b52653fce169f61a5e1387968635da44da5123f9681f7008944d7b068b06403f

Resubmissions

11/09/2026, 02:02

260911-cga69s1vbz10

23/08/2026, 00:49

260823-a6f3pswtfs10

23/08/2026, 00:45

260823-a4glfswtdy10

19/08/2026, 06:57

260819-hq759ayfrh10

Analysis

user interaction
yes
max time kernel
143s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
G_f5ndcg_windows_amd64.exe
Size 4.0MB
Sample260823-a6f3pswtfs
SHA256 b52653fce169f61a5e1387968635da44da5123f9681f7008944d7b068b06403f
MD5 4c31b904ee4954dbcdd5d2bcb1148a7f
SHA1 744d13e3979a214032d8c1afc5d8def2da9bb756
SHA512 68e4142a0dea1ec147d03c43ff785ed44c0beec8b77a6739a7704590261194bf35fd3be06db923c16b5b7c268c65efe475ae9804417e5a6f548486bbaf9c6fcb
SSDEEP 49152:Nu6YvP0a3PrjY3W87Z0Jj9nJOc3zfFEhyjZbsacRGeTkT9nwPDC7bODth5yx30Gm:Nujs8Hz875pQTFwPD+8th5aE
TLSH
T1EF168D57FCA014F5C0AAA3318976A5527B71BC441F3123DB2B60BAB82F72BD4AD78714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5320_587096597\_locales\en\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2796	msedge.exe
6020	msedge.exe
3964	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319198678590784"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{46F9185A-9FE3-4513-8519-2EB87B0BA480}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4216	G_f5ndcg_windows_amd64.exe
4216	G_f5ndcg_windows_amd64.exe
4216	G_f5ndcg_windows_amd64.exe
4216	G_f5ndcg_windows_amd64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6340	msedge.exe
6340	msedge.exe
5320	msedge.exe
5320	msedge.exe
5320	msedge.exe
5320	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
6340	msedge.exe
6340	msedge.exe
5320	msedge.exe
5320	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 3980	4216	G_f5ndcg_windows_amd64.exe	92
PID 6340 wrote to memory of 6312	6340	msedge.exe	97
PID 6340 wrote to memory of 3984	6340	msedge.exe	99
PID 6340 wrote to memory of 2796	6340	msedge.exe	98
PID 6340 wrote to memory of 3984	6340	msedge.exe	99
PID 6340 wrote to memory of 3984	6340	msedge.exe	99
PID 6340 wrote to memory of 712	6340	msedge.exe	100
PID 6340 wrote to memory of 712	6340	msedge.exe	100
PID 6340 wrote to memory of 1844	6340	msedge.exe	102
PID 6340 wrote to memory of 1844	6340	msedge.exe	102
PID 6340 wrote to memory of 1844	6340	msedge.exe	102
PID 6340 wrote to memory of 4852	6340	msedge.exe	103
PID 6340 wrote to memory of 4852	6340	msedge.exe	103
PID 6340 wrote to memory of 4852	6340	msedge.exe	103
PID 6340 wrote to memory of 5320	6340	msedge.exe	104
PID 5320 wrote to memory of 928	5320	msedge.exe	105
PID 5320 wrote to memory of 6020	5320	msedge.exe	107
PID 5320 wrote to memory of 6360	5320	msedge.exe	109
PID 5320 wrote to memory of 6360	5320	msedge.exe	109
PID 5320 wrote to memory of 5436	5320	msedge.exe	108
PID 5320 wrote to memory of 5436	5320	msedge.exe	108
PID 5320 wrote to memory of 5436	5320	msedge.exe	108
PID 5320 wrote to memory of 2936	5320	msedge.exe	113
PID 5320 wrote to memory of 7108	5320	msedge.exe	115
PID 5320 wrote to memory of 2336	5320	msedge.exe	116
PID 5320 wrote to memory of 1732	5320	msedge.exe	117
PID 5320 wrote to memory of 2792	5320	msedge.exe	118
PID 5320 wrote to memory of 2792	5320	msedge.exe	118
PID 5320 wrote to memory of 548	5320	msedge.exe	119
PID 5320 wrote to memory of 548	5320	msedge.exe	119
PID 5320 wrote to memory of 3352	5320	msedge.exe	121
PID 5320 wrote to memory of 3352	5320	msedge.exe	121
PID 5320 wrote to memory of 3352	5320	msedge.exe	121
PID 5320 wrote to memory of 5892	5320	msedge.exe	122
PID 5320 wrote to memory of 5892	5320	msedge.exe	122
PID 5320 wrote to memory of 5892	5320	msedge.exe	122
PID 5320 wrote to memory of 2164	5320	msedge.exe	124
PID 5320 wrote to memory of 6604	5320	msedge.exe	123
PID 5320 wrote to memory of 2164	5320	msedge.exe	124
PID 5320 wrote to memory of 6604	5320	msedge.exe	123
PID 5320 wrote to memory of 5184	5320	msedge.exe	125
PID 5320 wrote to memory of 5184	5320	msedge.exe	125
PID 5320 wrote to memory of 5184	5320	msedge.exe	125
PID 5320 wrote to memory of 6044	5320	msedge.exe	126
PID 5320 wrote to memory of 6044	5320	msedge.exe	126
PID 5320 wrote to memory of 6044	5320	msedge.exe	126
PID 5320 wrote to memory of 4452	5320	msedge.exe	127
PID 4452 wrote to memory of 6064	4452	msedge.exe	128
PID 4452 wrote to memory of 6344	4452	msedge.exe	130
PID 4452 wrote to memory of 3964	4452	msedge.exe	131
PID 4452 wrote to memory of 6344	4452	msedge.exe	130
PID 4452 wrote to memory of 6344	4452	msedge.exe	130
PID 4452 wrote to memory of 5976	4452	msedge.exe	132
PID 4452 wrote to memory of 5976	4452	msedge.exe	132

C:\Users\Admin\AppData\Local\Temp\G_f5ndcg_windows_amd64.exe
"C:\Users\Admin\AppData\Local\Temp\G_f5ndcg_windows_amd64.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  PID:3980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://appdata/
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2f4,0x2f8,0x2f0,0x374,0x7ffbb7c9c188,0x7ffbb7c9c194,0x7ffbb7c9c1a0
  2⤵
  PID:6312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,10751168643447539536,16518055037479885606,524288 --field-trial-handle=2788,i,11524104725153014300,2817503176176586960,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,3849562903221232159,4493783225427960132,262144 --field-trial-handle=2788,i,11524104725153014300,2817503176176586960,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:2
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,8809879731662604671,17499826997124632212,524288 --field-trial-handle=2788,i,11524104725153014300,2817503176176586960,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,4931677936058880293,10474641524904658950,2097152 --field-trial-handle=2788,i,11524104725153014300,2817503176176586960,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,5295469140518849997,5932112259885562689,2097152 --field-trial-handle=2788,i,11524104725153014300,2817503176176586960,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x2d4,0x7ffbb7c9c188,0x7ffbb7c9c194,0x7ffbb7c9c1a0
    3⤵
    PID:928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1680,i,14409032767625736917,3425466922909109882,524288 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,6156776213519411707,3735030125455158031,262144 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,7869122061630442312,14212482331108887252,524288 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:13
    3⤵
    PID:6360
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,17840163222977976949,16833624806512367627,524288 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,17840163222977976949,16833624806512367627,524288 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,16095202884019272396,6024296978789313667,524288 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:14
    3⤵
    PID:7108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,5360273216649076114,13547268483697493733,524288 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,4016842653627243454,12635660095926113787,524288 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3000,i,971641133214713105,8858563984106602006,524288 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:14
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3000,i,13308922306524677263,17423687376488565038,524288 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:14
    3⤵
    PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4932,i,8790771279349295175,8223556044445001548,2097152 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4460,i,15649897202079782871,14226660115665845329,2097152 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,2634573136119594643,3576981576639745315,524288 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
    3⤵
    PID:6604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,4967024849274582355,7871729350591998545,524288 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5680,i,2926392230224647413,17758095283515291206,2097152 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6160,i,7487649696846819738,13643117489644547356,2097152 --field-trial-handle=2240,i,2610749983583926479,4642692959646243799,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffbb7c9c188,0x7ffbb7c9c194,0x7ffbb7c9c1a0
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2000,i,5278731195648792880,14268002596246985927,262144 --field-trial-handle=2480,i,17856283005531941691,16872598550247328043,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
      4⤵
      PID:6344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,3313546619001757604,6153551623151140181,524288 --field-trial-handle=2480,i,17856283005531941691,16872598550247328043,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:11
      4⤵
      System Time Discovery
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,9385818374574316784,15396112999493191809,524288 --field-trial-handle=2480,i,17856283005531941691,16872598550247328043,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:13
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,15228824570490360839,2618356080400151740,524288 --field-trial-handle=2480,i,17856283005531941691,16872598550247328043,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
      4⤵
      PID:6944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,15228824570490360839,2618356080400151740,524288 --field-trial-handle=2480,i,17856283005531941691,16872598550247328043,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
      4⤵
      PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://admin&appdata/
1⤵
PID:7124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9db36093f0db2b9a846feb897fd7cde34fb5a83a20fa209e9a9277e5a7f84668
MD5 a5fc9ceb00e26d8d6558b125046b9b93
SHA1 8cc599dacb67d78e4cf447441bc1a0f8e739ef9a
SHA512 2f0aaf22a3b54f998837cb0ced71fb681e7edebf1284c3119be1607c4752ef1848e39925e2f000d48c0ecc86e9afb6fc697d77403ab7a1fa590f988d9bb357dc
TLSH
T1D7D02320FE6CF8D1F0120538C1218600354E0563A5A37203E560004C5C366B312D58E6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f157f7329f2eba924aa0ca39485e6cde2fd8278825380c8456e9bec4022d2733
MD5 59bfb83bc4725eca05ff848ac3c2a4a2
SHA1 4d2623d00f7e4642df9afa30ce06597a532c5453
SHA512 e4c15acf75ae26b73ccdaa3290247d924d3a7f8025a4ef63ad06120f7648380481a6c1a9768e22ffc9e30b047079c9ae0efec32c522718f8316b4789f8905471
TLSH
T199D02321BB387CD7E5281571D031CB007A1A157362B792026650C40C5C7A9E266C76D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9b2ae6666730fd51aae1a0523a7f1d43c7a83d178f8d8f56ab64b8f8e19a4f57
MD5 8d33667ea5debe3eed76c1443f4942b7
SHA1 5592df659538d7e52a16f4eb91e76c16100a7dcd
SHA512 13ef6d3212b5f28e8c34ccefb0d7aa58bf28562bfcacaf4b719ed47bd6b01663da203edfe1fa2b72f052fdb8652101d43ee5e003b31aa664504ee962b865fd38
TLSH
T1A5E0E556D821AC2719FC1B1860544647E760131B3B40880F3B3C926C8FF1637578AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f2fef8f1ca4588a97a01dbaf0829f73e9046a4b8abacfd0851c6503f70d2894f
MD5 844211a366141e8ca08c2454f618c15e
SHA1 6c59302f31210d0808d67dd1622cb8b07aa2eb9c
SHA512 a50185f4e9c03d094e1507e30a6e0d5029db4c6c66f0fefeb8ccd188dfaa2aaaba2fa9b66531a89726ac5a094a6ce2afd45883f6da7ace2f7aaade720edd986c
SSDEEP 384:4+KfMMB2SHTWJQA9th85F1LMIUa5GpKf4I9tSsZkt0:4+KEFSHTAQAeZLfUSSsOt
TLSH
T10F13F57E66508D56C6C3F4BF614B0FB46374D968C1D82A577A32B320AB29F8528CE707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 cd76ceb91a7aff7e0163984eee1afee7d94a464019cd7b5d5f9e79103e96a2bf
MD5 e6fd78dd25ca8f07d593f4114fe1425c
SHA1 82f266b9682504511dbe558726d1ac61d8a28525
SHA512 4de29876d1485aefc43241f0cdb84aef98cf997bcad98a541331ffc90a844e82d8f54d8333a9446d7c4b8c5bbd70d93778d4557c0607e9cf9e0bcb349c917a8e
SSDEEP 1536:gz4mL/oBL/Pzqqo6h2Dc5jnL/oCmL/ML/9/mVdvEq+R9m:jmL/cL/OFtQlL/ZmL/ML/wab
TLSH
T1C7444FF71951A00BCBA892F6E2033E2EC177854D6CD1F9E8E5784D812825F31B6F9B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 f9073ad21502273fa6fe8e322e7cab22ecc5a642b2415221076a3eed0e8294a5
MD5 171197babaee38bfab39d14a3318116d
SHA1 e0a2e009526a2690bbf81eb80bee5bcbe9ff8671
SHA512 e14728a8f2663a35301a017a64936fea46fca2cd160221e86c7a8694b092b8d2aee958249f6a925d996dd9dc99ef434033560031f86871df6c23495784dc04f4
SSDEEP 24576:5Hcvy2U7TgXNXl+z48kJXSS1PZeJZi1x/b+:58vn6T+N648kJXSSOrD
TLSH
T1E8166DEDCA6858C3CE63DA30B4F0E9477C7413C3F595C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0d4007676404c9457f4a539aa307f8ad4f683e782e64551eec85081bc1bdba5b
MD5 75e47597fbbe6c3576e3742a48a69c03
SHA1 00cd1d5ff450f605df102c6fe6d9141cd5c5569c
SHA512 e05ab74b974b79d1c5982c2cc144f144881a7ca3809c0101cb5534a1d82d726f903dacf38aec2f7280cf2ba3d859f0934ab8a8f27fa21fab51b7e554fc4e214a
TLSH
T1A7612B147F2589A1D323F7B390A2D4A9F6E887250603AA23B0749FF4FA56E1451E07F3
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 8e95d4fc4ce5c695dd472fd2ffb8620c39f845457ac47d6bad3fdbec901868ed
MD5 145b0de83dacf1dfb178708d32406e57
SHA1 f0f4fce976b06c8de68f12514e030bd6e52c640b
SHA512 866bc5d439f64abc95ab0285d9c0ad02fc5edbb22647ffc74b39ad9b4a470fee0f7b55f7e47fee122aa807ba9a6bfb982b6eb01661575bac517a140828592d9a
TLSH
T181E020A954C7C15D5A5034C7A238B7CC81F4356AEB86AE031704CCC4760B045B6597D6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 848c5433e2c6d4ab1711f346bba2b8a58888480edac07432415af9ba6113f2e3
MD5 eeab3c8a65d0d0bb83562a368237d877
SHA1 d620cb95a69db32186a0e6c9cb4e0c71720f3d15
SHA512 71e932e931c725aa5810498b46e561da8cf95933aef92d9a9a3696c30b89ae8faadeb0754841227fb028036338930b7d663d7f00031e6287ad81e84514a76193
TLSH
T121E0268D08CEC97D9694A993867CB34893E0340BB38C3903170C8C8671012C9B2EA390
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 64e9bf32b5104164aeb4e447b19b966719604237d6f6b4d5a62754847f3ee9c9
MD5 4e7be414609d8f138795083a4f867909
SHA1 3af3e02bb9a42c5c71cc839a3a068218ec0333c8
SHA512 e7e30862068023c2a4809ab7360d9d968025f633854b7a4ee7a74fe31777f320d56ac0c5ab71de5d2ceb8aa2cc4275307ea7ad6e70ef3da903ef86a8c1a71533
SSDEEP 3:MsEllllkEthXllkl2zEflnul:/M/xT02zT
TLSH
T1CD4404447FC0044FCD0010314053C35537F0D4104511574334D114335DC75411C00044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 f0fc1228225f565ba06a1852e59073d96b14d5fd79bcae0d31b5463842211c27
MD5 4beb5e3f9024648dc81b6b46fa4cf634
SHA1 7d5665ef970980d9263976da30fafbf74ab01e60
SHA512 fb2791c6836add6181ba260b014c25e0df5c7f7f54c774f4ab457ab31c3967d77c7dbcf4132e5de5142a43b2a8e7caa2bc89b7297211a6f7db88b7371e56f39a
TLSH
T17EE020A544DEC51D9754A1C7D334B78CC3B0340AF7897E025B04E885F105044B7E63D1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 c0cbce8e46cdde541275524c6f63ce15a6cd820a000a16de412a1fbf66a0b2cf
MD5 13a80c59f9cc15cf8d1d4c76f8c93aab
SHA1 f306e6fc220696511cc308319074a7731667527c
SHA512 fa4dae62129ab2cae21c14b4331f6b2ade75b9d760c993f053afba101cb7db223776866765937d785f35eb1ad69a9a9427d173800ec94884e99d3ac8a321d07d
SSDEEP 48:TWt/LopFMaty423w/a9NUuTjAw7olwproPTJpu9Q:6DeMatha9RA58orJpCQ
TLSH
T139B2200E6F306221D0F05B37EDD284662E7C201DD3A33649DE1460F2CDA2A6BF6054AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3546dd948d6d07d9fd45b8e4bbc0d1fcda9ae73169ec49254cee0c7c25e01c02
MD5 821ac7d953f96673f8a2549e8a6012e5
SHA1 ff28767b4701af318dc8986d90227bb4da86e2a3
SHA512 ed42cecf2fad4ec349a91525862a56866653bd4982b0b67c081befc056d788b7340dfe09c6166d0b683784ed60c66e1f7aa16d07ab3c89fe2769ecefe1bbbde4
TLSH
T1803180F743B4856EDA1196F0EA18AE2FCF2D0515432C7DA985E0AE27D3E3471E041B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0dd3d130c264397e1954bda2a28dd2174a55aba024a9765e5682288569a43893
MD5 043de004a4987c3fdf1af3945fee080b
SHA1 5a7bffd4654b9e6e6641dcaf4fb39c3893f06a28
SHA512 e11e87e670811877b1bd522f5d4aea5575486193a54a9a8dae442d666424dd99ac24e321c3c67ad034c5d63ac1ff1cdeaeb5dbef1b069a46ab69d47a1c0a3388
TLSH
T1E741A0F783F8856ECA0195F0EA186E2BCE1D0955432C7D5AC9E0AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 12f5090b554cba3e27289eda835131eb58d5a27103b20c3b765908a4eaabdb3a
MD5 0da97262ed5f824ab0d281f8e61598cb
SHA1 8b00693ddf3e052b925022550c1e4a66121765c8
SHA512 a996278c95dce3b3e00364033e4b090e52e51f08a1038a241c13141cc4be013dda681c9cc1af1488ed5dfd8951451d3f7f068a5edf00d4d9aefc6f479be22429
SSDEEP 96:i/IEumQv8m1ccnvS6Q031m7pf5nFXMKPO4g:i/IEumQv8m1ccnvS6QUuq
TLSH
T19EF2F0FA07236205D99484F0E400AFCEAF16000B47B6B6DC76D447E3F7A21E2B5B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 b36d9ea5e80c0557a4294e91f8f70a7bb98ebd1f83a21293360d3a74b99b006d
MD5 eb382db573e7f49d1bcfdbab47bafc50
SHA1 fb9270ff995d0940397f5fb1da85a0695a7d34e7
SHA512 1a8c42ed49f7b7f7811e501a6d25ed38ee62c2c29e0c145596766adc08a2664160dc2920e3657a11c0a9fad8ac90342b13848dcd16e409912f4ff689605c8e79
TLSH
T17BC0125280BDE8735178557E2984A8817677D438114094E5DDA9933CA0911F77A1613A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 06d12e5d02159dc455153a6d4e3735ec66bb33e50ff3dc668fe5f7091b79e9aa
MD5 22b728a925806dfbbbf704ed1e8f62ad
SHA1 727e43f2624ff35928eb1b61930a198fa87b747a
SHA512 447960b2d726094128fb1e7af40a1df63e924c72903d6fd2102b9d1ea9f0159325fd0aeb0d35ab46ab9d3ce45f6be59b8545968412f91e9618d3422e9e3fed37
SSDEEP 384:sxR1r7c/fRsXWvTaN/RI6OE/5I2qnsGQ9TW:shvc/fYYToW4/5I2qnsGQ8
TLSH
T10672D815A924997B8DCBE619FA957F53C7F81133A1905E44AAFC9E0C00E76EC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 43a3dea88c474f6d9db7eb84a1139b3e8d71e2eb1b071b76edc45ffb470abe61
MD5 c05333238af55857ffbc6507ff383840
SHA1 d25ef632b477553f53bf4579c0baa0b8cbcc8bec
SHA512 4944c0ec3d3c2942f7ab1ed48588db093538e1ba053f2230cc1a499246b41d264be6094f366158416b8b066410a6da5e9b8e5c61ebb644cb4fbd018840c99795
SSDEEP 384:sxR1C4c/fRsMWvI2N/RIuOw/5IWqEsGQFjl:shpc/fnYI0W4/5IWqEsGQb
TLSH
T10872D815A928997BCDCBD21DFA567F53C6F81573A1505E44AAFC9A0C00E76EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6bfec28e0e230fab781d15e38f5660866c008a08e857c07acff345388b723cb1
MD5 49ab788ff4cf3e3d6a5d3ed95ec0f50a
SHA1 b1786552a2c8677a52e54cc594524a0915af0d7a
SHA512 b9f812fa3dab0cd50d64100ae009d8ee791ce8ee184f9e64ba8a46e3037788af2f83002f9a37d7bdd8f7136e920c60e985e2d62d273b9ee863b775bd9d019895
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOobbDwzro840:Ob4YZnE7yTWg1NfwBu1jatobHwAD0
TLSH
T1CFE2FB3B680CCB7E4F804ADDEC29BD8B6DA801CF5AD8895447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 01297c1bdcad8c9d4eced5b5be8ee375f460c389b427e124b0d9a637597d10e6
MD5 e90f5421b7747d7e59c2dd3fdec8b396
SHA1 bc34a8de5a96b12f8a0f782164a32b8d97a24878
SHA512 2790e7b0fd8490422ebcf62a02dd5807c9aac0b12dbc5d6afa60f58170a20d5c0c7dcef0cf0bea07becf212061d371a02ce419657a5181f25654d5dab4a71911
TLSH
T1D8E0269449CAC97DA19660470634F74CA3FC740BE3C83D026F00C8867146DC4B1EA290
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 716B
SHA256 9dd1eb9858e2fef3a3f28d73d663f40018c8a4a5871cf1ec84d42925d558143a
MD5 e18927a4bb6235f7503d494728354c56
SHA1 2ac4eeb2ecb2f1f72c3a914a6b23b83266dbe93c
SHA512 5d1d31913bbe5aeac5ff11c10868a97dac758d392fcf4b972f2a5df35c132a02939a73799485142e5849bb09f7b4394c28db0c77360497e880b3120039e1a709
TLSH
T1110149E74E08685ADC5F89B10DA533F49367D6DC06C88E97921E168316062373C19853
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 11e6cc723abaeebd7fea2c8e136696b44d57e57c4c3372e9075cd1eb100a0b1a
MD5 a7130dcf589b7937a3fa9459d60b5f90
SHA1 78d5f96434244cdddae8ce004d2d0bbe23891b83
SHA512 f6acb7781da19edf5735ed50f3ad5c08e46fce99a7f3be13b0dc4217235cda09e82f1c6b1f8008708f7e90cd9a2216b63584a8061a621d66c9005d096c9aa46a
TLSH
T12FE026A804DACA2D5290A6975A34B34C82E0351AF39D2D026B00C8C4B20A181F3E63B1
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13431919865874232

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13431919865874232
Size 392B
SHA256 e113945139b175528e16c791ff052f93d5ffec57156776470d7f695a116c8eb8
MD5 be9db80e5fc8f5babe996bba0c621764
SHA1 e3efa15f6d0332a3943b12e2ed84798e5780b688
SHA512 34e95c5585b85a73abfb274014a4bf534e873b5811a0b4367a063d5dad494750c18c75aaf3052bde701fd6000a1c80ca05b72a1de7b5e348442b767cd7a9b0d6
TLSH
T178E04F2A45DA4A36DDFC1C326C4BC5C78F37B085420E8E127DCD306074C3240BB0D222
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13431919866171232

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13431919866171232
Size 848B
SHA256 ec6ff6dab83f68375bd2f941c0705c475e03ce11b9ec670314b1648e59426247
MD5 34f4d97e18cd7cf40fc9a3f1b251d703
SHA1 b2f4399e253e90bedaf81398ce54c4226c2b4bf3
SHA512 aba822648f1f222858ea21b923846cd46c57911d25cc0473519b0bebb7eb4a946cc85a631891ed016c4d2f11a0d27b414014fd380c3f4407de55a4693796d161
TLSH
T17201A03A9D90263BC57F4C3A8ADB99E6DA267C026A810C0F415233A0583339A2B96C48
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 4ab8fb1e23b4542598a6dbd1131055490976bc92cb66d656b31f0847ad5eead0
MD5 5eb971bdac63fe781333cde94c971fef
SHA1 d105bb5461de824c2449d7ca843d6b53bf18af3d
SHA512 8ea3e1bfde4870b4276c6c2f509b6ed8b536d33b5b580171d07afca0c270fe97df214fe35b85ab1a17095b2205672544c4c4cf536083746e41d91c57c5c04804
TLSH
T1F3E0D86815DECE2E669960C76224F34C81A2741AE7C969316F089484720A5C07257350
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 edc632130600feee754f7d661c81c43b864977b365d8f425a4c385a4fab8bee0
MD5 8ddc9313e4770e70aa799c682b4d1dc6
SHA1 ec7ba7bf48388a3cbe7c6f6288c94c4fec6c4a8e
SHA512 01aa382b1b68b2d52c30fa61bad75210308e447eba13f043e529283ccd352b54aa348129ecb33e1b46e58b6a0f34e651101d7c211ca63780f5f0647f427198e6
TLSH
T120E07DF44DCACA3E5540E0874264FB4CC2F0BC0AEBCD3E02DF0C84A4B115580B2BA2D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 20c18881bdb5cf6c5016e3c0918f729ff2f92091a3294b68e6d7ac5d2de4b60c
MD5 fbb76783ebab4410d82d31bf6e112eee
SHA1 4c791ba2c036bcbad48cd0c9f061d53f443ed01e
SHA512 902989818189edd970843eb79ced22cd0d84a8e6dcaff3ef4a6c4d290a07064cd0a1f2d03e077c7d7a24ac67022444dcc14a3a02eb1a985a7848cbdce12d579d
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9l2n6b3xdZ4d0z/TB75oX3Ux0:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRv
TLSH
T1BCB24B11713F4680383EB90C91B8981F96C2B4637519E56F7BAC01A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 9adb10a77eb7a3db884e9a97432bd072579896f7748a8ab9d04b9442493bd8f1
MD5 ad1b18ffd423f69ef6588a7ccd535ee9
SHA1 34fb5b20bc75d5e1e4a9f4a8930039e766485e30
SHA512 64263e654c15150cced38eceb6280d9af5b61ea460c1396ba883598f9c5ba86afe538f6ccd023d8b62492c3d10f3ec27481abbafa6ce81938fb950369e25c41b
SSDEEP 384:DNrRZyCSDnxTICO57MEhIKyll7svbFKfk7:xFZJSDniUyI1l7svbF9
TLSH
T1E244630A7B747001EDE6D9725CB080771E3CB16D8F22E6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 80KB
SHA256 129c2146ead6c053d2b435417976cf73f727589df835c3dbcc6fcbb5b12ffef8
MD5 2967515b06d4d62a2caea946878c3dea
SHA1 886b9ea0485ee89e872b81370e335553697a5bd6
SHA512 c2e705b5eb62fc7f001510d1dc6562cd7ebe16436f381e1b11af6b35ee423de83f475abd16872a7256f0f1eb9b5a5aead7fd4b4685158dd9c5bb22599ac90484
SSDEEP 768:eUu/nIVceumD+phy7784c5miKPNoKVl9mFfsOjUzftSaDxblgZ+0+FsdCG4cblz:X3loKVlGXuFrMGO
TLSH
T16D830CF76D4AD1A6C9CD92B8E80BFF8440734221C620D9E9B97C08E77B796023D796C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 8df0da52a45ed2d06fd39779f6747ff2fe84425b2382f50c36941a511ca975df
MD5 aa33a1dab169e830c3eea40393b3736e
SHA1 abf0b9115daf1225921d39d4699e4998f50c15fd
SHA512 3fc3ec27f3f1e154b24f2fa3e259ebdab8c866f465ff46d4343958b2b3d482a816da4d545f835890e2e40d1b72c6977826ca3615edb717076302815560ee17ce
SSDEEP 96:cZve89+BFOxZqoQgOX8ZeDWXWY1lD2DseCMAWVtl9wDQHWWVzAhGXI1hBBBBBBB:z1+OCCAstl9wDQ2szAhGXI
TLSH
T16C224196BE435B33E10C89B353B6CF5053E3D48682776A1E76A4345D0ED6A6B87C82F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 4024b5a65484ad40f8066b1d184ac35c565826d662c5bfb462307966b9d0a6ab
MD5 7f5bdd9f5f03f5d72495e2a4221602b2
SHA1 92f272b2860ed6dd46c1941d121282538745550b
SHA512 669a611a22f291981b45b1a94bccb45d6cbdb6f8395689fa1c43f0d77538eaa9566ca5f020dbcd58293148a8a89bcf374b50d4113c5ccee554bb5f7da87ef9f2
TLSH
T113E0201954CDC5BEE658A1C7113CB38882903407FB8429051F04C489B0051C1B25D251
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 469021a740c3e31a73c1fd611d419f355a0fc0e63f3abd8cd9b520cea806b30a
MD5 6b2a0337d648809d2cf1df05923304d8
SHA1 490fc676d0cfa71928e8decebbde59eb8e5612c1
SHA512 e75373e61f7adb2a841c2429fc4c0f4396282cc76d76219e1bfe803cb063de8bd69efdc577990727d7d253f1f662ad3456027f4b0a315f53cfd0ea5c594931a3
TLSH
T1B3218C15F320C048E54A867E906B9B350738E8568FBCED0F847920762E71F441E8B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 bde82e7b4e2cf5b526109d4e50f6506a78667915f1f0ae4499251b146e6f8036
MD5 27632875a5cd02dec531f7348032fdbb
SHA1 787ec8eb6a228c5f6e5d1997b5ab929bbc9fcb09
SHA512 a820d16cd9e1dc57bc553386e11a77f3899bc2b05f158e7fcd9fc986d98baf5b247acef999d8f48bb08b2f21a2b83e89d577dc50d3c158e7010a939b1e4d250b
TLSH
T1C5E0261DA9CAC9FF92506183157CF3C882A1380BFBC82E021F08CC8AB105181B2AE2A1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b2e0c42f756b40205eff7e48fbd3ec8afdfeca3948bb4b5f4a610530abcc3b7d
MD5 568597484657b77eb9a883eee423fce4
SHA1 5a9ba4b7d3225f30f4cc438bbeb070f2e1ec8b61
SHA512 fb2a202fd66c2cb1d2162aa9ae974050b32664fa92a018fb192704f55d2a53dc4ee6f20d48e6438e3aecb2a306a9acea90071019895d99bf3cf86134653d3a7b
SSDEEP 3:MsEllllkEthXllkl2zEZlbNtl:/M/xT02zQt
TLSH
T11E4404447FC0040FC5403131C411C37413F0D5500715574334513C135CDD5400C01013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 28adcb0fc5e9b44bc53bb6121ee4e45a92b041eaa8b6a06b80dfc0cd63d84112
MD5 40454e560f643fdec7c36f3ccdadd794
SHA1 443c7eefde3b6480a8863640de83a0a695087935
SHA512 6e0808fef2c5f884444efb1179cd2cf4b8c1f55450880f42183a74f78d1ca7dfcc959f5cd04aee50972a8cfe13bd1d1278f9a421162abb598c758c51e8faeb5d
SSDEEP 3:MsEllllkEthXllkl2zEZlZckhkl:/M/xT02zIO
TLSH
T1C74404147FC0040FC5003531C011D3500370D4100711D7433C5114135CC5D440C05115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4f61e5ab66aaaeb7d440a1b9477120c19ea73789ae5e17485c363c7ce6a411fb
MD5 8cbe5849837b00cc40b554352b7e9480
SHA1 b13906813870856b790eb96c1218c9fb69a62646
SHA512 89ff704dc64a73d556ad9c44f606fc08d7fff5e0d10e5b79db538685fc2722ae074f827d6b1e9089ff46dfc6e09bb09aab93ed657bd48c20f5a9ba0175a05d23
SSDEEP 384:noiFMZcIp8NLe8TUNTUlIRLPvuTo4cESVfbzGjwTDGGL2u4h9k4F7Iz1o7:zFapQewgpubUtGCaJNh9ac
TLSH
T1C3C24A32DCA5CDB7ECEB5F85A64A7642DEE45163889C8AC8E9D5AD0C00D72DD070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 5427ac659accae520427804fca7ed9ca827818efc02dd16780222060a72be651
MD5 9bc3a2de5ee4998baa10acf0b3cf4c6d
SHA1 8975b556f176ac62515a3e5c17129b9507592b89
SHA512 5fb41ec84464211d902441f2eb870f1a7965963789161244cd62e6fc94b3aefb86d04a60e7b06aff5040b7bfbd697ad62e157cdc24b1e0bd5fcb74180650c04a
SSDEEP 384:noiFsZcIt8NLe8TUNTUlIRIPvuTuFcESVfbzGjwTDGGL2uTp3BDCXIKv9ppk3z9L:zF6tQewg2uQUtGCaJanpKv9nIz9ac
TLSH
T1AFE22739CC65C97F98EE7F88A70E76168DE44237C4B88998EBD51F0C80B719DE706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b0a6bb02a3df925804cc9c5f2168907135f06c347527ee4bd19f2c5317efefc9
MD5 20c7960ce14334fd5ebd1e607d4449b6
SHA1 628c6b34b9aeaacecdc56c0122e18d1847c1e05b
SHA512 0e9e72c59ac6a1b7838d2e5f88e6322fcb9ff2999ea9a9a4de4b3c4d721c19354ae02cf3ea4fc7298732be9963776bbb5c5f02490966947b61e7c3d3db21ceee
SSDEEP 384:nJiF1tNn/s3n9Sn8Ng+8TUNTUlIRiPvuTuiRESVfbzGjwTDG1LkqOObjI9G6w7KJ:gF1j+9SX+wgUu51tGCaBkq29MI
TLSH
T13BC24A36EC55CEB7ECE64F98B34E7A5AEEE0116385AC5AC4EAD95D0C00C719D0707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c7665cd0650ce00785cead97d45a22fa19631e9c6ebacee09aaf8f0f6bcb2daf
MD5 fe535823f662b093e517cd3d07e4bc84
SHA1 b3825a65916c402554ea33b95515424c722dc23e
SHA512 9cca5f870a2ba966509d124b20c9dfa62332af43473f4491282ef2c387cbf45a77768d50ce2efa9127423348c0ab97790402e1a962fd71050a97815a6cc18fdf
SSDEEP 384:nziF1tNn/s3n9Sn8Ngj8TUNTUlIRiPvuT+9cESVfbzGjwTDGGL2JkuOObjI9G6wk:eF1j+9SXjwgUuKUtGCaJOu29MI
TLSH
T1B9D25B32E855CEA7ECE74F98B34E769ADEE01163889C9AC8EAD55D0C00D729D070BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9a709c59cb5b92b1676257371c06e8e94664a2f8c35736d2f262fa6098ed73a9
MD5 2594ff38986287b2621e40ba790e9498
SHA1 91200b6fce32c21d56f728d6e30e60a8ceb47cab
SHA512 af904dde13ccf6d65de81ce1031d44960c79c20e61e7041fd29e68350ec02235a6290d372c55f8b20e74df721a05171f3cd9d8f15e2d0328285cbfec6d8bc0e2
SSDEEP 384:niiFMZcIp8NLe8TUNTUlIRLPvuTo4cESVfbzGjwTDGGL2u4h9k4F7Iz1o7:pFapQewgpubUtGCaJNh9ac
TLSH
T1C9C24A32DCA5CDB7E8EB5F85A64A7642DEE45163889C8AC4E9C5AD0C00D72DD070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 a313be1b7dd6bcaedb53a56557565089a40b0adbcbdd424e8125dde2046a29ac
MD5 a8ea53c0bed5a24352d1748853b97e5b
SHA1 4ab4a150379c2e0e1607eae2574ad4bbd5b461ed
SHA512 70bcfb9644f600dedd59ca0ee9d945f33ba8a32fce86f376a17df455d98affb6183490f850025af7ecd0d966521c993d688e6c5d0b578b68c52d03326db903e2
SSDEEP 384:niiF7tNn/s3n9Sf8NLj8TUNTUlIRDPvuTolcESVfbzGjwTDGGL2JuO3m+cbD4jGb:pF7j+9iQjwgtu6UtGCaJwT+cbD4jGW90
TLSH
T142E2173ADC55CD7F98DE6B88624E761699E41133C4BC8998EBC45F0C40B769CEB0B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 6275468d08e5b13067707d5bf7aa7604cea9fa1166229d2c04fa1349c1100483
MD5 e7e45ea2cacf5a1387bdd61920cde572
SHA1 5501f8ca30f62db333d94f35c61d535b74aaa9a2
SHA512 256f969af25938a0fb061cac4f14be7d223811bd51147f2b20163db3663e9236b5ccd655e693ce4a8a720a96083fd570c2b1a343edee1f0c4f244de35c7fc89c
SSDEEP 3:MsEllllkEthXllkl2zEfl1dZR+ll:/M/xT02zEZM
TLSH
T1A9440444FFD00405CD0110304451C35033F4D5100D11774335D10C73DCC7D500CC1101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

772acbe2-e56e-4ef8-b88d-2b721d1eb8bb.tmp

Path C:\Users\Admin\AppData\Local\Temp\772acbe2-e56e-4ef8-b88d-2b721d1eb8bb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512