hxxps://tunnel5[.]dlproxy[.]uk/download/6GFLcQR-w0DR1VtXiFRhvDKNTz0RWTGsBYFuN6uepDeUsI-x17--GJBcg2cyQvLrY7xOPzsmxXuJQi4MsB3i4YKUxHDVSI1bO2gTn3t1jP3mANh4nh3pNDTdk63gE2O4UIegXR7dVKN1n28RinujAgJZUdDy7R9IlhM0OgANoYiro5ZlgZqL3Twmpr5ms9uFGm2c3YRDLN-KeOqnF4ygUj7HDxNbbre1XI9ZuIeCpEQIZDPSZIN3F5E82JywIqzYCqtpqhK-9GzkV932rCbj9BnpmqKdD1bcmT9E6_Bp0bDJFZRnYfxD0uJhJNAEpH3A2ahCYayDBOA4ruDgBVZRgtyVFuZOUQazNbf8HQfJsl-Mw_l-HX7oIKkgOWYxct8OKA7zywiwecYkGblteGab3g?sig=GRQDflGjf0w91MuldMDPVwOgFJMF8X1mOewVvDAxITQ

Analysis

user interaction
yes
max time kernel
141s
max time network
133s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/08/2026, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tunnel5.dlproxy.uk/download/6GFLcQR-w0DR1VtXiFRhvDKNTz0RWTGsBYFuN6uepDeUsI-x17--GJBcg2cyQvLrY7xOPzsmxXuJQi4MsB3i4YKUxHDVSI1bO2gTn3t1jP3mANh4nh3pNDTdk63gE2O4UIegXR7dVKN1n28RinujAgJZUdDy7R9IlhM0OgANoYiro5ZlgZqL3Twmpr5ms9uFGm2c3YRDLN-KeOqnF4ygUj7HDxNbbre1XI9ZuIeCpEQIZDPSZIN3F5E82JywIqzYCqtpqhK-9GzkV932rCbj9BnpmqKdD1bcmT9E6_Bp0bDJFZRnYfxD0uJhJNAEpH3A2ahCYayDBOA4ruDgBVZRgtyVFuZOUQazNbf8HQfJsl-Mw_l-HX7oIKkgOWYxct8OKA7zywiwecYkGblteGab3g?sig=GRQDflGjf0w91MuldMDPVwOgFJMF8X1mOewVvDAxITQ
Sample260825-azzaps1vfv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4916	msedge.exe
4528	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320920459363476"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{ADEC5731-B3AD-44FC-B0D3-2553AD9B2D0C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{73B72960-4C9F-4141-BCF1-9C75EBA35EAF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\How-to-Fish-AnkerGames.zip:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4888	4880	msedge.exe	80
PID 4880 wrote to memory of 4916	4880	msedge.exe	81
PID 4880 wrote to memory of 4992	4880	msedge.exe	82
PID 4880 wrote to memory of 4992	4880	msedge.exe	82
PID 4880 wrote to memory of 4992	4880	msedge.exe	82
PID 4880 wrote to memory of 5004	4880	msedge.exe	83
PID 4880 wrote to memory of 5004	4880	msedge.exe	83
PID 4880 wrote to memory of 1828	4880	msedge.exe	84
PID 4880 wrote to memory of 5188	4880	msedge.exe	85
PID 4880 wrote to memory of 1828	4880	msedge.exe	84
PID 4880 wrote to memory of 1828	4880	msedge.exe	84
PID 4880 wrote to memory of 5188	4880	msedge.exe	85
PID 4880 wrote to memory of 5188	4880	msedge.exe	85
PID 4880 wrote to memory of 4104	4880	msedge.exe	88
PID 4880 wrote to memory of 4104	4880	msedge.exe	88
PID 4880 wrote to memory of 5592	4880	msedge.exe	89
PID 4880 wrote to memory of 5592	4880	msedge.exe	89
PID 4880 wrote to memory of 1212	4880	msedge.exe	90
PID 4880 wrote to memory of 1224	4880	msedge.exe	91
PID 4880 wrote to memory of 1212	4880	msedge.exe	90
PID 4880 wrote to memory of 1224	4880	msedge.exe	91
PID 4880 wrote to memory of 1224	4880	msedge.exe	91
PID 4880 wrote to memory of 2536	4880	msedge.exe	92
PID 4880 wrote to memory of 4480	4880	msedge.exe	94
PID 4880 wrote to memory of 4480	4880	msedge.exe	94
PID 4880 wrote to memory of 4480	4880	msedge.exe	94
PID 4880 wrote to memory of 2188	4880	msedge.exe	95
PID 2536 wrote to memory of 3924	2536	msedge.exe	96
PID 4880 wrote to memory of 5356	4880	msedge.exe	97
PID 4880 wrote to memory of 5356	4880	msedge.exe	97
PID 4880 wrote to memory of 5356	4880	msedge.exe	97
PID 4880 wrote to memory of 5364	4880	msedge.exe	100
PID 4880 wrote to memory of 5364	4880	msedge.exe	100
PID 4880 wrote to memory of 5364	4880	msedge.exe	100
PID 4880 wrote to memory of 1808	4880	msedge.exe	101
PID 4880 wrote to memory of 4636	4880	msedge.exe	102
PID 4880 wrote to memory of 4640	4880	msedge.exe	103
PID 4880 wrote to memory of 4040	4880	msedge.exe	104
PID 4880 wrote to memory of 4040	4880	msedge.exe	104
PID 4880 wrote to memory of 4040	4880	msedge.exe	104
PID 4880 wrote to memory of 560	4880	msedge.exe	105
PID 4880 wrote to memory of 1148	4880	msedge.exe	106
PID 4880 wrote to memory of 1148	4880	msedge.exe	106
PID 4880 wrote to memory of 2728	4880	msedge.exe	107
PID 4880 wrote to memory of 2728	4880	msedge.exe	107
PID 4880 wrote to memory of 2728	4880	msedge.exe	107
PID 4880 wrote to memory of 3900	4880	msedge.exe	109
PID 4880 wrote to memory of 3900	4880	msedge.exe	109
PID 4880 wrote to memory of 4620	4880	msedge.exe	114
PID 4620 wrote to memory of 5324	4620	msedge.exe	115
PID 4620 wrote to memory of 2816	4620	msedge.exe	116
PID 4620 wrote to memory of 4528	4620	msedge.exe	117
PID 4620 wrote to memory of 2816	4620	msedge.exe	116
PID 4620 wrote to memory of 2816	4620	msedge.exe	116
PID 4620 wrote to memory of 2228	4620	msedge.exe	118
PID 4620 wrote to memory of 2228	4620	msedge.exe	118
PID 4620 wrote to memory of 424	4620	msedge.exe	122
PID 4620 wrote to memory of 5624	4620	msedge.exe	123
PID 4620 wrote to memory of 5624	4620	msedge.exe	123
PID 4620 wrote to memory of 5152	4620	msedge.exe	124
PID 4620 wrote to memory of 5152	4620	msedge.exe	124
PID 4620 wrote to memory of 3440	4620	msedge.exe	125
PID 4620 wrote to memory of 3440	4620	msedge.exe	125
PID 4620 wrote to memory of 4892	4620	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tunnel5.dlproxy.uk/download/6GFLcQR-w0DR1VtXiFRhvDKNTz0RWTGsBYFuN6uepDeUsI-x17--GJBcg2cyQvLrY7xOPzsmxXuJQi4MsB3i4YKUxHDVSI1bO2gTn3t1jP3mANh4nh3pNDTdk63gE2O4UIegXR7dVKN1n28RinujAgJZUdDy7R9IlhM0OgANoYiro5ZlgZqL3Twmpr5ms9uFGm2c3YRDLN-KeOqnF4ygUj7HDxNbbre1XI9ZuIeCpEQIZDPSZIN3F5E82JywIqzYCqtpqhK-9GzkV932rCbj9BnpmqKdD1bcmT9E6_Bp0bDJFZRnYfxD0uJhJNAEpH3A2ahCYayDBOA4ruDgBVZRgtyVFuZOUQazNbf8HQfJsl-Mw_l-HX7oIKkgOWYxct8OKA7zywiwecYkGblteGab3g?sig=GRQDflGjf0w91MuldMDPVwOgFJMF8X1mOewVvDAxITQ
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b0,0x7fff7cb9c188,0x7fff7cb9c194,0x7fff7cb9c1a0
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,2582819282904631299,15244332191951639912,524288 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,10343624275117820759,15104048040751096468,262144 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,8502410164060195804,9577917193945990287,524288 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:13
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3352,i,3848471051886661359,5331681232748882932,2097152 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3340,i,9979939832569800720,11458929324363410903,2097152 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,3576011046780839117,12298131955921973520,524288 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,8590373197774505797,10162909485903253772,524288 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,12359864705634688248,4861169474920708268,524288 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5528,i,2939351755643883528,3417684529275252568,2097152 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,10779040343336404942,6738221307659555136,524288 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,1578148900722304187,4659355237487611695,524288 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6668,i,2956544365435980674,4810420872543251049,2097152 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,1578148900722304187,4659355237487611695,524288 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6652,i,13089709647892139829,11064601588844314893,2097152 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3464,i,14951059543778025596,11616211870515185087,2097152 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,17285175891766406659,4806366217377162811,524288 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3980,i,15055293261697772708,15434233050327046526,524288 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,12632283051323661267,9181001056634969863,524288 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6896,i,10273359230881506603,17243091630349325799,2097152 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,4427709093132018744,16085410921311703254,524288 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  - NTFS ADS
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,3281525978270830806,18375643262889820410,524288 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7324,i,6872396566393729489,1394081991702712562,2097152 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,5760685139847335743,14389586456817395485,524288 --field-trial-handle=2132,i,7395544342307612030,14554022660710318815,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7fff7cb9c188,0x7fff7cb9c194,0x7fff7cb9c1a0
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,15023276654631687945,10766591570471973080,262144 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,1018397786476900599,6934474851045982831,524288 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,6827417204674856436,11657540315629297435,524288 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,11521244857306551480,13487127251953452050,524288 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,11521244857306551480,13487127251953452050,524288 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
    3⤵
    PID:424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,16947886480464392652,11846042890521705458,524288 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4660,i,422983499795885090,8180107924670787536,524288 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:14
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,11352758280883871442,10280806748524208165,524288 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,6265186855903260782,11794804408694600261,524288 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,5428597759105804566,12910223926280941255,524288 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,13142302721542633368,18342954550982873708,524288 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,5496885926976045900,14345716935929554146,524288 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,4678489913023835673,1051832700508433765,524288 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,5964786796142418033,8929052030228780057,524288 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,14737605398749165957,7821109340251662996,524288 --field-trial-handle=2168,i,11584951117256990819,16297993643260327604,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
    3⤵
    PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
TLSH
T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3938a8b8a3b2829d585c74c71e9bfc40f62fcd1ea60366b6ad41d0f6ceda9299
MD5 fb236d386b0fca02ea6c1adc1c149cfe
SHA1 354b142d2f62592c29214fd3cbbf09a01f9da0a9
SHA512 86512b00062940b74deb1d9e5099b85030be6927dff725b6f585a26de0c1afa77859554c8d3f66069a8843754766bac4f4157a3d42a390963bb57044ea6035cc
TLSH
T1D9D0235456DDFFD6F13E253CB1D1415434AC64D15D021141B444496F4C9529646E2CF9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 391bef93aab7308c2a5669eb4dfe1d78b3754543f9fa4c3d4430aea783457ef2
MD5 3bab4bb08e35a24e07f3e04fbcdb0451
SHA1 6cd742a58928595793013d77b235ce84b6c5b9c9
SHA512 e51aca1d5f2aec9ec4cf588af9e7f6696aa7e17bf2b2ec56c13470a6e8c67266f7cd5d63b1a9ee776e8a4022288363a5edfe7627ff8d0a4d7d9c7d02fd8c104b
TLSH
T128D023A853DFBE45F13F513CF4D1516D356DB4D058014051A445179F484739596E14AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f7c293d8123015ad77439caf0ac8622b5755c719b6986f58c42dd53af79dd56e
MD5 33ebf95bb5ab806028aaee6ee90ed1c6
SHA1 46bfbd5cb6fe4c09737edba1bc47132b3188a9c9
SHA512 3e15b0cc98dee1b13450ca9db158831fa534a1d06a8a1d964cedcd91ab44949a287a5be2aff86912066c7eb8374c3de5ea2d8537e5e5cb77a0d2f48e8d9afbe0
TLSH
T196E02BE5C822BC2B48FD0718A4540B02D70113272E40994F7A3D820CCFB4A3A06AB95C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 2126c630717d893dfea2d6b5653371b4bb953abd8b6029dd8c46965cfef17117
MD5 1e63efa0cd8eadd8e681177dda07ebe5
SHA1 dce190ca06046d661cb8cd98c683dc2e7e1708b1
SHA512 84f00670595dc00518b88ca1a65a5bae8385d00c09115525f67ed33dc98f70a013bbef30e8364dd78f6c8eb65acd000284d6b2dd058c9d925182ad8045caa379
SSDEEP 192:TYlbVJ7NvP+lEl1Jl651lAelUlmlsClWlXl8UXlplDkR1+XIXYX1S1M9iZWpyIx/:CjlCRAzKUCRRudpyR4dsJ6NjjzCvM1
TLSH
T13213D5BD31161C0EEAD37DBE294B4EB16BFDF822D5D1432773B6B2160329B42895E901
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 ed0b53049d0e3a83acee93705f5cd9c1a79b960d876c8b835127879b2419474b
MD5 3371960d0735793b9faa5936ef8723de
SHA1 8fdd6808691ea18db82c0aae3de80e11a8889569
SHA512 b1759c545132f7deb1fb90b2bd2a6958dc77eec45904f8030294ce3c7d8eeda7a0a678693c9d8f369fefa277dc0938174c2c402fb81796103b1dae93de2d1a10
SSDEEP 3072:vNL/zL/2sx/UZ0L/rL/Db7n/eUI501B8:vNL/zL/Hx/UeL/rL/vLGL03
TLSH
T13A446FFB1951A01BCFA812F6D2033E7DD17B015D2CE1E9E9E67C0C952825F22B6BDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 38ac9a948bd1a6c8ef99af767fc5d4231a08efd06b8a1d3b411c22140af818ad
MD5 714cae82abccf72d5d71733a4966074c
SHA1 5bc0bd02a950d35991e7942103898327efa3a7cd
SHA512 8d3a95d2d0da9b4b82938e42a506979eee52f698a685113bd95f501634b1e57149cda2d409703837358092ce1f71544ad1be6761235b3ad0978446ac12fdf8f9
SSDEEP 24576:Hwb6olBm8YHLJycM/mewHJEB7b6WzkBGSMAoOqq1k1m+J7qTNjeW7Qo81:Hwe8YHLZTpEsW2GS9oOZe1XJqJ0d
TLSH
T1F1867DEDCA6898C3CD639970B0F0ED877C7413C3F595C1D68898C584026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8f41b077b76fc02a9214b091c42edc65e48a38ea07f1e6ae73a6c806d92905b4
MD5 08c71b5384cb5d5d383b92c02d1a0d36
SHA1 1fd9053cd1f9e71e9a0e9b2057c9fa43e3b0bde6
SHA512 9578ef9acaec6b95d77fa905ad4829c81736baa826d0a67a5c2d0edc0cdf533e525d651a8bf6206f7863e63287ea32d1833a387bcc1e53c83f0274cb3bb465e8
TLSH
T10E5190098A8B0573F7423AF0B1C053C473FC71440D5A2E428994F9B6B46AB3A8BF0348
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 aa236ab8c96939d9b29fc454c759a99b7179c93319ef8ca5db0274249f6468bf
MD5 b82197e194c6a2f94112dc7c1e0272a2
SHA1 3666b20525e0119f776a796882bb29506ed4426b
SHA512 132f591105175d1e476c822c049c5861df9a0bd1e6cdbdd3b7e6eefabb0a25c23471962224c99a3f0716b7a7924cba06ba806b6b097195b174750fdb01a60da2
SSDEEP 3:MsEllllkEthXllkl2zE/liPd+:/M/xT02znY
TLSH
T1404402046B801406C6002170415183A05370F81456525747259104725C89A840D00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 69a3dc06257a5418d9b211985bef37dfb75243924415741b1ed553a0536ca924
MD5 aed23462bbad8506083f12abfc704275
SHA1 a253f8ca2eac421f1676792ecba4575773bb65a1
SHA512 38e9e863ce9541250ae39cb22633b6f84924920c12140ff3601f0f19c273d937c500f9c36b4bd2d470b66f3d63fbdfb45b2eba1db6b5bc9d4ef0b4d9ff39b1b5
TLSH
T16EE020E455C7C15F99D034D35E64BF0AD2C73443D685AD031B04DCC87702405B245557
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 d4d18ae6b994f8b3f875c929e41a60b3bc9cda2d79e6066540e6f63f10b91777
MD5 cd9ccb5970856fb6bce7908c46e4ce0c
SHA1 c80cc6c14d1d5026837a9dff3de35db1f22fdd4a
SHA512 be33fa8b8cbd283d2d1f4d87c93bbf72fce52676239a5eaa8fa8c8d010e671486b6598110a55ac085ec0c5ee4c4de143f43325084f91afdb916dfbf1063670d9
TLSH
T14BE026A405CAC13AD4547CA38F787B09C7D2348BAA883D021708A9C4A102A4DA38A2E8
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 94737061c7622929846fc32e5fd1e98c5c118d827652055000c8c54637cfe3f8
MD5 722b796453c1eb92c544957149ad8465
SHA1 62077d834360327be03d3095960355ebb5154b8f
SHA512 383800a3695659b21c5aaa63a84966111494256793f7f546029bf0dd6994c77abea197818fddb55846ebe082ccfc9af239fed81bd5b0bd34b1c43f784e5fc830
SSDEEP 192:3NdHk0+G83uxXBBK31GkSJYEJH7DNspU:3NdHka83uFBBQ1GkSH7DNspU
TLSH
T1CA14230E5F343722CDBD913668E645A35D7CF03FCB1366DA686114B4CEE3652A42C8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 133B
SHA256 3c9b04c37907ce34d683996e5ef4106d0357c0130cbdd298188a160a6032e1c4
MD5 16fd67d91540483c7c1d029d3aa39ae6
SHA1 ec308c605b5b7accdc12201ee426dd1d00524924
SHA512 c56efdd14350241d20f1700930cca786c2db8e6195e03b32c6b17a178cf9f27e6d33dbadb38c68ec05ae26960dbf59311a5826d04ebea3fcf1e19d60bc660e36
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 314b1d732ff00e3d7ecbcacb73940b4d293794ec7e8139af89f3f04e6ff2ce84
MD5 5f2fedea73fd1cfe6897be1ae656e9b7
SHA1 43b8227733f5ac6ba43b790714c27b74dc72a733
SHA512 6fe34cfb6c7579534f25a12e6fa69660caeda3c809121285f7cf4660125fdb86c975f8bcc6916d8c265befb704d1e4176d0b2e71fa7d69e8be95b2fce0f35f1e
TLSH
T1A6E0D8B045EEC19A5554209757247F0EC3A13416D6C8AE011F08BDC4F245008EA95AD1
MD5 SHA1 SHA512 TLSH

Submit Download

23eb880f-d96a-4e6d-b6b1-10d7912f3a28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\23eb880f-d96a-4e6d-b6b1-10d7912f3a28.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 0017cf66a6c473413d3fe1b58c7195b4a2f5d3da11e92328181ecd0d7702e546
MD5 8680e07554b3f85f552503be63ef5869
SHA1 ebafd7df8339341403db97943cfbcf7d19bb5de1
SHA512 b3894cdbfb7a8db3ce8c582d46b48461c18a4984496d1350171ec491db2eab4793b7ddb959d775384cbf48503d5f5cbaf387d3ad04b85e650be0dee3bac9cb9e
SSDEEP 24:TLpLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfBY+omwOERo880D7UBGb+AA:TNLopFMatSaw/auUOt8BY+omwhxlaAwH
TLSH
T1E7922E5E1F306211D0F05B72EDD186262FBC201CC3A33689AA1410F3CEA269BF41A0BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 016aff012e0f29f90ab9e8bf8d9c64d43679e79ee6b4b020776826399027f720
MD5 9c30c2683d1bf7f8cdaeee03fa6525a1
SHA1 38b3941dd2d326003db54a9a91d2239e380be553
SHA512 6cb3a02de5924a461e03a9e9cbbf257fa51f239dcf4886155e5b3e110394eeea3c181a1b7d420158ead3183b552a2c40250849b8ac466d59e90be5e638ed2163
TLSH
T130318EF783F4856EDA1196F0EA18BE2FCE1D0511432C7DAA89E4AE1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 86de039cab9cefd75bcd410007aa4be477c1d695d0a165957550bafecf28380f
MD5 90e6d41435af9b44b3703d835d9f5e54
SHA1 c9a6c253bd7fe3968f3f8c28d600f166c9fb9d9a
SHA512 3d65f950e914d41f9157a7c290693d0029853c5f575a6b7f0e9464710c690143ed868b6af53ab0040e112a04f40c858825734ef196e80559026497c1d73f4cf5
TLSH
T158C0221284F8F0B210A6043D09C4AC81BB39C034000094A0C894937CA0801FB9B4202A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4007c581570140cf0309abc591a6b5634f8769a487a97f9f563da8c56d48f661
MD5 2da0667013f813cb548f1cec7c8153cc
SHA1 c0fb371a6e3bea40acd061bafad9e2160a0935f8
SHA512 de1044bd1d1b4369cc5320e41501e377e6c82379e66a51912fb3432a9ce934a23a75ebddcc0b3f9e225fcfdd1409e1589e469bc75e9e5f9218c9264d1c164b02
SSDEEP 192:sxZNROyMqZjK1Ml8So1/fEsEWpVLzKQ7P/07zodpW/W6+WNGY0ZPVRyUIgbwJqJ:sxZNt01/fEsEWvLzV7n0gW/bG599cJm
TLSH
T11D6208156A38697BCCDBD219FA457F93D7F9153391900E44A9FC8A1C05E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 70b88e1f30f818ba3925f983f5429c26cb8ac7fb73eb233af3a64ca47c8b3316
MD5 375d8ffbc2fd4a52af673f4841ea5be0
SHA1 37a1678fdb9a52beda59f22ce0523c447e5e50a0
SHA512 9a969cb804e161ff27b2fed29266c399a30f5404857b0949070132ad1934aa547520c6d2d3515f4149e5de57226541fd777f264980cf9fe0b6669657667c1943
SSDEEP 192:sxZNROyMqZjK1Ml8Mo1/fEs4KMKQ7PZ07zodpW/W6+WNGY0ZYnsGIgjJqJ:sxZNtQ1/fEs3MV7B0gW/bG5aBjJm
TLSH
T1D46208156A789937CCDBD219FA457F93D6F9153391900E44AAFC8A0C05E6AEC2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 0dc0fb9144ea796d9550509428b3774afe788a480b5de36b3fa44af52d7ad8a4
MD5 a9d7f872b5a853cda67e2f78e6f01514
SHA1 526b636c3658443e2952d90146568b34eafec42f
SHA512 e79b80e2dced729501c6fb3ca5ae9fecfce52ca7fadb9733663d0de7e5160816f55a9f8fe090a8e73008512467c3e05f910f9f57513e1feb06c1bc78d61fa041
SSDEEP 768:XwZh38Dv2aFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV309Ll/lv0bzkro1o:XwZh38Dv2aFWRm6GQFmu1jaK09LplMbC
TLSH
T119E21B3B280CC77E4F844E9DEC266F966ED802CB66684D5447FA894C03CA7EF511B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 0f10ea8f0bcac75deb15ccd2709a857b90a3f427db8b9a56eeca450f7cfa1083
MD5 fa324681b039dc0b0f565d9823df3fe5
SHA1 2dd521f1cc4d454577736f43d7e438dfc59a13e8
SHA512 b5269276ac9fe33b5be4250449b714e922ead3ba80078b33000f05532168e7a75f0f6f668e4127f1f75fdca4f962c002e73a5ff5234e4dce42575973cc7d85de
TLSH
T173E0262406CAD17E706524930B34B74EC3EAB547D3CCBE422F88EC84628A90CB196190
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 768b50f24ebf58d8f43fbe9afb7fbdf5c5a044ee6eec66ef9ab96d2bc9bd3bc1
MD5 3ac14f76f10db821272b1ba4aad82a9f
SHA1 689b901ee24948facac22b39ee3e7e2aa20a3e92
SHA512 7cc4740a28d27b82cf371e98d2b7241ef6211e9e728ff9a07d4a6a8df04949d1938ec1e9c0d7821ec19a1f29bcfdcd2efb89df03cf8c8397027f6fd0289fce70
TLSH
T154E0D8342ACAC22B61A6209B5714FB49C1A3B403DAD86E263B0DB4C4634A588B347150
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 b2eeceda08016598f25e2fa82246ac6b8213b2e9da2902d039b99180a0b39417
MD5 74f94219e85aa6003be09dd364f98e2f
SHA1 275764b61bd5fdb186125c28dcc12855b80fe4fd
SHA512 bb5f3234c6a946bb1bd1cacf2b747d3aa59ebe1217277021da2115ffec026236b6da57fd73ab8ac5d4bdde2fc72ee2d24a0886830791fc6a9fe565961bff4886
TLSH
T1CDE0867886DEC23A548460F34B78BF0EC6F6B80797C87E56570C64E8A206158B2AA590
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 549be9eb3bef7c1762a427bb1c176affab81a21ffa9ae3d45c1bed60c83796a1
MD5 54c26be42bda4b3e6422766930f1d7dd
SHA1 e9321beadee06f6a9c56c31853a3176a13fb263e
SHA512 c3cd44c4b450d955fc94e1fa193bf6dd0e2e99e13a94098489814effb1526a004387d3a6b32632528d1dd5b4ffb43355f25fac12cdf35d66008262f0312342e1
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlnrBfbg:ctGj+BCNC5qFVpKxn1fE
TLSH
T187B2891632FA02023C7E791D87A597375A42B1633018E93B7BE914B60E6BE214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 bc96e4ed92b4218bde83ea65c475483b8ca223ac7fbb7c6334b478335f7cc132
MD5 c3a200ae0801a4ad258bb031d12ad510
SHA1 cac02816a58f4ed0e41b18e6350f3257498db33a
SHA512 7a0ffc881d3c763c2187c485ad1a4c951d0837a0ab5855c6b269fbccb5ebb4a17a5bf4835e41d7f61af4229e4733a38f2a90a7bf2ec3661160ef66bd7f03c3b9
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlnrBfbva:ctGj+BCNC5qFVpKxn1fja
TLSH
T133C2791632FA02023C7E791D87A597375A82B1633018E93B7BE914B60E6BE114DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 399681fc1bbdf989596294bb4f7cb985366fcfbdbe608f150bd4c2d7bfe410fc
MD5 39e2327f5e6ebbf86fd07f88196d6e18
SHA1 94354644205d4fda8232b6bc4fc798c49b41f7ec
SHA512 a5f473d2a47e38b3513ebd7b5f497f406e21bdd0a85b81537b3f7683d19d0b5a0832596d48053a916a9b4d0c8d06bdd65a68f2c8ffea24ddd07a9644a91d9ccd
SSDEEP 192:FvoWJHrIVQfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aIfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T16E24640A7B747001DDE7E9725CB080771A3CB16ECF22A6915DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 dd536c162b6a877dc86eb3624b3bf2f52162994da66b460fcbee6ddecc555a4b
MD5 54e2db853f0abf97659765526535cd61
SHA1 81493bc6ff249e06a09d8cd32f2dd34ab6040e19
SHA512 5907ef32b89d03efd5c7b3c5f45fda8302ce8da578f63258554b8176316d8d0aa01845509d60187685c2ffde754921f281f73695681687d5994facd2812449f2
SSDEEP 192:HeOQjAsvlrqxrsj5RLhFCA1BkDkuyXQMcIIIcbsMIMm3YcYwDlflCC:FQ8sNis/nQ1IIIcbsMIM6BTBdx
TLSH
T102B2B64877451237E1DFBF7142B58B984AE46CA2453A318DB066284F5CF362B8BD39F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 5ac1917161b188a24a2b78ecdb8cc8b4a832e3c92f037d99484265fec9158de6
MD5 48a694d3c9c96ae665526eb9a5fc0a8f
SHA1 c486079bc55699d391ad77897824bc925943b24c
SHA512 c9dd5a18f79959332a8005e2a467920064de5bfb3ab9aad8cc620a130e153ea99a4b1891fb0816d92850bae1b40e9b3b754d7754abcc021ea131e61811bd1569
TLSH
T1B5E026A0BACAC17FF555249B5A246B0AC2863E03FA882D065F11E48CB45130CF28E1E1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 f0133e103c624453a6732ca95b9e4ca2f7f15b16699444b7a52ac89a1f8d39a6
MD5 e5d24f0158b3a0d449a3fa8ebf05718c
SHA1 21d8bc6c2ed1347dbd571b7c844a38efc30448d8
SHA512 cbc932deef35ae9882f8f437098ac3547b115db9f046a19c7f5c0310bee4ae384b8123d1b4ded81cb4d73483133c0c7ea549f39f1a467681b860fc53a0e38625
TLSH
T1C1216056F321C149E14E8A7EA12AAB361328E8029FFCED0F447920256D76F015E8F6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 eb810111964f19cb4fd6366d7d492575258e77d907cc3dda23aad670a4ab8074
MD5 b3ce1427a841fa9cb09c6970aa16be8a
SHA1 e8720568641b9a4748498e56f50a68e86d90e588
SHA512 63f7ed57f4db8e730faee74f749bec727d11ad10904180b56262eee5439597e424d82ba4cb591fb2d438d18cf0350089561f8044d47bd9daf6b2611ebfc0fce3
TLSH
T111E020A075C5C1AFD19528975674BB4AC2963903FAC83E111F00DC8C9151245F24E2E1
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8bfb2080e698a43502164fc71973ed56d08fa15e67ae70fbda65a2bbb8b5f0bd
MD5 838a2afedd553d250bea9da7cd5c84e6
SHA1 228c2aeb5131f75c61f508876f24fdbabe22bf94
SHA512 257cb26c88b9dd157e38a524d6892978971cc837dac9d529e76735738d7bda595afb5147552adf6a905058338ab509c9d267667a579fef48739268b3dbb389f1
SSDEEP 384:nwiF9CcmyWCs38NL8TUNTUlIxBrk6oS/F1ifbMoQ1uJ80aKGSye4KV8p0jdty/7l:LFccps3wwg4e/ToQ1uCJ3SyI8p0+
TLSH
T1A7B25B36EC99CAB7ECDB0F99F74A7A07DEE0126395889AD4DADC5D0C008719D170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c79465b5d471503e9c53989e552c376cc2c53d924a0cdea58d4129816bd98b74
MD5 6dc151eb500eee4f0d75bd5047b474e5
SHA1 a7e5407f67d5eba22a7823afdaa0b3f8dc4ebf86
SHA512 2428aee5e265e419a86f1ff0d668aac87153c6b57181e6c67256236ec4b384f9d4496f203daf9279858b3d171311dd8e3cd31750a73190d03313879884602472
SSDEEP 384:n6iF9CcmyWCs38NQ8TUNTUlIxBrk6tZJn1ifbMoQ1uJ80aK3XxRDe4KV8p0jdtyB:xFccps3Hwg46JBoQ1uCJKxRDI8p0+
TLSH
T1BDC25B36EC99CABBECD64F98F64A3503DEE05263968C9AD4DADC5D1C008B19D470F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2daefbe392fbe358ed295b6aaf40c6d37010bd8a50899072112d7fba139295c7
MD5 4931b54c335da7c0f90c315935ac0918
SHA1 1fe7ff462ad0885a875aaddad64fa1579c45ce90
SHA512 fc0643d13d42b4b47dc25bf8eed8ea1cfb4a0d34b13122b7545829a1a2d1c0abf433919af6ff112d01ce446549bc4e1be337ca9e9bdd4edb20eb2ca655778b48
SSDEEP 384:nriFxZcIj8Nk8TUNTUlIRBrk6jjQG1ifbMoQ1uJ80aK3XNuDivh+aaty/7IgMoh:GFZj3wgQYceoQ1uCJKNuDiJlWm
TLSH
T1B7C23A32DC99DABBACEA8B85F74A7607DEF0416395CC9AC4D5DC5E1C009B19E070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 29437d7f67ae042103804106b306e1a1d4f9e1b85e45a904c2fdb5af378314cd
MD5 4aa1fefe5e055a464cf025c5111dae35
SHA1 041a450ad5b28e1f89cfb180c062adda031be038
SHA512 5211ae9a2973346678fbb61af296f1e0253be1dce00276c0eebbecc4c48194fa44b7bd64f9dbecf8a2e25407091112ab0bfd9cf2bcb3d9cd376df5505b8590b2
SSDEEP 384:nUiFPZcIz8Nk8TUNTUlIRBrk6sKG1ifbMoQ1uJ80aK3XxFfD1YgTmkmkBivh+aae:vFHz3wgQWeoQ1uCJKxFZhT+kBiJlWm
TLSH
T1C9E2173DDC54C97FA8EEBB88A74D29169DE40137D5AC89C8E3D81F0C807649DE74A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 6c49c14aaf5c53c652bfa9f6dd2a5c761ef2f0e64e3dc1d17047bba130eebcad
MD5 78b0ffea384d684e8950d434c40f231a
SHA1 200b22e7b082bbbc7fe90641084a3f07f4070c58
SHA512 77955c5407acffe5c89cd56b969179626ab6e3f56a97b25b6e16ea392d5bf06cd0c27dc6bd3be028e8efb123205fed97a0fadbb09e49e083e37b7769ce9e8768
SSDEEP 384:nniF9CcmyWCs38Nk8TUNTUlIRurk6gwG1ifbMoQ1uJ80aK3XxuDity/7Igr:iFccps33wgjIeoQ1uCJKxuD1
TLSH
T122B23A32EC98DABBECD64FD9E74A3613DEE04163958C8AD4DADC1D1C018B19E474F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 a3ecec7d4d0c1dd62ee25d62b5aa31e2c7d87b296706cd878d91d99ca3ed9b26
MD5 3616842f40bfe679c8af987506045c7a
SHA1 4bdde062278686adb327eed3116bf7fabe5e1fdc
SHA512 3ded95b3b5055847f5d2b929c41254bc1cbaa1e9de630b70a409fc9b03ccb1e0ebe0d14c3665f0bec5e23f5106152fa4497fd9358aedfcec60ab508d4e2b989f
SSDEEP 384:nUiFPZcIz8Nk8TUNTUlIRBrk6sLG1ifbMoQ1uJ80aK3XxFfD1YgTmkmkBivh+aae:vFHz3wgQ3eoQ1uCJKxFZhT+kBiJlWm
TLSH
T171E2173DDC54C97FA8EEBB88A74D29129DE40137D5AC85C4E3D81F1C807649DE74A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9ba4797df7724ba36b6bf74f88008c871b1de3b203f213e8ca78db7fa4eff264
MD5 2c191d5973ba7414e4bb5ee65847ebe3
SHA1 909cb6755be4720ce45959dcfb3230d6a1f82521
SHA512 c9cfbb91a307778ec42103cb3afb22bbf4b37b96775868fabe4972017fab3d179ee861e64abf7490c5f0738d3d31a0cbb4ea48fa8c320f50e1176998318a24c9
SSDEEP 384:nniFiZcIK8Nk8TUNTUlIR9rk6szG1ifbMoQ1uJ80aK3XNuDivh+aaty/7IgMoh:iFQK3wgQzeoQ1uCJKNuDiJlWm
TLSH
T196C23A32DCA5DABBACEA8B85F7497607DEF04163958C9AC4D5DC5E1C009A19E070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8046fc8d9156d5d42b366363d3b90f6b24e349191067360af84cff90093ff69c
MD5 1e096ac5bda870f3e2cb94729922e2d4
SHA1 40b98e62afaaf269d907e83ee3c29b8a042b73df
SHA512 151f52985234f91f7dd8bd14c932260f3373451f487b84742a5a985943f9883661b25baf5dd479ee16d0dc4356363a2111827b1f73c42e5cc2477b7510dd44be
SSDEEP 384:nUiFxZcIV8Nk8TUNTUlIRBrk6jjQG1ifbMoQ1uJ80aK3XxeDivh+aaty/7IgMoh:vFZV3wgQYceoQ1uCJKxeDiJlWm
TLSH
T1A6C24A32DCA9DABBECE68B85F7497607DEF04163958C9AC4D5DC5E2C008B19E170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 029342f36f575a370204a59eec7df7afe43e3cce87453e7cb9a7fc48670ed0d1
MD5 f8a28be6a4f2a84ddfa58014ee741eb4
SHA1 80e534149f9ce7f3e2f2c4fe882f452238e59530
SHA512 2d0012e85db79f6b50f06403d853780d6861c9573300b788f7a9ca06a64fc000045dd275185d63b707c754bfd051a9a26a98fe26c635d5ff92fa0a3f84978fcc
SSDEEP 3:MsEllllkEthXllkl2zE+Pd+:/M/xT02ztY
TLSH
T1514404047FC01505C70030704151C3F04370FC155551574F35D104737CCDDF40D00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

394bf0a3-2a7b-4105-a8e7-d9b88f0d9cfa.tmp

Path C:\Users\Admin\AppData\Local\Temp\394bf0a3-2a7b-4105-a8e7-d9b88f0d9cfa.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7179031-cb04-4bd4-b440-073d25909483.tmp

Path C:\Users\Admin\AppData\Local\Temp\d7179031-cb04-4bd4-b440-073d25909483.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

70bcd4e2-9df7-456a-b762-6f0e3ab037bd.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4620_1929247229\70bcd4e2-9df7-456a-b762-6f0e3ab037bd.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4620_990145670\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

How-to-Fish-AnkerGames.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\How-to-Fish-AnkerGames.zip:Zone.Identifier
Size 526B
SHA256 7a4f9293375f67e7d0d68e789faedede5fa5cf00eccf2f61b753fa87bbd69cbd
MD5 ceb0f1d45f10ee0e5c0167726c951267
SHA1 add6697e4d59259db451bec3e88d44783d46d9d8
SHA512 82513ca5a81faefc12033a79e118b6239601a0bb7a39a3a659686463adda3c8accd5718c87951e88eefd654e48b7cabe679555730547e5ad5193d947ecbc0aad
TLSH
T1F5F0758C3D0E40087BDE750000F5DD2CD8982CB9C03F7400E45C0452B27222F4BC3C42
MD5 SHA1 SHA512 TLSH

Submit Download

memory/424-824-0x000001A3916E0000-0x000001A3926E0000-memory.dmp

Download

memory/2188-180-0x000001D16BB10000-0x000001D16CB10000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads