424954f308587734ed2e5e8e3f7c8c38b7ecc42a92871885a9fb53695572ac687d5b92d67a9f6a87a3d29980c3ab13
TLSH
T174C02B33CC31AC300D3007E408F08601EB34134FF500B0163730008D0B3C470D0206D0
MD5 SHA1 SHA512 TLSH

Submit Download

edbres00002.jrs.encrypted

Path C:\ProgramData\Microsoft\Network\Downloader\edbres00002.jrs.encrypted
Size 1.3MB
SHA256 b9cfdbb97ac867cb45226a27aea99fe3499af1217112a0a14bd55fa1547ae074
MD5 5341a851ca1957cd7b55985d688503dc
SHA1 723d5922c89c4e2fb50353f6a005fc7095f6879a
SHA512 78842c5f5a8e91d992eba04b3681e8e03b6276a84b5ae762a41c3bacc1f392d72913108c8ff96ed28d87c4e6bae411c2d98e3b7ef60f3355304ad967d1071cdd
SSDEEP 24576:zepRw2SabHJfrrSGcYgA2pZPcYYFukp3LxfoqU108Ts/b/2m3yDvRNk05j9mW:zenSabHhr+Gc/AsGuwFoqIscDZP91
TLSH
T15C553373DCFD0C54A2327E65801D95CF698E4A3D9F6825F8788A878509E1CEEF0E590E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet-hostfxr-6.0.27-win-x64.msi.encrypted

Path C:\ProgramData\Package Cache\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}v48.108.8828\dotnet-hostfxr-6.0.27-win-x64.msi.encrypted
Size 804KB
SHA256 93c2dd5e45c0727f49b9a1bc74094d6d6fada0e31affd2153149ab28e7df980b
MD5 6bdbfbbfa0b889389c05dc0e3c4ed8fc
SHA1 2552c868d48da876f0b1dbc19708c235ba04184d
SHA512 f5d79fd90d270dddc9c38ed005b27001660c2e13ee3f4a634e3aa88ecbac0e8d6a445cb68ac4855daf84844376d76f1d78f029e2952b2412a53b337850ea47e7
SSDEEP 12288:+hvOBP2b++EK6tpZ1s3A01j1dXTSK26HTUiKc4y4PNHqWkQv0eUbxfJEXkmX7:I0NpSZBBTSK2CQiReHpbv0eQYX7
TLSH
T1540523E8A6558F00A3840477286EBEF985E83F3C8F5F67B10D676EF596A88411DC8D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_runtimeAdditional_x86.msi.encrypted

Path C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.encrypted
Size 140KB
SHA256 85c1c4c07e5d8fa3a66bd6e7ba7167e8cea3834c90e395721404ef9f4ed0422d
MD5 da98044325cd673a3a8a8931d0aa8634
SHA1 13f8f9a8df4e47855b86ec94660c30d1fc02d991
SHA512 79f376d407c9ae95842518aff4aff166638c1a7d0ce89ec71320cd6ec48c6eb1e0a5f423b171bb5ba7c24b1aaea8cf57725a9a944e92d9f29acb66a74dd90f67
SSDEEP 3072:sJ5wSkLTYqsgS7bzsj+eUc0LU3I/uUU6JTPaoS1dnT9EigVRv3:sJ5jrXgSPA6eUc0LiI/uUNUB1dnT9Ejj
TLSH
T1E4E31220F0480E1371F140776D4AF49B36CEB733D8B667AAE9CCAEE5674864143179B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Affiliation Database-journal.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Affiliation Database-journal.encrypted
Size 16B
SHA256 f53e4c1349013137ad8746d9f4bb1c8c92ebed0b1bee069ea0dbfac76547cdb1
MD5 3f89bec4ffe2066942627e0b7b1167c1
SHA1 af3f7811583fb406934564bae4eeb584c7ec4274
SHA512 c7b66dc41b2cd225ef0554f07ff18748e7c926a3560b35f02ee18e17fbaf488e9587a01e28119a27aa84a5ceb6f3a371dfd0d18938abb710e83f5bef205b3c78
MD5 SHA1 SHA512

Submit Download

CURRENT.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT.encrypted
Size 32B
SHA256 bf8eadb6b68578fdb86b925201d7728c4ab769b9857005ea4b9957f5c3b3bebe
MD5 9785d981c7676af21dc91e4649f59661
SHA1 debddbd85edf77345b9e91f0f35576802b28e2b5
SHA512 3f36cf5a793c88abe3f70693287021f3e290ac4500f156b71073ae7be461b615646377b5c585902332d482a0cfc8c4652b89d0ee35b585111a93b5ef140c2ee3
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001.encrypted
Size 48B
SHA256 7f58d4fbadd1ece53bb7f6d0f73e441295974f6533ca8a756aa6a66a4bd2164d
MD5 191b261197997dae95325daa9a50ef58
SHA1 0134d7a6488465a5a161182d38d002769af8a0dd
SHA512 77ff1da9a238fd483f24fc7a66dd215577d203152062a789026e8ac1278ffe32b2f8f40d17cf8d2c45d4fce9f9bb6973d55e6222982d450f2fa3a5e17ff7aa92
MD5 SHA1 SHA512

Submit Download

index.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index.encrypted
Size 32B
SHA256 451bdfba5efb0058bcf2fd1f1a66f2b0f54a51837b722e318522e01c621cb7da
MD5 094b2e9f755a1643509f4e73a6592410
SHA1 68d0ae3f8fca03a0e579140d83472641d6078bb5
SHA512 295d8f10073750304d8160a900582e4c774b52ed93b3aa2d7a6f5a35153246497f4c53cd34f5a7df79aa350dd542ff6bded5646f4bf89537bb54639b9bc93cab
MD5 SHA1 SHA512

Submit Download

data_0.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_0.encrypted
Size 8KB
SHA256 53cf40404df59b3fb251a01d8e66d7fc068743609c3c4d3ac13f5b62a9a3eb8f
MD5 3b561105ec0a3a95d171901539c6fec3
SHA1 d63c2b46f961f54c0e76eb6515f7526e91a2c64d
SHA512 60a5b380bb2c3b1a2d6bdfbb7ed0834c5510791ca81ccce7718e8f2189702dbfca5a42e1c23f5b5744fa57c7d6d15646f1ae3e5d62834c31fae334b19d4179e2
SSDEEP 192:ZsuwPYLEcuSUgnRV+ud4H4n0l6nkSfmBF+7Xus0ODD2:WtPYLoSRD7ekkSfmBF+Luo2
TLSH
T18202C01CB312A102EB351126606D8DF7E3CDBA2F5BA99E998B130F54D529F3331DE400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1.encrypted
Size 264KB
SHA256 0584ea5693121331a64770426190207218b4abd755d4a137e747f868eab6af36
MD5 9d81425c3a101d40287bfdbd0705399c
SHA1 c9669d4289a44388e85eb91d522e1cd6a1e71cf7
SHA512 20f12becebb7d50ff5d2697b15753b245ca0d6e9266fe31ee1efae245fff0b710a10b8a365fd7459153b7771b1e335f53daf9d032bc1ede66473570a89981fba
SSDEEP 3072:AXtUa5uSiZVfcICNVqVX7nBZezrYeHMB/jjkl+m1hqlvBydL2VHnq6Sz/X0GuSzP:aCZla3rY5Prp8dL2J67uFD++bW
TLSH
T1A5442352CDF8628D6C02866DF67A44441C448648442CFDAC4CE1B68CF3EF3FA5EB966E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_2.encrypted
Size 8KB
SHA256 71a90d36b1509ec97b633876563b733252a051a981256ee47015e4bed735a76f
MD5 99fd751daccad5cc1dbf0d94786e78a4
SHA1 2d6d1111906c37309c1367d694d46dc1f129641a
SHA512 a302bb7fde4224092076e5c74c23d4a1b14f41af5d29e5be8831b90e44c88672e65852be079164d521325dc006975b81cb6918aebdc417a65ba956670d7a2e34
SSDEEP 192:lF/9shO3wVcmbt7N7EwZWmygwBMbnF+cftqVOMD5wB:SwpmbZN7ESJkMYcftGVC
TLSH
T19602B0E178BE957F14DF93127E2D1103210A01970F44DE7BE8D73475A3AA29DAC71758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3.encrypted

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_3.encrypted
Size 8KB
SHA256 fd9d266a6c6b7009a7d523fef08450fc3b479540b3ab2d6b93bf7a21859a0c5d
MD5 4d0ec54a4f30e457e4b31958d453fc23
SHA1 8d7cb6868a3020d30a89ebed4b86c944d8d7ed40
SHA512 1b9b188bdf906b78a5c9d028153ed2b1b34ea8f092b3916736443ab3e24bec552ba6e49debc20868888e964d0c282789b052be6945f9327f69686910cac523f1
SSDEEP 192:myxMTfURdDYj4tIkzivaJ9YN0bI8G2UEoamvkPivkxq:mAafUPYsikzivVA17PJxq
TLSH
T10302BFDE0752BF3B52C31E7B1155B26331C6AFAEA2A0F8135AC09054875799D8161CAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 110d3f52d5ee708e756475c42c9d7696a9f600de79d860a23196205019c54e9e
MD5 91d4e9de75d02eed75be1e704645d7f0
SHA1 d2e4f69a97b4cf6daaa2b363bfbcd0264f01b808
SHA512 469a7fd01e674783f481c9ad0d98d20f9afdc148ecb0a22e7831f840a2bf0931adb051c36568c96641584525b796852be513a5fb749693d1f60dee1ea4ac60a7
TLSH
T131D097F8691AB2A0E03D083260204600B22C06A228A3A306E1AD180CDDB800062CAAC9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 406e7c7edcfff381dae0011c6c736d968f75ef9fe94379575d6e7d534fef8a28
MD5 79c1fb19453a711f80a76228aa029ddf
SHA1 cc58c6b526aa44fbf712bd49a5b3d6b3629387cd
SHA512 2b533049efc6deefdf16676e9b78ce0a9da1e25ee089a31db9602002415956d2a0ddd2ffd8374c39023ba7a264569a0e38288723c0eecf7fca83f200c19fd673
TLSH
T136D0A7F8A746A260D12E09316824A610B76946A038A7D722D079680DA99D028A2EE189
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 eef5c5d8d240861363bcee2c4e3aaa0c1bd22a511ebd42de025b4ed21fd47dc4
MD5 05daa8645ee520b8c25881e6799beac5
SHA1 13bb075d19784ce6dad2a3029f133c842ceefe1d
SHA512 05e06ee82438a27f8f344e7acda1b47dd1a51d83dd09e151180a4a44b3573279c55cd0ec7c45078d86b65c4df8890ae513c9a1c972da7be290b24f0650707243
TLSH
T1C6E022B6C822EC2B18FD0728B0498B66EB0013172E40895F3A3C910C8FB462A45C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 e7cb5a08091a8b51dcf138e5851fe7b6c5998159e5a0f540c2a8310e4a2ae1c6
MD5 44df96f6846a10ff49498bdc2fb94f41
SHA1 463b61388061d3ed7a6f4db8753c50c14e248483
SHA512 0a55fee24645d62e3b85528c26171d550bb441855c04a2d96e372b2bf5a676656a936c792f30ba1da969527e8c39f0b7c75aec8c3c75f8f081d897d84cdd34a3
SSDEEP 768:0nLbYazVxrJ0jJ9lmnHLFfFhF3FR1H1LidHi:YLjzVxt87IntHpui
TLSH
T1B513F83DBE591CD6DAD200BC181F1B31AB3DDA35F6C60B5373397296939634A0A0EE94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 d02e18f53c6a73172a2ac9d718e9ff6e3d11809e14edb76b7fe8afb7c2f7ce42
MD5 0167a53b84f732c43606c1533c641ae1
SHA1 799fd8be2e95ed55d80d7d53153d7794d7d7015c
SHA512 d4c824fc1cea01b0464167cb2f66c6af169b70e922c67a155dd91d124a363b7a485c4bcccfb8b7f888abae40e09a6f1af16d9d695d79d5624d24ccfc034e529f
SSDEEP 1536:BRL/wvxL/+J58ePpRSXwpMXXL/C8L/nVekhARwMIqcAvAc4ErWl0Mj556GI+pmL/:HL/UL/s/PpRSJHL/PL/nRAYsGfj5E0
TLSH
T1354460F74951A01BCBA802F5E2033E3DD17B056D7DE1E8E9E57C0C952825B22B6BDE84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 1a35550d0f1c1156def4bc56efb0023ff2661702e1b6b1e9c39cf3bd476b448e
MD5 82e7b65defedb0706c045c163ce6bf4d
SHA1 95a82ba47eb5ac995cd9a2997220a00c83c93591
SHA512 dc7727fda5da6dcee2732c185ab4e7dafc40c9a9153c9e0d75fe8c0a9ac355d44915bb059abfc33e4397063c2438507e60ab041ceb5f9defa1784f78c21cdea9
SSDEEP 24576:eYIolGX3YmkVoA59F2LlPygYWAM9PJhe49JVs6uYYKLOZwCuBS09IEAO8u:eYeImksLlPTY+Py493sIYKihub7bv
TLSH
T153867DEDCA6898C3CD639A70B0F0ED477C7413C3F595C1D68898C684026B7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 424KB
SHA256 6571f407cd59dc822be063e9102c68e2b33e9ec3434d01a82ac9975cb49d9aff
MD5 fbe95063ec5c14ea54697331a980c037
SHA1 8f35f5c805c7463bac9b868e02b5593ac6146ddd
SHA512 635473a3144fa0981493031f5858782ea7357cd00bf60c31f740d9c3be47cb2545f84c578fec2495490a0ab45247468bfc349ff7a83428be568e05554581c4a8
SSDEEP 12288:LjhYB1AAZg6dRzy5E0w7tKoqUFNW0dzLjOkU:LjOB1xgp5gwoj3Y
TLSH
T16B9423F99E4415D15A0E4A7AD04C7CB0153BE9335577028E357420F3AB0B389EDFAA6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6a3847899b0ee9952df88449e22140ced9cd195d0c83839c65696be4819f5497
MD5 633f3fe3aa9eef93ed2f90f681fdbdd7
SHA1 ac37cccfd318f6bed32dd27322c7de0e4237b10c
SHA512 cef16e162cf21ae7361758499665061b1c704594e3e61ad890d6081f71e1dfd81bb8136de1e1c2b35371ae04542b2f0db2b21b937f2c9c5dca4e1de753f9b1d1
TLSH
T1A951EAB9F9C1099DF316223F61E07218BD29CCE8FD9A0DE11E505138E9D3B64C5759C8
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 8a89b198bc91cd0ccbc9193500c695740d91a7386d78493a02637fc77e8bc578
MD5 a74281d5cdcfe5ce8f765f27d87a245c
SHA1 f9a1fc360904ed47484c009aff5697a92e7ea9f1
SHA512 2353ea2c4937d90c1d377e5c9f4186df5f3e0a1e6788e84c74b4edcf042765f848ce3fed41ec72297439c8b38aae88aff5fce8bb5b936e8c02af9d721ef54aff
TLSH
T1D3E0689950CAC25D9A313883A12CAF48C1C43146CF85EC071F4488C43702151F6CEB7A
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 aef99376a035c52fec55cf0845a0d3d176145941cb89a58b8c853986e12e3684
MD5 82e55b7ef8aa672b8f1afdf2535dbd49
SHA1 9543789b6792d26b988fcd07646698a47027ec78
SHA512 cc67abfb4480ffba892f5b0f036cbc72b8e0e90d8b73c4f8c6fb554e82882cc95fabed6cc7e7269f88c1b72f9e6b6e793131b0989014dd5718df17a2fe14bbbe
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jLb3W5LZC/K5fKFtIKvXXqYpL:Tyi+7f+UZD4jJ/Br3WxZSCKFOK/XTpL
TLSH
T1E6E2E08D3F11F512C5ED733DA0C2C6E05EBC686C464D71B192389DB68C52A62F49F11E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 703c7df41381ab40964ec51813929564d892e25274989bfa24f9416349a47308
MD5 304af6c76de54585a6359aa9c023c22d
SHA1 33de99fe05a70eead31dd17c7e2da2029e8d2a28
SHA512 ccdc9055637fc6e498e96b5d2136392290152655523be665191f3400938b6373fca5ba5a73602851e339d7fe67b5cf1036ab1658ac2ddaa7fcafd884e315ab46
TLSH
T127E0260845C8C32D942C7897D26C6F49C2D2B54AAB88BE061F0D9844A201A45F2CB7BA
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 bdd89b3ca4df3548f6bc83774b2760e12da79b032ee5b2c40039225b3768e6e7
MD5 2c6bfd659a17f2dffaa9ddae9f7c83b3
SHA1 98b910a166a83d7a70d58792674e5326c876b2b7
SHA512 30a692400c5d73d972dca2ba92de49992404bf51406113c966dabdbe4f636fd58db44526b94fa9e00395e9b9b7e80d90f7a9a41dc39df1d9e11ed05975ddd16e
SSDEEP 96:nc4x48f20Zz4x48f20ZaIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0n:nL232Rf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T17914725F4F252722CD7D917669EA44B75D7CF03F8B1216CA686100B4CEE2A52A06C8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 13f5ed2d31f0e11dced4791920ab3198a3bc1abee77af3d8a71d6c52bd1c199b
MD5 f8b8d6a89ff81dd0c01ae7ec890f9b27
SHA1 03ed0498d71078ec2a68f20bdcd6e7e1339550b2
SHA512 181ddece7f1c29149bd6d1a7fb2b4f54b5019af169f750f0f4cba9810b5ec135b66b69eb9831431b7164bc18362b98488d524453511ec744397c7a59ef436280
TLSH
T1C6E0D8A445CDC219A914344BA3197B58C3E0750ADB89EF072F0CE882B101044E2CA6F6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 3e8724152ec60621b7a9eefd1bb584ccdd4d17bbfb62e21237d4ea6f9f33f2af
MD5 88cccf45e0d764f6a8d2b0517e6489db
SHA1 16f11e6a511151dc4d51135d8de07848cd90b2cd
SHA512 84018b652641b8da1d492f744fb1a964f4ca824ca52ced5e10078f08813a4738cc7fc5b4fbb0f959acd04fac02c87f7ab1915bd72f00acabb1c7c7b4ebfa5118
SSDEEP 48:TNLopFMatSaw/auUOt8BMo21wSe7LAAwH:deMatUaAKYVe7cAA
TLSH
T141922F4E1F306221D0F08B72EDE0C5AB2F7C201DD3737699AD1460F38D926ABF0061AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 51036851a26700864565a16c9e8050ee45a78b5de56ee1bb250c2dda1090f8ca
MD5 fccd9d3a1a8e8de2b6f25f726fe832f7
SHA1 07513872b3ef27f3bd73f030bac20a472dbe175c
SHA512 e7579c9094f83e7f90354887f117c8bf11f6c222fa7704b4ec0a398a056536bfa48d90c280c1d9431c40c9a6f97c6e8dd4f2f6094a95d01b0c9e8e973f8ae68f
TLSH
T19C41C4F783B4856E8A1196F0EA18BE2FCE2D0515531C7D9A85F0AE1BD3E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 32766459f621bc404e63b01509b850f2daf6d4eb4dccd9bb99d0b0b0870740c8
MD5 b8db468ccb2a83f61e2dfb31e964a0d3
SHA1 7d3373e69c49ee222359c3f140422c239058d7ab
SHA512 c97867d5addc6b7ed757cf2d04e911673527d5bf88deee02e678e1fd31c496050db2b748c9589be63c6eb3706ac44897d016a2791d44d0bcd5f95e494b7af97d
SSDEEP 96:OIEumQv8m1ccnvSnouAwGrH2hf5nFXWx8/4g:OIEumQv8m1ccnvSogH
TLSH
T166F2FDFE07276106D99444B0E0009F8EAF16410B43B6B6EC76D447E3F7A21E2B6B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 95af68964bb44e0b0d1ab39d22db4cdc90b38f341a8bdc5ac7cdc783edca9447
MD5 d68007456a6f3f22bd0a7d51b7c5eaaa
SHA1 5ded4a4acfddb9de55abdc2fe993dae6700d8415
SHA512 3e40b1af43c3dd62d749db85ffa41f37de6d561c60b7d8c799e612bc7aff3f2207d86613d12075d55016daf360b7e145dcf074eccda62086725ea278cf938fa3
TLSH
T1C0C022328CBAE07B0024753D0A84B894BA75C870030080A4FAE5823DA3D04B77A0202E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c05f2bc107d2f371eb04175b355cfbd9397fd8f95aca80e22d7f721a204ff167
MD5 3e0476124f8d3d6547659de3be8a6d1e
SHA1 1f2cf17468ee97ccba595280aa7cde3662675fef
SHA512 563a0411c75dd51ee13d3f65352934768e76a688a23de7a497d4dc3356366887f45a1737f57794732382b2426bba58f3cad265a1379a6973888c11b4831f44f4
SSDEEP 192:sxZPRlyMqZjK1Ml8397/fzsXWpVUDdoaZdbzodpLHW6+WNGYveuQDJrWIgbe/J:sxZPqE7/fzsXWvUDdoazALHbGNJKyB
TLSH
T19462F8156A38997BCDDBD219F6457F63D7F81463E2904E4499FC8A1C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 99ed00c492155be26ce9abe5107cbb30786180640bcc40656c0d8975aa2ab456
MD5 f85a4fda69267136edf87f115711f382
SHA1 ad8b9170dc41951e282b4fd4ed03c102ce47fce9
SHA512 f7d07d4eb9734ecb743d4284dd1012368b725c52c91a08b99386c12ebb787c4acf721ba62cd40787865298b0aba3f8dbc034ea74c24cf429f82269e6b4d5369d
SSDEEP 192:sxZPRlyMqZjK1Ml8M97/fzssTDdoaZdbzodpLHW6+WNGYv0uWDE4Igj/J:sxZPq17/fzssTDdoazALHbG5ljB
TLSH
T16262E7166A389977CDDBD209F645BF53D2F91573E2904E44A9FC8A1C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 1eb01f3dd0daf593522bc374e1712ea0d4ca64fdf6d35b6c97296f485716acb7
MD5 f694d95a8a9e9cc979b70f8643c86649
SHA1 be72af29c2d92d55078fa3dfb405ca23034f0b13
SHA512 31620d967cbb6979d4f8bbe9c518dcc9495c3c2f944ab0498614a57a19b07fbbf3c88f8d4cfef8f23a26b63838a46e515353eafecc5b8338bcdc6e3911f45672
TLSH
T193E0DF1849C8C2BD7829224346A9D78DC2E9740BDAC8BB022F098E846243D84B1D66B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 ac94ff02226ddc5c354f18c4c41d216d79bc5679c3bbf434680c734ed5764c2c
MD5 d37398d2c5ad30784cc09d9eb1e944ad
SHA1 3fe3930db5c160ffbec95638ee258d1fd6ffa36e
SHA512 ed71a5b77e6193b66247ddd5222bb4234a67c6acbe8dfc9040d05fd5e4615a87a82c1f93c0a545e5bc3e4dfd6a59340cfecfe6686f765cb14a6b848425ed5232
TLSH
T1FDE0D828D5CDC37E65456187936DE749D2E2B40EDAC9BD222F0DAC446307540B2D7671
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 b79ce49f39740b0dcdc5ff113dba0c134b5dc7d0ef0bfa685abe2b6abcb7bac6
MD5 b8c1a4940719d3f302ade00af3dbe4a7
SHA1 ce8f7f6df5dc73b0ae4bdf987717eabc6bc26f1a
SHA512 b3888457c8a8a0487d127c24446ddb74d23119c0c7209929313b1f7b451a59366897c54eb693f14a6a3ac1414292bcb61a7d9acc8aaf14c4061731070fd00d8c
TLSH
T1E6E048B885C9C3FD5405718383B9EB5DC2E07C1A9784BE565B0C68546202644B2E96B4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 83a99cb171132d8670fd752a8e17c1c72c43d1f19f7097c7e890a28a857e520f
MD5 ff65a22562abd5e42cb30885658fbb87
SHA1 7e943525d1368060a740d42c90ca989d3d802077
SHA512 e2f0281dd3f4e2b48a28db6fada3ccf7006561f8f5909391ac087f82a6b03573900a487c1ba8b471aae00e4a004ddcc779fd22f688ee7690df0981a404af86d7
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGl:05ppxnY753RNBvRJJdt7p5J97rpj
TLSH
T148B26B5A703E0211393E2988B39696364F4235A37058E4AF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 07c28a93b740bc881f0175b84aa3f32699de5cabea49e16268adfd130ef6dfb3
MD5 41147ba283af00e61c2a39a3c09feec6
SHA1 82f2aeda0de64138e7e339fc77a0051888f1606f
SHA512 6a0782c361bf99c45c0ccf5ad266ef14520e0164190502af0472e70098c0da609330ffed26a878a4f3eaff96dc10560d3cb5216f1885ba5a54f1289e993852c1
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J97rpF7Jgvg:0LppY93PBZJPtN537tFdg4
TLSH
T105C2895A717E0202383E2988B29695374F8235A37058E4AF7FB814A14F67E125CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 d42d1aa20f0df6aeec41c5ee9fa80fe7485fcf6a3bf2954640b0d7a17bfe2006
MD5 cf8abf39b7339127710fb74edb09ef36
SHA1 d03d54eaf4b949a8ef97f3118783a85caba0e102
SHA512 747badb6a08ac311a256c56dd51b8eaa95a1672ba0c1e7beef9a3ad7bc62b7d0527d89d94dd86e4bfb6aa820a60d7feebbaa535b6ba3129c474025bffd7da93f
SSDEEP 192:P+xW8KuRSxlIgnqMpfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxaZRHpfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C724630A7B746001EDE6D9725CB080771A3C716ECF22A6D16DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 b08eb820f57ec5f1432c017d558154604d856f87bc367120944f6a43fbb339ef
MD5 7667996f854532489716ce9bc0ff32ef
SHA1 faf24632ad3b71c813a19e7e5717fc1b47ad1f49
SHA512 33c2db0fd134450055b847eb492969e5eb4528f7d4bc16aec36a44e9a1f05f3fa1d20ee180c627571e964d69df7f8c13dede97a2bcea3ca4866f8c386aeea7a3
TLSH
T10051C4C093E85486BF8AB9C1D20E6513ECE13E57220E58B1732E54F54F84C2A4E2FD76
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 1e58c1b73a0a7523b6a52c2252af66b37209e27a41d655956c4f973dd0e461ac
MD5 501d838ce5894e115884f5807d5ffe36
SHA1 5db6c3e190f379bae5b0e68dfa92a95a79d7c717
SHA512 f02d3e8c638e8b1d49b560ce74800407deda77814128156ee7e24d762e7c9eb1342ee57fe113a4aefa972edc400beb944c94e94715a91b812e731144711c9dc9
SSDEEP 384:GAhsBJGscH2D2F2D2t2D2k2D2DQlIIIsbcMIMaBX:3qvncWyoyAydyDQ2
TLSH
T1A4A2E8EAA105AB3BD50F7FB6831D899E93E9F893464A034E7016900ECDF152B45D25F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 55b05894c394dc64cc3a5aed7dae298be6ad6f0e25f93cea09ec5162896064d5
MD5 befc0be447b4f53c78c0779ba823fd81
SHA1 8bc176c13e1c0ae9ee8228e6ada203294182ddec
SHA512 04c291721a9b5b86f9d146fffb26038470114c489634a5d1da9c6d1a3c7de5ceeae063d1b8bb2174a2d4940ce2e55a2fd78ac4f82f3ecb9184d9c00afc8ea2ba
TLSH
T1F3E0D818D8C4C29E69247087616D5B49C3D1B95BEF8479051F149C446101500B2DA673
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9e72a48b3bb2f1ba346703a2f29a6e0cd440630caa078ef9bbe2e36b2bfeb664
MD5 9902aecfb8c02490e757eae2dfc7bc94
SHA1 3431d0b700243264392ea8624dedecf95716c8fb
SHA512 8c5e0431b8f2b63b3cf35aebf7e479cbcc056328c9158472240e7a0ab071eaa332a7ea2e23c15633f96dc78955b28917cd948442d526ba0ebfb82aff117d51b7
TLSH
T1EA219D55F320C159E18E863AA46B9B261378E8129FBCEC0F847D24352D72E045E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 eafa7a03ec97d771e8bb4f3e2f92a910d190687649fdd18d058c8760000d6d34
MD5 29cb32755f4dc4279a29a8a570eb8aff
SHA1 49abc4e7c752e7d136391a0145f6613861ae990e
SHA512 e26a324de7f639eae2ff0ee446d9aa2940aa985833b1b1b556646c67377a3f3f82e512e4de1cd38e663e9de61d3e09862485035677beb56e21d4961dcb6a2be0
TLSH
T188E0D81468C8C25FD4253087616D9B8AC2D2B907EF84AE051F0888489205142B3DB672
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.19\data.txt
Size 150KB
SHA256 e589f794c343744314bb92dc03cb87b0aabe1a0e4df61bd77327638125d6e1a3
MD5 67a2e4e53750b6b992e203c4e98608bd
SHA1 f84203baa2f63c3dd4e3e6378e9d74faaa27a35b
SHA512 86c77bc809e6e9d80b1e1c16ad97f6a3e9fad6b010f322e0e1146c8cccbb9c0f71146a87e1e6094034c0adb5c2e5f9229a90551bea00b9df975a4a6c05246a6c
SSDEEP 3072:0PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEEn1dm//OKXXJ1RxGfI:YX1aI5aZoKzMJ07NC1d81xGg
TLSH
T11BE3F210CAC41FECDEA4262C60FE0F1D6790C78D883B6A89D7A7FE4A5F9750895274C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 6f5f97effbaf864e9ac70bd1113dda3eb12dca0001149f76fec681d1fc5efef9
MD5 cc67ae3e86fb46f5a3f92787fb8940c6
SHA1 c02b0faf95a9a6da81018db65e9dd51dd8636cb7
SHA512 8993fa73c73a532633ba8a1ad4a9b757bdb68599d0d0545ce28f871ab5642e531e362e49eb0f2715920c5291adec1d50b9a39cf62bb4b4302d94c8184ef4abae
SSDEEP 3:MsEllllkEthXllkl2zEfl5wtl:/M/xT02zX
TLSH
T1F34404147FC44505C50030304053C3503370D5507D51575334D144335DC77400CD1011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ae6bdb7bfcc51c81c5bdbeeef102708b2cf89712018fbfb0ef3ab53ced805031
MD5 3e07811164212181da0215d53d3f58cf
SHA1 49e004eb6fa713222fe684ee7fe842eaa488077f
SHA512 51c550883823974170f40d2651b88f5b9d64a51f04e9c866f6ddd77dcb763ba1fa09003f999d8f5d85a970399976a249822f1657aee449f2a8c9bad7c7727d96
SSDEEP 384:npkiF9CcmyWCs3sNG8TUNTUlIm2QckCr9lsKpvBftGJXfhT9J84ttpye4KV8p0/5:p/Fccps3HwgbkU+kjGzT9J84tCI8p0/Z
TLSH
T139B25C36EC68DABBEDE74F89B74A7A03DEE0526785DC59E4CAD85D0D00931DC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0169d1557f1696b5104921c8c5ed45e339489b35969cc9c681f9fa12bc5554a2
MD5 f9b84322e420b95846d0225718411347
SHA1 1caa15827ee912d517298ff833bdd852113702b8
SHA512 911ff3fd91a72de393921995e595b81a3a17448d271f845101649adaf8e6c4a99261fc92cd85d7df2e4af8df7e97ee41d21519d7b61163f8939368f4af3900dd
SSDEEP 768:prFccpq3JwgVk3ljGzT9J8ztrKnewBKZOVX:5q3N+iKBGnevZUX
TLSH
T112D24B36D868DAB7EDE75B99A74A3603EEE04263D9CC5AE4DADC1D1C00971DC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7ba163b1fc9a0d2e8e0751235d2ad5555c8baf67d86b8972850e9e97d25952e2
MD5 9cc2f242f18e64c54e12ac287f310fc5
SHA1 dbcee6155bd63a1fda56b62b280817a105ce6a09
SHA512 67a647a0de93981d3b91e8205471b042e4bf9218ad7b4052b95c032e960657ced93208819b89a3525dab3ff4e1790b3d112781f09f39a4cfd99f6f8691177a7e
SSDEEP 384:npQiFiZcIQsN88TUNTUlI4GQckCrONLpvBftGJXfhT9J8dLBtrKnTKwBODNZOC6m:prFQQJwgxkbljGzT9J8ztrKnewBKZOVm
TLSH
T1FAD26B36D868DABBEDE75B89A74A3603EEF04263D9CC5AE4D6DC5E1C009319D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 4ab772f6ddf0a1a8218858ca7250fc91745cd2ea5ae1a7e1983084350e2bb1d0
MD5 5235480f2d248a50093e1350116704df
SHA1 45796240316e56fa29297cb6c002092aea26e778
SHA512 469dd8647b1ec1f42eb5aebee967f20455c06e4db9b806deb65e66e7d9420361138cbe48e45b43eaaa10343b6c75aca066b07cd0281e5116e3773530ea37f72e
SSDEEP 768:prFLlJwgxkfljGzT9J8zu28r99mACnewBKZOVm:fl5YiKG+ACnevZUm
TLSH
T110F24A71D8689DE798E2DEC9A74AF603AEE40273C98C599CD6F87D2D309B1F90307815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 03c821c5cadf60fa5dc716188477a08933844fada822589a5653092f7d49cd29
MD5 1f0c1698787a05d9ca8e39271fb60598
SHA1 2dbe74d5a083f3eca7996c2134881bd8f5667b52
SHA512 373cb8436bf84ce35dc7d6ecffbc824b9f3753afbde101ce3be64cee60b45beaa389495800a745f4fa3c2788ecfa326ed4140c796292b7f630ac50e83beccfe8
SSDEEP 768:prFLlJwgxkUljGzT9J8zu28r99mACnewBKZOVm:fl5NiKG+ACnevZUm
TLSH
T18AF24A71D8689DE798E2DEC9A74AF603AEE40273C98C599CD6F87D2D309B1F90307815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4bfed0562a10f4e967075355346c43d0d9c742730bb4345085bb9a3bc2def7e6
MD5 8fd0febfac0b8dfed5d16a0a0cdc9c87
SHA1 2a7346109df26541fe05dbbdc808df598557815e
SHA512 9ececcdd42e3d2f229d8afbc0c8b76c61543df2b8b5c2af3818803fdd32b5f12d43e24612328bfbef1e02d46396ef7b088ea5b1ea2d3565bc045dacb5bc2fdfc
SSDEEP 768:pmFccps3ZwgbkULejGzT9J8ttrKI8p0/Z:ws3DMiKPGI8p0h
TLSH
T1C3C25C36E868CABBEDE34B99A74A7503DEE05267CACC5AE4DADC5D0C00971DC530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 d222b6dda3b72caa9becb90ddc8209410a7b20b11fbba22f8a60f3486bf77f74
MD5 f6cf1d4aecb20f57a157c9bd219e73ad
SHA1 8a3c636bca796bac2ed0233b523963aa5439bb74
SHA512 33e4aaeeb55c81c3501659c937fe80cbfa93996016615fa6363de53db671acd3d4d0c945e2332c64abc635adf65e9ad0250dc3dd94cb038f82b6daad09750f64
SSDEEP 768:6FLlswgxkGljGzT9J848IWsCgG40vRewBKZOVE:elW3iKqWjgz05evZUE
TLSH
T128E24B35D868CDFBDCE69AC5A74A7613AEF04163D68C5AE8D6E86D2C109B1AC030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5996c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State~RFe5996c8.TMP
Size 28KB
SHA256 d507218106b940990e4c7cce30d7abe62df2476138433696315ab9a3d268cb03
MD5 af6add0879a4f49c1f57d07f9f4abde1
SHA1 0a5de815a295ee6d9f66320074d2d0fa8b8e2d22
SHA512 382d16c2faa53271a3a849a7150c158da1222b9cada19ba4745c3d1e84ffd9c57347e893e47f2f4c54e9d5eaf0a230e0b05b87b025f72d4c92910df93d5da658
SSDEEP 384:n+iFTZcIlsNx8TUNTUlI4GQckCrOWdLpvBftGJXfhT9J8dL50nTKwBODNZOC6KDB:VFLlswgxkGljGzT9J830newBKZOVE
TLSH
T1B4D25B35D868DAB7EDE75B89B75A7603EEF00163D9CC5AE8D6D85E0C009318D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 0318e2d5cf712af0de00388c69ca14ddd8cad2a5075f41d335564087b180d980
MD5 3e992aeddebda937470f14ebfd037f92
SHA1 7e3a9ac475d111ea059b2b9760abcd0fb6e96db3
SHA512 ee6d70ef9f9cda2fddf8e80b031a1733e8a75a3f4ac7ac8c6d1865b26bb5742aca8c55f2d001a09ea48cc50e6ecd5f51792b49d200d3e0455e63e1c7b73247ed
SSDEEP 3:MsEllllkEthXllkl2zEflxl/l:/M/xT02zGlt
TLSH
T10E440414FFC00405C51010304051C3503370DC5055115FD335D104375CCF5C00C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.29.1\typosquatting_list.pb
Size 927KB
SHA256 8da21018e6a6063f029ab8f81ef3de28adbd1740594d43934a231e9bc8458496
MD5 21617bc586960af1751aee4ef90d7b7e
SHA1 8e44d591d02917d5470a382ba5ecb31d03f0cec3
SHA512 75afeab96c768f0647940e940d0e842b2ecd422628a9c0adae06442dc6a27020c85ab03580e6f56382cc2dba3c6cca1f3b8b3e42194f5d27c211075a1faffb27
SSDEEP 12288:a6q8A6KIEJiCG5sskil3XYXHm+nQBfjvG605F0:jGskil3XYXHmyQT
TLSH
T1B215B5B9DFC00194DBB8112D20BE71D8181412A540E9EFEAFE7C855F2BC29C977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 438e61f5f8ba161456807902af99a76be4dc54d292bde18373dea2793dcd0adc
MD5 8f0fe4542a71968931eae58fcdc314f1
SHA1 f44d51de39cf29e1819ec7c5c0ff59935f68303a
SHA512 dde29895258374858cb2def582dfacfb41ccd81cdd75aeceb25e7ebfba74b26f687004ac1174e66ee0b50f3523e26b91c18475032b42817da84ec3f7689358ba
TLSH
T1874142E04C391AD6C8FD0EAEB89739FC84E8D626F4A43038289CEA58567D60D744583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 43b08c9f5897e84e1eb7c42f66b71858b56c75657385339c3d0a34cee7a24eda
MD5 a98ba93052a5d832a1cb0892b3629938
SHA1 c25bc20b36a52199fa19102a97f452f265e08a53
SHA512 eee82434de40c9290fc2e18763ea1e0b0112bc0e68124446fb32057682c98232b084c2dd09ef5245c34189fa699ffcb8b124716b22c8d51ca667c5cab49f3c5c
TLSH
T110311FE05C380AD6C4BD0EAEB4C739FC85E8E626B5A430386898E958566D60D745183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 50f5a7510fa1d2fa636a5a0caa964c3e16a9fa2d5f082aa074191037c2a606f1
MD5 f126b4efea1d7028fbb0ff34665eafc0
SHA1 6478e44e50398a33f6f1c068ce9c21b70e405bf3
SHA512 794f94daadd71eb84b111453f533ea6ce37203f58e694882e350538e39c55583bb28bfe2398ff736ed5475f4775a8fab1723380d542b129be9e5d0eb985f5960
TLSH
T1F73101E14C380AD6C8FD0EBEB49739FC84E8D626F5A830386898EA58567D60D755183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 57b7f1854c3e6bac06bcdabf8d681d17d4239c0f098065e36b00fcbdd98dda98
MD5 9c2e02702af9907b5404a5230f537028
SHA1 1d8378c8073b05afb7a4eff54920707bcc2ef44d
SHA512 57106d7c33dcda2277597eb33b0eec55528e6c1bd594554431bcc9490097aee1ad18c4b6adc8626fee80c3480f22d8568df0210dd9de2e2ee1613e28edc79ca9
TLSH
T12A3121D158380AD2C4BD0EAF749739FC84E8D73AB1E430786888E9A40B7E54D709183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4b176870c3d9a3dcde5f961d9eb2c07706cf485d22186b988b5880ad77e67d84
MD5 92a34f76e5b66dd1f1ec34e5c586e89d
SHA1 9cda80d4772b22f274ebab5e9e4fc3f68c6b20c4
SHA512 c77fd5abeb2dcb4ddb12521cf52f4c97cb722381bfd8016533fdb50e5bda61a53c712de7b8b1d2119be0192b1fedbb2666e47e24eb50b5dfc0189e570a6d130f
TLSH
T11A5151E04C795AD1C5FD0E7EB48738FC85E8D625F4A434782868EA485A7D61D348583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 01351d2a1cb55664466577fa251185c147a98b0a1e0ce199da27d3bd29660f9e
MD5 2c96271ed45bf4fe6636be559206293b
SHA1 0db6997a07d562677ec7a555e93118765baa4daf
SHA512 6a08df2d536ad4b75a5cadb39b19f879868b9805b92eba32bb6c935a9642a42c53def5f40a900a34a79ff8847546f05fa5522bbf8c6b6000261ba1bc6acc7dfb
TLSH
T1353121D148380AD6C4BD0EBEB49739FC85E8E736B4A470386888E9A8476D50D749183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 631d5f7a9399a9ea2688a75a77eb33d2a292cc79edff7c65e6751ece50e9f861
MD5 4d32aacc3c557d7e526098cb07b1cd35
SHA1 6163c27c1639c8a1a8f2804d8c1a2ab84fa0de9e
SHA512 ed03a57e7a41fa2780ce1456841f7a553b57ba2225fa4c90e9cd75f6aabf35711b7533995abee5db0dc757e7212c003f7b358a36b027fd13766ee4cd8ced205c
TLSH
T1A35151E04C784AD1C4FD0EBEB48738FC85ECD225F8A4307C2868EA485A7962D308583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 16df96800fe4c3e5eab161b157a21be510013a39f7e227ae9552fb3bc41740ce
MD5 b5a45fc3dd9f96cb817786ecb9e2744b
SHA1 6e0c20a4c8808568cdc096d48750b9f9ed7b53b4
SHA512 fd4ff0a51500c5e1eb320a8c16cb02ec3766762af2c14ae94ae06e3335caa3835b6b7a6c9275d4e7012018e8f02e8fb00ea4236898bf8718193b906ac074e1f2
TLSH
T12B4161E00C381AD6C5FC0EBEB4C738FC85E8D625F49430382858DA485A7D61D348483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 89eb8c3cdc96426cb9ea82a7673675cb0bbe9287168f96fd515821aa7fc4c330
MD5 f95912d2ef2f3d4d996a169bc96e34ff
SHA1 26eb750c178aa2339a69d69be9a6854eee8177fb
SHA512 3bbc664c39cf6a06e283c94ba225466d5f1f49f9117085801bf33de8ac8d32c0a9a22fe4c86cbe644e2990658bc50f50582a521474fe7fb97d501da5c285d310
TLSH
T1C14152E04C380AD1C9FC0EBEB4C738FC85E8D625F494343828A8EA885A7D61D349483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9c37f90e35145a97e5c9acf3218ee95b818eab65e76f4f558b1ba4d77e27988c
MD5 b4f311ac88503d6bc6e00daf3aa4f177
SHA1 4f0e8974815b51cb7fccf28c5c493adf6361fd7b
SHA512 db8ac6cff53c7382cfc6bb91aa6707a0fc13df8377e42ce143c5bd4c60766a5d6ef04cdb6d7f86773afad10a3186e76f9dcdc5fdff3719334f17eef979c349c8
TLSH
T1004143D00C384AD2C4FD0E7EB49739FC84E8D625F4A4307828A8DA585A7D50D344583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8f133560a2dac0417839d141143a755cad5ad2d6a3ca3a44f8df78f6ce9f5c3d
MD5 ba5e5dd9c6065002d7246a37d3a3efc0
SHA1 c2c6b7e8b8ed41057d93a778441c1c036cb53c99
SHA512 dc03939104114464e1193443cc875e7b55b35418c5af708f8f9fb81a5a756f8fc4d98b373104c7b9e8b78bc9833f7a7fd234d2a534fd1f5ca268cd67739995fa
TLSH
T1394131E00C384AD6C5BC0EBEB4CB39FC85E8D625F49430786898EA585A7D61D349583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json~RFe5a1464.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json~RFe5a1464.TMP
Size 1KB
SHA256 015926c2cbb98c1daf5cc299f98e7cf2ed6ae98ffb102d83b1eac5ab5e9389d6
MD5 5b89c93f2cd6cae33d5aa554f9a8d6c6
SHA1 4db6df81765c5b5e197bf9794fca41613f7cdbda
SHA512 6a21fa906ecc2beda017ef73596420f5fb6a51ae38f2f0e62ab12d6d99c5aed8378fb96ffbce6b78a14c0debcf6058abc0c328bc79e36fa211da63a033876de9
TLSH
T1FC3141D158381AD2C4BC0AAE749738FC85E8C32AB1A8707C5898E9A40B3D54D744183F
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 b322c3509ee886cf33b34bd8d26cbb3c9debd199d1429133182951782f6f568f
MD5 fb4baa8f015eb966169f181b1fa27da5
SHA1 619d2c24611a32527cc540a0a91e9939d10f1a04
SHA512 1844ae677d232ee633826436cc40b317c65e1909af05343c67eb02043d689c2e683643f93dc2dd7400924f2d991ef49de0a5fadafcbf9e2f7de4d1539f887601
SSDEEP 24:w943mC5fOqLo4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwW:D5pOqp/IHRH34kWqB1kQnjhHmr6ITmUZ
TLSH
T19442896EDA2CA9A2FEE00B3ED7D1D0127B36A60EC2E4D5F1095B505747C540405DB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 562e384a4048f6c58b226bd317c50aea39a08fe5092bf372cf1e2e5ad5aea567
MD5 d65ebcb2bb254e6e209d4a2bb5d8cdde
SHA1 10fddf97dd55c80b8885fab56dc87cd4fa8340d7
SHA512 8f1bb48256430340829738969680e21fc612c0c846f70eaa2801ead7a0985e96aa74151caeaaa6b823bf13561084e6fe39aec9052001dd727b3d45f781ccbef5
TLSH
T1C1412A48BAEA1148B7736E5B9BF6A86D847EB8773E46D49D10510E4E0633A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 049e29e952a50f9111fd7f2c89937c1ba666b07c9562089e7dec1e90120f1df3
MD5 598a8928a6cac0d54b4ffc3e25cf2053
SHA1 fdb33ea19cbade91baef3520c2814c3f2ae2e015
SHA512 2e785a25c2f8a5cebe78f21985351ee1a3e840040e8a540280ed17ebd78d1399213d39fd2393742d5724118d63dab7173b0510d9b34fd4643878f3ff951c755b
TLSH
T14A515D58B6F91158B373AE5AABF678AD487FBD332E06945D10010E4E4A33B41DC62B37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat.encrypted

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.encrypted
Size 8KB
SHA256 4153be1500bd2a6d441b793177b7486d931d660775b99b4afc53fe97bc43e1c8
MD5 412ccff7b6cc9013dad94f7b7581295a
SHA1 4eba7bb948d17506d81a79f3cc85b188e980f9d9
SHA512 b93a6fe567873df2f72471824df08a2a352d0118830fc402aa4150a08fc884763b1fe6621681e37cfdab64c8175a3dda27f29b07258a8451e2aa515861ab6b5e
SSDEEP 192:EcZ0SpfhZBenBlDjaY3QyWajgSQjn2WY0blAey5y7cFzzmTKw:EcuSpfXBenBlXaYRgPX5YaKzmKw
TLSH
T19B02AF5977D61A105C0607E7E9CD2EDEEF9CC31645E645D508C053299868AE093AA23E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8258fdd5-d247-4d16-a17c-863199a5ce8e.tmp

Path C:\Users\Admin\AppData\Local\Temp\8258fdd5-d247-4d16-a17c-863199a5ce8e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 37b11f21b28d3470e859b2874af1f01107308b0c26afff72aaa53403febe0455
MD5 77fcd6a73333b8ae6d455aa829eb7411
SHA1 01cf4e5165dc90e28ab89e51b3bdce2909c18ef0
SHA512 b40f62cb3ac5c5ad87b1e82207882e4a1011093b767173537e154fd6278e983d6024983702f13659af0c54d6221b53a35c53764d382112f27a97ec6a88bdde56
TLSH
T19C5158E93935A22F6BC387C560754C84A571F190032E5A5CEE1AC434BE6CEE2671F7C9
MD5 SHA1 SHA512 TLSH

Submit Download

e500b1bc-97d6-46a5-aea1-882548f7bf16.tmp

Path C:\Users\Admin\AppData\Local\Temp\e500b1bc-97d6-46a5-aea1-882548f7bf16.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5324_1891077518\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e32e8f5b-50f8-44a5-81fe-62ab37963f98.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5324_635319651\e32e8f5b-50f8-44a5-81fe-62ab37963f98.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2823318777ntouromlalnodry--naod.sqlite-shm.encrypted

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.encrypted
Size 32KB
SHA256 0e584228f805d83b5a2daba45d32a66e05022862a5aca467d7f8fe6cf9280f85
MD5 d1d40255e463bcf55cfe85d4778d88a2
SHA1 641dd105207f23da964bc643529d8d0fe7f5031b
SHA512 d79f5ee8ec5c16fa455dc9fadb4f6bafd4185c5b00c910b28aac4f471bebcf2922da9c5a01c079bb67c4259605fe37d6a51b66900796a76e34215c0e48fc2991
SSDEEP 768:6R/Bjzwa6htU/kwQ8CHbKljgvV8e6tUS/lA+6EArWNAcKfE1ZX4+vsonj:6fjzdkqtOvVWv/x6ExecKfE1yusonj
TLSH
T16FE201C921EAE9D6A598307F20F9091745EAD3EC23B916E850063C02B2964ACF62D5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3561288849sdhlie.sqlite.encrypted

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.encrypted
Size 48KB
SHA256 3227f9059f4b44919ad8108aeb76287ef58a3de8e2ab9902dd48893ba2d392f5
MD5 0cc9d4f7c0d44b9083656f8f2b4c32bc
SHA1 081efb1caf8c9b119805470a5b8c03c34ddd281f
SHA512 25dd279b38e394546faab403b09b672b1f9e4bef7b6007d7987141c047f408242cbf10d77ebc8837df9308754e6a5c131b6e1cf170d04f318704ffffb75c18e0
SSDEEP 1536:p6UuWpmcrJYBkFdVS3wP33BdTWY7ZW43y3:prpmFSbw3wPHBhNzy3
TLSH
T17D2302271B5097B9A4AA642154DC46FB2073D1884D1CA77BEA027CD4BF31EB3C3B588E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1920-205-0x00000171D49F0000-0x00000171D59F0000-memory.dmp

Download

memory/2268-772-0x00000269058A0000-0x00000269058A6000-memory.dmp

Download

memory/2416-762-0x0000020C09B20000-0x0000020C0AB20000-memory.dmp

Download