c3b20b8801df097f0ace05644343213dcaae445a7b7274e64cf398eb5455072f

Resubmissions

10/08/2026, 04:37

260810-e8wndsvzhv4

10/08/2026, 04:32

260810-e585baea974

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ages of Conflict.exe
Size 652KB
Sample260810-e8wndsvzhv
SHA256 c3b20b8801df097f0ace05644343213dcaae445a7b7274e64cf398eb5455072f
MD5 8e8f63b07661d82b816a7ce8e41d331d
SHA1 97e0351c1e6e07c94d787ba969b475034a82bd83
SHA512 53e95bbd6eaae0bdec80df98e77dc3b107f5815f697aa108f8631b1ce00c8b1b8220a30f901761810af1865831fcb7035a5d987e1c59be9367fec6ef8312ae20
SSDEEP 3072:O0wazAjvuMeUwZPRyYzK4UHcUIcLh2teMKg:OPaMjvuUwZplUhLhx
TLSH
T132E4409E6399C25EE16223306A11D33057B49ED87130D28A07EE7E937F6A5878D381FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_425921832\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_425921832\manifest.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_5572_1319772401\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_425921832\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5572_2045440750\_locales\hu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5116	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308102452309935"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{90C9DC70-5561-4195-8C17-4B9C189E075F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6068	msedge.exe
6068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 5572	2980	msedge.exe	93
PID 5572 wrote to memory of 5868	5572	msedge.exe	94
PID 5572 wrote to memory of 5116	5572	msedge.exe	96
PID 5572 wrote to memory of 4000	5572	msedge.exe	97
PID 5572 wrote to memory of 4000	5572	msedge.exe	97
PID 5572 wrote to memory of 4000	5572	msedge.exe	97
PID 5572 wrote to memory of 2544	5572	msedge.exe	98
PID 5572 wrote to memory of 2544	5572	msedge.exe	98
PID 5572 wrote to memory of 2348	5572	msedge.exe	99
PID 5572 wrote to memory of 2348	5572	msedge.exe	99
PID 5572 wrote to memory of 1408	5572	msedge.exe	100
PID 5572 wrote to memory of 2348	5572	msedge.exe	99
PID 5572 wrote to memory of 1408	5572	msedge.exe	100
PID 5572 wrote to memory of 1408	5572	msedge.exe	100
PID 5572 wrote to memory of 2480	5572	msedge.exe	101
PID 5572 wrote to memory of 2480	5572	msedge.exe	101
PID 5572 wrote to memory of 2480	5572	msedge.exe	101
PID 5572 wrote to memory of 5688	5572	msedge.exe	106
PID 5572 wrote to memory of 5756	5572	msedge.exe	107
PID 5572 wrote to memory of 5688	5572	msedge.exe	106
PID 5572 wrote to memory of 5756	5572	msedge.exe	107
PID 5572 wrote to memory of 5312	5572	msedge.exe	109
PID 5572 wrote to memory of 4648	5572	msedge.exe	115
PID 5572 wrote to memory of 4648	5572	msedge.exe	115
PID 5572 wrote to memory of 4112	5572	msedge.exe	116
PID 5572 wrote to memory of 4112	5572	msedge.exe	116
PID 5572 wrote to memory of 4112	5572	msedge.exe	116
PID 5572 wrote to memory of 2928	5572	msedge.exe	118
PID 5572 wrote to memory of 2928	5572	msedge.exe	118
PID 5572 wrote to memory of 2928	5572	msedge.exe	118
PID 5572 wrote to memory of 3776	5572	msedge.exe	119
PID 5572 wrote to memory of 3776	5572	msedge.exe	119
PID 5572 wrote to memory of 3776	5572	msedge.exe	119
PID 5572 wrote to memory of 2412	5572	msedge.exe	121
PID 5572 wrote to memory of 2412	5572	msedge.exe	121
PID 5572 wrote to memory of 2412	5572	msedge.exe	121
PID 5572 wrote to memory of 1604	5572	msedge.exe	124
PID 5572 wrote to memory of 3644	5572	msedge.exe	125
PID 5572 wrote to memory of 988	5572	msedge.exe	126
PID 5572 wrote to memory of 5336	5572	msedge.exe	127
PID 5572 wrote to memory of 5336	5572	msedge.exe	127
PID 5572 wrote to memory of 1872	5572	msedge.exe	128
PID 5572 wrote to memory of 1872	5572	msedge.exe	128
PID 5572 wrote to memory of 1872	5572	msedge.exe	128
PID 5572 wrote to memory of 2372	5572	msedge.exe	129
PID 5572 wrote to memory of 2372	5572	msedge.exe	129
PID 5572 wrote to memory of 2372	5572	msedge.exe	129
PID 5572 wrote to memory of 4132	5572	msedge.exe	131
PID 5572 wrote to memory of 4132	5572	msedge.exe	131
PID 5572 wrote to memory of 4132	5572	msedge.exe	131
PID 5572 wrote to memory of 5924	5572	msedge.exe	133
PID 5572 wrote to memory of 5924	5572	msedge.exe	133
PID 5572 wrote to memory of 5492	5572	msedge.exe	134
PID 5572 wrote to memory of 5492	5572	msedge.exe	134
PID 5572 wrote to memory of 5492	5572	msedge.exe	134
PID 5572 wrote to memory of 5204	5572	msedge.exe	135
PID 5572 wrote to memory of 5204	5572	msedge.exe	135
PID 5572 wrote to memory of 5240	5572	msedge.exe	137
PID 5572 wrote to memory of 2640	5572	msedge.exe	139
PID 5572 wrote to memory of 2640	5572	msedge.exe	139
PID 5572 wrote to memory of 2640	5572	msedge.exe	139
PID 5572 wrote to memory of 3076	5572	msedge.exe	140
PID 5572 wrote to memory of 3076	5572	msedge.exe	140
PID 5572 wrote to memory of 3076	5572	msedge.exe	140

C:\Users\Admin\AppData\Local\Temp\Ages of Conflict.exe
"C:\Users\Admin\AppData\Local\Temp\Ages of Conflict.exe"
1⤵
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\PublishSuspend.mht
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\PublishSuspend.mht
  2⤵
  - Drops file in Program Files directory
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ac,0x7ffec3f7c188,0x7ffec3f7c194,0x7ffec3f7c1a0
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,11767148518868287689,8817749307182558207,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,7364419627037438596,12854144055413733752,262144 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,6579801458023950564,5722519122069609019,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,5381202454920788197,7745855820535492312,2097152 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,8320125838912648405,3103849613429486510,2097152 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4796,i,10827898506354362954,1953411769252780826,2097152 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,10915439060460265206,17869529014791816896,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,3863930823329263715,4025672631266643012,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,1363864452640466774,812471041150020671,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,1363864452640466774,812471041150020671,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,956076366689901867,124319281758466149,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6308,i,11502451943638032911,18294029728719922677,2097152 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5744,i,12318664264348439358,8329192170987503913,2097152 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3648,i,10999438433885286486,17532866302664916163,2097152 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6676,i,6713037209569108444,254958325711456291,2097152 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7344,i,958801320558697159,76724530680286694,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:8
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,3537460849243227902,2154725705904130356,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:8
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7244,i,14678467845501165774,8300380784722415717,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:8
    3⤵
    PID:988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7224,i,12220196213713706806,2156121740347626998,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:8
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3044,i,1436106140975110486,12106267894709462101,2097152 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7536,i,17749342315668343857,13385097869495759817,2097152 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:1
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4760,i,14272693394222836352,10302394469366063294,2097152 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:1
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7852,i,18308382373069901275,17654298993722233529,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:8
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7868,i,514962765113050234,5651421051207935998,2097152 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=7924 /prefetch:1
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8388,i,10739627127526536739,8242767862736402448,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=8400 /prefetch:8
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,12630316004584772445,10396959995210804150,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=2136,i,5201390480688610915,16661382679964209952,2097152 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:1
    3⤵
    PID:2640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6856,i,14718978906164343173,7950042296298243074,2097152 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=8720 /prefetch:1
    3⤵
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7764,i,13733260898033810337,9865276724587945968,2097152 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=8724 /prefetch:1
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,5885523931599797071,11083702251547079763,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=8976 /prefetch:8
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,13962921064590001079,7953654894163191667,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7832,i,18238697839490232716,9786387143659818180,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7300,i,1727252029430691156,1326065481562287117,262144 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,16780137846328784008,15721023146676852721,524288 --field-trial-handle=2412,i,15277774626477822861,13380202999844316010,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:8
    3⤵
    PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5572_425921832\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

58665822-c877-4d35-9be4-c666f566a3da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58665822-c877-4d35-9be4-c666f566a3da.tmp
Size 18KB
SHA256 b9336b51bc0685e96697f5857ad83c0a1f518b634b1f6db786edc65f937d649f
MD5 af4425ecbb7b5ca747b3195a5cf578b1
SHA1 7a4e143ececd3ca7aad2ff38ff51277ca534722e
SHA512 6621d99381061792b6eeb08ef28842d4283d6ce59aa93f64ef0eca4cb08d1a186f1485cb7f72b8044a45e477113e44525ef472b63104f881ed34f98271100413
SSDEEP 384:sxZFbnm1Y/fysVPazIKYMaHbh/t7b8rQ7:sdjm1Y/fjPaziHbVtx7
TLSH
T11F82E846662499778DCBD60AFA657F53D7F9042299944E4869FCCA0C00DBBFC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d6aeecfbe528cd4a64937c01f45dafecaa4a2f8b94b0c21583b700f25424d6e9
MD5 ce4eb2762ca4333b2584e147841bc8e1
SHA1 1776a28b34b0df46d0629dd900e14baa039e162b
SHA512 ab6d5f8c5f3729074ba4346c8af8104962e4ab2a876eb63a048585dbf89729e9ed5784e27414b9d4b8db0bec9cdee27f105afba8e262585a992345f70a3117b3
TLSH
T1F5E022B6C862FC3708FE1768A00D8A56E70013272A408D5F7B3DA2098FB462A85D6C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 80538e412ce5e86b4757e0295fcb98695848aea73a77a10e77132451fe59e7e4
MD5 d87d1a19ffce3fd585861812fe3799c5
SHA1 953b071cc7da2270366b95794323e198299320a3
SHA512 448ccc328fcc01cc9c48f9b0406c31ca8b00b9ea08767df77445b6de078b4e8dc749856f726cd1c03b3928a6025fea08c17f997d32c2bb4cb33ee04459f0ed6d
SSDEEP 96:aWPclMJsRhCV8bxWJvHpyl3+2WI28Je8YraD/MeGtpXgTyiQcPv:aacWG4uwN8xrDA8Y2D/HO5gTH3
TLSH
T12FD1637DAB91A252CF0A2E70E4F4994135729EC2B8033FDA53707E7814CB79A4ED0D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe599a04.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599a04.TMP
Size 2KB
SHA256 d52960ee84af6693992be635a35fd975963450331540dc16f62557e1a6caef5b
MD5 ab6e692a1ee6a92333da4423a573e006
SHA1 4d554b1a2d7f69a1416072dbb115e87993aa906c
SHA512 6a51b934d1263fb85d025822a8dc7223a561e3ce3746ff53e19f9803426199e4adc2f2d8dfed60f13f76a871e5f9b1d1fd7042d34ea2e95c39140b9757fb76b5
TLSH
T1D3517F356F40F323EF4A0734B5E0D296206298D5FC022AFE884074BC9ADDA2F8759E49
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 664b76ae71badc130c7b256ed025405f937f5674e0974594c5da51cfa4ae1fd6
MD5 7fc173d69691ef4c0a3acca1262f5945
SHA1 ac179b7ef87daf1342e06538f810b50ac007c358
SHA512 0f294ca18d14b4eed628199a42079a53c5a7ad7f58c1d58e72e21faade12a5f45b722f7b375b82fa512f75b64efa6b94fcc1257cfb7d17f0782f2fc5708bafa0
SSDEEP 192:D1K20AMUDfJ1RQkNjdaij6Uj1BiMvIYiNikJn0ilfvmROwD7aZitQiWq1fQdmaad:D1K20AMUDfJ7QkNjdaiGUj1BiMvIlouu
TLSH
T1AB32ABF783F8A63DCE2156F0AA156E1FCE5D0954436C3C6AC5D8AE1B93E2470E241B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 f8fb7e2bf861a5e8c28d58dff89473b50df1c6fc3c1813834fe8f83816fb6cf8
MD5 71259c1d967810bcdf26937a773075df
SHA1 ca3de783df3cc546d0b78a431348ae6e2b575d0d
SHA512 ec3ea2bd66b3cbf2a8d59583a9584c2b3046aa69bef761d7e486b0de920669ce00a0bd9191d5e2aeba5ba09eaf5c8845b4242bcd2b212e21cb37324360727363
SSDEEP 192:D1K20AMUDfJ1RQkNjF7naij6U8BiMvIYiNikJn0ilfvmROwD7WtQiWq1fQdmaaDJ:D1K20AMUDfJ7QkNjF7naiGU8BiMvIlow
TLSH
T17B42AAF783F8A63DCD2156F0AA156E1FCE5D0954436C3D6AC5D8AE0B93E2470E241B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 07f7f748dae0981fa28279bc5e2116b505ba3d0c183a136901c21e205b88c337
MD5 cf83d6c1aee32bba76bd6d8f1e6aec19
SHA1 dfe700655278bd88bdf34452239e5600359516f3
SHA512 31f72270c9fa9c95aa58cfec6739f2a94653948c73af359dbc0d356fff6022a6dc102975796857b3d1c665e568446c34b877e831dfcf01c90a6bed2fd8ebfe12
TLSH
T153D0232711047079965C7D89F166FC4FC72620354411DDD512E0545C057D45C65171C1
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 38f6904fa30adcd00d0dc1d6c145fa8c74faee468d22933a93be56044942b4ad
MD5 bdc5cb1c4bf2ba0ff1934cd5b7552307
SHA1 35509e7a010a35500978ea7c96525c2829cf10e3
SHA512 f2b5aa38d15417cd3d0fddaafefe1260682ce2911958f95c5ea340bd357aa0fdf0de129bab2616c681f3457612ba71882ed2c60cf6b0262ef868f788152243de
SSDEEP 384:sxZF2nm1Y/fysVizIKYvpHb5Ag/X7bIGMQ7:sdEm1Y/fjiziHb5DXn7
TLSH
T12B92F946662489778DCFD21AFA64BF53D6F9042295944E486AFCCE1C00DBBFC2202C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 fd96d0b738a52ac47a215b0b934ab73cc1824374211614cfed97bbde1b2aaef2
MD5 8d8dc8aedaf52836a631f3be5650c256
SHA1 48655d4a123c6e06f6b9d370da37449c51db3662
SHA512 a58b08c450cd72a54a4779a14ae4e870e62367c8d890b55fa41b073a87acd36f6d4ac913898e4e85dc43735e9524bc675b701ca97934f64951be960e35ff7f3f
SSDEEP 384:sxZF2qhm4Y/fysVizIKYL7HbM6Ag/IU7bIGMQ7:sdZhm4Y/fjizUHbfDFn7
TLSH
T11492E84665249A778DCF911AF968BF63D6F9046399945E486AFCCE1C00DBBFC2202C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 1e80c393a40f86b56c055c1bcb11b052cb42bc515826de95df71a4dcf9d26140
MD5 bad84450b93f2c817b2f51b9cf127cd0
SHA1 eaac60db8f19c0ac0ec047e8b374e35871e9b3f1
SHA512 b8f3b45414d921c02e7f3552a86d8d442de06f90ebd1a6cfc33437abb8567e88ae3e2afa61a1767c5daa8e0da70795e39d952d8701553a6761d6d63e9c06fca5
SSDEEP 384:sxZF2sm4Y/fysVizIKYL7HbM6Ag/IU7bIGMQ7:sd/m4Y/fjizUHbfDFn7
TLSH
T16792E84665249A778DCF911AF968BF63D6F9046399945E486AFCCE1C00DBBFC2202C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6b474bcdad96450f367139747b4bfd1433db548b5fe3c266c66d43a3a53ee04f
MD5 e43c28fa8d6b2e076ffb1cf09574a8ad
SHA1 c26049fdd8c1127a3e847af2d954804af3420b6e
SHA512 dc730f96675923f45106693bda5debfe73955313c9605d349f4644e9718b4b1bc42f704faeafcf58d058c879d924262636d70c3d4e5517bf283a40ddb2fa4fb0
SSDEEP 192:sxZFRmyMqZjK1Ml8MjY/fyssPDPaZdIaRuvozodpHcHW6+WNGYvIupx7RKAIgj4J:sxZFb7Y/fyssLPazIKYb8HbGg7bjc
TLSH
T1A262E8066A24997B8DDBD219FA457F53D2F90133A1945E44A9FCCA0C05EBBEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 9cbcbaac2dce2a068deb36d5469adaf3eb927776b34c6ab23ec67cb04bf15702
MD5 4dcf1c65d25033db7735f777af89e71f
SHA1 af1a3bc0bdb14199b0d5a3406ed32cb02923d98d
SHA512 eff5186b64de617943f6665066cb6ec3d526ce87caffafedc0bc044ec5f5835cda8182326d6001ddc811fd5dfc3f1db05c538699790d693693e485c04470b67f
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVysy10Lla:eY8Od/HEnFhWvFvmXu1jaRt10Lm2NuOS
TLSH
T1D1F2FB3B6C0CCB7E4F844E9CEC2A7F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8d2d772b9ebd09e8b7219c12be86fbfb01d19e3bcd5cec720b9a9acfff537a00
MD5 4da338a6ac177cfa3eba21a6371e451a
SHA1 02f3eb70836cf84e965eb66a82b83af3a11bd891
SHA512 9167d0be54f009d7a2db56ef97b52196b3dec58b43920c330dfb7a07d425509b1e299f99c51eba686de3f19c7a8ddc562319428c6bef3b118b7164edaa3de7f3
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGu:05ppxnY753RNBvRJJdt7p5J9zx/4
TLSH
T184B28D5A713E0212397E2988B39696365F4135A37058E4BF7FB814A14F27E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ea54192b076e8bbed90a8f12638bf22a24092fb66e18aaf372712b19fff8895b
MD5 aab61f1143ae1957fc33b24a9b5553c8
SHA1 370388ea0671006a21e5238ce762d3922a253c73
SHA512 7454ed05352cccca5c20d049840ff2e09ffacd651a1850d8e05bc92d78190aa11394dd3c665cf93e9609f4a2480c9f86c63f11a6fa9b3caee80a826b9cff2258
SSDEEP 384:npHiF9CcmyWCs3sNJ8TUNTUlIm2QckCr9lBKphiftGnKBqYb4mWGpme4KV8p0OHn:pCFccps3QwgbkUrkoGwqYEmWZI8p04n
TLSH
T1E8B25C36E858CAFBEDE74F89B71E7A039EE01167859C9AD4DAD91D0C10971DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6d124b0d6363a8e8b36c192daa63daf7790998b8f732db871b2d6b8a1d4be7e5
MD5 f990073a89531859a25d5f407febbcef
SHA1 794216efd49ffe2a8720b28b1b39433dd42674c3
SHA512 bc1698d43f161ec020e2a98c071ef18bf7cd9be045a5432649a7a1ef54502db992064f5801d4ef59ad7943f1d1aff89df07ff40cf449e3a81e208c03e1356222
SSDEEP 768:puFccps3ZwgbkUvOoGwqYET7WzwI8p04n:Es3DkCqKkI8p0O
TLSH
T14CC25B32E868C9BBECE74B99B74A75039EE04267C59C9AE4DADD1D0C10DB1DD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 561016a863e789126ee60416e59f4c63f3befff59d6b06c0f0f5f639e0515a27
MD5 2cf9b7637db65e1eb90b7b83f3d1fa27
SHA1 5cdaaf60c7f6182375526ff036281e829847edfe
SHA512 69fff692e92175546337501a2e65a8898bba77a1df0eb9392b1645e89a4ed560149531cf0f18f0de5381d3f0ad6f4b3bcb7257fcd161626dc4e1ec9184b3bc31
SSDEEP 384:nziFiZcIwsNg8TUNTUlI4YQckCr/83phiftGnKBqYb4TjWzw6HlytEDq1CWrty/K:eFQwJwgbkr5oGwqYETjWzwoy6DqIWR
TLSH
T10DD25B32D864D9BBEDEB4A86F75A39039EE4412396DC9AD4E6DD5D1C00CB1DE030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1d4e2425fcdd953940eb2778f1107d18217b8c87f2eaade81ab12ff438302933
MD5 cabde2f362a30419f300ff4721fe8f00
SHA1 749237db62d741abd703642492c430afc71a66d5
SHA512 f616b34bd9c5064ede3f9dbea8e99ca875332a46613e27f5aacdf5c93387d254c60cfa8ffb871d58acefc6712bf9585e5aa070867298464961e810100d7535e2
SSDEEP 384:nBiFiZcIwsNU8TUNTUlI4YQckCr/pnphiftGnKBqYb4T9Wzw6HlytEDq1CWrty/K:oFQwpwgbkKpoGwqYET9Wzwoy6DqIWR
TLSH
T14AD25B32D864C9BBEDEB4B86F75A3903AEE4412396DC9AD4E6DD5D1C10CB19E030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 dab7b3448e2eff1e1dfa9cb3ef1d76ead87736f711ed76e7243e85868b1e1a29
MD5 f6c5de54dd2d36f52ad12d798c1d7d26
SHA1 33ac90ae2948501b74a783e1fb036a552210ada2
SHA512 0f446ae20ea030238ecc0cafd6546f338ee6ef5b72c7ae5f921f70453123162ddd848c933d8af4cff98ca55b1b0010a73f27cf7e47c24c8b928ee873dd504953
SSDEEP 384:np1iFiZcIc3sNg8TUNTUlI4YQckCrOYbphiftGnKBqYb4TjWzw6HlytEDq1CWrtb:p8FQc3Jwgbki1oGwqYETjWzwoy6DqIWR
TLSH
T198D25B32D864CABBEDEB4A86F75A39039EE4412396DC9AD4E6DD5D1C10CB19E030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 14127a8638764be821189207c14d5c32c6add95137789ae2f055abc3597b84db
MD5 a81da21088d66f9ca8cf0aeedcd9bf45
SHA1 baa73b70580c978cc4fa5d06c31395b71aa7e6a4
SHA512 bcb77faa8506048461ad27692e007ba81670600fbf040f6423a1d6f1ddc7e4d72d4f4aac0210a13524fdf8a563272049529cf19a47a530e9a59a77d045f3f72e
TLSH
T102E002135700019DC430673000475B3117D6C13001711316492041542D176005F12BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 01a2a29716e63cb542c70ae5eb38d8a5373dccaae408ed66c5a46fb5739186b4
MD5 5b02d896e02218021c819ca2a07a9fb5
SHA1 6419bba2a19aeb8054de1ea27b018f02c22fbdc2
SHA512 5b6ad43b7537bb1af66524f96264817a38b137aa2336badb9e6360631e46dd63a0015b99b5c15964858a1d41e0a66a926d373f6a343d1d949633fe2331d656ad
TLSH
T160E00113574041ADC4286B3000476F311FD6C12411B113174B70455C2D7B7507E22FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 560cc78a935dc3d7e974a241b5f92058a64708d8f48e903cc533d0bec832e7ff
MD5 62bd1defcb6929e25653fd48734b568a
SHA1 c33eff002145b621cd392b333dd4d8c30295c933
SHA512 cdd9f7855d55e72362d1a686dd409ea62922868dbd21cce508ee16895806ae6993c2873ea043a92c5b000b072b1ecd7e537ab7cb60f65fc14ba6954989ee8212
TLSH
T106E00213570001ADC4346B3000475F311FD6C13001B113164770455C2D3B7507F22FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 74f1b549b49ac72a3e0d92c4368032b83090ad108ff948b94b946a0c0c131792
MD5 3cf79247314389fb0ec066b96cae9049
SHA1 f759b777f7dd9b0ce8c68b747b24236fa4881714
SHA512 8db54313fe4bf5540709b76925b658ed166cd2e4bdc0d01d2e529747909a19b5607cf7a4b2bbfc00d59118c32ee296b08fb572ca6b993ee569ae8056777e1dc4
TLSH
T1C6E00912A75041ADC4286B30104BAF311FD6C16515B113174B70455C2D7B7507E22FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5892a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5892a6.TMP
Size 392B
SHA256 c0a0eebfe10bcb04069d6b623f554869be8cdd345e9e1c9f9cda2ff64338628b
MD5 0659a1a83674baf9f6ffe066b3bcbb5c
SHA1 8de94cada7b46cf56b79c82001d8534a3c519a71
SHA512 973df0c632766000d4cf900d1291e477523202806b3fa73f4d1fdc8eec904598ea8ae784075922985e5ad42e9b946dce32af3185f4613ac7ef8de1a8612e042d
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f2dc07e3481906b4f4289d195d839a1f5fb96741e208da5db41a5eb3b380f00e
MD5 5231028f737ea8c1d5da4e44ecfc5cf0
SHA1 111087b31608e264b80be6a2b6ad807b82c39f8d
SHA512 d8e0f2fa3e888150c7e088eff14fa10bbd639451c58c716c3f520de38c49a6debd08d8be74abf43031c861507d3de50bea9052128b7fc7dd293398e55fd739d2
TLSH
T1B6414FD14C381AD2C4BC0A6EB49B38FC85E8C725F1A4707D6898E9940A3D54E748583F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 94e31e888fba573ced523a92d9d7f99d49f536f3b3567424eede28cdab25d9f1
MD5 8e81981cb113e6089add225442b59723
SHA1 57d09c32eeaece78b8d5eaaa6bb18c4aa79e9dfb
SHA512 eb85c79bc44ec02cef90d601d293501f6570d6f150e382440b660115fd5b74dab0dee3a2f3fab5cc3929d315721a8e33ef4c567ff716432431c684ffec11807e
TLSH
T1A041D899AAFA1144B3B77E5A9BF6A86D447F78773E07945E10110D4E0A26A00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

a5f4ec16-d486-4c7a-bb3a-6e845d79394b.tmp

Path C:\Users\Admin\Downloads\a5f4ec16-d486-4c7a-bb3a-6e845d79394b.tmp
Size 127.6MB
SHA256 67fc3ca585261f9d79afc46d4887c3762b45e29ac078831c44d70211415fca4f
MD5 c4c7d2dfd3de080f1b1206999f79230f
SHA1 84629c00fddcad71e2d3259f81f5c30d4e6c3308
SHA512 a4de933853999989234cdb73484faa04cb761c29b23791c79da59024ad166725669fa71f6edab3f5f98399e374e38ad6b1f241ce59a83b4be0be488f6021a61e
SSDEEP 3145728:/dMsHG8qxTEcUYy30GnL8QqcaRU5z/qs9ctEBdtlQixOwO9cl:a42FEcXy3foQqcb5es9ck5wwO9cl
TLSH
T1FE583317B5274E63D52212F2A32FD26DF921E8B454F18B1753ECBD66782D8900B2B78C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download