d4f8856e27f4a75606d9ae8f51c7fe09927aa65ea43b827d317ed1060e8843b6

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
n7r m76h.wav
Size 4.9MB
Sample260814-e4lydsvcme
SHA256 d4f8856e27f4a75606d9ae8f51c7fe09927aa65ea43b827d317ed1060e8843b6
MD5 2f0a830e0d74d08016ed99162d5aa718
SHA1 0d8f39baaf82f1ff5aaf3a0e2650836a89444079
SHA512 5b19bdf21c3c52c3fd2b0c3963c3977c59360939d54379cfff5ee82c4569064496fab3aefc98787e18340e28ec1a9647ecb0ee0688ab07efa4a7367a88f6ca46
SSDEEP 98304:JhMUGx3p8WmMGY/ofzMkFRXoAQc9HpO/XqYSsJP+2qUo5XfXEfoYrxef8sSA8sDr:JTGYoG3r7zXoQ9pOqs9oJ0bQvDDdV
TLSH
T1A036C063F1434510EE9A1A77DE92B4401F60711EFFB9252F3188AD0AE2E3341B796B79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
214	api.gofile.io
215	api.gofile.io
217	api.gofile.io

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3312_1636614933\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3312_1890214496\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3312_1292139221\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3312_1292139221\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3312_3015241\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3312_3015241\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3312_1890214496\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3312_3015241\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3312_3015241\smart_switch_list.json	msedge.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3096	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311554039640411"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{89B3B28B-4A0E-4F6F-9613-02B9540C77BF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5156	msedge.exe
5156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3224	wmplayer.exe
Token: SeCreatePagefilePrivilege	3224	wmplayer.exe
Token: SeShutdownPrivilege	4984	unregmp2.exe
Token: SeCreatePagefilePrivilege	4984	unregmp2.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3224	wmplayer.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 3692	3224	wmplayer.exe	86
PID 3692 wrote to memory of 4984	3692	unregmp2.exe	87
PID 2728 wrote to memory of 3312	2728	msedge.exe	92
PID 3312 wrote to memory of 1808	3312	msedge.exe	93
PID 3312 wrote to memory of 3096	3312	msedge.exe	94
PID 3312 wrote to memory of 3420	3312	msedge.exe	95
PID 3312 wrote to memory of 3420	3312	msedge.exe	95
PID 3312 wrote to memory of 3420	3312	msedge.exe	95
PID 3312 wrote to memory of 4788	3312	msedge.exe	96
PID 3312 wrote to memory of 4788	3312	msedge.exe	96
PID 3312 wrote to memory of 1536	3312	msedge.exe	98
PID 3312 wrote to memory of 1536	3312	msedge.exe	98
PID 3312 wrote to memory of 1536	3312	msedge.exe	98
PID 3312 wrote to memory of 4712	3312	msedge.exe	99
PID 3312 wrote to memory of 4712	3312	msedge.exe	99
PID 3312 wrote to memory of 4712	3312	msedge.exe	99
PID 3312 wrote to memory of 796	3312	msedge.exe	100
PID 3312 wrote to memory of 796	3312	msedge.exe	100
PID 3312 wrote to memory of 796	3312	msedge.exe	100
PID 3312 wrote to memory of 3468	3312	msedge.exe	101
PID 3312 wrote to memory of 3468	3312	msedge.exe	101
PID 3312 wrote to memory of 3468	3312	msedge.exe	101
PID 3312 wrote to memory of 2088	3312	msedge.exe	102
PID 3312 wrote to memory of 2088	3312	msedge.exe	102
PID 3312 wrote to memory of 4468	3312	msedge.exe	105
PID 3312 wrote to memory of 4468	3312	msedge.exe	105
PID 3312 wrote to memory of 4940	3312	msedge.exe	107
PID 3312 wrote to memory of 1372	3312	msedge.exe	108
PID 3312 wrote to memory of 4940	3312	msedge.exe	107
PID 3312 wrote to memory of 1372	3312	msedge.exe	108
PID 3312 wrote to memory of 2024	3312	msedge.exe	110
PID 3312 wrote to memory of 3740	3312	msedge.exe	111
PID 3312 wrote to memory of 3740	3312	msedge.exe	111
PID 3312 wrote to memory of 4500	3312	msedge.exe	112
PID 3312 wrote to memory of 4500	3312	msedge.exe	112
PID 3312 wrote to memory of 5088	3312	msedge.exe	113
PID 3312 wrote to memory of 5088	3312	msedge.exe	113
PID 3312 wrote to memory of 4556	3312	msedge.exe	114
PID 3312 wrote to memory of 4556	3312	msedge.exe	114
PID 3312 wrote to memory of 4008	3312	msedge.exe	115
PID 3312 wrote to memory of 4008	3312	msedge.exe	115
PID 3312 wrote to memory of 6012	3312	msedge.exe	116
PID 3312 wrote to memory of 6012	3312	msedge.exe	116
PID 3312 wrote to memory of 5540	3312	msedge.exe	126
PID 3312 wrote to memory of 5396	3312	msedge.exe	127
PID 3312 wrote to memory of 5404	3312	msedge.exe	128
PID 3312 wrote to memory of 5760	3312	msedge.exe	129
PID 3312 wrote to memory of 5760	3312	msedge.exe	129
PID 3312 wrote to memory of 5760	3312	msedge.exe	129
PID 3312 wrote to memory of 5200	3312	msedge.exe	130
PID 3312 wrote to memory of 5200	3312	msedge.exe	130
PID 3312 wrote to memory of 1572	3312	msedge.exe	131
PID 3312 wrote to memory of 1572	3312	msedge.exe	131
PID 3312 wrote to memory of 1572	3312	msedge.exe	131
PID 3312 wrote to memory of 2160	3312	msedge.exe	132
PID 3312 wrote to memory of 2160	3312	msedge.exe	132
PID 3312 wrote to memory of 2160	3312	msedge.exe	132
PID 3312 wrote to memory of 6092	3312	msedge.exe	133
PID 3312 wrote to memory of 6092	3312	msedge.exe	133
PID 3312 wrote to memory of 6092	3312	msedge.exe	133
PID 3312 wrote to memory of 5556	3312	msedge.exe	134
PID 3312 wrote to memory of 5556	3312	msedge.exe	134
PID 3312 wrote to memory of 5588	3312	msedge.exe	140
PID 3312 wrote to memory of 5588	3312	msedge.exe	140

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\n7r m76h.wav"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffcbbb9c188,0x7ffcbbb9c194,0x7ffcbbb9c1a0
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,10103683489040787529,10585330282645856530,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,2906588388852657829,7742444229935017740,262144 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,16939090878120426999,1975063119984254117,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,10681701856081538026,2879573249257820474,2097152 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,1198457370412907921,5160477648853735228,2097152 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,13147136623235169908,5645708606132626609,2097152 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,12476415938799226775,17741639254206143450,2097152 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,15427058943549104056,4614099897270116984,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,17183253996798874405,7131815212894261463,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,17824766637471941167,3123987363818572776,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,1209253031935989487,7231164572359282927,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,9409021604999404466,8830338847494734419,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,9409021604999404466,8830338847494734419,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,8408676096474816814,13323270020893539213,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,17884320530635193681,3571613197309087226,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,11892084567851906316,14442064176934047711,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,17792065584380664280,9156375381881203242,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,13557171018867731553,8430685774056327308,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,10392463791530738446,18365947493223494527,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:8
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,2252179299058269296,10479847058042076051,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,15548088225060085292,16234319730866372115,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,13775398457464481659,15887157095868738430,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3996,i,18028653958949473014,3443943844967907249,2097152 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,12877326648646706762,12710217039619304245,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
    3⤵
    PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5112,i,11202179857085547428,17308980570502577101,2097152 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6876,i,13795523934847595141,17007238633469823300,2097152 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7132,i,14585342118576912266,7386528329776631529,2097152 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,9810763145460306384,9445927280544525831,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,10119072316060754847,17164699802982341119,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:8
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,15714524514858262787,8382321955619245495,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,14047444082176338078,8111948037536748020,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3304,i,1435687567279574483,14054936179761792636,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3716,i,6469605594591659750,15756901105066251255,262144 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,14673029399614743833,3806717913715998971,524288 --field-trial-handle=2296,i,4511046410110925345,12953545441887827171,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:8
    3⤵
    PID:5500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3312_1292139221\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3312_1636614933\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3312_1890214496\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3312_3015241\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 41b3808eef128e3a51c6e8936a6cc4a07d5436f8b2c0ac56d3daedfd75442ba8
MD5 5a3caa4deb6dc92d8ec728d7ffe8e9f9
SHA1 3e0acfc425b95cecf66c4b9aa04be55ac85d1647
SHA512 2bf9f65dd8797c8c81092cf4224cd5e8e884f07c2e59bb7c7464364b0525848eca4b7f75b9373a308f531c8b956dcae34e330c993069690ded6836bdec58d7a5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7b:fwUQC5VwBIiElEd2K57P7b
TLSH
T1F5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 f67811a21afe337f4d2801e228facd98cf78f57edc3b0b2ccb9360a9c91df0a3
MD5 7d5e7ceb001c4fe314ce5c361b84a1b4
SHA1 3be943bbbe1f0fba98a193ae33702dbaf1f3c2cb
SHA512 7713f688818d27d66947581136b332dbe560937df58fb3172cf389f24700b3c668edc9b0ae9a5e64994c14244febd8deeb40d43582dca2a2d0a831c420f17834
TLSH
T1A9E0DF485A84CDA48FA1D78BE4BC52544030F28BFBCCECDA3BD6E49E6404434528A18A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 2d8bedf6fb559e2159be6ce7cff81bc8b25e9c5cb91c86cd1702e821a7d07fc2
MD5 97878df01e30e44d83b7eb34ebda381e
SHA1 480a08967e279d6053a4dcd762621f4cc61384f2
SHA512 8d0628b8547083853dfe6f7e1692ea894edc9a09d0b87df5320526f47101af2ba8dc9b23b9150bbc881f42795afe435ab1d5352249e6bf9cc7da0cd4082f75cc
SSDEEP 192:4+3uaBnGKegMH39JoFLLd/HVQoAUh6K3pptt2fKh1JjEuKhf+Khi:4+3uaBnr6NJaLLFVQoAUMK3ppv2fKh1p
TLSH
T17902621071E95259EF532FB2E1E7184539F2A2874D072F8B4FC8AEBE64377A17AC4015
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 ebf86d0b486ed8fe2bb0194466226d8d033d18b68e70f456c5dd363e25a165df
MD5 00e4c6635c412eea15d10a7cd57b8853
SHA1 e10dcc017e7483d45ecd92d5e32bdd4423823785
SHA512 5f68f1fb564a093484ba700048d8caeb41e3c00a2c1a88bc4a5899718eb4b8740f9d09c203ef24c9b1b80768ff5690fe048fc0142bf2b0ea4662553e06a2f16c
SSDEEP 96:SP+3EnBnGSO6ip2OC95WFTrGS14CF7MQyJn9SuYKU8lnUttGO3juqfvuaFVbAgbK:i+3eBnGS9dOC95WFTr/iQy19wInUttGT
TLSH
T196C1AA14B5F9535EFB5363B2E2DB1D0435F266874D4B3A8A4F08AFEC24366B09AD4409
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589d16.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589d16.TMP
Size 3KB
SHA256 22a47f0a0486ccbe60d027606240a3b2b8535133c75914c56a86fcc63307b25f
MD5 f7f5e64d02c896036083d4777225d1fd
SHA1 123601f7c3b0955bb89c7d236a33c047bf72dced
SHA512 f3c4431be22ffbc4d12c55257a4570bcae325d157443438a2fcfcecb0eaf5c446e3b2e4c2fa6581634af9da8554a7fdcf8f3728e9629b41c15faff808f352657
TLSH
T1F5712A2952FE079DF3262232F1D95A1834F3679B0E937D4E10A88FBC6536B348DE5409
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 f0bdd1c6e2a4667e40adabcb85c76e35d65907268bada96e5955dd9c56691181
MD5 9506ec12c0b7e0a9df04e1d5631201df
SHA1 a227b48a4e8012f6b3ea93a525f0eea9b68ad312
SHA512 58234f7f8b3e4771053b896b6100c4c810e5662bca255cb042aa26e1a62ad0dbd558e7f13be3cbe78f5e4319b1ab8b4aa0a54b8dcebc5c365bfe006cbab97068
SSDEEP 96:DhOxYKzlnWxzHaGO5u4GwBtHVS5/MJiE7vP+ylx:DUxYKzlnWxTa75u4Gkt1S5/MJievPhlx
TLSH
T1F8B1ACF3C3E9866DC91191F0AA146F1BCE1C0556436C3D5AC9E4AF1BA3F2871E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 de855df48b791b27fc8c31b6bd6fd2d6ca8d06fc4a7232d1d97363f241c67cb1
MD5 3ca62ed265a9be6fe2828f3b9237b5af
SHA1 1c7acdf3ecfe59a3c1d5cf606dfaf47cbc2e2b0b
SHA512 96708c31bbc0b2749efc77c442392c84f30ba8f69b1126d5062f5a75a5d100b5eeed301a2484077be6664b3bce1c91e3738354fa03ddfe9da9b0b4062b1e9ec2
TLSH
T128D023933300F1F595AD7FD15057EC4FC33E00150C42DDD511D0B4D80532C5C4507240
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59406a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59406a.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 47bc7cde7d4a76390d91c6945941afbfb9923546cadc82b0f58961e12acaf6a0
MD5 d901fbaaeef965a4c9a7a7d864a05dc4
SHA1 3bd7f84138f2d182f157c4eae1cbed5ad80010d3
SHA512 59589e36bd901b40871131f56ba75aaf6480ed65b57ea88c954ca545d091128febeff9102047dd5efb17d548c7084a6f50d36ac29bcbfc2d24bd4491f876b53f
SSDEEP 192:sxZYeRhyM/jK1Ml8MEI/f7sAu0ZrbxQdpmkHW6+WNBHU/Y4HjSQIg4FH:sxZYe3cI/f7sAu0zAzHbu/XKH
TLSH
T17A72F851AA2499778CCBD619B9157F53D7F81473D9804E4CA9FCCA0C08AAAED3217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 bea04dd166784691fe426d40078e792b68227f832772a4ab55814c91822f12fd
MD5 f05b72412fca5f0e005edd504cc5584e
SHA1 17e2b1ba76dcac88589412d253b49bdc33ad502e
SHA512 07469605b9077d462ec408549749ea32fa35ba60d6687f1548f04cc3787eeda637a5b9dd3ab7a29d352ffe8f16fa9f3794e375b2a938cdcacc3c4a970e3b6e36
SSDEEP 384:sxZYe3nm4I/f7sYuFkdNHb5b/F9rgD/m4:slXm4I/fRuFeHbZnr34
TLSH
T18092D791A52099B78CDBDA09BD257F53D7F81463DD514E4CAAFCC90C04AA6ED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 2cad6cfd0b62a82db61ffbb55f05a1908a7e6b177005e7f670359289592022d1
MD5 13e95a815cf3661cafd0171696b181ad
SHA1 f5aef51a7b6a411c0960894480530593801c0de6
SHA512 29b57259ac3e65661a02ac0732401638cb1abe883021a415873aaa7c3382c07c003202de9c1138d3600f27d873f73a5d51929321315820ac71a37005912809f1
SSDEEP 384:sxZYe3qLm4I/f7sYuFLdpHbKNb/b9rgD/m4:slaLm4I/fRuFPHbshr34
TLSH
T15192D791A52099B78CDBEA19BD257F53D7F80463DD514E4CAAFCC90C04AA6ED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 8473dd4e3edc4bed328791d54de60b6f2e87a74c78117fbe8facb1c56a18d719
MD5 556000de7ca038c92608241afaae1c97
SHA1 b3d90576c4aee68dbc2e7f0dff7c3136aa3d72b7
SHA512 dce0669da2d7349205cb157cc832161eb605ab0d51bf2e089908ae3bc114165da0e330026882133139d3ea4d921447fc8656c958e0087c43168b0bf1d331890e
SSDEEP 384:sxZYe3qm4I/f7sYuFkdNHb5b/b9rgD/m4:sl6m4I/fRuFeHbZhr34
TLSH
T19482D791A52099B78CDBEA18BD257F53D7F81463DD514E4CAAFCC90C04AA6ED3207C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 9f0a02e914dcb54d4e30e937ef6ba74955993c5911151798af9b8461e36eb2b3
MD5 cf4d9f4c4b485f50c0ba11cdf3af3382
SHA1 8defcb17f28a7688000661264bfc044d303e878c
SHA512 46ac28a442bc52f7880e1d76391594716e7297ffbaf721c7ed76063f311a48979c2c747a23b20219fd8c14f66f1f6908147d4a5267f6ed8ccdccbc09d4ab03bd
SSDEEP 768:FF8iJNO7pLuLzxNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9cQALl6opdwroA:FF8iJNOEzxNWvx76ru1jaMcQALocdbe7
TLSH
T15FF2FA3B6C0CCB7E4F804E9CEC2A6E9A6DE801CF5AD8895447FA845C03C66EE15165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 98791bb1b43318994969bfe687b6b7ce9afc7c29f4f5b83759a2fb5b39c6820b
MD5 f7f5deb4f6f983b2f08edced2e0f43c5
SHA1 e91b7d8f9875875eba3f5cf8506488dcfbad32a0
SHA512 75feda95ef85aa031ada323bb52c026a62cbb862df8772b9931a807c079af08b16f7698f12031ddf9e9d61981271630cc009aa8e7dbb6d69417c2f457f2cc541
TLSH
T104A00250DBE0084AD05251B51A5307426305C8A09500134B4091004DCC504944D5111C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 27e88208c6699e91b62154efd009b5b1dbbf6179274b7b07c3ef5ffb2204b0cc
MD5 f7d81753b0beb9b335875a5458e58296
SHA1 2db118c2b35cf4fab21e5662bee5e8893fea94bf
SHA512 f67f26c9418bdcbb6474760a3b3ef6451e453a0e60242ee8e802f4e648820c4ae20e77422ed7b8209d7bccd6bd815da51817a0954ff2c497c0d5fc4cac9e6e3c
TLSH
T12DA0022412C47403C41313B035D7456222948955E241130546A043D4DDD06B9CA5391C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 1KB
SHA256 d27fedf71bd2d3c7baf10a95425551dceee75fb2f7802d17224699c25c3b4550
MD5 4b6a1a08377c39172002518d2bf2c27f
SHA1 733822847e3afe2a3fc64515443dbebd3d57e27b
SHA512 1d6da541a93c7fb5d611f32a0d45a7c28e620bb54bb41edb4c03b26fe5f116f330bfb3023115ab516286e5c58e5dd8f05d2a0e0b7de85e51d0cddebb5769593a
TLSH
T13C3165494DE5CE6FECA442B116B25478337494DC1755E653983C3130BD2737A2A4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 3KB
SHA256 534e6c8d95ef67431807ab8cb39b62379ff54ca29a6d58c889c1440969de257d
MD5 c3d00b738ef4695015215db76502ab5f
SHA1 449000abfd873432be3e2417fd6ac3132761fb89
SHA512 67862c242b80af001328f38689fbd92eb7f9cc24d87343471b3197955064ba0c3474f1a01bc1b32fb9e7e34c1d63ec876cef50e8d8dfcffbc8f082f9355f7960
TLSH
T1F051FA4E0C451D5EC95D41B21CF9198037BA7CDEA695CA1B66ADD130F8C333A2D58265
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582f1a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe582f1a.TMP
Size 1KB
SHA256 843dbaef68dcdb807c1bb65cd50da75b0ecf25b3e2917b57c8024b5256131b94
MD5 b4804c60d0a39a7f4b9030a9b02ed3ab
SHA1 b7ad8d451a0f02ced55336ac784db82c53ed39c6
SHA512 83c25f763bc94a0e7456b1c13a1e0e484745409cf07a2131143ba0c37095fdec4207a7cf881698e7b2b823490a22b2482852ab6acc0bbcecc3e92be9181b1af7
TLSH
T10331A74A4EC08D1AECC4407B0EA3A4B8333A99404316B783947C2138BD617BE1E4E0D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f88121e6cc1a170f0e31230ceb77897ed9564d71d2cec87ea78f81e665f3ebc9
MD5 86878734beb2a8fda14aee2ba5f61b66
SHA1 d444d7de73fbea8790c83ccc4daf0886f3b662d8
SHA512 9bdee1c207c0e6e4b113b212a89ce4eaf55868cce0ad7e3e9408296ef158a2b782e9010d8cf0fc2075df019a070afe114748dc246fac3432751f9a231eaf5b7a
TLSH
T10DE0C0F72EF72844FEBF63E10570A8A00245B459D584BC8F5416EB832461352340AC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 bb83d60870e0dc1a497745ddfdd2a8a383f06c9ebb7ccf3d76808ea34ec6732f
MD5 c3488b56bb2a1fd73042e1a174960202
SHA1 7b6476296143dcde2c465d8508252b921278204c
SHA512 4a0eb5d16a86cf9c3147f89006a4c47dbe2413226037f052e8ff94c2dea5e0031a92f2b7aebee35b68c68b61e83eb69416b1a0c523b617fb5f41cf527b6b71ea
TLSH
T1CFA00225DD54C241E14213BCE0B205CD72508C98862A331255AC14B48D6D1A05596518
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5883b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5883b2.TMP
Size 48B
SHA256 72322435971fac73d35151b699d84c0864f06c84442fad9e779d216f99f18cb5
MD5 7aa6d83da72156400e2afb41da17eeeb
SHA1 cb4a7a1a40621502d2bee02c1767a64c0218ff6f
SHA512 bf75072e0d39d150dd44b99e10756621a8593c36312af2a72076305c6d2751f09a6d50dc2ce76a11c07006e1ea68681c2130f3955ce5e6df15fd91b9da394161
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0f250572b198d0508424df9d7f3cf1ff6bd930aca0bec480440969c8f49f3b4f
MD5 fbfbf0d211093050d30a8a4bac2caa26
SHA1 019833b1fe3ab40048c2e419745aa96a8e9de5b3
SHA512 9812c20a8242edd9fc17c6f735ddc818bacb30f2abfcb90cc25c1828d8ab5d3547d3244c98d494b22296ca18e7dc764f37e760494f0b60d97864c5d95bc1841c
SSDEEP 48:K0YIjKlqcbyRyIfKnqoLkIfKpmUTyVLqn79hD:K0YwKlqqCy8KnqokAKpmCkLqn79hD
TLSH
T15591451335BB12523C7E294C96ABCB165792B6A33158E43B3BB940720E6BE250CFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591217.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591217.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 7b38b0f9760c3ca57b0c3afb99138c9af687ca21114855b1ff6e7b43866a279f
MD5 050cf5953ebeaa6f65b3cb7702815ba3
SHA1 c71a7c5783aa8293950ea5e8d49f3b573b7b936a
SHA512 d9057598f145f92982a36c3e44c0558e9bb7f28a640b38dd0c6010b1b7b5fd4de994f9857eb1cb26f4a7d9f0436774498797dfaf582517fd7a7d98d3faeee1a1
SSDEEP 384:n0iFPZcIHsNA8TUNTUlIlzTK6N97sP20DfhdywmfKnyyOOPrXLpe8C/s:PFHHRwgsqOtsXKnyyOi9PP
TLSH
T1B9E2D5F194D78936E8EE5783A73E2E468EBCC153B5885A84BBD85D0CCC821BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 dfad2791b35173db53dabce9bb28c5532cf68cb149f4755b5a89e1adfa528496
MD5 5afd742d1722c61453ff7243b7aeccd8
SHA1 23894edda234308e1b0f24dbadd3db0fbc9ca3a9
SHA512 ad7c33d2b4130862e52d246b3912cdc0c97faed6709e8d1b8704329e8c124e3f36bc959dcd17834bb50879cf0ec9bc7cecfd94f1c90f1e9fd16966f9d458f309
SSDEEP 384:nQZcIhsNA/TK6498sukywmf2yOOPrXLpe8C/s:uh+CdX2yOi9PP
TLSH
T1F9928D7168B86C676DE3F956F5423A139FF88467E7C82B8499ECE70C09D65980307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 55214cccd0fb81a990a83897990d04693d949ed18ca475fc47cab9a93753fafd
MD5 0ba9e1277f3ed739674230e30cc43c05
SHA1 615a777f7a5990a62fc4ba50798e25a4db57a6d5
SHA512 52c11b96224c42868d3d276d242fa338a7276b9d04cdccc7b0061953833812a49e0f5b877fe2c76c579fd2ec01ae8d1ff262bea3acd6581de0d2ffcc464b1017
SSDEEP 96:ZqONkrwQsjpfmUTmDK5ih/cIPURHl8h4otop5Ps5DrBhPwivh50xy0SFYKNAxOYI:gONw6kDfQmiUyPuVZ903iow+QiE90oU6
TLSH
T14302E83568786CBB8EE3AE45F4463B275FA8116BEAC52F85DAE81B1C04D725C1302827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3e997ec745b6ac3202157b2e63bdbdc03e59f9ff6cc761b496bc4eea87c18a16
MD5 5b9f72ba1f46f076a1763f845834b23f
SHA1 066243de6ee28e8cd4feb0c900bfd54a5d611db2
SHA512 7d5e3c1253bd6e772ae56a836e51fb26c8a3982039fbff503ee5d53da1533cc039de91d851b670b0e57b3c852e60a018f561d48bf8711d76a4acc90cfdf9607a
SSDEEP 384:n0iFiZcI9sNA8TUNTUlIl/TK649OsP20Df4dywmf9yOOPrXLpe8C/s:PFQ9RwgcMOcsX9yOi9PP
TLSH
T187C22872E8A4DA6BADF39BC2B6067657DEF041A3D6C85AC4D9D8AE0C05C719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b8e0c71871dc14be52c74e71e8b4067433f30f0b881fe4476007407664966380
MD5 f08bf1c237e23eac2a8249dd08957946
SHA1 61e1b6443be76dc757f952c691a38745393671ec
SHA512 4fdc173c22e88c9e0ded765341eea62d249ac0157321f7a401eea4f6151f37cbc6bf73fe4d3ae2e3e47332dbf0a49e51b58880d9275a535084a7b2f0a88ec20a
SSDEEP 384:ngZcIhsNAMTK6498sukywmf2yOOPrXLpe8C/s:ehNCdX2yOi9PP
TLSH
T128928D7168B86C676DE3F956F5423A139FF88467E7C82B84D9ECE70C09DA5980307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5a3d1bf4119a845c57ea3172233cfe97228fe52fb1f554ca9058e9f9538aecae
MD5 e492179eb55807e38fad8f63339adce1
SHA1 6ea2c90caff4df448b91bc159ad72a2df5fa856f
SHA512 83d0f943c3cad223df021d2525445e8fdf17c6b2475e879dcd8a63f4776575813811f2700f3d0b6b3e1e4a39958317ac574a11468920c90bb1542885ca48a306
SSDEEP 192:mONp6k5QmiUyPJVX903iowmcEJXcRIrqUU6:mONp66EvX9ywmfWyU6
TLSH
T1C6123A3264B86C7B5DE3A956F48736138FA4816BDFC96F81D9EC2A1C05DF29C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 32da81a33eacd33db8be01d49b0055602e1998e2f2dbed01ba09133c2fa986ad
MD5 d656a41deae2397ea40f3cf4f86fbd2e
SHA1 24c4bf72878939f5c7eff6209c6ee02faa2b5401
SHA512 3ac114c54317838275a95847ee7abb4a1a710e318b164f85781a4cc7ed82788e160ded7e0b121669e77ba994fbca024d785cda7429c7b807abde014ac8886751
TLSH
T101E00201D141001DC03C03740043263017D1C40441F20747D22005553D373146F30FE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a0b0d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a0b0d.TMP
Size 392B
SHA256 9b7b1793219d37d7061dfd9bc64d62f51af9fae9a758b3259959421fafe0c6df
MD5 2d2cc97c649f98169fc4022255df0a25
SHA1 7cdbbcf3c14135eb1902a97d169e6f7949c60203
SHA512 27e7b8b4c89f513decd6653b16d95ba69a6fc8bca3295ded167076f73152cd988a18f02b74b80838c1217d420503d6e79b3f11b934b04d54bc7e0708cbb63a06
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 3e0f8deaace5df337b21b5f319faf885100f9af2ffccece4602099219cc06839
MD5 89d069375a21bd4cc4fb9f5e769ee95e
SHA1 61db7b80192134e1693c10105f92d2c7717d89a5
SHA512 bb3a3e85d7b61d8d587a1ad2cf6c9151c7a5f89cf876a881e02dea72771227a6de7e8199da8a562179620f3eacd23caab97b1d9f7f872ed3eed6c8e9fc58f281
SSDEEP 768:10aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaK:zZP2tFP3vqY8+qEM0TaBacg
TLSH
T18E258437D190B0C5CF2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 be062cf7d058cb58e952b2bdcde58dcb1146350943653efba03b16dc2f91e635
MD5 78daa6889fe0fc8aa324c0cffb175927
SHA1 acea507d1b0fbab5b5c9ffeb92f0da5efa47dfc0
SHA512 65b0d43ab9277d23b6e0591257535aca65fef71fdbbda6cb6754c5fddde1d95be37f63f9355c4573dbaf814619d239ab98de9b4438d4a76347174d0597d92eca
SSDEEP 3:4nallkltlsl7pl+e/lls4XplsMlE+yHj46O9/lcI1Xlldl0lcNklltlwzl4hR/m/:4u+1E3+e9XplskEvUlcI10cAe
TLSH
T1B9534C04E26057A2C404837764B60747B371B4660A59971B5135643C1C4119929A4185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7bef9dc9a3eb2b08ab5a385faba3aa13843153010fc1e6eb19029f4c3767a7e1
MD5 d3aa36724508fc61b83b7ea5b80f8164
SHA1 ba8ccd658ee80cd4ff45a2df4019ed05a631d0d3
SHA512 945142ed0863f9e9f4fd60858ea2f93f6fdaca3d95e52e0fea07ff8a932206c9a3576b106aa0291c1da7007e71faec842ba5a79a95191a1c62700345990c6854
TLSH
T17E412A5CAAF50158B3B76E466BF6A87E887BBC372F07D49D00110D4E0666A40D871733
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05265050-192a-418e-b9f5-1d4063952f29.tmp

Path C:\Users\Admin\AppData\Local\Temp\05265050-192a-418e-b9f5-1d4063952f29.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f04b648b-b879-47d3-841e-bfd9b7e5c854.tmp

Path C:\Users\Admin\AppData\Local\Temp\f04b648b-b879-47d3-841e-bfd9b7e5c854.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff6816cb-0db5-4746-9c7a-973d896132c4.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3312_1038438403\ff6816cb-0db5-4746-9c7a-973d896132c4.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3312_475481650\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 14c3f06da2323c04b8c9088d689714938a170e3bc5c4e0db8554c654dee398e6
MD5 6c12674ce43d1ac7828c978f91a0b637
SHA1 adfa2555c338ee386f1049609f61b7e02970cf38
SHA512 a11f920acc45783ca826221d2b74304b79ea3c94eebd3bd4da7c391b20f5c03c0a95b312a3f8ce16e81f95be528314bf232dfddc16d49b5a3f3bb418131ab062
TLSH
T107214C5A1B8AE87089E01BE71DEC8E257377C7CA43A0E0A5B34DA029880352D5F3E45D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3224-30-0x0000000004500000-0x0000000004510000-memory.dmp

Download

memory/3224-34-0x0000000004500000-0x0000000004510000-memory.dmp

Download

memory/3224-35-0x0000000004500000-0x0000000004510000-memory.dmp

Download

memory/3224-31-0x0000000004500000-0x0000000004510000-memory.dmp

Download

memory/3224-32-0x0000000004500000-0x0000000004510000-memory.dmp

Download

memory/3224-33-0x0000000004500000-0x0000000004510000-memory.dmp

Download