9bdd07b06196fcba38b4024768de24b88618c7f2ab95206cdf99075f53baf39a

Analysis

user interaction
yes
max time kernel
137s
max time network
135s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/08/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Jitter.exe
Size 10.8MB
Sample260825-d3qphsek2w
SHA256 9bdd07b06196fcba38b4024768de24b88618c7f2ab95206cdf99075f53baf39a
MD5 c02bbbf16a213db30413212627358fc5
SHA1 6aaa5234dfec43e9288813e6a6d7d0f2915b14b3
SHA512 a0044280c0d5b88f97069010ac251a8734c0b67c5f067157ecb35552c27f2288a4462afbbd2bff69d60e7a35b966aad36fb72d873db49380613a9f48ed769cd2
SSDEEP 49152:Urpifgt4QtqSpXiAh8HzLwXV4f/yU3Y5MSlF8W99o4Qgl5F4IUfUyGA2+71wSH2t:UrXHplcqUoqw5zUfg9Qk0X0DiM2n5
TLSH
T13BB68C19BA51C1E9C56A8274CD9BCA4AEB71BC440F2247DB32D1337E6E333D42E7A611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2540_1577894185\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2540_879090844\_locales\fi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1216	msedge.exe
1232	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321026439617895"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{6C631231-46CA-4C66-BC27-BCCE4CB7F52D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{F69AE035-8296-48BC-B4EF-E8558E6275BC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\jitter_2702.zip:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5736	Jitter.exe
Token: SeDebugPrivilege	5912	Jitter.exe
Token: SeDebugPrivilege	3900	Jitter.exe
Token: SeBackupPrivilege	4284	svchost.exe
Token: SeRestorePrivilege	4284	svchost.exe
Token: SeSecurityPrivilege	4284	svchost.exe
Token: SeTakeOwnershipPrivilege	4284	svchost.exe
Token: 35	4284	svchost.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2544	2540	msedge.exe	81
PID 2540 wrote to memory of 1216	2540	msedge.exe	82
PID 2540 wrote to memory of 1084	2540	msedge.exe	83
PID 2540 wrote to memory of 1084	2540	msedge.exe	83
PID 2540 wrote to memory of 1084	2540	msedge.exe	83
PID 2540 wrote to memory of 1772	2540	msedge.exe	84
PID 2540 wrote to memory of 1772	2540	msedge.exe	84
PID 2540 wrote to memory of 6040	2540	msedge.exe	86
PID 2540 wrote to memory of 6040	2540	msedge.exe	86
PID 2540 wrote to memory of 6040	2540	msedge.exe	86
PID 2540 wrote to memory of 2300	2540	msedge.exe	87
PID 2540 wrote to memory of 2300	2540	msedge.exe	87
PID 2540 wrote to memory of 2300	2540	msedge.exe	87
PID 2540 wrote to memory of 2196	2540	msedge.exe	89
PID 2540 wrote to memory of 2196	2540	msedge.exe	89
PID 2540 wrote to memory of 2400	2540	msedge.exe	90
PID 2540 wrote to memory of 2400	2540	msedge.exe	90
PID 2540 wrote to memory of 2400	2540	msedge.exe	90
PID 2540 wrote to memory of 5312	2540	msedge.exe	92
PID 2540 wrote to memory of 5256	2540	msedge.exe	91
PID 2540 wrote to memory of 5312	2540	msedge.exe	92
PID 2540 wrote to memory of 5256	2540	msedge.exe	91
PID 2540 wrote to memory of 1296	2540	msedge.exe	93
PID 2540 wrote to memory of 5540	2540	msedge.exe	95
PID 1296 wrote to memory of 240	1296	msedge.exe	96
PID 2540 wrote to memory of 5956	2540	msedge.exe	100
PID 2540 wrote to memory of 5956	2540	msedge.exe	100
PID 2540 wrote to memory of 5956	2540	msedge.exe	100
PID 2540 wrote to memory of 992	2540	msedge.exe	101
PID 2540 wrote to memory of 992	2540	msedge.exe	101
PID 2540 wrote to memory of 992	2540	msedge.exe	101
PID 2540 wrote to memory of 5068	2540	msedge.exe	102
PID 2540 wrote to memory of 5068	2540	msedge.exe	102
PID 2540 wrote to memory of 5068	2540	msedge.exe	102
PID 2540 wrote to memory of 3912	2540	msedge.exe	103
PID 2540 wrote to memory of 5500	2540	msedge.exe	104
PID 2540 wrote to memory of 5524	2540	msedge.exe	105
PID 2540 wrote to memory of 4776	2540	msedge.exe	106
PID 2540 wrote to memory of 4776	2540	msedge.exe	106
PID 2540 wrote to memory of 1380	2540	msedge.exe	107
PID 2540 wrote to memory of 1380	2540	msedge.exe	107
PID 2540 wrote to memory of 1380	2540	msedge.exe	107
PID 2540 wrote to memory of 5952	2540	msedge.exe	108
PID 2540 wrote to memory of 5952	2540	msedge.exe	108
PID 2540 wrote to memory of 5952	2540	msedge.exe	108
PID 2540 wrote to memory of 3052	2540	msedge.exe	109
PID 2540 wrote to memory of 3052	2540	msedge.exe	109
PID 2540 wrote to memory of 3904	2540	msedge.exe	110
PID 2540 wrote to memory of 864	2540	msedge.exe	111
PID 2540 wrote to memory of 864	2540	msedge.exe	111
PID 2540 wrote to memory of 5340	2540	msedge.exe	117
PID 5340 wrote to memory of 1820	5340	msedge.exe	118
PID 5340 wrote to memory of 1232	5340	msedge.exe	119
PID 5340 wrote to memory of 5584	5340	msedge.exe	120
PID 5340 wrote to memory of 5584	5340	msedge.exe	120
PID 5340 wrote to memory of 5584	5340	msedge.exe	120
PID 5340 wrote to memory of 440	5340	msedge.exe	121
PID 5340 wrote to memory of 440	5340	msedge.exe	121
PID 5340 wrote to memory of 3188	5340	msedge.exe	124
PID 5340 wrote to memory of 5404	5340	msedge.exe	128
PID 5340 wrote to memory of 3764	5340	msedge.exe	129
PID 5340 wrote to memory of 5500	5340	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\Jitter.exe
"C:\Users\Admin\AppData\Local\Temp\Jitter.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\PopOpen.htm
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ff981fac188,0x7ff981fac194,0x7ff981fac1a0
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,3526628416139203086,18097062006849016495,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,8426213136962891623,4436712244504156877,262144 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,5309382079912125188,2865486236318318299,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:13
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,5635227591838307757,5573892533798611106,2097152 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,4121433859726687870,2185552665039752558,2097152 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,11868001027863968877,5925511462600378012,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5000,i,12136143504578741877,9339438186943370692,2097152 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,4827711124331598829,17943372003054153340,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:14
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,1624028510398472243,13140935936986655259,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,14303606632751061595,7486544358662511859,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,13411391026014346363,16808812754059814484,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,13411391026014346363,16808812754059814484,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6708,i,13920765222149236377,9205163181210002211,2097152 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6528,i,8597618575746583304,14297190218689287848,2097152 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6740,i,6247735934455041158,4038522216372303364,2097152 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,4227879062384587694,1730210777258555641,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,14473517264864374964,5885871710255350304,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,8663951898908913005,2439417501697278705,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,2425495426211619354,9081015622262755711,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7060,i,16569741935022000348,10976673497335428934,2097152 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7652,i,11454882180225044133,4063328391227345544,2097152 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7640,i,7315280115694455149,1226190466931917398,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:14
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,8053351495194329555,8635974618382613481,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7952,i,2839004656941441130,8008766318932370793,524288 --field-trial-handle=2232,i,1807181738213332846,9962859381844961333,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:14
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a4,0x7ff981fac188,0x7ff981fac194,0x7ff981fac1a0
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,8786176027836733949,9420081342310589958,524288 --field-trial-handle=1876,i,2659275131265310366,9695224989944968666,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,8052416571909430046,4035498518176376618,262144 --field-trial-handle=1876,i,2659275131265310366,9695224989944968666,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:2
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,15372679241442478763,16039694843439849440,524288 --field-trial-handle=1876,i,2659275131265310366,9695224989944968666,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:13
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,13402906087557536326,13429398742155146882,524288 --field-trial-handle=1876,i,2659275131265310366,9695224989944968666,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,13402906087557536326,13429398742155146882,524288 --field-trial-handle=1876,i,2659275131265310366,9695224989944968666,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=532,i,6623656497367770181,12545598886382435955,524288 --field-trial-handle=1876,i,2659275131265310366,9695224989944968666,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,10938664433398067839,13293272827240072545,524288 --field-trial-handle=1876,i,2659275131265310366,9695224989944968666,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
    3⤵
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,11162544020922503470,5210326863707426600,524288 --field-trial-handle=1876,i,2659275131265310366,9695224989944968666,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
    3⤵
    PID:5500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1980

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5916

C:\Users\Admin\Desktop\Jitter.exe
"C:\Users\Admin\Desktop\Jitter.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5912

C:\Users\Admin\Desktop\Jitter.exe
"C:\Users\Admin\Desktop\Jitter.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 006ada33c1ae1947a7e833766a2685602076ce0def4dedbfd81bd3406e14bb28
MD5 7cec44155f7ac3927c03d4d8830cb32c
SHA1 9a135dac286217f3e7c79e54b252c25ae61421c6
SHA512 3badd0829602ff5c26c4dea2e815b825a1630ccc8e87e86dc2d487a538ee337409737971485478565a07c0978a6114ca83e5d47b26ddbd844efb68a5ffe581c5
TLSH
T1DFD023246C7CB8D3D132243D4290430331CD0A626D03F102A040840C8D388C3E3E4CD3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e223de77028980b6162b08b793fcc365b77e7182cc33100fb6e0e6564c712ff0
MD5 4d84e828b699b9ede5b604042a5187c3
SHA1 7259f470898f5c638d822a809572a14de560e68f
SHA512 96090fc8981e374dedb5e9d5a3b971193766cbd6d57bb9738c275d3963ea496f1b3be8f2496baae777854c5e42299cf6b203c3c32a190b002fc9f82da776d58c
TLSH
T110E02BAAC860AC3718FB1B1EA1560A4AFAA013571681985F3A7D850C8FF572A42CA85C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 7c214173492d90381fc815c3ab84b85d47e44980a392fcaab729037846a8b7c0
MD5 da6782409a0f86157dafad1955e1ecdf
SHA1 45e9eeb39d6b2813a8aa0b713bc7c1a347231673
SHA512 fbcd9687f4b0923bc3477efb8732d0ef696ec9e58d2a2abc7cb19b0d0e658cae3eee04652777f133c621ab5330877a33582cb53097cd743e9f30af66f38f1806
SSDEEP 384:e+vAEG2PS8/OHviKhwSb/1hmXT9ClSN+YsR+V62NW/W4AnR2MNzGIXj/z2r8Mw:e8zpPS8WPi4wMm5dsmbhX76rNw
TLSH
T10113F77C63891C4BEBEF187F594F0A7C6368C9A4E7D057C727F07166121AB4EA90E809
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 0cb3c9b07a7c0163d3ca7ecdcbdcc47d9721d3e900909621ca82ebfbc90703f1
MD5 39c8829115f26c7462fe587a52e26394
SHA1 36e90f36fbb8108f41489b07208ea14a861f9831
SHA512 1035a9ce370bd79b730991941e34c039f539218347b81875de59cbbe839dd1534b763e38e5cfa042dd41c8a1b01ffb83f2337e09dd6554966a37da74d5b9ae53
SSDEEP 6144:DL/jL/K5gWaR724bYJL/6L//kaCew8ovsUW9:DL/jL/A4bYJL/6L//k5K23M
TLSH
T190B4B5F70A51A01ACF6C02FA96163E3DD177054D3DD1F9F6E1780CD52929F33A2AAA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 bc94585b8c62ac0a37a1c2027c6c101c8e734f1608661ce9c66e558c8b78ca96
MD5 889fe045f1891acb7637d87072af21e2
SHA1 0206169d3bb5033cf255eb0f58843554c5cd0ed1
SHA512 eedbdaf84ce475009d148121d29e7f80c768ac1a3233e554b953f54bf13c19cdbe584e698deb4867bbc405fde684ecd1adcad7b1100715c430177d8a2517bc84
SSDEEP 6144:fml4ZNhHrLuS1utciZ1tNqazi5fzK1shNbnUZSydQHWyNoWr4eZ:fRPLLXZiZ1I5fzjpnNikR4eZ
TLSH
T1A5255BEECB682C82CE6B8770B0E0D9077E712183B68DD0D39944C5D997D6B8175E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 4402b43f400d21ca5767e25f6fded4a1948f93b41cf1fa4d7c03cae67a67c32c
MD5 5805a69f0d148d76eabca1a37259a3a3
SHA1 9fb3a2d48ad4a7fd5ec43ada75a5967784ffe6c6
SHA512 fca2b9b93452df38e860262010015d7af75a8122c2231d7e294a6bb7d0514eee222b3c1c51d97dfb257c16014b8bcdd89e5a9d3944c453a9424d08cb63d29900
SSDEEP 49152:fYpYT72LvXqVuF44XiTPPM3DGeI3DxNCL:fj7VVe3avXeL
TLSH
T15D865CEDC97898C3CD669A30B4F0E947BC7413C3F995C1D28898C584026B7C5BBAE769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 68KB
SHA256 fc70b88dddb2da85326b7ff7e1fa801f0099e5c0d3a85863afd2737af9b199a2
MD5 cb3d1e69fbf9c94b15e92f2fa26892f0
SHA1 b8e5aff1547d49a1285e2e0c4cb43dcd9993f468
SHA512 0f890af69b223aaec8bbc753bbc626f6cf0e0660182e38871a03337f1eec7be6b47cb9d5034a3cb8c226feb6cd964d396f56fecf07257f3cbc13de642c175ac2
SSDEEP 1536:1RrPSv8UR94fNhLVxko8PojNVcL7tk9/yGeJ3GI:PPZGefNhLVxko8MrcL7fJWI
TLSH
T16E63026A7FAAA437FB2C87016FF23034D1F8FD579034042826515BB5A4578E92326F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 39KB
SHA256 28bc2090a696abac3f58b64052819146d487884bf63dfaa5b15c95a948e2b6d6
MD5 730c2d34c1758691b03f81479c4f8d97
SHA1 1353462d20e4eb282f6f7ac40ecf91628b1ceaf7
SHA512 a07e73c6cce577aa5be5ed0a307c6ec118acea5969bb0971799ba062b31bf01f5d1fdc2fa6299b86d4a1a3f96482f374280c3daa57cbc8763038348e7cd23455
SSDEEP 768:Dxjx1Coy6lWaLRB1FDdSEbmIovkJPx6CnE8H8lgDUTo/yX+Jy43:Dxz87SHCPFvOXHYgCo/yXRM
TLSH
T10D03F12CECB27134442817E581EAEFD9560EC6A7FA452041ACDBE741E0999D2D78FCAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 467KB
SHA256 f018bb462131444b6c74e5406b9503e22e49631da674a992963e660fcc5d79f5
MD5 53025c911e831285b711e08680148cc1
SHA1 573bd8e943319ffea90fc77dd0ff7af645d45f1d
SHA512 90486f640587e3396b276d4d9e202978c1a9fc83ddde53cb4009bebc0b9af3a7f0a4c17fd74e391211e04ca9962055c90a4693562107ed4be81c1bdd0a48805e
SSDEEP 12288:/nNNaJlIn93MtSMitsYEdEZ/tEyogbqkFm803Qc2nIe:3zRy/ieYjZ/tE6xsQbf
TLSH
T12CA42330C844BE309A6F2612F83E6DDA46EC6460FF8A7B4345FC85B17CE175096EE552
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 2f6a8ed4221bad53c953692c4b2e932eae7b405d3b60d9d545814037dff504b4
MD5 dda077b38f8e0b434708a7ed3e41dfdb
SHA1 6e4f4a8fbebf55328c08f864afa45b58f6a8aa58
SHA512 cb235fc10a49203fdae1014ae8c1eabc35294863e92482c534df00a7a4ae75d35d875142a51965ef7c35ffe52debd80f5be9e77d91319f5266a537e12e17bb4d
SSDEEP 96:aTGK0DgDXzEyLKRIvX/uzr9LWDHWSuPZuVlWWypVaItP6x5l9/3xrI/Fq:1aDEnCW/9e2Lu/WNSxD9/xP
TLSH
T1A5D17F9003BB07C3FF7B0ABFE8A1A4EDB63174549A0B8E855CE639751D3A3ACD255448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5995be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5995be.TMP
Size 3KB
SHA256 e84d6039b962a53b9f1e1c1ae66b019b1f204ea164900e6e8adde1e866b54a6a
MD5 da1f34e5ad202414079a4391ad7cc2cf
SHA1 a59bf4045a5277bd71a364bf8abb4c2595ecd8d0
SHA512 9d34d31f0e9f863e9162576713609f394eb09f4b8bedaac371789ce1fdf3abbcd1d971bc7c313ffc2f586def42220e95e8189d5793e8bde09407b216edd72a8d
TLSH
T19771F7E042B303E3EF621AB3E0E1193E773099A8FB034E450DE779B95D1D761D52A408
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 513B
SHA256 388c5c95f0f54f32b499c03a37aabfa5e0a31030ec70d0956a239942544b0eea
MD5 c92eabb217d45c77f8d52725ad3758f0
SHA1 43b422ac002bb445e2e9b2c27d74c27cd70c9975
SHA512 dfd5d1c614f0ebff97f354dfc23266655c336b9b7112781d7579057814b4503d4b63ab1263258bda3358e5ee9457429c1a2451b22261a1f1e2d8657f31240d3c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 44fea8387de3feadf09da3341900cc85dece12d79f88435e20ff5c9645a86ce1
MD5 21e719159e0fc85b01056f21b348ab8f
SHA1 99216fc125811f336d026d1abd28474efecd1f62
SHA512 478e2e418b0c415c603a69ba3294cc370fa0794e34fb42a3a7a799021dfb1ffd77308834306f143d64e8cc526c3ed5c8521d54cc431ac57894269ead49cc1792
TLSH
T1C5E07DF817CCC169D66678D7C7A8470FD3E03502F3CCBD02170ED844B141341B28AA80
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 c0bdede3557b4c1090734a5cfcda80e93599edd6c1b14acb774d48ee60a8cc42
MD5 c5ab2a6d142a42ff37d3ec5a71dfa355
SHA1 b79043e304cb285a3f23daaf69a46816a2752de9
SHA512 444a5ef1115f4c121952280de606bf836ad86b41cf341d06d48a18bd6bef2e0769efff5965a16f59dc830f162fa96939082f539220b58ac297876c2ce223b2ef
SSDEEP 192:EO9XeKSot5ju7RoNbeea/yZI/yiMEdUJRO:r9XeKSDVOAuiHUfO
TLSH
T17DD26B73EE30BD25CA9709F2A16D2D3AEE33D00D8FE2CD6D386651914D3802369943AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 b9e6274167319fe663ba28d8806c921f63e1b013c766ab472aa751ba8efbc8d3
MD5 186fb498df187d0a975c493c73552a66
SHA1 e82f625d31de3fee8a945640014fed34a79c6671
SHA512 01827ed8bd2cd484dd08c0ce4ce724ee2541e5ebf3aa0ec622fb3b21c06ef8809d7327c437bc241fd8e28c856ce1ce467d4a7b10e814b8e32d7e2ec722eea940
SSDEEP 384:qucAXYfja83uFBBQ1GkSAeFTMO4TLS77DNspUM:+foFBBlqiOUM
TLSH
T10414D96F5B313721CD7C41F268EF6897A86DF42F8B43A6D678A14260DEE2513A10C4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 929e21088c5113a3d25fa7c91acad999fc3dfed6e76c843aca1337060b46214a
MD5 4133aa9d170c9f10fa3dee81def8d5c1
SHA1 0a0450474e68173c3a5997ade71d305e6abf0147
SHA512 71aa86cc29dee737bf797245ac725e2b3588c7ac682be1baa41b95abc6ea284b1b0862d9d39b2b84fda7ee7d43d545182a77f154aa09a41422ae79a056afaa64
TLSH
T120319DF3264AD465EB2AE8F1353CFF1CF72B402D8DC0EAFAC1045D092A2947671469D8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 675f53dd4b4bfca17cdc7130a9fda36a19819d653a4c1e011e91f9144cb6d596
MD5 b71ff500898bf8d99c25dd0458a68067
SHA1 7b7bceff8843db6590923173de4c03fcc98aefe8
SHA512 15ce290ece8058511b348c58dbef05a66d5a0bc76e4e07398ce7929bebfabc67e52ffd16d1e5a2f0ec8a5fb5bc9d732defe1bddd078ae29fe0a5bdf23d053b79
TLSH
T1A4E026F856CDC1AFE76421AB9A3C670DE3F03606F7C9BE821B15E945B081004A383AC6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 40KB
SHA256 4022ac7d5ee2644d78e37cf07ce34e0749e5192e8b5c1547990622488623b15d
MD5 0980e627d9ebf8d1b381440dffff07fb
SHA1 7d051c3a3775bff7a021a9fd77cb9bda624c4c5e
SHA512 d8d90674683117c9e0a1ecd3891991226ac01dd4eb591d046b2cb14f5634a698c538c8d0a4552597510a6f043b35a57b346bb0d87da0d1b06974a614860ca517
SSDEEP 192:gLaSa/PvBTIQ1WZKsxvggyFSOuh+GXYJoKN7S/pcn8Eu:4vYBTh1sxvvysOuh+GXYjm/pc8E
TLSH
T1E0037D2D6A115800D39BE8B494AC9D2A380F90D29B83F5FB9046DDB16F34E8A36125F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 c5eeecfb9a75996c0a6d225a85147b6d2249c023adc9786cf8e58c01d717c04f
MD5 249d2f48314cd96e24ecfca134b54158
SHA1 b14ecffa7f0530de3bef41dcf2967cd071b8d6c4
SHA512 e1d466fb50c8ee0e728771923483554a98a93652a5c029c9cfc7a30e28c0abd60d0c32cdbc3c270281790f57d4764c9dc94b055c82e1e6c6bc2cc641ee4de382
SSDEEP 192:D160nCkTvhZNnde/r/aij6zZ4I62HokEohvNIvrkB6EA8TfI7Jv0V:D1/nCkTvhZNnde/r/aiGzZ4I62HokEoB
TLSH
T1C202AEF7C3D9866DC91216F0A728BE2BCE1D0915432C3D6688E4FF5B93E1471D242A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 5eac58ad5b81a6a638d159aa9545fb980fb1b8dcaa1528580ba7927d660b7c54
MD5 6c998526e3072d67fc97715174130372
SHA1 d080206763571d8bb12407e2178e946f4edc51f0
SHA512 8017881e429ad1cec36f5029006d35bba291261c46f2b824a01e6e5f93541ab4db7a2df1faadbbea5b52a7f2f7b8455334f69f455ac73afc30310d51f8bbe686
SSDEEP 192:D160nCkTvhZNnde/r/aij6zZ4I62HokUhvNIvrkB6EA8TfLv0SIox:D1/nCkTvhZNnde/r/aiGzZ4I62HokUhD
TLSH
T1F502AEF7C3E9866DC91216F0A728BE2BCE1D0915432C3D6688E4FF5B93E1471D242A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 4767b944aaa9770f3232fcb82593f3c4ecbca984dce3ad98e15af430edf89f36
MD5 74395dacee1731b69bc2eadf757bb875
SHA1 5579b85872864373649b4e5ad99057ad3f970950
SHA512 c11b32a7f04503c661cd0a91c387417037d0d33fc1b9505566fd69af0769fe3dbeabf53e9ae7f98880c9ba5111746cb69c5ef44f90649ed05efcf1186b52a18b
TLSH
T161D0A963260660F4A5EC7EAA806EEC8FC326152188429D9894D079A82A228A90A07446
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1024B
SHA256 c60e32cdabbc807342a1b9f50f60fec623c94f735052c5661c14777e6c7c9fc7
MD5 3d2e2152ed9dc041f12f666f47287305
SHA1 4200b5cf2d78ada57166551f8c7a5bd30b3e8b5f
SHA512 55f285fda3574c5e362f5939c90f36de0f6b637daa6748a5cc24650894cb699169e5f11a574616e450694c1529a99f9dcffb7c1ee64f084923a739494ceb2e72
TLSH
T16511C2E7C57FB8671079597F2E55B8065535A936109068F4E9A3D16CF0415FF0F05832
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 9e35f7e9cf37498490106e41d17833930267dfbffaadb23a23e2fd4c28ce221a
MD5 d3331aeb6a5a711e1004e3aa92e18f17
SHA1 74d0158c0942d613d86f4537c2704b70182ac1ff
SHA512 d903bab78ae0c200ff9b3bc00f9305a3f9b2180988632d933e10d5eb19ae87d9ba6209dc5d1ff3c18b35ff6fcc9b05eb35bb2db7ac85ed9737499f47ecfc521a
SSDEEP 384:sxZRiomW3/fXsGWvC20Ly8FFb/bCnksXeLrZT1EmEL:sZJmW3/f1YC20x/bCn/k9TCL
TLSH
T1A4920852A53499B78CDBD619FA24BF27D3F51423C9804E885AFCC91C00EB6FD620785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 1b1a261a75f85e2413591f6fb83d6f0dd18dec2dee85709846bdc481331b9742
MD5 6797b577b97abfe773868d2bd43e19f1
SHA1 e5f3c7a1e3895b46c5fa943dd7e646fd92ac7880
SHA512 816dc0d4941d894e927abad550d595488b1633c4f12e2db14c6420dd1d76b2353fe1b1b7378eaf7cb77929fab824c365fea1d3ba13fd9a430332f2057321396b
SSDEEP 384:sxZRiEmz3/fXs8Nn60Ly8GFr/bZ/SWpj+L:sZPmz3/fX60q/bdSzL
TLSH
T19982E6169624D9778CCBD609FA657F13D7F904238A514E889AFCCA1C04EB6FD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 416aba461f15f5f44d526198d8b1980244b0eebee2bb0775c75d732b2bdd5fa0
MD5 b73711a3bc3836547589a6c8c42d0fbc
SHA1 33dc6f0055e3b0153af6d8dd0c593b0443d4e82a
SHA512 5b8e54ed753542db61b526eb5757c374aa6b311eca4ff51f5f583d126f9c6bdf80b07571c58ad06719cce4378ca1688993a2286b5d697dabb185912562b8eb7d
SSDEEP 768:ciWKy8Eq2Da7pLuLzydWRm5rQg78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3b3pQLlL:ciWKy8Eq2DyEzydWRm5rQg7u1jaKb3pQ
TLSH
T1D8031B3B680CCB7E4F805E9CED266F9A6DE8018B66D8895447FA840C03C76EF551B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 d9511cf79a49c8b69352bd98d14910a7878162c34d96bf9097134580314d3add
MD5 662a5d42d927304b083439154e2c6990
SHA1 81e588b32432ff6f2414f96374b1cd2f35dbffac
SHA512 bd6268884aff2909060f4572653b22cb8bba76ed77e2e64867e8ed28dae967e281725a182cb9cc206d8aa0a835f02c985af5db2c174f8604992597b01195d6b0
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3x3pQLle:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKx3ph
TLSH
T1B8030B3B680CCB7E4F804E9CED266F9A6EE8018B6698895447FA844C03C76EF55174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 ee1d864ccb87a2db2cb8145eab2098d42a919cf2e15a4c94d5f3ea0248c25a69
MD5 3ddd004ddace7d31fe94c5163d92a353
SHA1 0b4b7268876d1d6a41ab0166f390cb4e53838ea3
SHA512 f8cbce448326540b58cc1ca7e2991b2648ee466eb17ff30861cfe152a8ab814248cbe49706bc5568082388fca55c8eb9e5536e01fd9dcfb23a4b5f80ed009280
TLSH
T19FE07DF4DEC8C1FD606620470624870DA3E4B507E3CCFD022F42F84465C2504F1A3590
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 184B
SHA256 bf3bd7c2907c8b56082ab171eb21b87fc67ef577b6a4c1b73d3156ddac69b2b6
MD5 e9a7b574f36da5aec134a0a1a7ddd63c
SHA1 5ecb130336d536ae2809d7698c48e2c53394c13f
SHA512 86e4e845dd1da33527a490a855aa67282a7fc295530a9bc4874c04f0a07e9602514026c5a45003cec2438cbd5eb59f8c6946938dce29af95324af81fe4a172b9
TLSH
T1E8C08C10739C2B32D44F69321766E7096B20D04A0920843BC9ACAB140D4BDD7AF036E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 b4bdaddd3ae88ae79e4935b9a06de91439251e2dbcd9b08709383608a557ef37
MD5 e7d0a8e6e1f31d4a5619a9fabbb4805e
SHA1 0e53c0c6cae1101dd93b3976a1e13f8902352431
SHA512 d53057fbb74bfa80dcbc75ca56754257afec7eebbe204ad7ff5d7f4df021731a384ee3d391d49dadd4e89049f289ec8b944db83b1676e870efea696c87b6d984
TLSH
T195E020F86FC9C76F619531875228D30DD1E27542D7C8ED212F19F445E246140B253540
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 98db6462b3fc0e8db02357ff81c970934602d103db627b0f72dfbac28d717dc5
MD5 b0075d6bcc8ebfe7de083b2a75e8a475
SHA1 3df4da2861dd7b6921428b7514b7574b5853a167
SHA512 2ec6e1e4f69e34a25155179581aa35c0ac418eb25a79c11b44f65b60d42791f83d8fa0fe023ece1bc0a21a41fc9a673658c76cd6b52337d0d7852bd4215988a2
TLSH
T139E07DF49BC8C2B956D2608742649B0FB2F07D07D3C8BE0A670CF444F102100F2A69C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 662335667b169a5b91c790f3b7b5fc23e39bbe47e17709354ee78a7d97025707
MD5 b4cd9cd9a43f639199fa5d32b2d7aa48
SHA1 c9423b1de5fd9f0c1ae3b30e1769799dfa16b61e
SHA512 6f2be88b89163a4328636b46ff9459a276e38ac37a0241e5e3ae425b2ad6fd2d91af16eeea4190a3b44ee0baa3d8a227893b4cc6d4d26487ee3e77cae208c0da
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7Svh:AFBHhTofhno2mB21q3Llbfe3sLDdeEpG
TLSH
T169B28E56717B12023C3E290CA6A19B370E8272A3355CA56F77B800BA4E67E615DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 7a663fe2b4771bd4c92f2405a9ed4971283124c78131868fb899e701788a0dfa
MD5 4b6d276a9e35f3ab5c526e13426ecfd5
SHA1 5c9f783ea9de217bed7c19b2340ba2f1a1344ba9
SHA512 1f6cdeec44118f0770752ca2364d5de0ec2286549d3017db8f82643f2ab0d2565feb8676a253eb87982df27b5955ea6c983fc8edc3686a7198c5f79c19d00ff0
SSDEEP 192:FvoOtQVAZfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:axqZfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T15A24840A7B747001DDE7E9725CB080771A3CB16ECF22A6915DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\81a27fb1-7e53-484a-84fd-4be6a4d70959\index-dir\the-real-index
Size 72B
SHA256 a49b9c5d252451a6e32a2dffc47cc9d03aafb30b3d0d086ae08c24a2fdd8280b
MD5 6c2446d796e1b61608af9478dac3fa40
SHA1 11c241e7a6f2e5d77aa0d3b0b550e113179ff682
SHA512 6b9d437de717d8c35bce9df667d3400a12bdf0ea6327518718134d53f99a13912f671f815d9b72d41147d4ba7b46d50553f396c5c003d0b8d21e621771af1265
TLSH
T1A8A0023816645701F8715376364701A177314D14FD05024785E075C5D8A69AA414757C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599acf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\81a27fb1-7e53-484a-84fd-4be6a4d70959\index-dir\the-real-index~RFe599acf.TMP
Size 48B
SHA256 103850f16a42e839e614a9d1ee4985932d4d5af9bc2d8e9ba75fb511f05696d1
MD5 d1b9d388195bad24538c555923a50cea
SHA1 9d6d26911768fb8484fd8d44ccfdb4c43855b0fd
SHA512 d9c95418566dba1a69e9472d2fa435768e47b6beb8a773a8141febdefaa0d9c1c70a543ef55896d06280c65a9396876357051c92b637c712d7cbce2c2d604792
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 76B
SHA256 a8abee0819bf24e864eac083da1fe416c6f4734f0bd1e3acf9194d7b69f1eb18
MD5 dce0ea7d7ea8731f420d844ed22f4e4a
SHA1 fa54059ef3b6b8d2000c1dd5752f8245f17aac04
SHA512 05be3be12b674b246ca6af9158520491efa3fffe4d7b7c6fcdf91bd7fd0ed104d5dad351f23d526852a235ca9f48ad99e23f3cd9d21d5ced31299dd7e48e5f79
TLSH
T104A001B7090480AB4F30A8E8602DB21DF44B919C8CC0CDF4840885422128A72100295C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 157B
SHA256 a84b5f123052ec9644070e310c2fca8d64c12ac2fa8ad5d3a9b69d789a5f8112
MD5 faab3629fb6accfcb1d6de7cbdf558a7
SHA1 857bfd60844673012e7e2242b70955cb49cbee20
SHA512 7656bf0f00d78dde50055b0e38a98ab72c45543a443e70acc2f8df22e1f390214aae032a8b8de0b181681f68167cfeab9a670cb2cf43799dc2f8a14196e6a7f9
TLSH
T171C08CE30860405B8B7095C82038B24CE02B6C1E8CC0CDF4900C71023234A734C00A6C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 151B
SHA256 0313b7dd150bc4365fee6cdb5ef50775ab06d000554a534d7febfcb954850bae
MD5 4a1d664fecbdfd489d7f93f7b8638504
SHA1 802a2d3b6e064f59fe02ca7bbdf4085b4f3b6d6b
SHA512 1ff2ff7e8430c49261219c743c8f2404b93bc2ae2d0f65a1149d2c9434b3f7ca0686f3faee504f67be51dc689b2789325bb6d292cc8c461de9bac7b8d716d0b6
TLSH
T16FC08CA308A0809B8E70D6CC202CB25CE02B610E8CC0CCF4900840422234AB20C01A6C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe594433.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe594433.TMP
Size 160B
SHA256 329dad3791b8282a9cd70bc04f3c0d8c04a469a16a8e94298b265298c5282aa1
MD5 64b6c049ff2a00e6a7d88c086957a53b
SHA1 7cb687940ac89aadb79442cb82e1d4cec88b6ff0
SHA512 ff929e5b7b73fa910e6660ba44c35e4dac8c7a8e3ca27410d77e6028981d97ae5ef4f93fa77be419b132f507d389de37a7a490ed7ec917bcfce498c3b8d05f1f
TLSH
T196C08CA30730E2670F3094DCA02DB05CF0077C0DACC5C8E48509B042B078672910A659
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

c79baa68-f365-41ba-b907-8719c97cd10b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c79baa68-f365-41ba-b907-8719c97cd10b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 15KB
SHA256 4285ae4656a75d066e996ac31e9130046ce6b20eb89d23c300f5c27c99f4f00b
MD5 282cadbb066b464b20cae9523f68b5f7
SHA1 1cfaf0ba93fe401a85ba04fd17742665a3f2c269
SHA512 1b01bd1640db2e8bdce45766d8b9c4606f70469b399e698e15c09df01243359fa7a68f51be7dd6b5391cb1efbedf0cc3e0668222a179876389e62d3f7870fad9
SSDEEP 384:GWHsoCsLoQ1IIIcbsMIM6Bu1HJwDKjzKjw:VMobLoQ51HOi9
TLSH
T15672B76A67110F33C5AE3FF753A98B8427D5FC054562626D70A1288F8CF2E6786D42F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 630a9ca32f5a386da7535ed53838f48d3f47a54a807341b303c1bfa85736c400
MD5 b904690913931b9746eefdd6441cb444
SHA1 0e199941f2c611224be40e0598ef83e8278d6414
SHA512 fdff9880cc8c0fcf0359d69dd44b275e79997cad8bb20123d3ba33f7b5a1a24c33060ba71a09a7f239a839e9cbc93677b71ea1861f776c0d61d5733aa3cdbc45
TLSH
T1DAE07DF4BAC8C3EFF4B420C711384309F3C43A43FBCCAD061F01C489A445100B68A581
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 b33f3980d7e7256bfc30282199334f65973e35c278a77b4961f8d6ef39c85e12
MD5 5c4438d5292f6bcbc081f84872f05bed
SHA1 594744dcabccb6c019ed0e458111ba762184e9cf
SHA512 43c83522308a2e085d7d257326bd3d7709e89a5bf75b0eef73f4c16183b53889b07e0c314110d02188d240694bb098cdbd0aef981f2dd0fc0872158ca240cb0c
TLSH
T1C5216056F320C159E14E863DA02ADB291778E8169FBCEC0F55B924352D71F041E8B7F5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 8fbef9af22f3abf8ed86d1dc7ff3b4af4dfc44ea32d56dbf0501b176b441d432
MD5 9e37c23d48f22bdbf5dd489fe0b68abb
SHA1 80d013d241d6446bf92a23b060d070da6ac1336b
SHA512 c3bc942405dca205335783c03d27e5d6e8e4ef2b62df5bd9db4a22a533f122178c0d5bee175effee754ab0685d5054c150bc6b0de4fc51df56c584f874952a25
TLSH
T169E026E4B9C8C2EFF0B020C311788349F3D53983FBCCAE061F01CC89A945241B68A581
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 033b07c3c7b6141c310e6131d4c06a945bae503220f6e9811bbab5b60e62ff61
MD5 63bf37a0d2e9bad48113fbd7d5af01c9
SHA1 2cf48911298a11aa657275cb523d8637ac72108d
SHA512 c9ba95b7aeb9bcf5b35a7aa1fba502a1a2fcb208dc082bdc9f530e695df790c762695018ab0c2d1a9f5703426cbb89bc4b196a79585ee16445ca43714f0d661a
SSDEEP 3:MsEllllkEthXllkl2zE4eI:/M/xT02z3eI
TLSH
T1FA4404047FC04507C50410354151C3D0437CF431055157C734D144337CC7D740C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 af6ec4f50e5e2a9d1ebf49aab35bf69508651df14140df36802c28a2a212c61f
MD5 2316d21cdf555831aa1babb595c69e08
SHA1 e821483345de7dbb5776094485bcadcaa48fac56
SHA512 42942786eb5b2633df95fa753984f9bc24c2ebbf3631693c6a0adfb3be09c3f40bdf7aec775c6697ed6b14e6ae07d1e1c6d824a57021162d94687eb4e5793215
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
TLSH
T11F4404047FD00D15C50414754051C3D04370F411055157DF3CD144337CCD57C0C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 8021b8e104110b7eeb3b072bf2d8857211057a1304c36d041beed3158c2f3811
MD5 a84d529c8198e2c71710f45f491c28e6
SHA1 d4bea215f3eb673aa43e85eb3f42f99310899ad8
SHA512 6ce5c0be4d6861bcb512a8d1394f503ab1730faf83ac7a443a4eea6618500d4f703fa608b3c9898d9b0dda3fc41d2032d2ce2f4f43aded1cd24035bd94d31583
SSDEEP 384:nfiFPZcIZ38N/8TUNTUlIRTyhKAuP2jGfbwocWK1RbGnI5Hy/7Igpo3:qFHZ3UwgIUGocW1nIOQ
TLSH
T1C4E291F198D789B6D8AE4B87A73D6E069EFCC153B5884984B7C41D1CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 f3465aafe6f94dcec33747d138174571f650442920cc54ef96d0f67c0880e97c
MD5 0c1aec4248f21b381cf89e02fa4b2974
SHA1 350a2c2b98d88b5f1430f59d1c2e75e302c87e39
SHA512 6750141bc8a4c66221450dca922588d2676ef50e545265a152195447fc7ed5381a89f8f724361536ec2485744c16c135ea95cdcff0040f298767a772874ffe55
SSDEEP 384:nfiF5MZcIL8N/8TUNTUlIRTy2KmuP2jGfbwocWK1RbGYvQVS7g/sMQVFf48grcgT:qF5aLUwglUGocW1CeSNMQVFf48grcMOQ
TLSH
T199035CF198D29DB6D49D9BC7533DAD02A9BCC023B5488988B7E42D2CEC4B5BFC306855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 dcfb18f910ff42734d413121893ab01c188a58cfd457f92c855c2f993d4ed2ae
MD5 a6889a40c2d06439159eca3fef106594
SHA1 247f5af746ff971f7c65b820567445e1152566c1
SHA512 af862f82cd95c71b7b2ef88dea84d6f5dfdb3d6b835417524a595051eb55aafa1e878f7dcc11a9d5d2e6f0c155a6d533139cc1fac8335ef10a0eebdfb05eadc5
SSDEEP 384:nfiF5MZcIL8N/8TUNTUlIRTy2K9uP2jGfbwocWK1RbGYvQVS7g/sMQVFf48grcgT:qF5aLUwgmUGocW1CeSNMQVFf48grcMOQ
TLSH
T1D8035DF198D29DB6D49D9BC7533DAD02A9BCC023B5488988B7E42D2CEC4B5BFC306855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9b34cc2be0ff298e010a55a362ad11c03eec2cff27710047484ffe17091bdc16
MD5 ed0b83a38abedf79b020e255568199e9
SHA1 de67394aced5267853be234501fd6abd8b0bcc66
SHA512 e595f527d0055be7b69fbcbdeabfbccac6252080213747e9a1c4c4026fc0db00bc941c06a8902b2300168ab674d763ac9a3a8889bf48ce5769211f2ed685e588
SSDEEP 384:n5riF9CcmyWCs38NV8TUNTUlIxBydvIoRajGfbwocWK1RfnIhkP+lFYS/5xHy/79:4Fccps3iwgp0iocW8nIhkoFYS/C
TLSH
T1ACB25B31EC98CAFBECE64FD9E74E7A07EEE0116385889AD4DAD80D1D009B19D1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 29027161aee51083ef85d760573ed8c4976f586df5457a2e42d65fb53649ed90
MD5 d4562df8ea603777ae7a65aacc703bc2
SHA1 01ad0005bb7e63ef51743ac0538b812573879b03
SHA512 777d203999627cde3144177d0b929c1e20e27e71ab592e155206baf65dd524e65c3f4b68777e0f95b0cf1ade8e19143a860f47168571c0df70d10d71ddd73b8b
SSDEEP 384:nSiFiZcI538N/8TUNTUlIR/ylKAuP2jGfbwocWK1RbtnI5Hy/7Igpo3:ZFQ53UwgsUGocWwnIOQ
TLSH
T1E7C23932DC64DABBECF79EC9E74A7607DEE41163858C8AC4C9D85D1D008769D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 49a0da026d117200c17d4a6736d7af0043cdb8140c1a309543ca8241d35710ba
MD5 46b8a91f8a880f16b5d4af57af273a57
SHA1 5a9b9c3f70ebfcbf614d16d9b59338b32efbf9fe
SHA512 9c6223b162d3d2abff09a8bd6a68c9f39f1b35e5efcc671b4c30a5687820cb116aa5393c8814b5568d4a900c0a6fb3dceb1e415bea93a5a1b60baa2c39444da3
SSDEEP 384:n5xiF9CcmyWCz38N/8TUNTUlIRwyxKRuujGfbwocWK1RbtnI5Hy/7Igk:GFccpz3UwgWfocWwnI5
TLSH
T148B23A31EC68DAB7ECE75ED9F74A7607DEE01163868C8AD8CAD91D1C008719D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0396488f00316479b13d81398fe9ff65c548312afbdf4fc0437a914852923f0d
MD5 373756a76d7ce3cfd48d985f365aa2ef
SHA1 b73b375a17c392497f60777e46c761ba1bb44fbf
SHA512 136f29b66e24b5a8c0a609cf47d27c000517a6a3819e40825db7ede8c9a32ccee89603b172ab133f94f4eaef5a978b62f763f96c4161b1f7d2395a93d3c942d3
SSDEEP 384:nfiFiZcIQ38N/8TUNTUlIR/yXKAuP2jGfbwocWK1RbJnI5Hy/7Igpo3:qFQQ3UwgiUGocWQnIOQ
TLSH
T193C23A32EC64DABBECF79EC9E74A7A07DEE41163858C8AC4D9D85D1D008729D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8ff32f8efee9b472aa6cfbc26c23fbffd8978df5418a8f39c7ff2337d7392798
MD5 4560d6e1a7eb4b998a613d42d909d890
SHA1 99c2c44e996117f47a14c88de4f68b9ee835d697
SHA512 ffa26d12805607e9f23d7bcbb9bea0252ada9be53629e2813f0c6b6900b2b883a1efe980cb44bd6201ab0556ed11cd4daeac01f856456ba6780e1fe2d59e6bf1
SSDEEP 384:n53iF9CcmyWCs38Nz8TUNTUlIxBydwlAjGfbwocWK1RbAnIhkP+lFYS/5xHy/7I8:IFccps3kwgbIocWTnIhkoFYS/C
TLSH
T1B5C25B31EC98CABBECE64FD9E74E7A07EEE0116385885AD4DAC81D1D00CB29D5747C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 5ac0839a4a94744419fa5db24f28f34d21533ad7723b73b2ce061ed2aa7e4a7b
MD5 11ad24b34699ca095f168487fef396df
SHA1 06b49b6c195e5114c6f647668b25b1d7eede64d2
SHA512 6fcdaedeb54d1ff149ef4b6685555f3b791d20f53bef5d0c0d22f6a1f84f069cd9f9bc546689e3df0f26cdf18cce3ee8e7a19eb5dc201c6b12d7c3d53383907e
SSDEEP 24:TL85UOl0afDdWec9sJ9dBCdUjFq7QB5fc:Tg5UUDbg3KBfjFq7Oc
TLSH
T19292DF627D312023D89A4B36FC8349910EFD136F89A7744489904DA119B2BC1B6955FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ed99c637176d33f3ccdeb2ff91f58bd9025abaf2855c46c3c7c37776539ffd4a
MD5 b6619742d060e311bbe36e89b42dc413
SHA1 91d237cf7109ff543593e522b5073c535cacebd4
SHA512 8e59fb8ff71d41a1ae0299281fe755d5ef706d6972a4b35e1757c41e9d51369883794beb93c084e39dd5d280e2617966777a2c354415b754f3651cc6024043df
TLSH
T1DFE00201E34404EFC438033805D3173435F1845043F352D6551005753C173806F30AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5956f0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5956f0.TMP
Size 392B
SHA256 8240be8a8e0de63faa8a9ef0d0cdb299d9d4a40137c7915cb529cd696988caf8
MD5 3e7bd048b23063d18f54ac53fbdfea72
SHA1 b1c37d149ca94e5bb95b50c4043d5d6002ae9f39
SHA512 82bc77e0cb51f1a1855cd10056f73c273bd3ad42436618b4112d9accd79b2824c671cad0e7da4b22f25f78ca13e3c6b35527c9144bff6f61ec541529cff9c346
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 6b1320e77d2f5ebda4156184c60267ac137fcbfb2de172e1be523fa594a246a4
MD5 dff356317db4f17f623c8e7ee777d089
SHA1 fa8d0754ef80d8130a0cf113af2507ad15fd95bb
SHA512 46af76a5771aba8626182a70829feb4ed7901721c8d7f616d8320b28ba73a49bf04312166fb145b2b339850e430b9ad9b00722de8a8996f3995c532da5f5dc73
SSDEEP 3:MsEllllkEthXllkl2zEro:/M/xT02z
TLSH
T1F14404047FC00505F54510354051C7D00371F413075157CF34D114337CC57740D10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

jitter_2702.zip

Path C:\Users\Admin\Downloads\jitter_2702.zip
Size 3.2MB
SHA256 a266d9f6158bf6900797ab0d9670ede567574e47fa70f7a6c008658d1ab47894
MD5 c7c02080ddf276a873338a6dd6da80df
SHA1 f4c330c45e3273b5673b23a07746dcecae4a98b5
SHA512 c3ba43c906ea02515280c326cd35b01dc7e243020af99e9b642aa38ddcc49768673904653ca1fe1f5b6ef1dfad806d1da011549ad46198683d7f4b3ecf7d98db
SSDEEP 98304:P87FYq/9X6ZipPDySOj/OD3CCSa84P+9YmKDOK1ddp++ovxfN:E7FYqR6ZaLw/OEf42amKqK1Hon
TLSH
T1B3F5332D685EA2CDF1D8F08499DD19D6EF908A295D2B9BC1BBC4B84813E31BC7F911C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jitter_2702.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\jitter_2702.zip:Zone.Identifier
Size 117B
SHA256 744892623032a00a881350302be454aef968187c42ebb44f8cace7580494ef67
MD5 713631934bc920a52006b0c0a445afcc
SHA1 a41d660be1c8269695744c5c14dd9894453e5838
SHA512 b395b8b53a650a8d9c3a5d99d036bcf7e55de1b0d8c40d2795b4eba0ad445e9aff5fb0d8bc40993b81d4f9c688fa6d171286ea3729f4e8cb5cab50b69f277f85
TLSH
T168B092AB854485200B6032D462AFE08DB90B21280860C2D0D808098BF8400A9C5D564B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3188-1285-0x0000023EB0100000-0x0000023EB1100000-memory.dmp

Download

memory/5540-423-0x00000253944E0000-0x00000253954E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads