073e6c04d584678158cb5c175938ed63728fa30ded9cb87aed76f4ddf4ae5f55

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Flow_V1_Free.exe
Size 4.4MB
Sample260823-sagcpsae97
SHA256 073e6c04d584678158cb5c175938ed63728fa30ded9cb87aed76f4ddf4ae5f55
MD5 077d9d04a60a9ef0a19890b2cbef5fe6
SHA1 6a18eacbd3c494c44fc1ae3219286ffc4fc68f1c
SHA512 9b52d87b57fa3a5c1797857288bca591c09fb5b746a13bdc203a30ea844140fb3415635682119b0bf9aee76fb2d390174637429fb55cd29f40e6776d25e413ca
SSDEEP 98304:z0Fy+K7bTRSuULHO9y7MCXGTTYZMwXBYt8I4urI:BRQuULHJg+Z5Yt8LJ
TLSH
T105261256F1D28499C225E07F9562E607E675FC980B22E7CB23D09B1A5FB27D48EF6300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_1455376134\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_1455376134\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3736_1913555556\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3736_1918819814\_locales\fi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3244	msedge.exe
2788	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319717583420276"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{82A1A59D-D938-4847-BF8D-58BA9577DD83}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{051622B0-89D9-439A-8FF1-AAA241E3FA92}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5000	Flow_V1_Free.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3968	taskmgr.exe
Token: SeSystemProfilePrivilege	3968	taskmgr.exe
Token: SeCreateGlobalPrivilege	3968	taskmgr.exe
Token: 33	3968	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3968	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3736	msedge.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5000	Flow_V1_Free.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe
3968	taskmgr.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 4604	3736	msedge.exe	92
PID 3736 wrote to memory of 5332	3736	msedge.exe	93
PID 3736 wrote to memory of 3244	3736	msedge.exe	94
PID 3736 wrote to memory of 5332	3736	msedge.exe	93
PID 3736 wrote to memory of 5332	3736	msedge.exe	93
PID 3736 wrote to memory of 4888	3736	msedge.exe	95
PID 3736 wrote to memory of 4888	3736	msedge.exe	95
PID 3736 wrote to memory of 1900	3736	msedge.exe	97
PID 3736 wrote to memory of 1900	3736	msedge.exe	97
PID 3736 wrote to memory of 1900	3736	msedge.exe	97
PID 3736 wrote to memory of 1052	3736	msedge.exe	98
PID 3736 wrote to memory of 1052	3736	msedge.exe	98
PID 3736 wrote to memory of 1052	3736	msedge.exe	98
PID 3736 wrote to memory of 3824	3736	msedge.exe	99
PID 3736 wrote to memory of 2676	3736	msedge.exe	100
PID 3736 wrote to memory of 3824	3736	msedge.exe	99
PID 3736 wrote to memory of 3824	3736	msedge.exe	99
PID 3736 wrote to memory of 2676	3736	msedge.exe	100
PID 3736 wrote to memory of 2676	3736	msedge.exe	100
PID 3736 wrote to memory of 4592	3736	msedge.exe	101
PID 3736 wrote to memory of 4592	3736	msedge.exe	101
PID 3736 wrote to memory of 972	3736	msedge.exe	103
PID 3736 wrote to memory of 4952	3736	msedge.exe	104
PID 3736 wrote to memory of 972	3736	msedge.exe	103
PID 3736 wrote to memory of 4952	3736	msedge.exe	104
PID 3736 wrote to memory of 3436	3736	msedge.exe	106
PID 3736 wrote to memory of 3168	3736	msedge.exe	107
PID 3736 wrote to memory of 3168	3736	msedge.exe	107
PID 3736 wrote to memory of 3168	3736	msedge.exe	107
PID 3736 wrote to memory of 5768	3736	msedge.exe	110
PID 3736 wrote to memory of 5768	3736	msedge.exe	110
PID 3736 wrote to memory of 5944	3736	msedge.exe	111
PID 3736 wrote to memory of 5944	3736	msedge.exe	111
PID 3736 wrote to memory of 3060	3736	msedge.exe	113
PID 3736 wrote to memory of 1700	3736	msedge.exe	112
PID 3736 wrote to memory of 3060	3736	msedge.exe	113
PID 3736 wrote to memory of 1700	3736	msedge.exe	112
PID 3736 wrote to memory of 984	3736	msedge.exe	114
PID 984 wrote to memory of 2952	984	msedge.exe	115
PID 984 wrote to memory of 2788	984	msedge.exe	116
PID 984 wrote to memory of 2044	984	msedge.exe	117
PID 984 wrote to memory of 2044	984	msedge.exe	117
PID 984 wrote to memory of 1064	984	msedge.exe	118
PID 984 wrote to memory of 1064	984	msedge.exe	118
PID 984 wrote to memory of 1064	984	msedge.exe	118
PID 984 wrote to memory of 3852	984	msedge.exe	121
PID 984 wrote to memory of 4104	984	msedge.exe	122
PID 984 wrote to memory of 2684	984	msedge.exe	123
PID 984 wrote to memory of 6104	984	msedge.exe	124
PID 984 wrote to memory of 1908	984	msedge.exe	127
PID 984 wrote to memory of 1908	984	msedge.exe	127
PID 984 wrote to memory of 6020	984	msedge.exe	128
PID 984 wrote to memory of 6020	984	msedge.exe	128

C:\Users\Admin\AppData\Local\Temp\Flow_V1_Free.exe
C:\Users\Admin\AppData\Local\Temp\Flow_V1_Free.exe cmd /c %Rat%
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5000

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=Flow_V1_Free.exe Flow Sense â€” Enterprise Gaming Suite"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffcf57cc188,0x7ffcf57cc194,0x7ffcf57cc1a0
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,971157607072659477,7354262037854854913,262144 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,9439267316355416021,7281123133333923080,524288 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,10636300092253163147,617595373968806689,524288 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:13
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,16260260805038352772,5664789112194275327,2097152 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,283133453230733484,9881928418070588549,2097152 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,16514032322390265032,7292275075703635918,2097152 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:9
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,13054111315704260205,4482003415418390925,2097152 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,3392538882222957066,3699500275973823190,524288 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,3058190269125273109,12522590163674141096,524288 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,4232227602441770509,1223055895702833287,524288 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,1725088110659176936,2404172466103013445,524288 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,1725088110659176936,2404172466103013445,524288 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6204,i,16828378770778748640,10543932868148835685,2097152 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,12158642022651270853,11831999628481949471,524288 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,11348238238125212913,6105562247629308710,524288 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,2651269658880551665,18403103843088109076,524288 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:14
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,7498830628335475783,10351408863081000935,524288 --field-trial-handle=2280,i,15061359786589970443,5547522187585036407,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffcf57cc188,0x7ffcf57cc194,0x7ffcf57cc1a0
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,3407007215945368175,3475438320019855884,524288 --field-trial-handle=2700,i,17788410441899050245,10905025018536905427,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,16994994040490599558,11472889823385543362,524288 --field-trial-handle=2700,i,17788410441899050245,10905025018536905427,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:13
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,9941085200105169675,10741773097985159059,262144 --field-trial-handle=2700,i,17788410441899050245,10905025018536905427,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:2
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,10852157982939269835,3886893598328309303,524288 --field-trial-handle=2700,i,17788410441899050245,10905025018536905427,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,10852157982939269835,3886893598328309303,524288 --field-trial-handle=2700,i,17788410441899050245,10905025018536905427,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,17792350211739385759,17296877917945787068,524288 --field-trial-handle=2700,i,17788410441899050245,10905025018536905427,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2828,i,3237108411248770461,12361921866159464408,524288 --field-trial-handle=2700,i,17788410441899050245,10905025018536905427,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,3842146127579314082,13350944243246618886,524288 --field-trial-handle=2700,i,17788410441899050245,10905025018536905427,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,173419083712748351,9067081119116350087,524288 --field-trial-handle=2700,i,17788410441899050245,10905025018536905427,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,12221808515105731609,12166475198365133363,524288 --field-trial-handle=2700,i,17788410441899050245,10905025018536905427,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
    3⤵
    PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b27d5926cfe2be0df2c3ab0a124f348c5eb253e973fc38a3ca03eaadcf7cbef3
MD5 6563ca326dd50a243300796da9d50c31
SHA1 0d4d43573b95f9d9e1c65ad2f7c92f6b32990ced
SHA512 9deb1f97d55324c2ff327bb7db10c31b75b7273615d8da5bf9406145a33357de641f2ff564e30306b3b7170c1069a35d61484c42e78e5846e9636019c596dfd0
TLSH
T13FD0A76069E9F6E1E116153D8210021071996A92AA57620BA250451D9E3E1C356D94A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cf86feadd56e6ce2fbd82eccd0a5956e66f311646085c984381c10494e8dc40b
MD5 4609396f1778710c4a68f65de25473fc
SHA1 37c72f57019a17a1bf201b298c6b462224178719
SHA512 91ee7aa3990f242d19986637c0d852e44542538e690be154038c09d88f3427602dd1cd584d2e0997893b546304ea85d7a012923f6457fe246afbc82afcc9d53e
TLSH
T164D097B066EAA810C1070039C1102225319E6A90A823620BA140020D5D3F1C2A2CC027
MD5 SHA1 SHA512 TLSH

Submit Download

73d9d12a-dc2d-47e8-abcc-49abdc8f8375.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73d9d12a-dc2d-47e8-abcc-49abdc8f8375.tmp
Size 14KB
SHA256 ef3f8e984bbe33468a4bea3988b542a09d9c3304a9413a1e78304350628d9db3
MD5 a1d441bbd061f6fca64f8ebbe161ec69
SHA1 268a0c4d569ab3eb82189349b5f8e62462ef463d
SHA512 f3ed605887b12f284f73748b27e8937abb888abbdabe59b4b796eaab37fa7093dca228e49a723c52a55abca0e87bc344c70d38ea0a95fc2f816a4704fe0b6d8b
SSDEEP 192:sxR8RCScBzo/fosfhEQwZCjEoA8pK4A/g6+WNYRN/A5twoy1iYl+GpIgVgcFDyK0:sxR8Hmzo/fosfzuCjH2/5Y/gArL56
TLSH
T18562C6566A24D977CCC6D619BE35BF62D3F9502298911E4CAAFCC91C00DB6ED220B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d8b9cfdc50c64feac663477bb832a0072c931104d65f629958e81086b2230b0e
MD5 ad75a1c293d67afcee61b1572215d0ff
SHA1 365a3379510c6ea029b5f58662a8f97021248d9e
SHA512 7df75f66560be9f0abb4b35266fc1ad91ec2beb434a4848077b0a4a3abf287e0a069fc6c56c9196960aa8f85cbbda6091c424ee351a1ecc1d891a5f83beb9e81
TLSH
T1CAE02B95CD21EC3718F91B1850540746E76813572E80898F7A3D91088F75A3E5A85C2C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 dc8853521f2605c8ebc79f0a0b27e4efaf1fff48e9887c03e4aa45d1c9717e9c
MD5 ee2741c2c340fe0ae3f672c785ccca3b
SHA1 590d02d783b19c2903f510381ca217c818f0aeae
SHA512 18de4c860f24983240e45b2bafb4321dad1381c43900b6d8c00059103122a55ee4c5dd4de7077b4ffef0676529123aed35c2b8a1f1018163dba266dfd3cb3b9f
SSDEEP 192:Yn2A/WGvHn4PyJmY3xem2ughV8bLDQciEcIgbEthKh33p/sd17nnLkZp6NzQ2jwZ:82A1/n4PsxmV8PX4W235/gTYZYRjQ
TLSH
T197134A3DBA145DAFE6D200BD165B0B71B374DE71C28205C76AB4F038AA09F6B58DE483
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 fc6a387d68a6951d104fe8ee758133195cf4639c6dc7fa6b0059ce67d5f72eb2
MD5 2f8e55e8e64848c7ecd36cbc77b3f14c
SHA1 bc9f591707b895cab59b494bbc950a4c54da4c1e
SHA512 0f6e4b2f3d68f5a03262f532ca45b6fd69656b006016eea7afef49f40c9435934488c152ad49fdd52481daa525316e6157e2ee1e27f6cf1f41705b7ec82374ac
SSDEEP 1536:zqmL/juL/D2FTMonJhtizgKupAjpPmF/m78txMFOk1RM9UF:emL/aL/kTTkhcm783MFiU
TLSH
T10D44A5F71912600ACB6C02F696163E3DD17B464D3CD1FAEAD5784CD12929F33A2B9AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 e9992c262d13d1392bee397a70c2ddc05bce915e92ed3dce884d7ba142865c2d
MD5 fc385d2814401d99668a8c048fddc3ed
SHA1 d74f9b918e94834b29c6d93efc4e0d0363e5b184
SHA512 074a062519d0fa8aa67887b91fdb6e8e75c0ac0b60618a14013ffd1ef15683ece525c10e0ae184a23775d4c3cb3d9bc98ffca4fc17f777927d10c1f82b154bbb
SSDEEP 3072:Nv9G+HN42FBiHK1LOLU4W70FBZXajZqgiv9eKF+1dlsXH2N:NQ8u2FBF1L5MBsqgiVaKX2
TLSH
T16D257BEECB682C52CE6B877470E0E9077E312183B69DD0D39944C9D897C5B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 5ada3479dc65bc8199ac96cdbda122334eac964a87fe28dc9e74cbea4dc70f22
MD5 1600e0c38f6e932b98eec39a2988ee3f
SHA1 d12796de557922e69e3c2d1880d32a47a8bb6dab
SHA512 3559136e0bf6c89de51f780e1565953bca9a952f3195750c08d152bedb9534a6e3729b7a109524a393b068507dd41461361eac228ee36b01061368fb94727ee3
SSDEEP 12288:6THL0T37Z/Abz6QuMRI7RzEgUQqigFHZr/cqU1a+I6fHZMQcy2Ld450qlTZubf6C:yHAIZYfNbAojX3W7lB6KXxHeZtsTRJU
TLSH
T1E2165BEDCA785883CD279A30B4F0E9477C7413C3F994C1E68898C594027B7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 467KB
SHA256 f018bb462131444b6c74e5406b9503e22e49631da674a992963e660fcc5d79f5
MD5 53025c911e831285b711e08680148cc1
SHA1 573bd8e943319ffea90fc77dd0ff7af645d45f1d
SHA512 90486f640587e3396b276d4d9e202978c1a9fc83ddde53cb4009bebc0b9af3a7f0a4c17fd74e391211e04ca9962055c90a4693562107ed4be81c1bdd0a48805e
SSDEEP 12288:/nNNaJlIn93MtSMitsYEdEZ/tEyogbqkFm803Qc2nIe:3zRy/ieYjZ/tE6xsQbf
TLSH
T12CA42330C844BE309A6F2612F83E6DDA46EC6460FF8A7B4345FC85B17CE175096EE552
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 29ef936fc700d75d28c7f42f35762f53c2b5cfaa806ccb76b12eefbde4ae4580
MD5 98785b0868fe9edae2d0486475542260
SHA1 a683ce8e37c4ef692fae82dfb5b0aeee4433a6f0
SHA512 699655e4adcca9f91516d7f76f4e1f353606be9f2372ed860a4e8dfa3e01bcfdf8d974fadd5caa0801d072aeda20d015060e9af4d7b4a5a46e5abb3c602e0682
TLSH
T19E710F50476A00AFD756ED7402E080B936F9AC3E42279EED2548FD783706F3721E5057
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 1645ee848a27dfd5f56ad28dc77ba05045604ee289e122a42d7a7a1d5a87fb41
MD5 6af4f57a2bdeeb8f7ec7f50dae1ee8d0
SHA1 93ac86ab03338e65cf4bef14979e015ded31143a
SHA512 1fda0505db356c3205eac87977e1b1cb98977035a6611ba4b20534f515fcb30ef10b2cdc5eaf693e751a2a290bf6ad1fffee95968f37ba79e7eaf43d111ba8c2
TLSH
T132E020E855C7C25D599434C3B238674C81D03586E68FED072748CCC57707045B742DC6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 9fdaa6764be895e27e5abb77f9ebdc54e8ce34ca2203e8443cb39785c51e8f37
MD5 ba450c8081b1b31b07e44c7a5b0de09d
SHA1 830fd12dfed12de6b9dd7668edaaae89aad214fa
SHA512 2ece39936eb2644402ae74853f63323aa83f96eb34038cebd4187b769023ad70d1b534c14e140dd18fd378bd6bee95070639855c2ff9e0e0115125c615d4302b
TLSH
T158E07D8C55CEC3399DE468D3937F730C93D03882F2C8BD06778EA844B901282B38AB91
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 280d098c12e4e5ea6640009023e0d7459b1f710d6dfa167884bd09a98c696b96
MD5 f362313745eeab6aa13db3d5e46348f9
SHA1 6eac898fc31a926e9c6843a9ff16d3d7df3cbdf9
SHA512 37b07954d3db8232462a88692ab909ef35147dd78d4699d92e6d978e6b46fa11d109aa410a2fbe3e580b752baf932f6c4dfef0a19ff6954baa2a24e27f6ae4d6
SSDEEP 48:uzBmw6QU1PzJ6qlt7NILRNdGNxY4V6Kdf6q0K:6BCxPD+ROY4w4RV
TLSH
T10D92A45B0F387822D7992DBA265F1C32CD3FD05CAFE99C9A386094262CF844390715EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 0700c45e7d3a9d1bdc2b8542937bf565d94a4a451c52709f340b1322738c8b54
MD5 9ff6a1a02a87ad817a399e7d95e64113
SHA1 521d4fb1c090e6267d2e8d7ab0eb19a1d41fc026
SHA512 b6d103a010606cf241a4eed833ad113a4a02bec9d23626c6d6fc66dc4d514f660234e7c9487366b42aae0a7e82c805d91adb36a383823b8654d838b52db4ebcc
SSDEEP 192:9MN/z2H+bF+UI3iWGVoWN3qL/rJ4sJgJxXzeVVV63:CwIkUI3ijVoWN3qL/+viA
TLSH
T15F24511F4B253722CD7D81756CE758B39D6EF03FC7126ADA78A11460CEE2652602C8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 78f0eb07831b65492604a953c3564b4392eb93973fd045f1a23e019667d795a1
MD5 33747e2932315b074f9982959a23a83e
SHA1 824587f242e0d26329fe3a6cb01bd0aff3f92ecc
SHA512 5234c8994add0093b00e6ecf0fc759407b021afe34620275f5901662673e67f78555170395f8b4b9b89495fdf747b4e2a73017501fd26748eecc3544e441892e
TLSH
T18C3154BB16455404D689F6F969FEFC1CC37A0C1A5590EEFAC0946C045CA806E212DCD4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 2930ad5ce7eb127bef8e2071a7bbd83ce3c39b70ffc11c953968a7118ae0da05
MD5 6d85abf3ee7b59511ba273a16e9074ff
SHA1 79fc17bc045f76676a6deb57b67028ca55110417
SHA512 130f8aa894d4ce27eddce3502e59b0156fc5aa62fc74e8b2d2a59254c1d008508e75955697553c2069e232f07866c5e51356b0ff73954235c25b5cc1b5545cc6
TLSH
T10CE020A145CEC21D558470DF57AD770CC3B13446F689BE453B49D849B511244E781BC5
MD5 SHA1 SHA512 TLSH

Submit Download

30e7066b-7807-476e-a97e-4228a750e00a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\30e7066b-7807-476e-a97e-4228a750e00a.tmp
Size 211B
SHA256 801cf8b165d40ae6142b5dca6ed7a94fd70068eddae252d7122079bbf48cb708
MD5 22e6453bc457f08db7b4a8976f926063
SHA1 89ba5727695eb0337e7504577d681dc826e2588f
SHA512 5c6263c35dbbc22c0807f23fb66a4a2bffa19c9db0da95fdd9459cc201337cedc0a6fb5d8b71fce5800192e79d1a8429d3303c346325d88f72120894d80c5b17
TLSH
T100D02263221030F6A9ADBE9E80AFFC8FC36600300812FED620E4E8A9263586C4907140
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 28KB
SHA256 40aee2f708a437f119c59e62ad87784458a992446cc373fddcb106e7605adbb0
MD5 14c79e53fcec648a560631027d23b4ff
SHA1 a6318003b472c5429076f7228db357fa1dcbf5bf
SHA512 313b99511379f2ad2ac06aa88670a16159de7dbffa47ee2bcbe4649a3f43ba3e4f4c3ed91e2d20e813a16e34fd48a900015fe941880a157367dc192045a8b4e6
SSDEEP 96:tDeMatha9HsaSwJrCeZruB9EXM3n5n4wL+mh74UX78zr6ns3BEbpv5s:tDLaTaTrTuBWXa4wymWDzrKFRs
TLSH
T19BD21A0E17272413CA9923B16FAAEC916A151417E323DF9BE074D2B10F3E397B5164E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f62dffe4bea3b48dac3afea595386991af04d4c33c929ab5d311ecb70e519495
MD5 9a5328b164c5ea59fd824fe3c82fa608
SHA1 379ac5fa004ccc5887c34ed5e88d2e7e2c229717
SHA512 18ee658a96e63082f037b813db681be35e4d4acad788a6bb48443712ff3b9178fa0281f8163d4ca6b52bb8a9a18863977269de01964ab9cfc08b5c6a0b4e3ea0
TLSH
T159719BF3C7E8862ED91155F0EA187E1BCE1D0955832C3D5AC4E4AF1B93F2471E181A9E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 90527fa161fdadbabd05483cbf7e96ce92d22e36207cc942abfede55c80e0945
MD5 014a008ab3ffccbccae377146876f839
SHA1 4080f6f669b2374c771e12b66368220cc853718d
SHA512 bc73c116be09a56062602522b0deb8ded145b7d4e07fe09c9c905c95cf6f602d6e6a0356198ad1421d17c39169023a1492c3f62db6e66a0897fc5624ffb3b85f
TLSH
T1B6014C9781BEBCB71068996E0E8AFC0625B89835015175F5D9B6E17CB0924E32D02431
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9d9139786fc9d5779de440e18089dc407b72d26ea7a483b5fefbf42fbebec8ec
MD5 f4e787fd2c83b2af5dabba753a9c8e7d
SHA1 a159169fcddbd8b5cabf3001ba1f988da2e0aec9
SHA512 183e3e07a138c60ed93ea7aa2adc2c3014e16049860500cc3adb1d2082c9564701d257c04da754e2d2d9c599733047b1c19ee4ceb741a1dc6e0df46a1b1e0b58
SSDEEP 384:sxRDcmzo/fos3WvaAuCjDIU32/5S/CAzrAtn56:s/cmzo/fLYaAdjsUm/5oCAz+n0
TLSH
T1E172C6566924D977CCC7D61DBA357F22D3F9502298911E4CABFCDA1C00DB6ED220B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2abb4c534aecc1cb8696aab2823fbf82cc9fb261448c73cf0380db5a7769e312
MD5 82fb6d6c54e1602db6d9542277b89c75
SHA1 9467079f29747c8ae68857ef111bad6039678bb0
SHA512 d35526ceced399c1cb26de48a3168159eb4c19a7ba8705ea16c76ff382fe2f1a8898f868e31aba4ec405de240f90f0f8583af0e5ff3d1bf22f0d8e5542e3a934
SSDEEP 192:sxRDRHScBzo/fosDWpV3hEQwZCj+oA8pK4A/g6+WNqjRN/A5twg+WiYlCgpIgDI0:sxRDcmzo/fosDWv3zuCjV2/5S/VARm56
TLSH
T14172C6566924D977CCC6D21DFA35BF22D3F9542298912E4CABFCD91C00DB6ED220B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 03b8d8283b25bc2f4b26479aa942a624faac1b1a579c60883e438d4fdabf7762
MD5 904a4385c599406c9b890623a503426a
SHA1 6ca63f770eda597059698ff00b4084e45063b4eb
SHA512 3466d2334142e7be6f4822521c642563b14927f77b28b1db99ce82d2712967ea603e929c814921748f5a9f5dc3c7e55c54877588d1398d1c80e3caf0a3f8f6b0
SSDEEP 384:sxRDcmzo/fos3Wva9uCjDIU32/5S/VAzrm56:s/cmzo/fLYa9djsUm/5oVAzC0
TLSH
T17272D5566924D977CCC6D61DFA357F22D3F9442298912E4CABFCD91C00DB6ED220B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4a482eda4ca5a58578b9a54dd6ce7c22dcdcbb5bf60c0e31ea44e5e190d72826
MD5 1dd6382e109ada4936f47a919b632a4f
SHA1 ddeb7df532778385293ce9c526e6ec1f1fd90f0b
SHA512 0ec7df0b81e9b65fc702f4ddcabdd6f2f4577f2b29f11e53076449aa04d18bcd47c0c5e25cbb9916fd0d86eff0aded6f45eccffe5d68fed291fa9c73d67279d7
SSDEEP 192:sxRDRCScBzo/fosChEQwZCjEoA8pK4A/g6+WNYRN/A5twoy1iYl+GpIgDIBgcFDI:sxRDHmzo/fosCzuCjH2/5Y/gArm56
TLSH
T16E62D6566A24D977CCC6D61DBE35BF62D3F9402298911E4CABFCD91C00DB6ED220B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 3dcc96fd47579f9ba5f2d56827e3b310a3858859d00a2fc7d11d396be6a36431
MD5 f02c0e21d12bf475b3ac009eba3314f8
SHA1 40144a07575aad269e1fe144df013cbefc669091
SHA512 ecd36de41bf8937aed12ffd48e705043961b48f298bb31616f0d0de0bb239d9db33d7ede8434dd10b2df4e822c7bb46a5a67564f10742238aa5d8a47c0a77843
SSDEEP 768:j26HLj7pLuLz6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVvABVuwJro95e0H:j26HLVEz6RWgs2f02u1jawAB4wis4
TLSH
T11AD2DA7B640DCABF4F800ADDDC197EDF6D6802CB9698CD8047FA951C02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 12d094ed295729965b946ef3e70b843bffc5b1981aab07cd6bdef03bde21a8d7
MD5 e299b1c0186014cbd79c452151d476ef
SHA1 d6f21d5f405c83d54302415ffe9c18f6e3829714
SHA512 93a9f8dead198e8d0057be3f3743a4e54ad8bd7246cb0a72820957b43c604e04c0ce942a87da58eafe21bc7766884886bc670ecc4eef3dd91d1eccdd8ecb1328
TLSH
T1AEE026D10BCAC27D609620870229970C82E8744BF3C8BD063FCDCE84B18298BF2976C0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 f438ee2f5a35f5bd6fd34f562c281d110a68c4a69e91312eae570ae7bcb61d2d
MD5 8e552fb15e1ccaf785e8a9190a41ae1c
SHA1 845510feb5b625c19da17469a9d0c547b5dfd212
SHA512 dedb6762fd04edae71e63889800a6dc3891dd8d527725034cd90c93af458a7a7e42bc43dbabf86965eb2cba7978f10b2c8d90a44bcd4d1cfda08162f52e08456
TLSH
T149B012007B006B23C08B483723A0E74277A0E2010010A543C80DBF100F466D92F439D6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 7d73cea0aec6af737410ff7b03f0984bb3d2ab03f2f63280c09f986f711d117e
MD5 aab5e71996d0943af81cd97bd269e5d0
SHA1 3ac39a43732ea848a1f6df4e6a50545e8ce0b0ec
SHA512 b7b79a0c015ee650dcf2c519339e7aa9bca5e6c5b7de30406f29548b9a6b9e51f47d57dd77d217078df8dc877ae3e7a8ef381c38d6bdea7351485fae5c1dd432
TLSH
T182E0D8601ECAC32A61D520CB622DE30C81A27442E7D9AA293B5E954473065C8B387640
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 fef281f11f101b8e79171ef059433b8a40af41591bc9113262d02484eb2987f3
MD5 c1198a64db759855202848405744874f
SHA1 f3b4d59209b2777299dad16ffea4849bf5e87844
SHA512 382e1511385281895d6f9776e9708e7bcc1de25db89868befe84ba988a3c165e0979146165a862bd56fd0251900f39f722d477ef4a1951e65ca22dacc71c84db
TLSH
T1BEE080B44AC5C73956D460C3426DAB0C92F47946A7C57949674C6489F901548F3695C1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 db07c9058985d6e8499a822d50bcf63e28a9a4dba71ab479cec84c8e5fde1484
MD5 2e01fe77bfddc8db5e848da61dc4f0e4
SHA1 3f8f084652a219bebf100115f577b5df66e2cf73
SHA512 b85d2410697d535a028381f0f5348977eaaded188d65ed2b9b3fb5e851f1630c8fa0114cfcbdda7fa0c97bf8e57a7dbae07ec40a2eb4a0f765f89711d3971151
SSDEEP 96:KRVCbvlfjHWLQeg3HK4GgJHcNVIbTMHRu/bpLP7W/cKgD7K4CgN7cRZUnWmHkYmZ:CVCbvlfj2LQ/3dGgJ8NVIbTMHRu/bpLU
TLSH
T15691414131BA13803C7EA64CA0E5881E838274E63546E52B3BED05D74B67E579EFCDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 011f2f40b220b26cd218c13d2dc098d4c824241343abd0a7fefc75bd6689c2dd
MD5 7d60b98b09d944b1811798898180e388
SHA1 59fa46aac39f2f3dcaffb909c41c5b214b115edb
SHA512 d304f680e4c85674b115874326b1e464cdf7f59360cb543579d82385aff800bcfd21ed1b12d60174a54c7e370e897ea75be2fed580af98bdc7ad949fb9bccef7
SSDEEP 384:DNrRZyCSDnxTICBhMEhIKyll7svbFKfk7:xFZJSDniJyI1l7svbF9
TLSH
T12744640A7B747001EDE6D9725CB080771E3CB16E8F22E6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 367730a8a826384574d5bfcb294f8a5d3c535d72d69508a736b604351499634e
MD5 22fa4d649027233abf3d409e82e111c9
SHA1 a7dbf24cf8f4cdcaf32ca042bd8361d7112a6a2d
SHA512 7ed4af5dd6f9e61abd5b6723a5d42eea0ba54428bcc5e2f80ecf32b5a3b606c432ed30d052cf91ccdd877d9a8770792083617b16982933b8c99585a6906f19bd
SSDEEP 192:k95QkIIIbbLMIMNsYcYPUeO5gAscl8B3Q2szZ:6QkIIIbbLMIM2BGa5psGR2s
TLSH
T1EE42856B26021B77C06F5B7613768A58ABE888C10472A12D77526C1F8EF3F9783D52F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 e410baa21ab6711c675264bd9256f9c022fae61b4512d5a45e04fdc848e359f7
MD5 be54886b2343fc928abdb2fa33038d2a
SHA1 04e82333a38c1b172683fea8512b5b9c7bafd002
SHA512 7b5cf3ef62921383cf2572d648967598419a4bb5634ed7dae56b0a84828e79514e89842cab63a08b1e167f8f20383a7151edb1ec1c0ec1bffdfc3de3276e085e
TLSH
T1CAE0205167C7C27E649930CB1239630C92C9345BFA846949AF4DC4487011544B749941
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 be977a16e4c01bdb642f4f055c0dd79442d0fb72098331af515f4eb61df2bdca
MD5 03b1863659ebfe66e52063ae5089bb7b
SHA1 635770de08efb85b5ce44726cd24e923359d1c2b
SHA512 377b9aeef831d6bebcf53c80a0572a49a4972d050443f6a02cb2123b6718c93dc36deada7ca462eda3ff333f35c2a8ed6dcf7fbd0641506af235986282f6edc7
TLSH
T124210055F330C149E15A863A607F5B361738E8168FBCEC0F84BA20346EB6B040E8B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 bb8279e951fa7d2c312fe1112e2e8658e562f2cd970f4b2d53fcea6e7c074aea
MD5 ed95bbd1e3d202a1fc3a629e3c950430
SHA1 a7700c67f8fea177d428e487a913ea6d30474238
SHA512 acb0d188604a895e347f81049c8a08db1175d949c83daa9af6516e8e51a8157f17d09b79121f5d85e435d4f0f09285719f370a7580404e38d43e33efbe3db9eb
TLSH
T125E0D898A5C9C29FA09420C71169A34CD2993C83FA85AE052F8E8C4D750D185774A681
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ac564.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ac564.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 46f74cee5d2e47a0869c05ed5227543987aea04fa2cb0278557c79aa6762eb66
MD5 c69cda79885a1ee5c315e1e5b2ca78e3
SHA1 cc13a426325eb0d353e6b1892206df0a1b9bc857
SHA512 4494b67ea9deb837446d559ec2082956589f0fed7045a001e07cca1d2dddfda7daeefa901f469e8d40e4da389f9e31cd996362b5633e89b4bbe209a8b3b8ff81
SSDEEP 3:MsEllllkEthXllkl2zEfls/t:/M/xT02zN
TLSH
T1524404047FC0040DC500113054D1C3743370D51005155F4374F10D33FCC75400C11000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 c0152b38b7f07179ca3e2ef852ba0dc646dfa78b9e3662d8d55124095d3023aa
MD5 893cdc0a0bd227277181fc1265f13ec0
SHA1 8cfc77921cae620e91fa0cad48f979b398739b61
SHA512 2497fe3a6e28fe538bbe9f0c56ffe1924db1f764f3bc082f84b336a3d7fae467a85a11466b589c07fcbd73b80c409ae02cd764bce2d0458535a8998017d48118
SSDEEP 3:MsEllllkEthXllkl2zEflmZRq:/M/xT02zXv
TLSH
T1B44404047FC41F0DC5011131C051C3703370D4101FD1775334D14433DCC75400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 36b41d94582be5b22efb4240e828162cea16037878feeba69d58e037b3547894
MD5 f48c06e7983c4a0bb7e05ed3b251126a
SHA1 8a3880288851bf1843b761bf6fa204e90269acd9
SHA512 f7863c4298e106fdc2ae942b598d3776be3e206ccc45398b1360732a5636cf741c8a9a6ffcd527b54ba8879b20af97651d7fd466a431f923400c27f27d46ecca
SSDEEP 768:rM3zve/TBOWMUtm0SthONXyer1IRCzni9Mf8u3V:rM3KSSIqnnf8+V
TLSH
T1D0F2BF7199919D338CE5E3C6B542B387BFF85063C5C88A50A9EAAF1D0583A5E170FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 bf1a8a934ed39d24bc94fdf7687be73fb1fca095437bd899348cd94f9312e432
MD5 46ff5bce88896ab719f62f138eb49438
SHA1 7fc3406f88376f9edde7700f464b690986c552a6
SHA512 6478c21984d8d17dd8617c1a2fb92de6c4397970961e6a887efddeb05906fadddbb0bb83e694b998a0761173db2e54ff4908438a109f3a1c0c6c96fd3bc76d0f
SSDEEP 768:rM3OAe/TBOWMUtm0StCONXyer1IRCznieSf8uOw:rM3cxSIqnMf87w
TLSH
T116F2BF7199919D338CE5E3C6B647B387BFF45063C5C88A50A9EAAF1D0483A5E230F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 59KB
SHA256 8ededc9300689bcd42be51d9c7d6c44325b7065904e038407650252071864a45
MD5 101f4d8b1f412a28dbc5c259af67095f
SHA1 31a76a67b2cc33dfe47155d91452281d8ea189c0
SHA512 e2c41ad027ac023984f53237139bae6a4a5321322dd8cfd17ddd5722e964db08bae0f2605858bf80c9798d3a051b66433ea3942542676e0375f598701bafe860
SSDEEP 768:XFDM39wgked07ONXyer1IRCznisE0fFHlNZ8e+oejbAEEDVQSh2Bb4jhW8uOw:dM3PGSIqnltHvV+9AEYCSwx4NW87w
TLSH
T1C6535BF588D3893BC89D6387A73D2E065ABCC067B6984990FBD81E4DDCA647FD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 a5fb2f7bcadb6fc903f646f7a40b0b76a30bfeafd1b9fdde5a70be8b69239d4f
MD5 acfd040978a0cf0a86fc27be5a0b9111
SHA1 6178c8608483f185961577fcdddb21ecba76cee4
SHA512 2a4f4a9f11e19d739d384e2ca024d64808797f3f2d20061fd92a35eafa00afdeecbcd536fae3174dc3bcb965ab39ace042351d0b9898b4f692120d63807defb1
SSDEEP 768:NM3OAe/TBOWMUtmqnONXyer1IRCznie2Bb4jhh8uOw:NM3cjnSIqnsx4Nh87w
TLSH
T13DF2BF39DC919D3B8CE9F3C6B20A67176EB89037D2DC4A50DBED5B0D00A395D630B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9a477eb891d5b9644e1507e6e2e4c030c9116d8c59b3edaa141755e546182138
MD5 3a3d6d5b04a40f782be64cc3ef0cfd7c
SHA1 e262615284271e9db309f980059952c501b4fe85
SHA512 a6440d5f037006f4a88595de3fdcc9da7592cf6a30c13a7912b5d79990c74dd97df8a8c7a0b26f08176352f80f1bb3d81b49a1510a3a7ef1a5944cc0f4d2f4e7
SSDEEP 768:iM3y9e/TBOWMUtm0SthONXyer1IRCzni9w49qwf8u3V:iM35SSIqn5Bwf8+V
TLSH
T1AB039D3C9D519D3F88ADF385B20E66576EB81037D4F88994E7DA5B0D8472A1DF30B806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 009afbd587ec198651a1db4af4bf80fc75a14fe96fa36fbba040a7245c356e57
MD5 5fba3539a25ada10b41cb5d2fee8e3ec
SHA1 bc33813b4a3f9cfe3c300d9f80d59bbf9240ff24
SHA512 f593031cb7e2004abc1067af0ede6a6a2dd01281c73dd31d8f07671ee931a7ab2f81787f653dfb2ca2ddb17f633ab018510537b5ecfae8d2072bac15274c77cb
SSDEEP 768:hrv+4UNbdz3I1c/TBOWMUtm2ONXyer1IRCzniB9eVH1SK7:hbsbV3v5SIqnyEH1l
TLSH
T13F03CF32A4989E338DE2A3D6B047B6437FB86057C6840790EDDE2F4E069B59D230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f6f6052f2be4c9b47afb8c50917ec9a46bab340e0bf7b3ffedc144a8fa66077a
MD5 249be04764cbb214bd5d78224d10bf11
SHA1 cf9c22afd3684ee4e67bc703224d5cc734948fdc
SHA512 dbbecfd3ae368803994f2f6d2da8818dbab287836a810679476cdcfc17466e6511063ae79a7fd8bbefb82fc97b1ff66a854e3ffe42a7586ae835e95ba547adce
SSDEEP 768:Qrv+4UNbdz3A1o/TBOWMUtm0StGONXyer1IRCzniwMeVH1SK7:QbsbV3PzSIqnoEH1l
TLSH
T16403B031A598DE338DE2A396B047B3877FB82067C5C40B90E9DA2F4D099759E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7adafd2d0e3f3098e860ff523b9c9b3ac5c91176fde0d058d3d60eb2da2c8380
MD5 eda80383385b4cb4d37755ae8f2e28d9
SHA1 53764240058d885e5a0725a113d5d0b50f034ad9
SHA512 ad740d93b89ae8915d08b0e3789e051eb187a524975cdf4a9647dd57af01e2372f79591ee50282d0ea6d1e860bc96bb8bb305b32b1bba36c607e95fac6fad2f9
SSDEEP 768:1rv+4UNbdz3zze/TBOWMUtm0StGONXyer1IRCzni9Mox6I:1bsbV3WzSIqnnor
TLSH
T13503CF31E5589E338DF2A396B107B383BFF820A385C40A94E9DA6F8D058755E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 022718f10dd8cb97f39705f1ef14471d600aaca90d439eb869cd1d8a38506597
MD5 1871716637aed8d10b858245c3b79b5b
SHA1 7b64db1e19df766f0e4220ee3c487cd15f8e6783
SHA512 da031d70b6c7eed9c17798410f795dbea988d7966710c729dc167fcf7d6eaeac3901778f75c00d09dfbc57e966b848d2dd4225e780866b0f20d8cf6970bf2c6d
SSDEEP 12:TLJYJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isQQQtydJwMzA7dsr:TL+j0afDdWec9sJVUO21Zq7+jy
TLSH
T1FA92FE666D312033E8DB4B36BD9389900EBC025EC9A77855CED48C310EA2BC2A2552FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 7d5acd06d6a282e0d2b464be22bce1eb55b3e341187cd5f7182cde2b7debb62e
MD5 615b2c014121b90e63da08c5e2c60f7b
SHA1 7487c42b6e2856be1a82c2f475e2ac359ebe92e4
SHA512 eb23a4f2de35f212aa89878d9424ad233e479197add1fd63e1bcf1e4cc685bc632d9c7cd5ec6dd0928b93b81fd3edd87e1201dd7694d83f5c8cb905819a53e86
SSDEEP 3:MsEllllkEthXllkl2zEflhTRKX:/M/xT02zeI
TLSH
T1824404447FC00C1DD5101031C053C3707374D4100513574734D14433DDC75400C10014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

d44a58b4-43ba-40bf-9c9e-b3f945e82a93.tmp

Path C:\Users\Admin\AppData\Local\Temp\d44a58b4-43ba-40bf-9c9e-b3f945e82a93.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3736_907199122\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3968-9-0x0000019770F70000-0x0000019770F71000-memory.dmp

Download

memory/3968-2-0x0000019770F70000-0x0000019770F71000-memory.dmp

Download

memory/3968-6-0x0000019770F70000-0x0000019770F71000-memory.dmp

Download

memory/3968-11-0x0000019770F70000-0x0000019770F71000-memory.dmp

Download

memory/3968-8-0x0000019770F70000-0x0000019770F71000-memory.dmp

Download

memory/3968-10-0x0000019770F70000-0x0000019770F71000-memory.dmp

Download

memory/3968-7-0x0000019770F70000-0x0000019770F71000-memory.dmp

Download

memory/3968-0-0x0000019770F70000-0x0000019770F71000-memory.dmp

Download