hxxp://docs[.]google[.]com/document/d/1dO2vmAOquA86uuPzJpZLQFUgM1mn79OOcpZ62pOswfw/edit

Analysis

user interaction
yes
max time kernel
61s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://docs.google.com/document/d/1dO2vmAOquA86uuPzJpZLQFUgM1mn79OOcpZ62pOswfw/edit
Sample260916-yfn8dsdc94

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3712	msedge.exe
2584	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340614420742341"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{70323AD4-168B-4BF8-A759-E51C81C2C670}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{731310C9-8E7E-49B9-B10E-76CD99C883A0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{6BA87F55-9217-4CB0-953E-90316B05592A}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 2376	4548	msedge.exe	84
PID 4548 wrote to memory of 3712	4548	msedge.exe	86
PID 4548 wrote to memory of 4976	4548	msedge.exe	87
PID 4548 wrote to memory of 4976	4548	msedge.exe	87
PID 4548 wrote to memory of 4976	4548	msedge.exe	87
PID 4548 wrote to memory of 4036	4548	msedge.exe	88
PID 4548 wrote to memory of 4036	4548	msedge.exe	88
PID 4548 wrote to memory of 5548	4548	msedge.exe	89
PID 4548 wrote to memory of 5684	4548	msedge.exe	90
PID 4548 wrote to memory of 5548	4548	msedge.exe	89
PID 4548 wrote to memory of 5548	4548	msedge.exe	89
PID 4548 wrote to memory of 5684	4548	msedge.exe	90
PID 4548 wrote to memory of 5684	4548	msedge.exe	90
PID 4548 wrote to memory of 452	4548	msedge.exe	95
PID 4548 wrote to memory of 452	4548	msedge.exe	95
PID 4548 wrote to memory of 452	4548	msedge.exe	95
PID 4548 wrote to memory of 2620	4548	msedge.exe	96
PID 4548 wrote to memory of 2620	4548	msedge.exe	96
PID 4548 wrote to memory of 2620	4548	msedge.exe	96
PID 4548 wrote to memory of 2852	4548	msedge.exe	97
PID 4548 wrote to memory of 3964	4548	msedge.exe	98
PID 4548 wrote to memory of 3964	4548	msedge.exe	98
PID 4548 wrote to memory of 2968	4548	msedge.exe	100
PID 4548 wrote to memory of 5736	4548	msedge.exe	99
PID 4548 wrote to memory of 2968	4548	msedge.exe	100
PID 4548 wrote to memory of 5736	4548	msedge.exe	99
PID 4548 wrote to memory of 4784	4548	msedge.exe	102
PID 4548 wrote to memory of 3452	4548	msedge.exe	110
PID 4548 wrote to memory of 5068	4548	msedge.exe	111
PID 4548 wrote to memory of 1964	4548	msedge.exe	112
PID 4548 wrote to memory of 5668	4548	msedge.exe	113
PID 4548 wrote to memory of 5668	4548	msedge.exe	113
PID 4548 wrote to memory of 5860	4548	msedge.exe	115
PID 5860 wrote to memory of 5308	5860	msedge.exe	116
PID 5860 wrote to memory of 2584	5860	msedge.exe	117
PID 5860 wrote to memory of 5980	5860	msedge.exe	118
PID 5860 wrote to memory of 5980	5860	msedge.exe	118
PID 5860 wrote to memory of 5980	5860	msedge.exe	118
PID 5860 wrote to memory of 1992	5860	msedge.exe	120
PID 5860 wrote to memory of 1992	5860	msedge.exe	120
PID 5860 wrote to memory of 3004	5860	msedge.exe	122
PID 5860 wrote to memory of 5664	5860	msedge.exe	124
PID 5860 wrote to memory of 5664	5860	msedge.exe	124
PID 5860 wrote to memory of 5684	5860	msedge.exe	125
PID 5860 wrote to memory of 5684	5860	msedge.exe	125
PID 5860 wrote to memory of 1716	5860	msedge.exe	126
PID 5860 wrote to memory of 1716	5860	msedge.exe	126
PID 5860 wrote to memory of 4292	5860	msedge.exe	127
PID 5860 wrote to memory of 4292	5860	msedge.exe	127
PID 5860 wrote to memory of 4624	5860	msedge.exe	128
PID 5860 wrote to memory of 4624	5860	msedge.exe	128
PID 5860 wrote to memory of 4440	5860	msedge.exe	129
PID 5860 wrote to memory of 4440	5860	msedge.exe	129
PID 5860 wrote to memory of 3784	5860	msedge.exe	130
PID 5860 wrote to memory of 3784	5860	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://docs.google.com/document/d/1dO2vmAOquA86uuPzJpZLQFUgM1mn79OOcpZ62pOswfw/edit
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x24c,0x7ffdef7ac188,0x7ffdef7ac194,0x7ffdef7ac1a0
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,17877014550465804911,13481565656411042017,524288 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16063995562314965787,7167638984333777687,262144 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,12876178420030556278,5682457608770741598,524288 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,13072066947707668643,4257775175006508954,2097152 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,3870748306882659232,9601377255812124934,2097152 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,16227481608849813171,8623517814486147410,2097152 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=2580,i,16088954723407717382,3361568960443963376,2097152 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,6337895849705835515,16869289882489018437,524288 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,14758634677783427002,16353550846737136445,524288 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,16291448826570243924,1865266974386645564,524288 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,4258330447910941912,6331353570104575634,524288 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,14408893861353646368,6627062291478607830,524288 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,14408893861353646368,6627062291478607830,524288 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,2391636803463586414,9465158956510516108,524288 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,9239628731749328948,1840311145477876480,524288 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,15446494929735795458,5295100231392168593,524288 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,6908857980690804100,11128394462315546213,524288 --field-trial-handle=2208,i,3864423330055493989,1435424623332944851,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffdef7ac188,0x7ffdef7ac194,0x7ffdef7ac1a0
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,4782779453597560103,11192987458930721339,524288 --field-trial-handle=2272,i,11361999237353299986,4745641339245092403,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,17123999824042357652,18337421236433978239,262144 --field-trial-handle=2272,i,11361999237353299986,4745641339245092403,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,9036048283738026279,16585399707795598595,524288 --field-trial-handle=2272,i,11361999237353299986,4745641339245092403,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4056,i,1609890131682662663,1673545527075292420,524288 --field-trial-handle=2272,i,11361999237353299986,4745641339245092403,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4056,i,1609890131682662663,1673545527075292420,524288 --field-trial-handle=2272,i,11361999237353299986,4745641339245092403,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,18413778510799409441,15164241440389101865,524288 --field-trial-handle=2272,i,11361999237353299986,4745641339245092403,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,351787745169081672,463985614468723274,524288 --field-trial-handle=2272,i,11361999237353299986,4745641339245092403,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:8
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,6150465145270166616,10391365951949802162,524288 --field-trial-handle=2272,i,11361999237353299986,4745641339245092403,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:8
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,13305804704242754767,571857836219388777,524288 --field-trial-handle=2272,i,11361999237353299986,4745641339245092403,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,1300691234782449424,12560778874012323812,524288 --field-trial-handle=2272,i,11361999237353299986,4745641339245092403,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,16157476540595554952,12815997179434875308,524288 --field-trial-handle=2272,i,11361999237353299986,4745641339245092403,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,5891242415832550814,10911111876545326070,524288 --field-trial-handle=2272,i,11361999237353299986,4745641339245092403,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bc826aaa75d7da810bfdc30a1671df54c18887a7ddc779d5b9f03835587852b4
MD5 77e198de5db1473b46a54bf11e90ef65
SHA1 d40423f0ddb590b81cb9016394df150361acaffc
SHA512 208c9def9ae2c86b2de012eeb71379c0f243edb53a958e991a05233405a4a20955e43cd9ddeb6944b19a1811ed512d3123f7d75ab4ca5b9a71dca6edca139ba2
TLSH
T1ADD08028B57C7BE4F03D353D0224414C31CD5AB156067545925417554FD155315D48E9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e046f1532764855a2846fe8e51f68af7947cd3914bd556b7cf718067a7580a1
MD5 6e4c53c2d043fd97dde25f3fd13b49c4
SHA1 37a7ed71994d35616364304b7918588b8ead2386
SHA512 78f9c9bff32eb38aaa553cb66670bc76c973700cb9aad6e796737ee21dc3dc9f84fa331ae754c1cc85840cedb57865c0de3cd9a8ef80489160c09aaae283f6d5
TLSH
T154D08054F358BB64F41A743C2614465D31DF9F60590AB964645523D40EC191301D8058
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2b27e1cddaabfc7960ad62182c9290fbf1102f29dea3089e6766135c93e8b100
MD5 30c5dfe91b563eeef443da7cae9e7496
SHA1 6b2877685e6199aea371dfbe5ea75fda25d25f1c
SHA512 2057dfe19d994b7491c75c4ac739b3c8c2c748762425c012d8792488c77604cd73d247b09d9d758daf7f772a36e3fd7175403932e24b3ed4589e56dde5bed88f
TLSH
T127E02B6AC911EC3F08FD0B7954940745FB10236B2A419C4B3B3E81188FF55364599C6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f50f694ff755846f9314a5d96ef955a82486196e40033676be2e4b0802137158
MD5 76e5bcceed8d8dd0cd3eedeec7393649
SHA1 5641ffca6301db37e5afe27d64d967804492fb18
SHA512 bf6a5b095857dbac91cc28ce3edbc59f9f5c5bab35ae5ee360e0f339761f004463e72e42c52621a2c5c81dff5f5de2dd2b7bcbfd9b6cb2ccdd92b6b5d5d11a6b
SSDEEP 384:hx7osybVbJH+nvWoqjz8gGaoOcIfbn8JRmN7OTBv6rg:4sypb9+vq/8gd/IJQQFS
TLSH
T1E713C8BF36689C21EAD740FC491F6AB72B74E839C8C54DAB8379F1729768742381E004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 0f07c05a5fbf1ff21a7c3a031aa8af1812f8f70e376013d04747d4018c7a23f6
MD5 b2e1685a7ab6799ee33fafb3dc88892a
SHA1 925b9a8f429208d56eb31b231fe691dd85379fed
SHA512 41b6ab9471a34bfe090486523bce7d024b9ac51b6e48f1ab54d39b1498e953ae3df64ccdee4a8e2d5eaeafb64c4815c49b20b429f3c18941b258ffa3370dce7b
SSDEEP 1536:ba3dVL/QY3L/l8bemaLzom97fGAL/OL/wL/fk2ciAU3VgwRzjaBP2R:bAdVL/lL/J9bGAL/OL/wL/U2zj02R
TLSH
T16B4492F71951A01BCBA802F5D2033A7EC177416E2DD0ECE9E67C8C952925F31B6BDA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 13782c433b9a7a0163bb952c3093493a81d666907dce8cef826c94127adf06e5
MD5 8ad18b2b2a458d8c7396a6d85cb1a18b
SHA1 73b294e6d1ad696a8757c1b365e6fb5db4fb4547
SHA512 385a43cdd8d878684403f88e1f85aa8ddc26613a17ca9591bbdc8032bdee4a17bb0b437c46649a3e8514363b2e26d5e97a341450477715f5b7a95706f6bdb32c
SSDEEP 3072:AW3n49WcCHcU0MJfouo1s+isXoSbOXtOB9rZcQ7w/P1hQ:y9W2U0Mpis+irSbOXtkZcQ7w/P1hQ
TLSH
T11C254AEECB282C42DF6B8774B0E0D90B7E712192B95DC0D39944C5E897C2B8575E92BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 b15b5114aac367d37eb1bd52a8b163c87f9616c913a1b7b527c33c1d9f3a493c
MD5 057446ce90bed2f61168c6c5663c67d7
SHA1 5cde662ed93074b197ca572f1583aa79815ac105
SHA512 ee1af4fccf2c383cc39e11f16d28ad6050b8bdff453f48dff54887547343b5bef5d8e14425bdc481cb63ef709b5465cb3ea02dfc530ffa6baae9a506ea4d4085
SSDEEP 24576:P+riTmEdNxjBHklk13VV9A5K803+a1YqTO7ZQjRblWF:mromcNvEypVV9A5R0uMTO7ZQjRxW
TLSH
T155867DEECA6858C3CD639A30B4F0ED477C7413D3F995D1D2889CC18402A77C5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 53KB
SHA256 351ba345250baf98ce325b4017ac9b96c9498f6644937ef558dc5993af676f2a
MD5 1e2d4737305eea41ee9198e3fd3f59c2
SHA1 abff05d701173ab7eae355be60ad30cf7f63536b
SHA512 469723131222dec7ea745b528fe62586da62d02505b6904a4b97157259dd37c26bf0d7012538ec6ab999c4a82d44f97ad7a1bc526cea9e8ee1cd30ff218fbce8
SSDEEP 768:aE9HsQuRLPPTiTRi06pYSINz9AdaTV7n5qAsVUdRwRuIDzjYTXqq2emOr8d/cNPk:aE9HsHPPR06bIhedCaAb+u2veJ8KNad
TLSH
T1354302A0446EF3CA3E6FFD7D9F225D5124E22A354838CAF6103721793F58B959CC1A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fd3a5ffdf12093f79b5989be5e343dcae7d2bbb3e1b8b593f7940ca1ef60ad9f
MD5 b9471d0b0f5fd380da396e2207694764
SHA1 dd181a2b1578fcfe1b11df25d9c440aff5b78328
SHA512 59fbb7a2cfb94c516da1dd91af71db33dabab3e230b747b9d899b12078f6afa23b5199faba58ced91598ea28847a29fa1fd134c77ab282f1beea52118745f5e5
TLSH
T1F8718462818EDB67DBD8BFB0C99614C731F4E178A5A74E42229CD83C1F6A3197316064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d94f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d94f.TMP
Size 2KB
SHA256 9d90ae3ba65fe4320e5ce0c86d8222e5454f2d5e05e4d9191603a10cf0285c93
MD5 a35e927443cba6f4e42eb0604688fc8f
SHA1 7e079d178de62f6f6b24cfde50ebb39c4656d98d
SHA512 81d32045889f81c75e5b20735c85bee05dd8838fad65623abd544d00042c9e28197bdfe1261397c73e587931585a7e45c35497f97914ece82dbb8babe0c5061e
TLSH
T139514DA2919ECB53DBE9DEB0CAD950C735B4F5B4A5A74D0323A8D8784FAB3193312014
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 35dedab60414f86d79a8532d05a85612446dcb643af1d2ada81769d77141a108
MD5 d4ebc83f2c62700517c594e64c70e8f0
SHA1 e09730c1506bde93a1a18dafe3e1ee5b2d3d46fa
SHA512 5dff4c497fb4cae8933c78405c253815c27d998dc8e0c1cf9e4cd0633ab72871d1ba91505704069f964aa23dc04827b19098e6ed6b495866f4a6df78d259a34e
SSDEEP 3:MsEllllkEthXllkl2zEklX:/M/xT02zn
TLSH
T1F544040C7FD4441DC50030344011C75003F0D45445115747345F05375CC5F404C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 db43e05996663e7bc6edcb06570e275fdf7e5f9172bf7d6c1739b530ed1c7823
MD5 1dbb6c40a941a3d4de2d33d80c708c3f
SHA1 ef8e7cff0d422f4452b22e51906bcbe974a86bd6
SHA512 7328961dc4da14fd77df1cc1e2a8edc20fab2b3597a48cf9bff7a9b732dc91c120aab27ff4ab041393bc0a005e57975ca4f42161df13de674fc9484e96e0a1d1
TLSH
T1A2E0D89854D6C21E5960B8C351286B48C1D0B643FB99AF8367009CC47746159B28E5E6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 9a015c8879313dc6b55c3d3146126e0b38332f928e333c8901dda802521c8399
MD5 72330798e1c705de0b4a6c25571ec06d
SHA1 32072546fb1d7377e42458599a3c85972fd0240e
SHA512 41fa5540b999e2872091b72a4822839bf6d82a5fd68ae77be2f7d21fe0c9a88c1ff6e070ec91183f4c4904c568ad0af5902a12490192289a4e7584603964cdeb
TLSH
T1B2E0865414C9C62A986878E382FD6B58D3F13587B68C3E525B4B8CC47141B49A29A2A8
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 72KB
SHA256 e56970cd6adbf3395f1daf7d0e2b6857fb9a4472dcb68a96cfff8972f02eb7c4
MD5 b90d91a6ace09cc58c2848bbc548630a
SHA1 f36448727ad6bf8d2c20b82921c0c8aa89f5e61b
SHA512 97bdfbb2fd28c9f39c0c0910a5d0eb55f300210af17cbc524783c97d0897588c9bcb261a371c1794abd7beab6ee574da4d1ae620531762d6135a715fcca9081f
SSDEEP 384:fSCujCuGBMFBMooinnCcWKkvBDuyUBD+yIAdkyoioZAdVcabAGvKAGvgEca:a1j1eMjMunCTVJgPhrraGJG
TLSH
T16C736CE31CF52443ED045F70396EBC0CA723E54C7E87FDA879E5429F86E0A59129B09A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 256KB
SHA256 17603f5cfd844ca29c42501308c13a14ed7f2961f738c492c30b842f3f0d5d41
MD5 e978a0a48f8881152ea79b4576151466
SHA1 63208dff7a927f676981b11c341281706c851171
SHA512 aa5473bb1a9c2025c4b120111b974a35e4e5d855efe6ecd90f1e20e1fb6c7baaa4e908ee571890826aa975d75677c27c1b4e384de00463cee3d11f5aa9bad3a1
SSDEEP 768:54CCM1ptTBBuCU3SkZMQqbGTGs408o1Oymqqvh7WJ:5wrCU3l9q
TLSH
T104442BE71CB62403DC1C5670385BB84D6637E51E6F83F9E92CE4019BCBF1A6D215A0AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 bc4d7e72a199738a9334804fe16f73b26d1cfff228b6f4f40b9317bc5580f9fc
MD5 399847ce2148b4219144bd9d35159b62
SHA1 1eda1a71f6b988c351e76cbe5cdaba85094f7aca
SHA512 d436ee6f2a8b8564d307eeb76c1a530ce73978a533aa1347ba7d631285982f0387b19c754375d32987c8cc68b98691489b01276b6a329929abb8b1bf93068198
TLSH
T172E0D8B049CDC21DF558308793A57F88C3F03506E7CD6B915F059C84B0C250CA6D55E2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Size 56KB
SHA256 d33ce850688d7e0ae10167910df69f4d218ea6d5b769be09b46098db4e6ba708
MD5 0bfbc4206050600a5f536154577d45de
SHA1 863c751cbdacb04f63908595ada8392d54bd5cfc
SHA512 2dd4e021d29e7a2a66779a253a4a7369c6eb089fb458464783b48e035c978f5f4707c3c041ccee7ea40ee797c3c248fa5a5863a3cd14485b5a674bb0798c783e
SSDEEP 96:PkS/KLPeymOoizhGNOnfmG38to2ZvJHbn8MouB6w9fUPnP:R4oizhGNOnDA77Iw9fK
TLSH
T18143361F1B682802C8598632BCB195F36F7CA13E8F53DAD26C7044359D75852B11D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 dc9432f77e583f09e5685f7bd2fad98024e47407a54583f2b9c60d600d146a70
MD5 a495fca412362385848ab31c1453b962
SHA1 789b7cc6b8f6f3ebb24e74f20951f1165abeee6e
SHA512 067ccbfbd0d0bce56afa2647466df8cc176c29e102c1e339dbd2fbcfabbe887f73eec507ed2dfb05bd800a38b098ff194a31356b3458425925dedc2d2eb2d474
SSDEEP 192:DW1aKXqkQ7WAFa313uMHXtUM81sTouioFZm:DW1aKXqkQ7WAFa313uMHXtUM81sTouiF
TLSH
T1A8E17BF7C7D8862DC90156F497166F2FCE2D0A18432C3D6AC8E8AF1BA3E2471E11565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 858B
SHA256 df96b3e1b7800e7d26481075b807ec49f6eeb7c612bbeeec238a6cb4dfd87ab9
MD5 40c9b51752c9321780bcb94aebd392f9
SHA1 07178446a01176c7365e27a667990a40dfbd6268
SHA512 0676b8dcc1c03bf09a7ca6955d3c3962d71db9e95bfee51f029940e9543c9a20fe6338ccf98235577b501a070403618f2515fe35483150c4ae8e22f801fd4b0c
TLSH
T1FD11AF9789BEB47F106809BF1D947C152579B838016398F0DAA783ACB0D56FB0B1E535
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b879ca23ef806a8a21a9ccc36a21fc2ced323e86b9f3ec87362e4e7d0f98e181
MD5 1eedbebe83c6cd1ee7ef140ff62f13ff
SHA1 53afafa59c72e1812b72be513fa01f08eb6cfbdb
SHA512 17ef90ca2940001b5db6e0e179b54de65979e0c6f36b7420285dbcc7e4e48bea838d71e72e6e60ff412dfb44ea2e4683cefd8428f8390182b2f7a518d7c402cb
SSDEEP 192:sxZPR4kL/fUsGaQZLE8ZzodprmhHW6+WNuwnXYoc2SXKIg5CHtoJ:sxZPRL/fUsfOvSOHbBXDS6GtM
TLSH
T1C242C7566D28A93B9CC7D619FB55BF53E3F9103291911E48AAFC8B2C14E76DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c926eb8e16c014547ed3878ffaa688111114e84bdb2a459c3e9db468e81df1c7
MD5 0459ed2a543dd34f2abeb517d8c76cf8
SHA1 c78d5d454d5f69f523d17066bef6f27315d8a808
SHA512 ba65b3507d76e9a79a3e83511d0a10b5cef3127f645349bfaf1ae3e3f46d2d49f819beec1d23f0b6c0cdd5a7a6eae16f83062fb2d33c2405768e907d2712fc85
SSDEEP 192:sxZx/R4kL/fUsVQZLJX8Zzodpr68GVuCW6+WNJyg/8zZYofE2SXKIg5CHtoJ:sxZ1RL/fUsVO1MSwRbQZzS6GtM
TLSH
T11F42E95A6D38993B9CC7D619FB55BF53E3F9103251911E48AAFC8B2C04E7ADD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e192bb823119e7b0bb36a0b3aab6d0e2c197d3e871fca469262def5b6fd8ec3c
MD5 b11042cdb2abe86423d219090af5e8aa
SHA1 48d9e8a29d55c6a665712b393c338e573ad27da9
SHA512 25b4814978cdfb2409bb38039b1c1f20a57a6cb9a789e483f1886b3ca6b491d3baad3362f3bb98a3d32aee23ae3f67efec6a73085b723b6832bb3f8bc19fbb3f
SSDEEP 192:sxZx/R4kL/fUsVQZLm/8Zzodp6KAENr8OVuCW6+WNJ7ug/8zAQBf/Yoj2SXKIg5h:sxZ1RL/fUsVOxSrRbsAK/IS6GtM
TLSH
T15D52D6576D38997B8CC6D619FA15BF26E3F9103255D11E48AAFCCB2C14E7ADD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 85f97c25a86d359309df0b3e65c0568cde62551206604d93430ff20b9d2606ea
MD5 0e3e2013f9dd050f34f673f7bb8a141d
SHA1 cb1edd7845f7b7aaa3d8bb38d4883c05a03d4d5d
SHA512 f46ce054a04e888b7fd7753aaebe3551272284953da1f1886cfab574c8e4beff4d344e661326779b5b333c6bc80b35fa947885bc163c558aff6a2978d687fe37
SSDEEP 192:sxZx/RukL/fUsBWpVMQZLg8Zzodp6KAENr8OVuCW6+WNJYPug/8zAQBf/Yge22Sb:sxZ1/L/fUsBWvMOzSrRbvAK/USVctM
TLSH
T17062D6566934997B8CD6D619FB15BF26E3F9103255D11E48AAFCCB2C10E7ADD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ec199f2790bc88144a203de1b50fb7ab4564daf1efdaefa56353e9d1693d408a
MD5 435adf5250ddefc7c78582751ca2f18d
SHA1 6d8ad5f41c8a6639c1c84a702e119b768daed45a
SHA512 887f337298554be48f9285f8c1b73f80e93af40b28258eb39423a21526a6881b87fe5ee94f5a2174343a8df2869f1104bd4fa81a39cb4d44040cf273cf4ba5ad
SSDEEP 192:sxZPR4kL/fUsOaQZLE8ZzodprmhHW6+WNud6/YoZ2SXKIgjtoJ:sxZPRL/fUsnOvSOHbd/aS6jtM
TLSH
T16042E7566D28A93B8CC7D609FB55BF53E3F9103291911E48AAFC8B2C14E76DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 e84d4a8c6cdeca327583f5fd54fb2101c5859a22f1908ab58bc960e64041c151
MD5 72ffe789f67216acc8255adcf3b9fc6e
SHA1 91745437f892c88bafa47afb090707bc329427b4
SHA512 e9f883b6648c532ad0fe5366c080edfabcf3aeeba78ce192348ecc29546120ccc7936fd71a7b721f2eeb890ab3005c0755c295edddfe300a7b06b8833eda78c4
TLSH
T1EBE0206809CCC2BD749D318342F59B4C92F97517E2CC3F525F41C8887183A0D75561A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 232B
SHA256 c3c8f6cdd4570bc6f035b042b90ff0556d5aa37496442ed4bc8a0ecb4f4dacaa
MD5 100baac24b93576259a7db68163780e2
SHA1 6065090269c1b68c198e63da6cd506c506dac869
SHA512 6bce6daa5a91258a00426c96ef85fee08c79573f0b35fa4e1f7bc9ff258e80582a4e389b7d2edce6dd212ca8ef507ce61b2a01bd532661a23a0208a13d7b5376
TLSH
T113D023807791B405FDDA3975108867655220F03742DD65034D245776DD310247D9D8D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 656c1d030407a3e8617c0067b8dac64631c897b538396d1bd847513a4762f40b
MD5 7d4c3fb910f68c1db4e94d18d6ed608a
SHA1 3cac4d2027a3e6c19dcf6feb42b83f786b6de9ff
SHA512 6640973345496fbdd5975bdc1dd4f00909810d33af82387f53c7ed83f9f8556f52e2904311631169fd4271fced405ceffea9e7f57a20115e4b029b272162f05d
TLSH
T150E068A401CDCB6A318A308792A9EB4881F23502E6CC6B32AB08A884720374872471A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 87da3e85ee366dfdd782c5c39517580a83cbc8b8e5120d771c0203ae1177c526
MD5 cdc86f22eb054c43c47eb29337f832e5
SHA1 dba1613d0e08621ce2cadab5412072a8a787523e
SHA512 9f31d8f6e5de874f938511216b034c9601f03662d09f8b8a786ba40fefffc0cf87b7f5928346131f974a6c71aba0456d61174696b512019c0476b1a5c610badf
TLSH
T155E0807455C9CB7A6588708382E9AF4CC2F07916E7CC3B56D7085494754374472ED9A0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 4257829487b17ee8a8e61cc0169807ba0339020c009ad8bf41afedfc98257075
MD5 2830772cb4ebb307142e930515e075d6
SHA1 335e34fcaa605393b6c775aaf955b46b96cd931b
SHA512 0d463a05aaa716f2726eec6775c0e341bcbec8f5e89887a114677ae2a5965a4e0bfb0495e0e4d9d90bc89d4f8522e42beccdf662502b72ed7bd6b45fcef60ab9
SSDEEP 192:ST/2dXOJhJlpfnpp3tNXVrN3w+Z6eME0DE/eeuT04vG+no+nFTg:SL29ObJffppdNlrtqfTg
TLSH
T1CAB2235571BB421039FE391882B59B6E068231733119E62B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 a749edb89d970004f56913b663625d0a455b5205fa66608fc730b7da8805f73f
MD5 7b38e6a9c3b518cb88b0f7c63d9d2a40
SHA1 5b103eceddc75e061d495e9a4c9f0e103e617778
SHA512 d305148edcd693db3cf7331ac826072b82aff065f61dc30ba24ea240df6fa109020b39dc601004562cd3749c9dc834989d0c040701b074b41d2eeccacc5b0a51
SSDEEP 192:ST/2dXOJhJlpfnpp3tNXVrN3w+Z6eME0DE/eeuT04vG+no+nFTdF8Vg:SL29ObJffppdNlrtqfTj82
TLSH
T1AEC2265571BB425038FD291882B59B6E068231733119EA3B7FBD00B69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 28KB
SHA256 1bbe1f76afade224bc96c31131caf924978e2e6ab31c869065d0c5760c4d597a
MD5 476d4cb558f03a69422dc86e1391b067
SHA1 d8269b41cb375868e3b033b569f2b8546dfa4257
SHA512 5ddf12609410e342980eed9702f523301c64eef59526b7e5a118a7c8e346bebdf54698bc853ccb812db5d3e778e178f04de405d3533a91a84bd3eec5c276ff67
SSDEEP 96:OEtSyGhp22iSZPyK0LRXzyK0skWkhqi8NsqZpBaza6dkgs/lalima/kgs/r:OLTZP0ne6sQss/3ls/r
TLSH
T104D2B8C31C3A2017EDD44B71B882F54C2E23890D6EC6FAA25CF8828B4AF5B7D615B059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 4f8ec5356a0fe71cf31b53b44c1a9a7b78dae66e52b1bb3687e323614f3e03b1
MD5 0b1922f38094bda5be8035b7f9c4b90b
SHA1 f98ea465526984555194beca3ccc9615eb9e9fd3
SHA512 605b7ea11227d5dda29cf82e475fd79c342286be819c9c87cdcbc28fb8feacd0604b019229f9781a6e84a3a3ed9da25f96a55d6ed5e4dee858950b99d233a55c
TLSH
T17D5141C0B3E950997FC9A941C22E6A0364E13E77260EDD71372F44F89F488180F6EE25
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 3f2cb38e54f438c6796631a88080566cbece3e9b5571ebdbd7c60868d280c96f
MD5 a2361c49e0ac42bc3df42e240ab88c02
SHA1 57d4b9f109d2b6b2e1d4c4539222866cec2ae232
SHA512 f773ac8bc2645b031235aae6045272eb7d9bd362e7e0bfcc42f936b4d9e217048b25d5d290580777b4b025a5bb8f55f0b8f56af0e183b6d494767a2e17a50eda
SSDEEP 192:8gR4OE8Aslli0wQ2sCxJnBJvaJa2D+QtVIIIObOMIMoJYcYF:8eEls/72sApQPIIIObOMIMSBi
TLSH
T15552402D260A1B33D05E1FB7236E8B959BDD888101B7225D3062584F9DF7A77C6C92F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 cba79e87d57c08c99486c4dc371c742932dad32acc10af93b3b8fe31a7a4f73e
MD5 f5fa32cc3a1d05f6942c1bec2ed27034
SHA1 8e6383f01157e3b791ff783d6c7c2b42eb13f62c
SHA512 3d9ff03bde1c2a2027d46801975820c172fc140bc10ffc7da3313c58ca4bb99bdd88185986408dec7c515a02798f94f735847f511a9f4ac584e2de9dcb87ab25
TLSH
T147E0205074C4C27F646934D711D99B48C3D03583FADC3A455F02CCC87041704F2491E5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 cdb572ee3fdb7908eef3de77452ca79db6fc41164e60a0c094b499eb6b99ef21
MD5 cb880bb7cff76953c646b7aa20fe573f
SHA1 49d939e5fe8a08556c8603d69a0aba6abbb402a5
SHA512 9ee0d2fb23503af40f479814fe2d8e52b51c16e6dbc39c1826ea0ecb24ffdaa99851fc48f4aa86d31e5dffa1fe02abce79db25795d89b71e83b1e3003fde7983
TLSH
T11621BC55F320C208E18E867DA06B97291338E8168FFCED0F847924252EB2E101E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 ba0091172caa9009ee592db9073ac2a12d1d102dc7932562494fe8a491ece31d
MD5 e4d0210a1541734f25210c43ac3febfe
SHA1 866553d947d1783670cfaf128a5e2661efc07291
SHA512 ef9d01083ed5a96872aef74e7b92f66cc941ae6f04274d90577d27dc788d2c134015f37b51d0ac007684f78971bf06a13d945ed92f6e2fac9af17e5d79419e67
TLSH
T1DDE0D85474C4C26F5455309311E99B88C2E13983FA882F415F029C886101645F24A1A5
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 2d8c0be8db44987e19df22cbaac35c7c53681cd1044d4910537657f9fdb40964
MD5 36056f3a58877a23429d836d7da08b66
SHA1 d46c4b6f0d33b00238ed24c94037df2203aa0852
SHA512 f46e97e9af142b5c5e1190f1319006713ac062a7828fc65faaa63d5c8b74610d644ac5cafe1926855e3688c7497d9a2e6c53b888314f6e427967571867488192
SSDEEP 3:MsEllllkEthXllkl2zEely:/M/xT02zNy
TLSH
T1EE44040C7FC41405C51D10304011CF500371DC30051157C37C5144175FDF5540C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e91b78199fb886a1c687ee9aaf5653dcbf8f1dc60b00e7dcfbe548b05dc39446
MD5 36e49fcd753ad85af110f8c643b0dc1f
SHA1 c2b3d8a63f9140cd3e9e181f18ae723e22a3c74d
SHA512 d4b49f8b00ab330fe3e2e4a7a69cf345441adefb768dea8d4b211c92a64be16b7a84c6bafe9cdb7919b3bf4795be120ea21b15886b89abf900474eeb294846c5
SSDEEP 384:nYiFiZcIe3sNW8TUNTUlI4gaKMcpvw2fiBCauGlAbu/iO7O6R2FeopljgL/7Izkq:jFQe3vwg+eoBCaXWsiO7TRHq
TLSH
T1BFC25B76E898C9BBFDE68AC9A70A3A07DEF44153858C9AD4D8DC1E1D00CB5ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 594130a43e3ef7680398a57e80ed0f89e7b9ebb968a79a6af8c61bf7cd55bf84
MD5 8ba0fee094f31907d498c8a5b38f8cc5
SHA1 91bcd4c5136e5b6c67244ef89d34ec74b2d78ead
SHA512 5fb1f3fb63e78b4ce8db902da0bc9830ba8397e24eb11afb214f0ba282b097422214cf6501f57e714caa27caddb8451c38260b68e70def910d3d61c977798a9b
SSDEEP 384:n9iFiZcIA3sNW8TUNTUlI4gaKMTpvw2fiBCauGlAbu/iO7O6R2FeopljgL/7Izkq:0FQA3vwg+joBCaXWsiO7TRHq
TLSH
T174C25B76E898C9BBFDE68AC9A70A3A07DEF44153858C9AD4D8DC1D1D00DB5ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 865670778652df2a5427c98b8a2a4076ff93360c8d21ad1d94f177fcfcd18c0c
MD5 fd9ca611d585a0fc80d6b15ece2046f9
SHA1 77be41182caef59b8d30bbca747fceaa42981dd0
SHA512 82cdf164708a4806f7d9eb14c28b992011fa2af9a66c34432e6fafe502743028840cade5a18a6ae6cdade4d9f01fcaa3ff18379acf87065f6465759faa9a004a
SSDEEP 384:nYiFBZcISsNW8TUNTUlI4gaKMc8vw2fiBCauGlAbu/iWyorWhG/ekLR7O6R2FeoP:jFJSvwg+BoBCaXWsiGrJekLR7TRHq
TLSH
T19DE22976D894CDEBA8E6DAC5A60AF606AEE40233858C599CD5F87D3D309F4FC0306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 062b5ad4d163cd3f495756a701d8324fb57a358fd5fe84fee6fee492b16455ed
MD5 5c8011856d4dacf2cd31c856b9324f59
SHA1 c02e83c9d6936a50fb6713f959be708b74e7290e
SHA512 79cfa2de29ac5b322053fece01a009682aeb7733189ede8987361c2f16f81d981ecfaff5ce40ebb26f08234b0c8905326298d1b7e1c3b3005ffd590acccc6707
SSDEEP 384:nYiFBZcISsNW8TUNTUlI4gaKMcDvw2fiBCauGlAbu/iWyorWhG/ekLR7O6R2FeoP:jFJSvwg+moBCaXWsiGrJekLR7TRHq
TLSH
T178E22976D894CDEBA8E6DAC5A64AF606AEE40233858C599CD5F87D3D309F4FC0306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9a23620d1ef7e9c0b8a29db23efcdd6dd865bd953dcfcdd0a8179d25b6c80414
MD5 76298a459f33b66232bf34cf7a37d048
SHA1 d7a8083a12dcca6d98e83ba4b5480ed2ec4253c5
SHA512 234b5626ff9417b126ec640e9a6d51c11c34b21b5a30b50e7323bd9fce3b9340b30dac857feda45ebb7a50fda1f760a480a08d48006bb1da1fd640742cb0f963
SSDEEP 384:n7iFiZcI63sNK8TUNTUlImZaKMqGsw2fiBCauGlAbuQiOsa+VYYrgL/7IzdoC:WFQ63/wg/DLBCaXWNiOhgPJ
TLSH
T1C3C25B32EC98C9ABEDE68BD5A74A7603DEF04263958C9AD4D9DC1D1C00DB1DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 b4b399d41714a41c7f9ad287d9d7b25233d0161262654f372f1fb0e1bcbd4d44
MD5 b3c7371783142c1fce764fccf8c0280d
SHA1 edcefe3ca7bfe4048d53a55f0ae6e7614558fd99
SHA512 7c81539b43acd6dabbc1937fac5ba413ab93b262aa4442e372e6e347afc7112d26a88122aa612a780bf50ea9f1b5751ce83f5420c6418a70ac409ab60bb2b5a8
SSDEEP 12:TLH8PFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isA4HqzmdxlCmQQtAdxi:TLc5UOl0afDdWec9sJh4HfY9ZB5fc
TLSH
T16C92DC636D352033E8DA4736BD8385D10EBC125ECAA7B804DED04D620DB5BC2A2496F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bbff3e8c030b95dd6c84b116fa3857af7511ed959dff23120d4316c52caf2c90
MD5 13782bf624587234232af04b8607b0f9
SHA1 d9c26a57b81d5b51e740397b7f6d7187cee2efd0
SHA512 9f654a355cadf656e622ded1dc1576004dbf5e46c6b87585ada44042d6e5aa37c033abfd1df20b49515cb9045b0e15f7ce9fa9a79ece7b1a00edb2eb90c03c7c
TLSH
T137E00203D31010D3C404033405835F042FF3D070076303865F31817C3C363003C10640
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8e1514b9b435092108c89417388e55ae26efbcf457cbe2dadaa02f4d6a38989d
MD5 407754b19cf905b7b9c49fbd3816fd0c
SHA1 21312d0e3a8bd2528cace183e859495fce375357
SHA512 ab2289c6c335c904522501d143b3909a4f6b2401b3bf56f48a976c8ab31f68ab667a915f032d11db13f9405a06dbcfb49e452e95c867d5a7c0323263e2c288a5
TLSH
T1F0E00113931010D3C844133405C76F443FB3D4B007630386AE31917C2C323403C11640
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0e47b08cdbff6fd2156a6bd4cda518cb362ee9fa4230ade5f4c7c32d10dd30ac
MD5 1bf2da49a4e948cfc9ba250605353d53
SHA1 aa11a390b160c9bea9e574b6a041d29171ad237c
SHA512 24c5c6c0be175618e378504a184e6002e5ac788e34c2abbcd70c3aa35487054c4649bcce1ad3918f9389e348dc6da5adba9e9f80cea99fd24951aed9dc4e7547
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe597555.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe597555.TMP
Size 392B
SHA256 cf2d99617b9f2bf57a150cc795b5aaf5ade692993c58ae83cedbc1164a1e3cb8
MD5 0f33df56c59f4d95ad4442e1e9d56059
SHA1 7f5805a31c324cd6268b44c5a774a9352f8b9c3b
SHA512 d8d92eed367d31d638f4c6253ec687e85be51a376407beb279f9b3c86841484d6154a3e5a755bd123bac32dee49975be5055c6f342214d49bbb538601ea70a71
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 60a96f36aa85ac7f1c6c9aa086f8b7369b7b7a3de9b842924dd07357a52934a7
MD5 dad86307ea0af80234b28a445872b607
SHA1 c3fafc96e7a3f7ef7676788d253fcc050dc51c71
SHA512 43f8906f080da9d3fbd76537821949b6b02e6781e66fdcc6f85755f71656552d197e7c74c9e847444529a9aaff677688ff226875b85e6d2b4678cd18eacae6d8
SSDEEP 3:MsEllllkEthXllkl2zEelG:/M/xT02zN
TLSH
T13F44040D7FD41405D51510704011C3500370DC30055157473C5144135DC7D400D00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2300f03a878b297ab76845b20585dc1d7d360ebda34c79a980acbfb62c7fec12
MD5 f2b143a215c7de3a9e240639ef697e3a
SHA1 df284e3797187dffb1f6a3e383b1ccc33a9aeff8
SHA512 0dbfd225fa73dae61a09ad260bcb680925b8d176fd8a2a1ced26b2a0d8500a6fdac5ce53ddbfeaf785be28ffee49c20cafdc76d2ae9da6d290411f525b7c7575
TLSH
T1A8412958A6E91048B3B76E19AFF7A86D487A78372E46D59D00110E4F4A22B40DC72B37
MD5 SHA1 SHA512 TLSH

Submit Download

6692050c-d98e-4c02-a8fe-72e9320991a0.tmp

Path C:\Users\Admin\AppData\Local\Temp\6692050c-d98e-4c02-a8fe-72e9320991a0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9719f565-9fcf-4d9e-9d84-48d61fa05097.tmp

Path C:\Users\Admin\AppData\Local\Temp\9719f565-9fcf-4d9e-9d84-48d61fa05097.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 1be40667050a0d461f08e73fa30d6118b378e333dea1ed0ed38208dc92a25606
MD5 45d84c405c2c4e3e40f0eed14555eea2
SHA1 fa4ac2ce091dc2cb6e40a6a0a53892c505753c4d
SHA512 c474eafcc0f0da118559c135c12bad98ca3d895386eaea088a8df2f26e46d28c83f8e50a0acc3c5b471fa96f22768f47787b052a2cedb60b32b641b89d50051b
TLSH
T154417BD13935B63F4F8B4BC4A0A20C943660F191132EAA5CEE165474BD5CEE3972E7C6
MD5 SHA1 SHA512 TLSH

Submit Download

b2443576-0f1a-4c1e-8f62-ef02878741d4.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5860_1893973843\b2443576-0f1a-4c1e-8f62-ef02878741d4.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5860_982053369\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4784-234-0x000002C3D9AE0000-0x000002C3DAAE0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads