119eb288d01d5c24479e1115132f1c50d5a051bd25871ed550e76d187f977e47

Analysis

user interaction
yes
max time kernel
450s
max time network
441s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BodycamLoader.exe
Size 540KB
Sample260919-vbmbfsvsgv
SHA256 119eb288d01d5c24479e1115132f1c50d5a051bd25871ed550e76d187f977e47
MD5 e1d74df3ba8b45417985955eec7e5a1e
SHA1 8d1d92acf3aa683445f38bd1433b16bbeb81ee4e
SHA512 addec21d91222061a7525c0d53fad49b212757f2a8b66c9eea7a54c823d54783d9bea421a6a36b580ea388f53201877aba421db10bbeab6de293e3480695194c
SSDEEP 6144:RHRu7F1nQnZ88UnvrRrhA8SZQ2/bmbrBsj0G2OkL0OgHybXYmxZtnG1:RxOF1Z8GdtSq2/bmbrB8RkL0Og49xZQ1
TLSH
T130C45B1233F8425AE1BF5B7994B05051CFB2B6275F6AE78E0E905CED1DB27809A27313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
76	3544	msedge.exe

Drops file in Windows directory 36 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_489967801\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_265306129\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_916377430\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_916377430\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_70672987\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_1342962228\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_2131133771\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_1190954615\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_1229047102\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_233565246\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_966922579\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_966922579\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_1190954615\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_1190954615\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_265306129\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_1190954615\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_233565246\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_966922579\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_70672987\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_70672987\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_70672987\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_265306129\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_1342962228\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_265306129\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_916377430\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_1229047102\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_1229047102\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_489967801\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_265306129\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_270658216\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_265306129\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_916377430\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_966922579\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_1229047102\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_2131133771\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_1190954615\regex_patterns.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3544	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343101745183123"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{A2BB86B3-174D-42F9-A65A-FA932C07BC6A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5648	msedge.exe
5648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2696	3052	BodycamLoader.exe	89
PID 2696 wrote to memory of 4124	2696	msedge.exe	90
PID 2696 wrote to memory of 3544	2696	msedge.exe	92
PID 2696 wrote to memory of 3496	2696	msedge.exe	93
PID 2696 wrote to memory of 5840	2696	msedge.exe	94
PID 2696 wrote to memory of 3496	2696	msedge.exe	93
PID 2696 wrote to memory of 3496	2696	msedge.exe	93
PID 2696 wrote to memory of 5840	2696	msedge.exe	94
PID 2696 wrote to memory of 4872	2696	msedge.exe	95
PID 2696 wrote to memory of 4872	2696	msedge.exe	95
PID 2696 wrote to memory of 4872	2696	msedge.exe	95
PID 2696 wrote to memory of 4632	2696	msedge.exe	96
PID 2696 wrote to memory of 4632	2696	msedge.exe	96
PID 2696 wrote to memory of 4632	2696	msedge.exe	96
PID 2696 wrote to memory of 4260	2696	msedge.exe	97
PID 2696 wrote to memory of 4260	2696	msedge.exe	97
PID 2696 wrote to memory of 4260	2696	msedge.exe	97
PID 2696 wrote to memory of 5088	2696	msedge.exe	98
PID 2696 wrote to memory of 5088	2696	msedge.exe	98
PID 2696 wrote to memory of 5088	2696	msedge.exe	98
PID 2696 wrote to memory of 3208	2696	msedge.exe	99
PID 2696 wrote to memory of 3208	2696	msedge.exe	99
PID 2696 wrote to memory of 4636	2696	msedge.exe	101
PID 2696 wrote to memory of 4636	2696	msedge.exe	101
PID 2696 wrote to memory of 4636	2696	msedge.exe	101
PID 2696 wrote to memory of 4360	2696	msedge.exe	102
PID 2696 wrote to memory of 4360	2696	msedge.exe	102
PID 2696 wrote to memory of 5752	2696	msedge.exe	103
PID 2696 wrote to memory of 5752	2696	msedge.exe	103
PID 2696 wrote to memory of 1648	2696	msedge.exe	105
PID 2696 wrote to memory of 3516	2696	msedge.exe	108
PID 2696 wrote to memory of 3516	2696	msedge.exe	108
PID 2696 wrote to memory of 3172	2696	msedge.exe	109
PID 2696 wrote to memory of 3172	2696	msedge.exe	109
PID 2696 wrote to memory of 2800	2696	msedge.exe	110
PID 2696 wrote to memory of 2800	2696	msedge.exe	110
PID 2696 wrote to memory of 1760	2696	msedge.exe	111
PID 2696 wrote to memory of 1760	2696	msedge.exe	111
PID 2696 wrote to memory of 1760	2696	msedge.exe	111
PID 2696 wrote to memory of 5504	2696	msedge.exe	112
PID 2696 wrote to memory of 5364	2696	msedge.exe	114
PID 2696 wrote to memory of 5152	2696	msedge.exe	115
PID 2696 wrote to memory of 632	2696	msedge.exe	116
PID 2696 wrote to memory of 5892	2696	msedge.exe	117
PID 2696 wrote to memory of 5892	2696	msedge.exe	117
PID 2696 wrote to memory of 1256	2696	msedge.exe	121
PID 2696 wrote to memory of 1256	2696	msedge.exe	121
PID 2696 wrote to memory of 4868	2696	msedge.exe	122
PID 2696 wrote to memory of 4868	2696	msedge.exe	122
PID 2696 wrote to memory of 5648	2696	msedge.exe	123
PID 2696 wrote to memory of 3460	2696	msedge.exe	124
PID 2696 wrote to memory of 3460	2696	msedge.exe	124
PID 2696 wrote to memory of 2072	2696	msedge.exe	125
PID 2696 wrote to memory of 2072	2696	msedge.exe	125
PID 2696 wrote to memory of 1228	2696	msedge.exe	126
PID 2696 wrote to memory of 1228	2696	msedge.exe	126
PID 2696 wrote to memory of 3156	2696	msedge.exe	127
PID 2696 wrote to memory of 3156	2696	msedge.exe	127
PID 2696 wrote to memory of 4644	2696	msedge.exe	128
PID 2696 wrote to memory of 4644	2696	msedge.exe	128
PID 2696 wrote to memory of 468	2696	msedge.exe	129
PID 2696 wrote to memory of 468	2696	msedge.exe	129
PID 2696 wrote to memory of 604	2696	msedge.exe	130
PID 2696 wrote to memory of 604	2696	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\BodycamLoader.exe
"C:\Users\Admin\AppData\Local\Temp\BodycamLoader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff97c46c188,0x7ff97c46c194,0x7ff97c46c1a0
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2088,i,8822717244715985563,5886506287083836437,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,13036718600277585685,6476927913824180866,262144 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:2
    3⤵
    PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,3297808183298302450,4595279332241283302,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:13
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,14403470615778425801,17487989644288129094,2097152 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,4513861591584371291,2339327228662017912,2097152 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,1139000572542365365,5580512913738960289,2097152 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,11144697848215255526,15126712251838057134,2097152 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:9
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,1577135147247888503,1730390134721711570,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5132,i,12421806620163254687,14692439377969556240,2097152 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,12141584227435978471,9426641569731752300,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,14584425490047303963,17230770907449823565,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,18002165342950495431,5598391298538322374,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,18002165342950495431,5598391298538322374,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
    3⤵
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,11191930198626024470,11185268147072186492,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,443329620340559662,18105147668844506840,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,11242767771438980467,13817460624992509153,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6852,i,13839067209088972774,7292486852513430583,2097152 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
    3⤵
    PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7364,i,10495075457610429802,14431276668358381111,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:14
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,11701288144716937523,11885135245619341069,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,5900506859196483733,11878066448746926749,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:14
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,7977614310769072695,4166364164693090354,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
    3⤵
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,141781836519998095,17540980686009597099,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,6173799137962673535,8434366082602005175,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,13150988672231385455,14833238693280991726,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4532,i,17423979564126901208,4312790180922846058,262144 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7344,i,4077793346873928718,5604061097292233643,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=1496 /prefetch:14
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,14166117973892635686,14202967457645861370,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,17069222556562305199,11184705281251072452,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,13479552502108047544,16286312130911397325,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,8125057640551063709,12359412138594851743,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,5185713695429033709,14467387435237662861,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:14
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,11102430149206153452,15398439572553972955,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:14
    3⤵
    PID:604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,8053420290641275990,17580114434737389250,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1488,i,12396022866677135370,16188945380953161658,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:14
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,5051281841882462912,16821039081218407001,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,16735902359549824208,6000575855509376962,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,5416861534535963473,13654894174055298514,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,15232988185619309371,13516161852539355826,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,5037310746013546192,16892765663871779636,524288 --field-trial-handle=2980,i,18332562954603614355,11260606593143919500,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
    3⤵
    PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

2e014588-8b4d-4661-b202-a7ba5871fe03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e014588-8b4d-4661-b202-a7ba5871fe03.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d485ba766d12278538269ecf2d4ce6181ccd9c65b5ae831ebe91321df7404934
MD5 6a06bdefc02baf0c3c0604c53fd3fb37
SHA1 b98d8d434c5fae9f00af8671177bde7da6365d27
SHA512 fee3757f7aac0e749bb13620d9be5d9876841d8ed60268e7be8276ac44a508eddd22acc1f41b4949c352d9698a87016760523cf65fb365898694786b729f9677
TLSH
T1F6E026D80AC8C62EF358A64B527E570C82807B0B93CC6A6B170494847146040F2C2790
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d602c53e0b7015b0e71395b5065c02050d8b9f5295177889e6f7cd22c19aec5f
MD5 d1f3a316657f6e5b104a72e161898ff0
SHA1 f29051d3068c870f28177709f195440bbcfdc1ae
SHA512 a8f6adb71c83026a9116d4777f474622a1b55573a798828c3dd9aa7113f4e90354a4181cce101a6085c439669402ebd09bc9fb2ee98f16296442809df8bfee46
TLSH
T18EE026D804C8C26EE34AB44752BC770C82803B0A93DC6A1F27088C887101C40A6E27A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 829ffa51168638773b44d1c6fa70eae3df5b71996c5b347b6fc38ab3d60b3580
MD5 899ab58bc02ae118d8a64d72005b2552
SHA1 d210858309a0b4e7304bfdcf4c608ee85286fb1b
SHA512 066b0c7cee5c338b0b5a72b3ab5f5cd21e617535b7968d1b5a717edc39c29ff0f90c950ba5c10df053c4b79421b5e4b189d50a841a1f0115b1bf6c1afdea7126
TLSH
T132615383D1D8A553F76E1E728DD89C87B678DA8C79432DE10598E6BD5C833B050DCC1A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598ce4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598ce4.TMP
Size 2KB
SHA256 a9ebdfdf0a16e83cbcc7d4ca1f984f7158b8c1bda4e7990a95e8444bdb4ae896
MD5 cdb67088791ae0c4733da98655143430
SHA1 3624f7642c0b3e90817025e4f6febc61a23719be
SHA512 a417e64b7e31809fbecd7f0d19c3271d7860933bb38c60ffc49ee7fede1c0e7e7e1b87db0e339b2c599196279e0999a18db3f7274c9f34ee7c4acc0e20f240de
TLSH
T13A514083D2D8A153FB6E0E728DC89C87BA38DA8879831DE604DCD5BD5D833B1509CC5A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ed8b7a64236e6b5d3a4490e2720c2a7bd0e18ee872da8ed7f5314cf9220c7396
MD5 dfa43d0e28bdc6da708497411c604fa9
SHA1 f012cf8c85958d9cf605c9b33bd8b2624719f9dc
SHA512 bb2878a76269ca07378348c2107c53040068dd352f21611b9e87c36dd928b07c239ca66f3cde4435158f3ba4f014e5045c6c02b884c948307f1eaa8e339c6d28
TLSH
T107619CF787F4856E8A1196F09A18AE2FDF2C0615431C7C6989D4AE27D3E34B2E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 56a0f71122ab0e12e8627fb54bf1f1cc9b0387692436116d5168d02291ed5d18
MD5 90e7f7d56efad719b3162ba58073267a
SHA1 77fea7e2b9fa3f5137644d86ad49e0944eca680f
SHA512 e7707daca77a3a7baeca2311adc9940f319e94fe6659335d89163c61cf16f58cdbfb66995370bab5673faa2428d27331fcb646715dc510a5f4224762aaf56d0e
TLSH
T16D61BDF787B0856EDA1196F09A18EE2FDF2C0515431C786989D0AE27D3E34B2E10275B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 60fd5df4723e8d6eb6a3dfaabc74fecd67727b6ef66f0ce54719ad466599e9e8
MD5 0ee3d564f5053b3a25c7325a7703df83
SHA1 4e6380950f11ac477303f9b2533625ff7d060fa8
SHA512 1e1a5b01ec9557215e0ae6c1db71c4052db54b74d9e33ebd464384f210509b2ab21281037526c43ee2f12803592619b913a694859cac86251d1ea0d366a264bc
SSDEEP 384:sxR49U/fwsM66s8qMpRiYnazAW8pZS15posJWeT+e3TK3v/5OXhV:s09U/f44Mnc7WeT+e2f/5oz
TLSH
T192C21A09A824C83B9EC36D19693D7E33DAEC506221C5DEDA56ECCA1C01DE1FDAB07417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e210f83691a63709c4219bb3491d4b8b5ba6d53fbed3a84c255f950c34e9a309
MD5 1a9ef7e4e471bf47cf4f43fbb4336cf2
SHA1 546ff0ec08204ad70b8bd4db668d20e2a0381ef7
SHA512 4447ceb14953ce72ec66d92dc496131ae534c0d3b84941ce9f892a645d38fed50bf74f398c000680385eec40c66eb15aae22b089d06d6bdcac0ff600ccd1277a
SSDEEP 192:sxR4RpTU1/fwsZZZTK6zoA8p9r/g6+WNZ8Z/ANi3a8GolIgDPJ:sxR4vU/fwsZ3TK3Z/5O/FV
TLSH
T16842B919AD28A93B9CCBE21ABB55BF53D7F9503260951E44F7FD862C04E76DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f598b58d2d2c8d3d05599c60925802e92409b84c933242c5040e343d94c63faa
MD5 a437e4a547151af7f9040bd2f67124ba
SHA1 03a8ca1cc728eeaee542bf8afaf64b45697d4af6
SHA512 f5c03cde642e017ae3e326dc4e082f741ae74b02f7068d77c68816e1470572b4e2e59da2bfb3c1e1191328756f96f8281cb070f42fe54affc0a28a53981fb449
SSDEEP 192:sxR4RpBU1/fwsZZZTK6zoA8pLr/g6+WNZJ2XANi7a8GolIgDPJ:sxR49U/fwsZ3TK3v/5OXhV
TLSH
T1B742B759AD28A93B9CCBE21ABB55BF53D7F9503260951E48B7FC862C04E76DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d8a7dd4273e50b04561d7ae870574e50cd2c92e528ea8136135eaa396961ec63
MD5 7d0959bc5bc87b7b1b5f5a075a504d7c
SHA1 0888495d0b77fcae478f5640530db254985023cb
SHA512 f435c225090ec9aa435fe292d176dbe23afe0d3821f40cede81855a56dd3885497f85c5b4b3c7dc13f55aeff32659c85e3cd372abae9dda5a463af349644e530
SSDEEP 192:sxR4RpTU1/fwsHZZTK6zoA8p9r/g6+WNZ8Z/ANixa8GolIgDtJ:sxR4vU/fwsH3TK3Z/5O/P7
TLSH
T10442B919AD28A93B4CCBE21ABB55BF53D7F95032A1951E48F7FD862C04E76DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 59a7b17741323e40227c362a51dc690c903605164e5d9f15329085979bc17cde
MD5 8d04c949eb1e874fe1d4262a6e55ca68
SHA1 2b597508c108ed2da75f4b16795ce4732273c939
SHA512 20007375d0e50efb6dd38c320aba751e790899ccc8125c9b15ab19e04b6014cc495b82c51cb4212eafe94a7b84854de24743b24721aa358ca7d6ff0cd8c7343c
SSDEEP 192:sxRnRpTU1/fwsdZZTK6zoA8p9r/g6+WNZ8Z/ANixa8GolIgtJ:sxRnvU/fwsd3TK3Z/5O/P3
TLSH
T13642A819AD28A93B8CCBE219BB55BF53D7F96032A1951E48F7FD862C04E76DD120340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 85435ad30703d5053fc32a6af287875abfc0d7e4dadf778fbb8ed7c606b8992b
MD5 712dbcc5b9c50f205d07e4cc196cce5f
SHA1 b42b5ae6bc3a6f296d0c2979c4fd2ffe80da5c42
SHA512 8c8f23bbbcb9f20b90260ad76ec739be777e318a46955927978ee8877772a4bb584ff04558e39bbcafc709e2c3921c09d556c733096035fa75827f560c217abb
SSDEEP 768:XIDmj17pLuLbdoWgvHfnv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFmMIlj2roTVDB:XIDmjDEbdoWgvHfnvu1ja6mMmjNTVt
TLSH
T183D2EB7B640DCA7F4F800ADDEC297E9B6DA801CB9698C94047FA841D02D6BEF52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5d698f02-6ef6-4809-bf9b-f0e8dcabccd6\index-dir\the-real-index
Size 144B
SHA256 524bd2f24f60eb853274580d186f669d5962223797ba3e1aba905026063fb332
MD5 ad871f5ad4f8b960fe37630b4afb46f2
SHA1 d5e75a819933f4c5a4b11602456afd11efde2046
SHA512 2f9fc95c3850a96deb853d4afa1dddc2cdaf4f6a8e9639e94cbaf4864121ecd3763c3f090783bafdc293c5d8e1ac8b862b4b70339d7a6be0bef4f7b06b654e49
TLSH
T120C0125A9C61B101FCEA99F038FB30B0696508EDD0059B2A01FFF14DECB0FD9C2A1209
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5db420.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5d698f02-6ef6-4809-bf9b-f0e8dcabccd6\index-dir\the-real-index~RFe5db420.TMP
Size 144B
SHA256 3d146e6e09ac2274ce55342de2c41cef63ab287ac2d265a798d58f32c1578447
MD5 475834f5e0cbdbd717d06cb59f5c42a8
SHA1 d445ffc1680dc41d422c9d82594a87117933679c
SHA512 de8dd4ddb0950bf95a83ec592dacaa0913f9084c91420493a5b18074b9a3e378e272af7b6981178e2ab55b5f6a629d87001a8408400d8a83f2a13f147bec1d90
TLSH
T16EC012446D32B055FCE9E9F82CD7307115108C489412A62B41FDFB5D9CE0AE0CB22305
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 96bc52065291bbf9bf0f896a8b8d06e64bddb3b01612a1b047a20df794b27880
MD5 6e52ec7defd8a62715d8dc4bec0e3664
SHA1 2a931b79d7b8cf0355b114a9441ab9580358a192
SHA512 c89d23dd3ed2f3d0cc49a426d495c655d15ac4cfc10fda985969d4b819d00ed59e1d0bb7bf371fa1f9de1ee84e8ab566dfc0dc2aefd088194e306023639c2c34
TLSH
T1CAE0C0BF2EE72820FC7B87D574706070000178A8EA04ED4F443BC2C760A03542169C39
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0d05382dc998ccb55fe917dc70996f02dbfb813be82d8c2d14c02a2b7d7e18eb
MD5 561abdce98ea55e06694e14c7454edaf
SHA1 55d70c4022e6cbe6d763e634a072f978cd34fdcf
SHA512 9fb0acb416e0b7cb1044ac643d7ca3e4473b008542ab5f9f33e610472d35982513446f4c62eac194dc056a405183ca375ddd217b1e8811760c5257792147b921
SSDEEP 24:KEsles3sys6Bs/EsmsCsL/sysn1s6ISsOsLKpsEhBsYsL1bsUsbSds1jsQzsCs4f:KUoIvK1+cTylC1INK+ow3ypMInK1mci
TLSH
T13491F310343B1249387E7558A6B99B3E1282B1633025F63B7BE940A28F6FE044DFE5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 b4ce2f572731a297f2cfd1cbf1f72f66953cb88c8fc730ee2a25ab438f32ea79
MD5 1c55d32da3e9501190843e9a86e84bee
SHA1 56debfefc017031af1cd9b398b6366a32a3f64f4
SHA512 c643ea71ddc6ca4c33f177dfa6589ce549367626061fd7db23b6e48229de33d70e349f7ac5f96bb465ad93121f42fedbab5b45be48150dfa88b5a129e19da53b
SSDEEP 768:E/UxvxjgC+S3x6cZ0rfZWmYo/YorBw4Ot5AEl94BHYjHKAFTUQ:xZj3+S3KBVa5AEncHYjqAFoQ
TLSH
T10813BF38EC659D238CFAA785771B378B9FF114A394815ED49DD95D1E0E8328E170B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 456e91a33365dad502355c3ad0f68b2658d10dd4389216534fb2ed632ac5a17d
MD5 24cf3bacb25c7d7866a518ea2e7d8998
SHA1 b12e4a8c74f5c0b260e986b6a11be7806bcaf684
SHA512 5b2132651561e93847bb59c5a8ebee7dbec0cddd153d049dcf2d74ae2e7bf89789313023af755b5019728e4bf5e329e6274bb0c208324f8b41abe46eefb8873b
SSDEEP 768:fj3T6cZ0rfZWmYo/YoZBw4Ot5AEl94BHYjHKcTRD4:fj3wBVa5AEncHYjqcTRD4
TLSH
T18BF2BF78EC758D234CFAE386BA0737865FF151A399C15EC1E9CD6A1E0D8368A174B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 e6bc606e124ae2310238cdc92aff0eaba5b50e5855f8761de2cfa8b0caa90579
MD5 f3d0c9290805a6d75f8480296ebc2534
SHA1 d60446b6452f206307a8b36b06993a6bada6d202
SHA512 dc62a5807798b625168efe53b9f015e40a718f821613716871f5240d49531226147a660b3696c925e9cc18856028fe8b9b2a8da89629b09ee116144dd455206b
SSDEEP 768:RO3/6cZ0SbzsJWmYo/YoqBw4Ot5AEl94BHYjHKcTRD4:RO3JBVa5AEncHYjqcTRD4
TLSH
T107135BF498E78933C8AEA387673E3E455EBDD15374814A80BBC95A1ECD4317FD60A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 088f00f7478f4bc24ccf2890f924c6f3a4d0c4573047c37369513a652713dce7
MD5 26dae3b2f6064974be5a8382bf84ab32
SHA1 46400bce524b7afebefe89c235297c70beded6eb
SHA512 632aff902315ce129c250fba413c80aa13bbd248f503b50c994a696391e4310e3dc5b2e1099014279becf71d307b65663397c5a9a8cebc75ca997bd3e6175a3f
SSDEEP 768:z/UxvxjgC+b3nIcZ0rfZWmYoBBw4Ot5AEl94BHYj/bAFTN/:GZj3+b3eBVa5AEncHYjjAFB/
TLSH
T10D03BF39ECA559278CF6A785771A338BAEF18463A5C16ED48DDC2E1E0A8725D130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 439a0735576fd57ad77b6daa64f639c41a8a7e2054a8f36828eb97fb54e9ed35
MD5 1213505e2e5f2d9e2ad6ee3fd4f44c37
SHA1 84771362d85cb6bf6585b5310d2a95c9bc1cce16
SHA512 1993a587ddb30d2c8a0953eeda5202870e9daaa13af5158f17654eb2adf0178e34bae861f381748e254ef6f1e8b905508a97f8991c7ba34d9ef669618fe53f12
SSDEEP 768:v03J+0xcWmYo/Yo+Bw4Ot5AEl94BHYjHKcTRD4:v03nBVa5AEncHYjqcTRD4
TLSH
T1EC1317F898E78933D8EE9387673D2E465EBCD15375844980BBC95E1DCC821BFC60A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5c31842e1664b35fa3a50acd71fb36d96fa20f2ea288b8cd56a946618bd5815c
MD5 6cd9e80afd2cfb003133ab8ba52d8f8e
SHA1 55176120c51d857711f8ce144b9e263ee8f9712f
SHA512 a1038323843eadbcabe5fcbe34b80c98df3e538b4caade8865fdcfb3303ff5cf2d86299c7e28e448241a172d8df8e3ec4e400fb6f7d10d2beb32bce06a1d7f85
TLSH
T11811EFE15D391EC6C6BE0EAEA4873BED44E8A616B8E87078188CE958913951E2051C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9fb67212c8d86125f0c94498aacf0f20821354ee3d03a0e114e5c46587a59c4c
MD5 1e21f924e7b00cb8559ed5e1197dbe12
SHA1 7eabd14180e23c963b722ef6600f25e618badf4a
SHA512 e570cd20d4a9b640ed1467b60f24ba28615552a9074bb4e94b82b8a8f28de23f040ce7b259b5bb7376d5d06c861e96b2171b99e4ab6d7e7414b3175a31b2088c
TLSH
T1EA21FEE11D3A0EC6C5BD0EAFA0832AEC54E8A616B8D83074188CFD58913E41E2051C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 cf404f57ae1cd10fc2d112c68e9243f163cdc859ab2c645341f98a4fea67c9ab
MD5 b71e0902fa37e797e75cd9ae37891e41
SHA1 9915a40d83ec4f7d955ff1097bbde76edf972bd3
SHA512 3abe7f3cb00ee13203c18fe3497199f55f5d73b1d5bb250af8266ac6f6ec245061230f754dd275cfbad5dd02fb9644bc0eef06ad6c083edfc3ec82a925cc7186
TLSH
T19221FDA15C3D1AC6C1BD0DAFB0872AEC50E8A612F8D83478289CFD68913E52E2150C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 f837a0be79824b3ec6f3abca5350dfc7c56fc8e114e0bd4f52c3f8136da186e6
MD5 2028f83487553bbb26a0fd35240568f1
SHA1 69311c7b88dbc2d714c63ffb128c45a77993a372
SHA512 95490eb641e7973f170d67b9ed8606a774fc9049b1eebba2eaed7a32b1d591f4a427c7054aa4f769a5d2d728dc5b311b3f09f16cb3c757d551de6ba9e2a7f2bb
TLSH
T1221110D14C3A1AC7C6BE0EAEA0872BEC04D86613B4983074188CF958903941E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2696_1646480006\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2696_916377430\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download