9dabc0df6831f8934ca96c7d89bc2e6427b7e5aaf5987653c742bb252defc7ba

Resubmissions

08/09/2026, 17:46

260908-wccdbafp3v4

08/09/2026, 17:42

260908-wah33sha544

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DEMANDA CONTENCIOSO-ADMINISTRATIVA EXPROPIACIÓN ADMINISTRATIVA conciliación extrajudicial no ac.msg
Size 110KB
Sample260908-wah33sha54
SHA256 9dabc0df6831f8934ca96c7d89bc2e6427b7e5aaf5987653c742bb252defc7ba
MD5 20f22007354707246907fbf89e0d0275
SHA1 0ec873761d414eb81744f054c1cb2026946d2351
SHA512 67c868758de11dd00bfb36b144269a4830daa0e30441e417b960e22ef0723736ea74785596726ad438a9ad1149c3d8cb74b7cb234afe9d6a5b135e2ba918ac26
SSDEEP 3072:ciJihql3nsx3mh+RJnCV9Wd3jLJoiF5/:Uql3nsRJfC/hiFt
TLSH
T1CDB333243AFA1119F2B3AF3689E250978937BD626D35894F2195330E0773E41DD62B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_26061157\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_1689263211\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_1689263211\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2020	msedge.exe
1184	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333630571201651"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{C76D2F2F-6434-4A10-B0DB-FAD237D9D832}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{8A0B21C4-FADB-407F-9D15-A0ABB5C3C90E}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
3668	msedge.exe
3668	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4836	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
1820	msedge.exe
1820	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4836	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE
4836	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 1820	4836	OUTLOOK.EXE	90
PID 1820 wrote to memory of 1140	1820	msedge.exe	91
PID 1820 wrote to memory of 2764	1820	msedge.exe	92
PID 1820 wrote to memory of 2020	1820	msedge.exe	93
PID 1820 wrote to memory of 2764	1820	msedge.exe	92
PID 1820 wrote to memory of 2764	1820	msedge.exe	92
PID 1820 wrote to memory of 3828	1820	msedge.exe	94
PID 1820 wrote to memory of 3828	1820	msedge.exe	94
PID 1820 wrote to memory of 2956	1820	msedge.exe	95
PID 1820 wrote to memory of 2956	1820	msedge.exe	95
PID 1820 wrote to memory of 2956	1820	msedge.exe	95
PID 1820 wrote to memory of 2556	1820	msedge.exe	96
PID 1820 wrote to memory of 2556	1820	msedge.exe	96
PID 1820 wrote to memory of 2556	1820	msedge.exe	96
PID 1820 wrote to memory of 1500	1820	msedge.exe	98
PID 1820 wrote to memory of 2484	1820	msedge.exe	99
PID 1820 wrote to memory of 1500	1820	msedge.exe	98
PID 1820 wrote to memory of 1500	1820	msedge.exe	98
PID 1820 wrote to memory of 2484	1820	msedge.exe	99
PID 1820 wrote to memory of 2484	1820	msedge.exe	99
PID 1820 wrote to memory of 6116	1820	msedge.exe	101
PID 1820 wrote to memory of 6116	1820	msedge.exe	101
PID 1820 wrote to memory of 5628	1820	msedge.exe	102
PID 1820 wrote to memory of 5628	1820	msedge.exe	102
PID 1820 wrote to memory of 5628	1820	msedge.exe	102
PID 1820 wrote to memory of 1284	1820	msedge.exe	103
PID 1820 wrote to memory of 2496	1820	msedge.exe	104
PID 1820 wrote to memory of 1284	1820	msedge.exe	103
PID 1820 wrote to memory of 2496	1820	msedge.exe	104
PID 1820 wrote to memory of 4868	1820	msedge.exe	106
PID 1820 wrote to memory of 1864	1820	msedge.exe	107
PID 1820 wrote to memory of 1864	1820	msedge.exe	107
PID 1820 wrote to memory of 4892	1820	msedge.exe	110
PID 1820 wrote to memory of 4892	1820	msedge.exe	110
PID 1820 wrote to memory of 3668	1820	msedge.exe	112
PID 3668 wrote to memory of 4552	3668	msedge.exe	113
PID 3668 wrote to memory of 2360	3668	msedge.exe	115
PID 3668 wrote to memory of 1184	3668	msedge.exe	116
PID 3668 wrote to memory of 2360	3668	msedge.exe	115
PID 3668 wrote to memory of 2360	3668	msedge.exe	115
PID 3668 wrote to memory of 4300	3668	msedge.exe	117
PID 3668 wrote to memory of 4300	3668	msedge.exe	117
PID 3668 wrote to memory of 956	3668	msedge.exe	119
PID 3668 wrote to memory of 4532	3668	msedge.exe	120
PID 3668 wrote to memory of 960	3668	msedge.exe	121
PID 3668 wrote to memory of 4876	3668	msedge.exe	122
PID 3668 wrote to memory of 3616	3668	msedge.exe	125
PID 3668 wrote to memory of 3616	3668	msedge.exe	125
PID 3668 wrote to memory of 916	3668	msedge.exe	126
PID 3668 wrote to memory of 916	3668	msedge.exe	126

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\Admin\AppData\Local\Temp\DEMANDA CONTENCIOSO-ADMINISTRATIVA EXPROPIACIÓN ADMINISTRATIVA conciliación extrajudicial no ac.msg"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://smtxukkkuie9d7oe4oirgkopwd7ize0kt7oq1exocrsv9lbs1opfgoonk8e0d.flujodeamor.store/pezqby4cgwu7ob7o2d1xew/nuug2nj0scmveykz7zjmtdmahany/2mdace2k26t8ysozjif/xhxhvgfyfu9mqykg41d6dwwjqriq6ihitzfqj7l
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffc053fc188,0x7ffc053fc194,0x7ffc053fc1a0
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,2688233671623944883,10445938014768609539,262144 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
    3⤵
    PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1832,i,3785613532743514628,15810267510310660239,524288 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2228,i,8538008714028448966,10198584760769399028,524288 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:13
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,8941115468777668363,15656322280015401695,2097152 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
    3⤵
    PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3644,i,9914786447645104238,9104584084914292386,2097152 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,12585609780222079533,16435211578893506097,2097152 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,13203629204031646727,16199927780302173440,2097152 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:9
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5404,i,76945623042257473,17727040941093915911,524288 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5412,i,5975806471826609282,13794494263423617005,2097152 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5432,i,17376930319405723840,5546811159872703179,524288 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5448,i,2031459813357693293,10937119253064527542,524288 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6208,i,6196916657545623085,5687155932378375852,524288 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6208,i,6196916657545623085,5687155932378375852,524288 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6432,i,2421621181342779559,978201393619388219,524288 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
    3⤵
    PID:1864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6492,i,14312625054409550173,13531568540843080877,524288 --field-trial-handle=2380,i,14075640760867471472,9664296739978179851,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffc053fc188,0x7ffc053fc194,0x7ffc053fc1a0
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1908,i,2033189596411226240,6540519307965671985,262144 --field-trial-handle=2520,i,16290441045916456645,5437136284783699942,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:2
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,18271594746478290057,9434981984227577961,524288 --field-trial-handle=2520,i,16290441045916456645,5437136284783699942,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
      4⤵
      System Time Discovery
      PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,5105115524869874765,2979999578106325194,524288 --field-trial-handle=2520,i,16290441045916456645,5437136284783699942,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:13
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,17900634719761616601,13515924919403180004,524288 --field-trial-handle=2520,i,16290441045916456645,5437136284783699942,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,17900634719761616601,13515924919403180004,524288 --field-trial-handle=2520,i,16290441045916456645,5437136284783699942,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1372,i,1895177146765784576,17088247450876874941,524288 --field-trial-handle=2520,i,16290441045916456645,5437136284783699942,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:14
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1384,i,819987793986406060,3544461566916810545,524288 --field-trial-handle=2520,i,16290441045916456645,5437136284783699942,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,17388933147678199709,6877966622070587852,524288 --field-trial-handle=2520,i,16290441045916456645,5437136284783699942,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,10731260543704002544,1447923626117733171,524288 --field-trial-handle=2520,i,16290441045916456645,5437136284783699942,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,6868274297541115451,3039529945151508086,524288 --field-trial-handle=2520,i,16290441045916456645,5437136284783699942,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
      4⤵
      PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b27d5926cfe2be0df2c3ab0a124f348c5eb253e973fc38a3ca03eaadcf7cbef3
MD5 6563ca326dd50a243300796da9d50c31
SHA1 0d4d43573b95f9d9e1c65ad2f7c92f6b32990ced
SHA512 9deb1f97d55324c2ff327bb7db10c31b75b7273615d8da5bf9406145a33357de641f2ff564e30306b3b7170c1069a35d61484c42e78e5846e9636019c596dfd0
TLSH
T13FD0A76069E9F6E1E116153D8210021071996A92AA57620BA250451D9E3E1C356D94A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5c34ae4ef613057a35448e3e216f4b15c1e98fd7075d693b8e0ab6c299a113f6
MD5 ceb7fc35c7d4465a18fdf73456a93e97
SHA1 3bebe5078398621522619a8cd99b6a3d3a82ab4c
SHA512 7cfdc842fa39a72ec36ab62d2b4b870ac2438ba205cb855a9547449b2c9f692f0838bcf12b717ff1313f5f24415730ad9962d529c928ae6f3f480a30af2cecf5
TLSH
T147D0A7A0B7D8E660E60614389610432971AAAA50AD17662AB151114D6D2E59342DD066
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e9f84209ee27bd8f54b1a1cb033a9832838b1bb1fd9fde85a506338c72eb07d5
MD5 1d45e5e0d76a27d85b42c61360714604
SHA1 49dd94650d7e39de60a9f4b29e3f4ca111d87796
SHA512 836f5868fbfd84067fe98d56dba02f6003aff3115725db69b65d665d79d7533cff81c8fd1f7b1665776ecb71118f7f963c957293dc42d4ec245cb94be0f17bfa
TLSH
T103E0ABE9C825EC3718F8176C90C0CB41EB1003073A404E0B373C82198F7023655C5D1C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 dc7d00fe705434dbb34350a1a176265ef7a82bbdd0460151e20cb94e2ee54837
MD5 69780b7d7cab99d5dc63b75f77403ab4
SHA1 26fe555b9d4e3d18ac1eb5ed077462d8780fa700
SHA512 7e3b8e2f8d4f02f090044ff5a31a304eee1829e52115040cbbc4e91e25c05a80ff4820a5277ef66f55fa0051c09e9ec46f7f69e1b4d884c2d2dba7c27e78bafb
SSDEEP 384:M8x5mazOM+9wfU0vEsyzt8h/xQ2kQNNFapXfYLzqk:MK1zVYCcq/Q2jcdf2d
TLSH
T1D9133B7D37231C63EADB803D4257AB363F70DA28ECC0981F1B3AB12516213A7184F628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 bc31ec5a5c51b84ae4f812a06fcbeb166a71f88024ce2e1a3fa1d4a1435414d7
MD5 6d46d990f17d39ede63fb2fd0adf4a92
SHA1 0f547922e89b912375573df3c11e75d5c49af98f
SHA512 0399f87552361c53db278c324c6b4e6a583fba8d976ac38175c052cde024bb5364d29de3bea5b1aa9d3d674911e20aa32f4464f14cafd6fff5cd0ff032d4b077
SSDEEP 1536:I3L/7QL/omaHUndSxK1D7gJsXcyR2+RoRe:2L/UL/pawBlow
TLSH
T125443EF70911A01BCBA852F592033E3DDDBB455F3CD1E8E9E5784C952825B32B6BCA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 729aef768729c701d680e9d6dc481d730c5bb8857b1f28cb6ba6293fdc7facbc
MD5 752cb5aea195d08c23ad3dc8dce6ff1a
SHA1 3d8777b288b2bab726f0d262cd24b69f234b4d49
SHA512 dac2bcbb42d00aef4d4feefe5794ae89f736caeec5b78c1331084203e603e032472d36173e9f87d1bce64c8d8c070afb8afd9b96ae66c6399182f5c8eb053e9e
SSDEEP 1536:Li49G+PNaMuAN4q7e74717HJ72Wx7o7U77iH57C7v7rDz+Ij7fZ7Vj7f7Jj7o7a/:Lv9G+HN42FBiHK1pOL60MD5cIVw8r
TLSH
T1202528FEC7682C82CF6B867070E0E9077E712183B658D0D39944C5E997D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 4ec0ebd66a0c417e3a679746d370ef36f7517237a162ba62c24396a86e691bda
MD5 90fcf066ca6fe5106b4b4c68475b347b
SHA1 72e5b240969e4c07106ad9715b6892147ac5b159
SHA512 85c7b2542a573c20ddf5b15f44bb280068e749f649ea3670359801466591511da8da939625d89535675dd42368cd8190a1d0d0b53b3cdeb03bc71915515062a5
SSDEEP 24576:ZHAIZYfNbAojX3W7lBxKXxQeZtXQ4J9tsDECAf:ZgIyFb1jWDQXxlQ4ft6pAf
TLSH
T112168DEDCA785883CD63DA30B5F0E9477C7413C3F994C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 25c9ae3ac9c8d54597be2e5ff6a95b12d8120c6bf9f7ccff51a38d7a92f570aa
MD5 6823c78c54ad0a673e1edba438d314dd
SHA1 dcbf3d7e6fa0654cb3545199f7417b85a061201c
SHA512 e651b64d20ac04c2f22e073976232219e5630d76c63e471958eed4c992e22d57258d41328ff9b439e826e830fbcc99594591ee2bf96fc1feee6783d859016758
TLSH
T19D51BC86436379C3D77AA4B220E31C96BE7C844E06CF6FDF4811F0769A4B3A45050630
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ad841.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ad841.TMP
Size 2KB
SHA256 c5f419c9de637528a16539e812b9cd215fdd6db37f700600e2b1cb1ae33d3eae
MD5 3b3fde4b3485a9ea37aa5a91c6cb2837
SHA1 772c1af8bce5ef814b6bfb627da429cb507b4528
SHA512 99c12d1792f1f299dfb5e289d826ad7d5f4edec3a888a7bb4a71d70b4ec3923a13d665afb9435313c278dba57fbe9f7d17d8e599ec70bfd4044ae693a94e7ed9
TLSH
T17951ED87432379C3D77AA4B224E30C9ABEBC848E01CFAFDF4811B17A8E4B3946050230
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 46879372b172302b5487a136c6aaa003bb0830be29bcecfd9b8f0379ecddb971
MD5 88e61edf2c9557973bb5259fb366d0de
SHA1 7b4c7ad53eea6b3575ca694df5f2a56070ce3a36
SHA512 c87d929926f8989f084f7b0402dd6d452e04c4512bba86f9d1b8fc02b9e749ca77a21ecb5e975057bd0a1c96df9021f76b8c3e05aa71e30cc066c1619407cd6b
TLSH
T137E0C0D8B9E6C91D1C3034CB42F86F5A91E03952E6CD2E031716CCC03A82071B3C3152
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 6cd12a8fe182a0ab95bc79eee5e9de48cd26e4000cde8750336d7198e0c8639c
MD5 cdde50b738c0839a82358dc2e60407db
SHA1 39cfa3c2a7d17a854e174f23edfe19e3033a0d1b
SHA512 40e53c213b78071b6e8d729bb5d89513b16a36409a910b44029ec153c006ac1dde0e39a23c75a51718b57819334f59d7546f6daddcefe7311242cbdffd4235e9
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj2ZQN:TdD4jJ/0UC+lf5KY
TLSH
T11AE2A04C3E21F511C4ED733CA0D2C5D09EBC647C478DB67142386CA68D52AA2F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 7a1757e6f6e06c4caec1d1af057d0ea66de2e90fe27cb05e5736c737bd74659b
MD5 3b0e954f7c10a3807e0607e066793b07
SHA1 15c3bd732e67292254b81138e658dac27ca1c0bd
SHA512 d8efac323fa5f15aff1e0b13ab9406052e9f9d529ec1e0c37caa727a20eb355ebb735d697ccbfe62d7a73b3911cd86c6776d4be9232951438e7286c002ee590d
TLSH
T126E0262854ECCDB9992468A782BC670DC3D33D02AB8C3A07570A98847181349A387290
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 c0a963277a14ade612e2a1b725dfdec0a32eb9b27918a2747d379e95290426a2
MD5 da4f02fa8f41176dcc92914e0433bfd1
SHA1 3def2f750d1608f3baa5571f2f92277f14114d15
SHA512 54a52f9dad2508137938b1d7cf90bdd341c0de47fb60d8c3ae1b3dca79055fadb24f6fe22d792c19d7d38711929db101e0b4c95e36120416f2c1ba33fd2d42ba
SSDEEP 96:UBCxdBK5clOK5IepQRIadHetQUAEYOPA1Q:GadBK5clOK5PQRAtQUAlOPA1Q
TLSH
T126B21A9F3E743863DF9D0CBE312A5975DD7BE21C6E399C95342458225CFCA4150346AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 839c39614ac1245bef083eff7a222176897c864aec75d64b21d6f8e1c5d2bd5a
MD5 ade8bb05edfddf655d826d93ea5941c4
SHA1 e734aac787d40461702bd89363a254b3d73be12a
SHA512 1e380a01591d2aa0b57e2b32a8d4f8337ee0f36cf8e46fc8492cc93c1683b7076319611cb577805aa6e6617a2b4e95ac326e621479a51c9b5148de2632fe4e00
SSDEEP 192:SK53BXzH+bF+UI3iWGVoWN3qL/YK5iVVV63:SKlBjIkUI3ijVoWN3qL/YKYA
TLSH
T1DC24005F5F753712CDBD813668E744A35CADF03F8B1326CA686114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 43aefe70751e6e0249a64b7b13da064dbe5bc55d8e8f0305332f5641623c44e8
MD5 dc9cd432fddb4c330a7b9281cc82262e
SHA1 fb00692f3493329c4192a007f3c552c3199ad2b7
SHA512 5da480991b49d1cfb495cd3427a531b1bdae58f73a68fbab3f31ed4ccad7aca0a7a24d98bc66957f5a702daae1b36b46006d833a367ec387a7619a9920546c92
TLSH
T16911D86FDFE5C019768E90E43597353581ECB0BE3A8CB7E2BC450C0BEE9949D2A14A60
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 e8c8a84aff5fac594c6b1f7862e4c333901ce0b230fbba8b2319911dde762243
MD5 e66b79d14317e6fb10933d35962055b3
SHA1 f676ac9c99ab48d082b4024ec1883179fa11a9b4
SHA512 189ceab747f16d59b02b31a44cf8a4a6e15865325ac10a6d51bd88c91ec0d23cf2c4d0dd68e52c48b07618e452d52c93260ffff262478344f2a0302787fb6126
TLSH
T1F2E0D8619CEDC52D5A14219B527D7B0DD3E13A06DA8C6B021B05BA44B885204A3861E1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 90e136873e2d32ff72ddb8553d6140e622986ad57af1f98b2ca1fb2ea56fa69b
MD5 941a96c67d5de2193aa1187a3c78300c
SHA1 67b6d9cf36814fb1d9dfd3e1d3823d27b4885e3b
SHA512 b70ecff0c13ae2954f2160e25951c0d883da405eb7de17488f0663219c2754a953f697a1636314ca20bf86e40a1b7606256014316a47398a02ce61f0461b3704
SSDEEP 48:Txk/LopFMaty423w/a9NUuT7GwG77xzoHTWw/ifSwZNHNH9uPrsX6HNHBa6je:qDeMatha9UeCbfSY94rvBa6je
TLSH
T117B2875E1F303623C0F0863AEDE144561E7C011D93333ADAA64474B28EA2DEFF9064BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d3b25ab6e59fd9e77eb697fb2f65c973309c1f13c000af0748f7946e0e1adf1b
MD5 15046e42a46f350145b6099e43b99956
SHA1 61f59a8d7210821dc8cedcc194fd178e9a216b0f
SHA512 d73cc1e06aa0a2364dfacd8f0e9da1e36d0a4d6d204a1874fc1bffb1c3ace90b1ae26b90901ca9f811cccd6541770b6bca5fcba857c5bf07d7b97705fc64b1bc
TLSH
T1986189F783F4856DCA0196F4AB146F2BCE1D0615432C386A85D4AE2B93E3871E241A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 25760728c97bb5648f33f6fc3002fb1e37b92f1fe52400128b217ee55bf65ef8
MD5 1cd5957a71d1019dec328c6dfcaecf91
SHA1 a3b4df49497ce4e40b713dccd3c0deeeaf9987e7
SHA512 97cbdb676d67729941367fd2c5332eae933bd65c4a87bfe12fc75bd45b4f5773bd4da66e3f020e3df2182c61868f3533da46fff2481f6d91d62e2ca79435f9ee
TLSH
T18DF059E7ABFDB0A7107949BA1D547C45AAB9A43105006CF0DF5AC22CA090AF39F0A417
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bbdf3c2c26b35bb1e6a0a4605d5a7299fab66a8eeb2956789810e837b57a6875
MD5 39c9f3ebaf499f9c650aa7ba1c62e7a9
SHA1 0f67e267221c36c778e53dbfc3e67bb235e7951e
SHA512 9de47bd0ff4337610a03e11cc5c0dc6202d5a9215f20a2e7895abd20a2534439bdfc2606b20c9745e73284bef1f72036fdea38bd3574eb432b759e7f3036a051
SSDEEP 192:sxRwRsCJ/fEsBuWpVKcwGMzoA8pjdR4/g6+WNqmBbQ/Yg89eCYXgE9IgVHJ:sxRw9J/fEsAWvKcp9b4/5fG/2YhP
TLSH
T10842C9566928A93F9CC7D21DFB65BF53D2F9603271D06E48A6FC961C00EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d8e39a392ef96cfa9d99641c7ebb32cf2b3b4f99e962f7dd8a574208667b368d
MD5 3ee9da3c731a5cf593b22b0ce3672169
SHA1 63642f100d7dc83672f4b3f0a18c1d25500fb4c9
SHA512 427f3563b5c6c108c8667fda7b19670ff4f657e8c06a8e742080fffe15859abde7e70cbdc363160f5917b3e5f15ee9433e17f22787c9a7c0d6dfaf86350a3caa
SSDEEP 192:sxRwRsCJ/fEsFWpVcUwGGlhzoA8pjdR4/g6+WNqmBbQ/Yg89eCY4GE9IgVHJ:sxRw9J/fEsFWvcUpGlcb4/5fG/2ThP
TLSH
T18752C9566928A93F9CC7D21DBB55BF53D2F9603271D06E48A7FC9A1C00EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f1df7bc76f960cd77ba44dbed6e16aa6e710099832fcd539ba7b494baa7650b1
MD5 eae3418c91d379075902c9fd9d76e72b
SHA1 9dd23c4b43432ff4cdf84686e80d654beeb93457
SHA512 8cda54cf17dc282826d89fc6cf3bf999bdc33881639b95a69a2e2529f60a51ff4082c860f52ef34040f4cb378546783e091da73995693fa17dbe63445911a620
SSDEEP 192:sxRDRsCJ/fEsiWpVc5dwGGlhzoA8pjdR4/g6+WNqmBbQ/Yg99ICY4GE9IgvNSJ:sxRD9J/fEsiWvc5dpGlcb4/5fG/HTh1u
TLSH
T1CF52C856A928993F9CC7D21DBB55BF52D2F9603270D06E48A7FC9A1C00EB6DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a4dea32a864808410a149963aacb88f2f2368f7fcfe51bb17afde00fb5ffdc1d
MD5 0d61a92452999d0015e56a88275a5f4e
SHA1 93f2cf51aec79ecd51443fd756f497bd3cf2d23a
SHA512 2cd8b43c7637592cc33c3a574604c42255ec3e3583cfa3fe8570396f5b70e237016946dc55928a47208657aeafd3268d900cac153a2481f439f25440755228e8
SSDEEP 192:sxRDRsCJ/fEsiWpVcUwGGlhzoA8pjdR4/g6+WNqmBbQ/Yg89eCY4GE9IgVHJ:sxRD9J/fEsiWvcUpGlcb4/5fG/2ThP
TLSH
T1B352C956A928993F9CC6D21DBB55BF53D2F9603271D06E48A7FC9A1C00EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 720570c2deee48990e5b5f15df0a0d8f267924c386399c568a943875973a56db
MD5 877ec0b3a38057def8e3090aa41d46e7
SHA1 6d50566ef869ee555637aaa9b3df0996d084bba1
SHA512 a86c9b4b26461f0d3d1b7a1855b1f10bc1e99066addfe1a32691658ab9d00c18d3c2ad36a7bc398c22473eeb2987b6bbb85b3895e25b64df8b26e7b8ca6bcd80
SSDEEP 768:j26H1o7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVAlBVuwXro92e0Q:j26H1UE7MRWgs2f02u1jazlB4wEtD
TLSH
T1ACD2EA7B640DCABE4F800ADDEC197E9E6D6802CB9698CD8047FE951C03C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 d12560f5983a5e37ca42588668035f35ae2d4e9beb49934664eb22f1aa61b103
MD5 c05ca86b67415f4769af1c1ed85c1812
SHA1 869577cc8a7d2436d1e8f0508ac9ddcf4f3afe36
SHA512 dda4110c278e6107e524c2065d6b84b2dce32f89d7da1e8264234e4bbf4e61d6d047fa3cb22da51086ec7cdd4b18391fcf25f8188e7e28400ec3c4333905b866
TLSH
T149E0266525E8C97D7825249B06B8A70E83E5B90FFACC3E033F06DA4065C6725B297193
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 e84144484113170f8799b845a961992f6673d08963876269706faf708478c82a
MD5 00ade8174666e2c7a9567cbe1738fd9e
SHA1 995c30c3821993005cab07f8445335ab2e2378d0
SHA512 cf9c347f745685db280b6fbf557c0f373b13600245134e1f205bb5ba44e1954ddab92c7a89c2dab8df5df42c28c5cb86e0f3ba930866d8e9be7ed194ec9ecb68
TLSH
T10AA0027941C54814DC0641F1658111881A3858353D20D6576D90F59D9853040811312C
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\db
Size 44KB
SHA256 a6a1d977b36e879d2d321ca3d54109f5270c436ff821753b053ef78191b69190
MD5 7ee9319ab30e431c651de227a8321f75
SHA1 b72ff19660e5e669845fc11cf7d8adea46e17fed
SHA512 d478b612884131f64df420f95b3043eeed2a5a9842d8100a4949653e8fcdb96bf9197de87b83aa5196a95f9673010e5e7c1969c5e260594b34b66fe253b4ec4b
SSDEEP 24:TLxtk/9JhPaWMuz62ZeL1b3IeNSllviteteX4TDQeU6Uw9q8zPq8yzRfJhIv1MKf:T8Za31b3fEvTFULcqJzxXIO8Mv6eO
TLSH
T15B13FA9F2E54B481D2A98039E49A8FBF1E7F200C8F83ACD155A056B30CE242C192F17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 972ca4b397b4260a0686dc629a33880fc7119d9d840a5ade4032497428d430a4
MD5 46e11444adec618780b8b7d2d2b039f6
SHA1 11f159ef11a0e15b20b239f5170a1f99bdc572a2
SHA512 3bdb457a57f1985b8b8f7e6b28cd179c28e7e2379df0223ea5b6ba3b6731912944eea8242c20726b469d8751c31e526c222051cab2f5c4be1cd9ad760da4e73b
TLSH
T182E0682021EDCE6B6A24309B037CEB0EC1E33D02EBCC2A232F08B64066026507343640
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 f96515ab32a354d838b13b69bc63ce2fcffc19b887464018b371543cb5da3f36
MD5 6e44046830774db668a01d3d147572a7
SHA1 34502b9494817f48cb50b23a45826edf735c12d0
SHA512 48fcfcd04102e50ce0f67b0c52451ab76b8a7aafa3fa65e7c6941963539850a6ea09311414e80af653aef98048bf1c94abe1deb0171092939216d36cee5590b0
TLSH
T10EE026B055ECEA395A64B09743B8AB1EC2F27D079BCC3B537B0C5482B941610B3AB590
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 8eaf47d6b3c016758849391560b2fa44ba0e6ccf19f1def09fe26e27fb03bd07
MD5 8a0e8de7e5afc498a5b817f5a448374e
SHA1 29206d95a3a3e59dc0d478f7c8de08cf402712aa
SHA512 14016330d3e9e7125fc8add88d14a40c2fe9fc3008a0a1a797fef7e2cfae557ce1f8b1a13a08ee627bbfd486e0099e76240b3eb495c5d45e67eb516fb9b245ce
TLSH
T12451D3123A3E43813C3D2D1A8074861F558379E674B6EE7B37A875A50E2AF1C4DBD4C9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5721497da1adee4fc8af8b36c8bf88d2131b5258c92b6dca68987db5834fb8db
MD5 f3b488bee3fc43d9a4e2b44510d32927
SHA1 d30b17552ac1002d61eddad1477ea6a7d02aa832
SHA512 1976c5b8a08238d7282b98d723d381d9123cdd8340548969520d3f6b87ef207147e1be0d81f91fb2fbe76df09eaaafb44a9859c0cd67ff67090698e6c0381b25
SSDEEP 96:KMAHuawKW/buFWty/KVutM/h4gt+GU+n2Kk0IGwKPqCKU:/AHuawKWzuF6youtMJ4gt+GUxKHP
TLSH
T104A147113A7E42813C7D2D2E8170865F168339E27466EE3B37A875A51E2AF2C0CFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 0e91b3958a6bf5ae3b0d77656cba55057539afabcb74c1ac05e1cd2832fcd0f2
MD5 00c72444de89198f678a263d713edc44
SHA1 cea46e76ee49ef0ce57a92339c5891d04bc56388
SHA512 9b5082925d354d51179f32def88fa9488def9387d9cb11b5ae56308ebbaace44607b6276b6e4619d21ae808a879d0025dcb07af1a4910a4757854bf339cc2b12
SSDEEP 384:DNrRZyCSDnxTICmyMEhIKyll7svbFKfk7:xFZJSDnijyI1l7svbF9
TLSH
T17E44840A7B747001EDE6D9725CB080771E3CB16DCF22A6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 698c9dbd8595d9b20c01d833865fb25595d328d83d0ab5aae0ad6d2b1f2bd7bf
MD5 c379d3741a00feab8f74cfbaa2dfac19
SHA1 8b984fd6397c9ade748370ea3f14fbe6fea756c4
SHA512 e3a62d7f9d191389f123d58fe228da2024f8c5aa8fe04ec5439a5d848d54d52525fbac0805f610f7e1655cb018ac35d44617c9cd05b0a79cc1dc26758beffcbc
SSDEEP 24:LL0OGxhK3thdkSI5QjUsEGcGBXp22iSBg1jilJGt:zEK3tjkSI5IUltGhp22iSBg1qW
TLSH
T19C52799BFE342212DDEA83719AD001E57E7A903D8FC1EB4254D610211FF4A91A71E5DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c057e132-82d7-427b-9141-632464ba22c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c057e132-82d7-427b-9141-632464ba22c0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 4d685eb745e6c10045868d5abd530a890dfa5936e53a979bd842eb8a99cf4548
MD5 f5a9db1ab6b2b6e1dfbba0e40176c4d9
SHA1 1ef5c6537a960ad95f9c2edcff962f7c988bcea3
SHA512 6fa43bff73c09ac6d040573ba0a0424c3f8c5ea4cf0d9f7ff215297290a17740e7c17f3f664f7beb4d3796b1df42b16d5ea6aeeab2085a10127a5637a7867013
SSDEEP 192:SQnIIIGb2MIMwxYcYXkOyMAsuliq7Csg1:SQnIIIGb2MIMyB+y1sscs
TLSH
T1C542A56E17061B37C54E5B3613628A44BFD8588200B2252D76972C6F8EF7F9783D62F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 a81c497dd59f0a98275922827981a36d3a4a18efbfd8340b7a0248df81d9f7bb
MD5 0de1022dab61c8daf37e0ff302c4610f
SHA1 86b182b72df58d31cbea31420c8da3bf74e21f27
SHA512 1b9f3330d918edab43e230fab9a8da274c4c4867477fb7bacfe5569b88a694343dfb5eedaa5de5e17467a5d10bc87ad27ddc9995e6cfb38231e13c538da94e0c
TLSH
T127E0DF34A8E8C9EEAD24209B01BC574DC3D23E13EF882A0A5B019844A481201B386191
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 bc4cb086fc3bd194d2574b494fac7d8fe6505e63e04a840634f9bb4ebb740692
MD5 e9a0ec42a9178d241bf38f3ed03109d5
SHA1 e5b933d7b841fab38713e6785ce960e80e9fa175
SHA512 84214aa0912895349b3b106563bf5d2bf238fe00c2843848a73cde580416a4876b08e49fced2c78d0e117977f680dfdfd0da2dcca6643c40315e9e71a9d8f547
TLSH
T13D212255F330D109E15A827A607F9B391738E8128FBCEC0F847A20346EB2A440E4B7E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 e826683caf0adf6527d998f55821001601f160154852a9c701b110e2e3b8c896
MD5 f0c63f3fb51f1b5b98e02ecbead03f3d
SHA1 79c02c2c1189438b770025e019392943915d8d67
SHA512 5803d76e2551030ea1ddcc894c2e0cf13f2fdea650d0aa43772f2fcf7d46f86acbf50c8992720c88eaef3d2045b8d2945dd9fa5a84d34baf3553274d7beb0650
TLSH
T119E0D82074D8C9EF5920209701BCA78DC3E23D12FF882F065F018D445981245734B151
MD5 SHA1 SHA512 TLSH

Submit Download

e28096ad-7e99-4de7-b450-6f54f207342f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e28096ad-7e99-4de7-b450-6f54f207342f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 46f74cee5d2e47a0869c05ed5227543987aea04fa2cb0278557c79aa6762eb66
MD5 c69cda79885a1ee5c315e1e5b2ca78e3
SHA1 cc13a426325eb0d353e6b1892206df0a1b9bc857
SHA512 4494b67ea9deb837446d559ec2082956589f0fed7045a001e07cca1d2dddfda7daeefa901f469e8d40e4da389f9e31cd996362b5633e89b4bbe209a8b3b8ff81
SSDEEP 3:MsEllllkEthXllkl2zEfls/t:/M/xT02zN
TLSH
T1524404047FC0040DC500113054D1C3743370D51005155F4374F10D33FCC75400C11000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 c0152b38b7f07179ca3e2ef852ba0dc646dfa78b9e3662d8d55124095d3023aa
MD5 893cdc0a0bd227277181fc1265f13ec0
SHA1 8cfc77921cae620e91fa0cad48f979b398739b61
SHA512 2497fe3a6e28fe538bbe9f0c56ffe1924db1f764f3bc082f84b336a3d7fae467a85a11466b589c07fcbd73b80c409ae02cd764bce2d0458535a8998017d48118
SSDEEP 3:MsEllllkEthXllkl2zEflmZRq:/M/xT02zXv
TLSH
T1B44404047FC41F0DC5011131C051C3703370D4101FD1775334D14433DCC75400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3b196b4958f94941618174ebe3bc7433f30b3025422d783b768d38f6f47df4f6
MD5 c8b1e6a438ebb71ba01199d97a67e67a
SHA1 7a8d8fb4103a5a9ba869c1ba5fa06f321f151a1a
SHA512 c87b498fef9d7a6fe03bdfedf8f2623786c6d42e4e43a6cff80174247900371ce53fb882bcaaeca3ecbe5e50419e8ae7e0125677ceff282d7a9150e106cc8cb5
SSDEEP 768:uM32hEF8M/TBOW3v9WONXyer1IRCzni9cr995MgnV:uM32hoPWSIqndD5MgnV
TLSH
T12D039D7C9D549D3F48EEF385720E23626EB8503BD4B49A54EBD91B0D8433A5DF30A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0ac0f3a82211468e185f8b1e177505c744a8b43932a6c7c16fc3266d869df499
MD5 30b4a5dc3c4d929e9b894290676caf3c
SHA1 4f7f8444bfc10a86f9b4e80da52871c09808235e
SHA512 c0c1b1bdcedce5e8605e09a676a0dec9d67bc42ae50dc3539e593220e26e56233b3450df64062d93a0ef134a85fdf31af59a6aa308d0e3767b71bd19ee6ab30a
SSDEEP 768:5M39hEc8M/TBOW3v91ONXyer1IRCznierMgGj:5M39h1P1SIqnpMgGj
TLSH
T173F2BF70A995DD634CE6E3C6B6476383BEF86063D4C45E50EDEA6F0E048369D130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 59KB
SHA256 ca88987b10be82deca46ea5dccefa13c3f7142e7c8db9b680fb7b4fb8878cdf5
MD5 cd7b1575f381b9545eabe6d4a10ff927
SHA1 cff569daff55b466759ce753384fc9ba8da43f28
SHA512 c313c1749bc77aa4c0bd88fd8888da70b99bbd152b17257553986f7f39dda4433974ca4a5d347d2063d33c69abc100b46e587be71030f8a84161774033888d2d
SSDEEP 768:WF9M3mwgwhES8/c2ONXyer1IRCznisE0fFHUnsZ1swh8u1QGnCnHVMbRjhogGj:WM3rhIFSIqnltHrZGwhZnCHVeRNogGj
TLSH
T159536BF589C7893BD8AD6383673D2E0659BCC063B1989854FBD91E0CDCA25BFD302816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 ccddeb847db10ed95a1ecbf866b67f0727f69e0538179f99324bcefe83ed2308
MD5 695a570b8de8cb9e277ef6ccaf9cf615
SHA1 898c20de87c72267034fc37a3dade78a833c0697
SHA512 9530101dc0537494c408f917cd5f60e6dd5b696f11b1d754a049cb0e383e6b7cf0b6eda657e768451f175f16042c5a19b167c037fc1ae19b9d440cd7dfe020c3
SSDEEP 768:rM39hEc8M/TBOW3HsONXyer1IRCznieHVMbRjhPgGj:rM39h1FsSIqndVeRNPgGj
TLSH
T172F2AE399D949D3B4CEAB3C6764A27136DF89037D1D85A54EBDD2F0D00A39AC630B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 563d1ec9347bad9fc00e96b7b5562642a0e97aaa62a2b37dbfccf361842b6d92
MD5 f0c6402d9915ede627c76dd5f2c2ff3e
SHA1 ffa26f3d8a547e8321ad6fee41f477fa60fb6f82
SHA512 ad63d17a6c1b6f9887ef960efeaecc9b5131c6dec7427d217aa4b300272b3d255b0963d94e3f48e6f8a1503be15ab2cf987cd77249a6139c42862fd89f7fe786
SSDEEP 768:FM32hEy8M/TBOW3v9aONXyer1IRCzni9TMgnV:FM32h3PaSIqnMMgnV
TLSH
T1AAF2BF70A9A5DD634CE6E3C6B6476383AEF86063D4C45F50EDEA6F0D048369E130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c08f9ce0f0248df2cbffa8db3249b4bba337fd12c1743aa859631efb37a2805d
MD5 61b3899cd415aceb0034452b2ec9d25e
SHA1 0d1569f4c20f0e6d66db56cb87559b0fe0d7a2b9
SHA512 4e642a204278520e53137228561bece962608cbe72914603a4b06ffc06afb4e4ec97b2243f0f21f957fbf0ed682421587351314812f25750e1bb1031198f415c
SSDEEP 768:Crv+4UNbdz3A8+/TBOW3v9SONXyer1IRCzniwTeVH1SK7:CbsbV30PSSIqnvEH1l
TLSH
T16703BF31A068DE334DE6A395B14B72537FF82067D9800B90EDDA2F4E069759E270F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f6a2e8ac8cd8e3bfd50b9a17dd47ab90e153923944e955f166939476844e0cdf
MD5 0eb662314f533010e0fd473807fcee65
SHA1 8a614c9925c6c8ce39c1f84ba7fad9c99b720f4a
SHA512 fad3e2fa237456dcb58ca2b703ec7316f6764e7141ecfa7aca7703c74ade3f6000ad64dadf2612f7b6e8a47a243049f1bb784425d2531d54278dee70d16d1379
SSDEEP 768:hrv+4UNbdz3m7+/TBOW39ONXyer1IRCzniBjeVH1SK7:hbsbV3bnSIqnkEH1l
TLSH
T1BF03BF32A4A89E334DE2A3C5B14B76137FF86057D6840B90EDDE2F4E069B59D130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 7d5acd06d6a282e0d2b464be22bce1eb55b3e341187cd5f7182cde2b7debb62e
MD5 615b2c014121b90e63da08c5e2c60f7b
SHA1 7487c42b6e2856be1a82c2f475e2ac359ebe92e4
SHA512 eb23a4f2de35f212aa89878d9424ad233e479197add1fd63e1bcf1e4cc685bc632d9c7cd5ec6dd0928b93b81fd3edd87e1201dd7694d83f5c8cb905819a53e86
SSDEEP 3:MsEllllkEthXllkl2zEflhTRKX:/M/xT02zeI
TLSH
T1824404447FC00C1DD5101031C053C3707374D4100513574734D14433DDC75400C10014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e12a40ca-45e7-4f09-aed5-7bc1cef0dbba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e12a40ca-45e7-4f09-aed5-7bc1cef0dbba.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1820_226124816\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4836-0-0x00007FFBF6EC0000-0x00007FFBF6ED0000-memory.dmp

Download

memory/4836-10-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp

Download

memory/4836-2-0x00007FFBF6EC0000-0x00007FFBF6ED0000-memory.dmp

Download

memory/4836-4-0x00007FFC36EDF000-0x00007FFC36EE0000-memory.dmp

Download

memory/4836-49-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp

Download

memory/4836-1-0x00007FFBF6EC0000-0x00007FFBF6ED0000-memory.dmp

Download

memory/4836-9-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp

Download

memory/4836-5-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp

Download

memory/4836-6-0x00007FFBF6EC0000-0x00007FFBF6ED0000-memory.dmp

Download

memory/4836-8-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp

Download

memory/4836-13-0x00007FFBF4360000-0x00007FFBF4370000-memory.dmp

Download

memory/4836-11-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp

Download

memory/4836-3-0x00007FFBF6EC0000-0x00007FFBF6ED0000-memory.dmp

Download

memory/4836-12-0x00007FFBF4360000-0x00007FFBF4370000-memory.dmp

Download

memory/4836-7-0x00007FFC36D80000-0x00007FFC36FE3000-memory.dmp

Download