c3d8ceb42ae6ab89d2b6f002431566e744c84ef0e22717654259b4d748d48e56

Analysis

user interaction
yes
max time kernel
174s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/09/2026, 23:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wqa2hja4.html
Size 28KB
Sample260920-3grgcsvwbx
SHA256 c3d8ceb42ae6ab89d2b6f002431566e744c84ef0e22717654259b4d748d48e56
MD5 5771011f8c8db8bc070780fb58ac99e3
SHA1 4879989ad76a75894b7bc460d6d1c6b797895fc7
SHA512 25efc4afb799ee4819536347062bfa66d5c8d6b5a8a46535f548c280a5328650e3e9ca74b139c0ed61ebcb2708ecdb7fe07975b72d3257be66ea5c6e04bf83e9
SSDEEP 768:wpR/RMkZRLRqwk/Rf6RDRhR22qfRHYRMmRoMnSS+FyUOZasRW:wwT2QpMSt
TLSH
T1ABD2972B51C42817033EC2C9AD7AF76DF84690ABC246882374AD5B4B6FF6E57C42385D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery phishing spyware stealer

Malware Config

Signatures

A potential corporate email address has been identified in the URL 1 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	207	[email protected]	3092	msedge.exe	3

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	Ledger-Wallet-4.19.0-win-x64.exe

Executes dropped EXE 2 IoCs

pid	Process
4788	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe

Loads dropped DLL 19 IoCs

pid	Process
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
3064	chrome.exe
2784	msedge.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
475	discord.com
476	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3092	msedge.exe
6216	msedge.exe
896	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Ledger-Wallet-4.19.0-win-x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Ledger-Wallet-4.19.0-win-x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134344205761994839"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{0EB10423-77B6-4656-B9D7-90B84200A7E7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{48FF5834-1B93-4003-BB46-EF5AD420C1B3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{8E14885E-0E36-4F79-8587-21868119BD47}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe
2012	Ledger-Wallet-4.19.0-win-x64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeRestorePrivilege	5480	7zG.exe
Token: 35	5480	7zG.exe
Token: SeSecurityPrivilege	5480	7zG.exe
Token: SeSecurityPrivilege	5480	7zG.exe
Token: SeRestorePrivilege	6748	7zG.exe
Token: 35	6748	7zG.exe
Token: SeSecurityPrivilege	6748	7zG.exe
Token: SeSecurityPrivilege	6748	7zG.exe
Token: SeDebugPrivilege	5856	taskmgr.exe
Token: SeSystemProfilePrivilege	5856	taskmgr.exe
Token: SeCreateGlobalPrivilege	5856	taskmgr.exe
Token: 33	5856	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5856	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
5480	7zG.exe
6748	7zG.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe
5856	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2012	Ledger-Wallet-4.19.0-win-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 1700	636	msedge.exe	85
PID 636 wrote to memory of 3092	636	msedge.exe	86
PID 636 wrote to memory of 3996	636	msedge.exe	87
PID 636 wrote to memory of 3996	636	msedge.exe	87
PID 636 wrote to memory of 3996	636	msedge.exe	87
PID 636 wrote to memory of 2732	636	msedge.exe	89
PID 636 wrote to memory of 2732	636	msedge.exe	89
PID 636 wrote to memory of 1068	636	msedge.exe	90
PID 636 wrote to memory of 1068	636	msedge.exe	90
PID 636 wrote to memory of 1852	636	msedge.exe	91
PID 636 wrote to memory of 1068	636	msedge.exe	90
PID 636 wrote to memory of 1852	636	msedge.exe	91
PID 636 wrote to memory of 1852	636	msedge.exe	91
PID 636 wrote to memory of 2828	636	msedge.exe	92
PID 636 wrote to memory of 2828	636	msedge.exe	92
PID 636 wrote to memory of 2828	636	msedge.exe	92
PID 636 wrote to memory of 3232	636	msedge.exe	93
PID 636 wrote to memory of 3232	636	msedge.exe	93
PID 636 wrote to memory of 3232	636	msedge.exe	93
PID 636 wrote to memory of 5024	636	msedge.exe	98
PID 636 wrote to memory of 5024	636	msedge.exe	98
PID 636 wrote to memory of 976	636	msedge.exe	99
PID 636 wrote to memory of 976	636	msedge.exe	99
PID 636 wrote to memory of 1792	636	msedge.exe	101
PID 636 wrote to memory of 4580	636	msedge.exe	108
PID 636 wrote to memory of 4580	636	msedge.exe	108
PID 636 wrote to memory of 4580	636	msedge.exe	108
PID 636 wrote to memory of 3884	636	msedge.exe	109
PID 636 wrote to memory of 3884	636	msedge.exe	109
PID 636 wrote to memory of 3884	636	msedge.exe	109
PID 636 wrote to memory of 4900	636	msedge.exe	110
PID 636 wrote to memory of 4900	636	msedge.exe	110
PID 636 wrote to memory of 4900	636	msedge.exe	110
PID 636 wrote to memory of 2624	636	msedge.exe	111
PID 636 wrote to memory of 2624	636	msedge.exe	111
PID 636 wrote to memory of 4580	636	msedge.exe	114
PID 636 wrote to memory of 4580	636	msedge.exe	114
PID 636 wrote to memory of 5556	636	msedge.exe	118
PID 636 wrote to memory of 5556	636	msedge.exe	118
PID 636 wrote to memory of 5556	636	msedge.exe	118
PID 636 wrote to memory of 5832	636	msedge.exe	119
PID 636 wrote to memory of 5832	636	msedge.exe	119
PID 636 wrote to memory of 5832	636	msedge.exe	119
PID 636 wrote to memory of 6100	636	msedge.exe	121
PID 636 wrote to memory of 6100	636	msedge.exe	121
PID 636 wrote to memory of 6100	636	msedge.exe	121
PID 636 wrote to memory of 5196	636	msedge.exe	122
PID 636 wrote to memory of 5444	636	msedge.exe	124
PID 636 wrote to memory of 228	636	msedge.exe	125
PID 636 wrote to memory of 5452	636	msedge.exe	126
PID 636 wrote to memory of 5620	636	msedge.exe	127
PID 636 wrote to memory of 5288	636	msedge.exe	128
PID 636 wrote to memory of 5620	636	msedge.exe	127
PID 636 wrote to memory of 5288	636	msedge.exe	128
PID 636 wrote to memory of 5288	636	msedge.exe	128
PID 636 wrote to memory of 5748	636	msedge.exe	129
PID 636 wrote to memory of 2760	636	msedge.exe	137
PID 636 wrote to memory of 2760	636	msedge.exe	137
PID 636 wrote to memory of 2760	636	msedge.exe	137
PID 636 wrote to memory of 6404	636	msedge.exe	140
PID 636 wrote to memory of 6404	636	msedge.exe	140
PID 636 wrote to memory of 6696	636	msedge.exe	141
PID 636 wrote to memory of 6696	636	msedge.exe	141
PID 5508 wrote to memory of 2784	5508	msedge.exe	156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\wqa2hja4.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2e4,0x7fffa090c188,0x7fffa090c194,0x7fffa090c1a0
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,15771952146226681726,5717073916074358449,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,9808761303094585045,14840300141725294357,262144 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,6323091443999626126,6115594449391244055,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,1717068131686092375,11802055401504484086,2097152 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,10702112489175371150,2976436664200803007,2097152 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,2678864112445983233,1460262955770763469,2097152 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,9767944948658080175,9238364854989079192,2097152 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,14701431084981238069,18187987438867564007,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,12812659580318423265,9102331757987667453,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,14604475382263021037,3439277714861126107,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,14604475382263021037,3439277714861126107,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6308,i,5699821611239844808,17927070647229052042,2097152 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6508,i,8687391256041797406,1126378979276138968,2097152 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6644,i,12713023611387651049,12735822622231271589,2097152 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,16905573223614886990,17230628196301813187,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,13593862214816070286,15162359664015928143,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4404,i,2459808675215986570,2976767762260987580,2097152 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5960,i,12051488572541256108,5285007998488448368,2097152 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6916,i,2805356531369479557,7368517418934514806,2097152 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7620,i,12787683893038552924,11880846174655375866,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7808,i,13784617500863283081,951804356413962972,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:8
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7236,i,4727070652651210990,11883465112602071222,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,4239180242927376199,2737251995374950265,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7804,i,10913112571342150741,3840451157967630088,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7384,i,192574143164375173,14092934693297127081,2097152 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7892,i,1853001739290668182,8544122080159106802,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4340,i,9920972789252459856,3344796108713710712,2097152 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,11495603026905502215,939424535113495656,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:6404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,5637076117570295079,17156168541549607724,524288 --field-trial-handle=2184,i,10870985191012424327,3919996193793026071,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:8
  2⤵
  PID:6696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4776

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:220

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap22421:128:7zEvent25498
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5480

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Ledger-Wallet-4.19.0-win-x64-v2.4\" -spe -an -ai#7zMap21747:128:7zEvent16804
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6748

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:6740
- C:\Users\Admin\Downloads\Ledger-Wallet-4.19.0-win-x64-v2.4\Ledger-Wallet-4.19.0-win-x64.exe
  Ledger-Wallet-4.19.0-win-x64.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- - C:\Users\Admin\Downloads\Ledger-Wallet-4.19.0-win-x64-v2.4\Ledger-Wallet-4.19.0-win-x64.exe
    C:\Users\Admin\Downloads\Ledger-Wallet-4.19.0-win-x64-v2.4\Ledger-Wallet-4.19.0-win-x64.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window
      4⤵
      Enumerates system info in registry
      PID:4428
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff9e3bc728,0x7fff9e3bc734,0x7fff9e3bc740
        5⤵
        Loads dropped DLL
        
        PID:3064
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --exception-pointers=61881889783808 --process=164 /prefetch:7 --thread=1076
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5760
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,13342387215018223356,11191632070701510057,524288 --field-trial-handle=1720,i,3083977022268003871,11792374966888794215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2244 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,11486375790446047571,2011265923966689174,262144 --field-trial-handle=1720,i,3083977022268003871,11792374966888794215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1716 /prefetch:2
        5⤵
        
        PID:1952
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,380161154056528380,4023312053321350222,524288 --field-trial-handle=1720,i,3083977022268003871,11792374966888794215,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2272 /prefetch:8
        5⤵
        
        PID:3328

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7fffa090c188,0x7fffa090c194,0x7fffa090c1a0
    3⤵
    PID:5608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,7888776963105623251,15478774534938137672,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - System Time Discovery
    PID:6216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,10657575510615634472,402709703642189819,262144 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
    3⤵
    PID:6232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,13288943226177426363,2045422064873724025,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,14263375776577788009,14833631362169110989,2097152 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,7558327314879441241,14154597321908102010,2097152 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:6804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,17275177177100140917,15232241990730357155,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,4035096668393899364,2245099632026601805,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,10650013513796051173,1751250460066082756,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
    3⤵
    PID:6408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4976,i,8599862403114953828,8179316394360684369,2097152 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5176,i,7899308469508989058,12615606306112947661,2097152 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4984,i,6010803500716306221,1964319104885391091,2097152 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=556,i,9752513528173734679,6142894584650277171,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
    3⤵
    PID:6224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,8899481449162694796,9748635168902343657,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
    3⤵
    PID:6440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,3809189047473520295,4425993669965578398,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
    3⤵
    PID:6780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,16901792199162856439,17641671494967777949,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
    3⤵
    PID:6532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,3562192275289461317,11147146440768270329,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,730060823522462299,8201544653307172880,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,730060823522462299,8201544653307172880,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,10487872693184954337,15378105816791987137,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,9193302697092348950,10313614877741557838,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
    3⤵
    PID:6352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,4194267145059495626,10402612020505476900,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,1540453962117187425,9220170407224911884,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,11610815285014984520,10135456996250793169,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6612,i,2401850576015574169,5954091239286949509,2097152 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,8634920349251957546,9053610962787206230,524288 --field-trial-handle=2280,i,4768047401938898741,4461325337362054855,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
    3⤵
    PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6cc29728ec7f1de55c37c35f3ce5c5ae8397ecc6d39a4b935e0c0c78d0caf55a
MD5 99195cbdb71468888f0e3324c1a4cc20
SHA1 cf71270aaf2f691d6e1956c99ad443a0bf2e422b
SHA512 6f4688a018df806f9931c0d17a4a6c45a03d87a0d50fadfad7d50e4e360583d976d69aab73a05eb27bb8dde537a1b305948be9776656b3c88813e87a3aea4bae
SSDEEP 192:yRI/VZ6LqjxYAv7TpAPRp2V9WHsb+WNnxC2UHxyIsnAUge:yRI/T66YcvUX6UwQ2ie
TLSH
T14332832DEE14B53B9CDBD22AF9267B53E3F9102124A02E44E6FC893C25E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 33984f55ea56f159544f3428c0d50b7175e966158efbe8c0e40b6847937712db
MD5 26bae11bbf8331e583f6aa9b6487b2c2
SHA1 eae3723a640ddc4d17335b4ff4fd47d8a9556fdb
SHA512 1a457b2a641157fd3dbe1ed2de4126903f671da1f87001a0ad99a7f454232ee137b1c6333013d38a5bc9131fb5b1a84c34aafa62ec20b312caa051ea8df00b07
SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5S7pLuLcIZkXOD/q+ErU3v7HGISVpQZ:TN/O7KxkXqKf/pUZNCgVLH2HfgsvS7pC
TLSH
T1E3720967BC489A3B0F94C5CCD8167B4FECB9024B65E9886446FB982503D5BDF11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 318be915858248ab88a7f267ae584aa0d811273ebe73468376b8de6de405277b
MD5 a1d157d79660254ad8d8b3ebba656ec1
SHA1 468c47197253123f71c9c21f0f5beba4d914d862
SHA512 07325404aab696f0c6a87ec1a92a69c0b065ca08f29e7090ff0de976da49ceae8fcf6e2c8eef62ce631758101eb9a268dff736b53c1b635088d75be0f559bc51
SSDEEP 3072:y+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:y+hFD+7t56OD9ZfSApprU
TLSH
T101D31232AA91D87BC9FD5541B297A300DD666CED41DE2B09444A5F8EE09FC4D07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 0fa550ee942fd81781f93ba03e3e8771990faf46ba3d568e9368691d166ed0ed
MD5 d55c65a248e98aa851379e4cf421ed9e
SHA1 63f5dab6eb66e6974c172c46ebcebe99db478884
SHA512 c09db22531e13387fa8072be68a1b58148b6c281b880fce2a36beb7732307f73d8f654cda03c8e37021b76fd5efbf68823726097481ca834a23c82c1ebf279bf
SSDEEP 3072:b+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:b+hFD+7t56OD9ZfSApprU
TLSH
T156D31232A994D87BCDFD6541B187A300CE7268ED41DE6A09444A5F8EA0DFC4D07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c5d2e3a54f03904bbe55eebd2e15796e5b26d6e7120a6693c971408f22102794
MD5 4656163abf32e5ab1a0774c2d3ffd3c0
SHA1 7bb2730f110962fe6a55dcf63196da9d74635fdd
SHA512 2096bbc1475260d24baaa9e51217bd19dd5edfd500aa9c96f8c9ec0510a31f436be7ca6a34af3ec2478245bbace0f09d84f152f56ad9a37ae2441e8f22301bc7
TLSH
T1C9D08094D4B47AF8F035313D5136450177CCDF96F603235A91454956C8501C309F1DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 496477d34a0b4ed0abfe792da475ad519e4500215035e0e6881e4f702d702177
MD5 426c15bfb0079f847e1a32c48f779e4a
SHA1 0bee3c4a01d5d86aad39bceac99563f257661295
SHA512 682125e703de96474b2f48fbe651049d115a7fa0509df55be00f57adb913eaa3185e86bdb060a42bcd8e9f1d684d90fe9bbdb57f2f5b568477ae2fa0f6b81f89
TLSH
T111D02BC8D4D47558E01630355036850233CCDD98F003224680490591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

7b575639-3341-4479-bc62-0e9efc4cf49f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7b575639-3341-4479-bc62-0e9efc4cf49f.tmp
Size 414B
SHA256 e907a79f214aa8e1938eea8b2a16d6723fcb49cbc1f8b008c3f53738fd5ec42d
MD5 f0fa58a03b03bbd18db82baf41f1fb1b
SHA1 b5241908c2f16034ed9cccb90970144ff47ddeec
SHA512 c09b497a9cdf465887f91047ffeb5d32f898d9f3aecf6f9576c9e52116f1c286a9ba2b93fe46c1bf98edc751090a2431d9f16ceadbf36974471c90fcab47dbad
TLSH
T1F5E0E5A9C930EC6718FD1B68A1200A4AEA5413673640654F373C530C8FB1A3605C685C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 415KB
SHA256 010aadec8e80a12ba20e84b1401cca4b01d1157397eb4c31db0d195e46c240b6
MD5 6dae65294ad6cd7de25087b4e25879c4
SHA1 33ede3b35c5e9219802f5f351f3001188a58c735
SHA512 1b03200267062593a87e05eacad8296a82183fcb51af7b9684ba5f528fc54571247a537d853da43b4079f642d2ae1e837bf5fd8dcfdee1cab54045e0b7f9c49e
SSDEEP 12288:1aveBHOcagoXICIzZ9V7UVdBfQ8CHgpaeKYe/I:oveBu7goXIJlnqH2H6Q/I
TLSH
T1709423A43C5C5293513AB6E72412CB03281EA3E4D66CC7C627EDFB8B5A477B0A763507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 72KB
SHA256 4661b99deec46e6627b253ef5cdf6ea0677e30463d50cc61b2700dd3a00721ea
MD5 76603641df6823ed5813363615826c6a
SHA1 e95296f27c36dce1ece3add884b3f6c2c0ee4200
SHA512 30cd5120f3f97c138e4ca19ca6186bed24db72691787b3da50e1334296b8e4142612de329e167591c629f236675df0ab0a9c1e5e1923b16f2f454ef18373a442
SSDEEP 1536:dgtiO8VyNU9mnSxEsMYLbaiHuVF8G26YSQ5xmdRRgfHimOCQb8:StJ8VMMqOMY3aiC8GEmdRiCmOC88
TLSH
T117731220A097A859B96440485D55DFC9A89450E187ABFC8B78FCCF7B70030A5DDB7FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 205KB
SHA256 133a44311166b3cb4b266c73c882c5663b6373e1a3853b84e42fe81a30335ca7
MD5 8ed3294f2f3f1c25464e2cbfd6fe3073
SHA1 d21ea54216a89d71383dc47f4d8340aabdb853ca
SHA512 95fc9334b601875f636d390fa53ce97976da59c2db4d9b6a7b47a3da6a3984cc10d01546d35061182fa0d7bcb5ac6a7455913c691a03961f19f751075136d6f2
SSDEEP 6144:Vhbouofi66xJwd08RHTjZHNDxMkASzAVQ9wMZVtkzgY6:V2uU7MJuhPZNIz3MZX
TLSH
T1402422A16B5E991113875222A7A6540BDCEC0CDFEDB8D127F3AD93055F2983C120ADFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 77KB
SHA256 06fad0d8b7565dd44adf01fae850b4efcc89694268b5ca3c110fcc242e7878aa
MD5 223bd38f79c11992ae08244c4340d137
SHA1 857726e193e2f9b9b72773255199327be09fabd9
SHA512 a3c2d2670ca2df8d3f4ca8373d53839d550ba3328340cb5c0695372c3013df1a2b2d2d8736e8ca107a487efa89109c405690005bfc1c94fb814a6d48928ba5dd
SSDEEP 1536:h0vPbdLNkwEcbGMlrYlWK7izwt9QwJKbAlMKU11i6EWpe2oL:W3bvkwEcbVlAWKUwFl5WpKL
TLSH
T1AA7302003FAD11C8F792B66904C9CAC6682715903C429E5F6DD0ACF5E791BA2FE391DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 256KB
SHA256 266387d6179d8cd4661ef22124dc479059fe8e40758feb4022b2cca865cb654a
MD5 fcd6fe1438e4149e6a7128144033a8d4
SHA1 360237dcd048317694abe16fa8d8e9d0445969a2
SHA512 24b22bb6a1388315f42f20495d5593da0ec537840f9ae46e4cb71cb090f1611d341492f7cf091dcacbb8d85478f4e4e51e45801b505708bab2e597717fe07fe1
SSDEEP 6144:fc89w5sS4So6X7GUfKyxW12Hngz1DwVETKG5:fHQ48XViyxWjZ3F
TLSH
T1E6440250FB564388DB032A36E4583E671E626AD530D37A0906A4BC12F81699FF33FB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 512KB
SHA256 3524d8883e4d5781b6215c05f97d1232b442cd41f66cc59723de6c5e19399ba3
MD5 a0355e6554046083e262e04dd1ee6199
SHA1 73f053d90ec3e9ddf235f2f79902350096be795f
SHA512 3e794941897c103033e709913af6e7057295c2e9f4587f19d1a13bcc867c86f6816d168245660195ea96ac17c833696abad4a4f034aa9dc2a45033ca09d52a11
SSDEEP 6144:aVIHGR+Y4LbXL9wD4GR9R9YsRUhovbfxGyTmSfKcKApMqdjdLi9NrMCrx4F:JU+YI9wD4GVwdVALzu9NQCo
TLSH
T1B2B423E9E1268529D30484B1BD769D0939BA3B681DEF3D4B04009A62FBEF1D0761EFD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c5
Size 38KB
SHA256 c9f4d7b0618304f5b60161ad648cc2e7fa9e70d79d29d4055d8ae6cbab56d183
MD5 76bf70fe3a30ec740fc43afaa5b9809a
SHA1 e5d7a1cc9500e6d4738bfdf67e589067965db8bb
SHA512 7a4515836498de895590587eeb258fb98ae28d569ca0fa5b8894b77b91e0fda93c54e5af2814b43872625f9d5853bc5f3bba067e79ce5832626a0c27f58ba079
SSDEEP 768:E7yCM+esvzre8y7qtUoU5B9UW0v+cb9ywWEpWqQbWfk3eQ4FLL:ekA+KJU79l02G95z0bW8OQW
TLSH
T1D90302469AFC50ED40F3EF92C057E3EBD4784588A6917ED523236BE5EA48D83D302886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c7
Size 45KB
SHA256 9f09a01a3e0171e6650a3c8b503adcabcd11a8db200a94b240dfd216f504f722
MD5 fc74e451b871d4155c26682644ae6d0b
SHA1 cd5625b952b7571d55525543600a47c97056ee37
SHA512 c0dd4ab299e1dac261099f8b98dc6de55746107686e391c459a31305905d1d393651e95505899dc07508d761646266340ca7bd39e5dc7d99b0c757f3269c394c
SSDEEP 768:kq0I7CTZwBppn7lnuJx8zQ+NUvYNKdgz8Z1Yhv6qt3BbQrc+5/yjik/jMA:Rzckd7puJx8z5NUvKOgU1YhVoc+ZTkLl
TLSH
T11923018583B844C1264BD8259665E7B241B7A70B53378B360B5E09FC3CC5DC6BB4F6D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 c9cd259e0f272f944208dfce0c62d58f55ba0bc441aadd45c344bf222abb5906
MD5 cfcb5646dce3f79ab9310aef1d366c3e
SHA1 5d0b34524b9e5a7767ca7869f233d36120cfb9c4
SHA512 2fdac15d39acffd85c9c047156a045b1539755154c9efecf825aa68bd02b23cca2aadc1cfb39d5e83d09f8e5bbac915fddd95d04c948a2e29ed0a195cca9c8e6
SSDEEP 96:cbThOMF1WUKgdCutfKBmUSGsgJPrr78iFBtW+VXijJAen6ylqZx:c/IYWUKGC77SI78Su+JiNd6Zx
TLSH
T17EC14F46F4E01646FF6B747863A5BEBA3C55A60D54874B0F3426E83A994378863D8C88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 6c6ac16a0a66972eec71bb8241e528edc99dd9246f2b63e9f7e9e7ceb05fadef
MD5 993146d01effde551d6b751dfd1468ad
SHA1 7512077375ee580fae0dcc612fffaaa6d526d0c9
SHA512 67d90e900073ebe9869570ed17034ab8e3c1fd6e6665977c4b48c2cd6e3dd429fe309b09b6d21bab6bfc95323f6a0ecaf48cc1ed579db8e38492b45b56a23931
SSDEEP 96:kaDyELYMR4s/XwG4ZJc09/6zbrle6SoSMG7fWe2Uu+bn:zDyQpS3GIJc8Ge6SoQjWibb
TLSH
T1CBB15345F0B01A4AFF493070B3F56ABA3D1D564C048F1A0F3065F864EAC375A939AC88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe598ab2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598ab2.TMP
Size 3KB
SHA256 729286f374f29562bbcaf9dcbcc8d15d1dbbb4eaeb495137496605111ad5f0c5
MD5 9538193dda7bd4968c81fcafef30bf40
SHA1 75db4212c6adc3508ecd29989e51d7e2b0b09f7b
SHA512 e59d75c2643a264a6c6c6b96ae04bf2748598b35c853c9d9aaba881ed47462340e8c417772af73676c6d9700f4260d80eeb0337d5e25163d9ec8342ada6a0198
TLSH
T15761F98581A00F5BFFA8403892F672BF3674A88288C3DD6E30A9F8795D5674863DCC0C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 64KB
SHA256 1f5a70803323a908901243b6ca4f470f62752faa6a79c4d6b8ddc038c5fc3e35
MD5 678951b82a09b3912729e7b9cfbaba82
SHA1 cc16a3f6004c61e637798f65f24c43af374ffe09
SHA512 3469462d58058d4d565a50756a38373b4a162653531af65833a5b0bd27c29c57811caad7c7ccb1e55f0933a5dc616361e90dd528931bf95961f0662f298a87af
SSDEEP 768:lRYjR/1zMRwRBFwhBbFQvQ/kOX/CGWHwFYUtVtbY957My:EBZSwRBFwhBbHkahFtUb
TLSH
T1F4539FE71D3010A3EFB069B6322D7549E527168C2DFEADCDA1D54D039AE2A25304F7E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 256KB
SHA256 6baaf03f9fabdba5f80a3784726d20455079a26c7560cee4be04b1e25539e8e7
MD5 89445293e7d2bd08167e9918233a7b36
SHA1 c68cb8f9f2ac754e1bee3fed8c16c5de19dc440e
SHA512 1722ca973c0a5fc3143bdcede0767341350f69634efa9ef60f2d9d465b024c21d0dfc816280ac48881283822e18fe3c0569c6f0175aed931bcf050f9b6a55fe8
SSDEEP 768:+Y0tDJptTBBxU3hY0tKOH6OHdwhBDwhBRFQHFQ:+pU3hY3swhBDwhBRW
TLSH
T1E2445CDF2D301123DEB454B5346AB48E98AA752D4FE5BDCDA4A10813CFE3E26304E5E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 8KB
SHA256 411d34f467a3cdbd47597b49743745754ab0ea645135bd29792c52f20ef64f2a
MD5 42de26f51fc370eeb71e0eb63be7b3a1
SHA1 73f1bc9ab527cd7c22507d434067bc4b79499a1f
SHA512 90571dc46953ac014f34aa4c4e7811d2e15d03b2c88fe14465260904b1b2f16f32970086683552e3401942314f360653f136304e882e52327410d1161919841f
SSDEEP 3:tGuev3lljq7A/mhWJFuQ3sVkWUdd/ln4dwenqFtjE9SFcTpz0WWaV1vGrV9RUIQn:Ks7nVkL4d4FS99pzTB1eB6
TLSH
T1070212414B509573EC08A73DA28341E85F72780C9851DC4982088C120E609DC534445E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 386B
SHA256 8ffff9c8f1d73ed4f21b5d02e92e8a0d5ddbc8d3f81ddf9a7128ee27ccb79ad5
MD5 a000f1784e2767028c6487444d57f214
SHA1 ecf37c1c2433384465723e2a8d86f5fbc2a44ed2
SHA512 483ae063f9ea47afa3bbc383cafcd3b004d29f1d01250c3140259711dc2d6304568e708bc49d3880375cd9e5078666c729753fd7d7f22cc471e7e6b43240777a
TLSH
T191E06DB865CDC25FA55462A68624BF0CD2A3378FD68CAE835B0888B5B081140B5FD991
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old
Size 383B
SHA256 93b22a1b86b45dc71c159b0ba68bf5125d788904b70953631c939dda847a766b
MD5 ab1c5c2b920ba49f964158071cf9ae3f
SHA1 1265c733737f5193b47f39d6a12c415f4b6fc771
SHA512 a509a67b64fb30e4265e631752c7aca163d32c87f4331b93627b8d9801eaada16e9d92e16d205cee2ba6bb32d785d15c88ed60b662970a3fe17af26f62489641
TLSH
T1E3E06DB844DEC25FA11422A68529BF0C96F3370FD6CC6FC21B0CC858B082140B6BE5A2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 19KB
SHA256 876812b78e04832c75f98fd2ccddb5b67a20c1973635899b369938017398e972
MD5 912e80c80c23c7f26b8ae33e2355784a
SHA1 1bd794f1b8fe7fabac83b1158686369f2ef68673
SHA512 44a6a34794101b1a803ec79404bd6cf2174d7287bba66319efa8917627f982119c18216e6624c11878ae32fbfb300116fd127307deb9345d046650cfca873027
SSDEEP 192:CJ/HZB9QcBo5QmbJwRoJnrHotnsnIh7OZYMd1tboVpNDk:KRHgJwRo1mnwIh7OZX0VpNDk
TLSH
T1A29294F7181CD457DB8528DAC6B3FE4DD2438D3BCED5F9D9D2A8849E06AC03436A6242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 a7508d09082800cb9e243aa24c978095a83f0778c6b1bfb66d85b5635315008c
MD5 1ab052956c158758065e6135aa2be932
SHA1 ccc74208230191cbc5add0ca48c0897f01c211f9
SHA512 5715dd424253f63d03f9145ff3ee13595e26c1aa1bcc0dfab5f5b0eac33f05314c2688ea81896e036501e48e4e0ac2b7dc62581deeb024f664eff74dd8a34e19
TLSH
T186E0D87849FDC11D62046187872B7B18C3A0390BD7CC2B471B059884F582104A68A9D6
MD5 SHA1 SHA512 TLSH

Submit Download

309e4a8d-6a09-4a60-9454-9bc67a49d35c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\309e4a8d-6a09-4a60-9454-9bc67a49d35c.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 558e1a106aed700f8bda7765bd1252f4703419e2927eb35b0cd795a25d5ab318
MD5 173b0a191c92d1ec7c3b2dc1b8fd83f3
SHA1 edcef6669f9b76d7406983e2b0c64d13b629d5ab
SHA512 8b7d30ead50487b23b3b911e53e8466ee1a298a69e8e0592debcc6c60c5ac6b77f7ef31011cabaafc6ab58af22d842614a96f2657a2790c9d1ab1110a7b22b1c
SSDEEP 384:D/+AP6cS+8eCRp0mq8EPt2oI9EGNQ3ZW5ZGvw3ZHI2qLEwGqjc7prqTc+7/tGstK:cqQHB2RA
TLSH
T15852AEF7C3E5862DC81256F49B15AF1BCE1D0925432C3C2AC8E9AF5BA3E2471E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 be26971cce158600ff3b6eabcb7e453f080d9c896aafedfdab12c2804fa77fce
MD5 e132f28b66a4086ce22bfc2a457f5e3a
SHA1 ed5247746ae419a9c68644b4baee26f4d54e3bb5
SHA512 1e22785a8772af169218d34e564a60c7c1ebe61ac856ba71095193aab8eaaf88a53eeacbd5d0ccdc3896a4980290d52495d8a8480c655a84f1a878eefc4462c9
SSDEEP 192:sxZhQUnhRsCW1/fdsydQefVrpPbTGddpJP9SfQHW6+WNMswO75mqU7/YaNYOIg5I:sxZJnhs1/fdsyd1frH4xHbPUB/D+
TLSH
T1875208136D242A7BCDD3D119BA19BF13EAF9507295905E99E7FC8A1C04F6BDD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b3498429a5f558def7a0bca86be5ac7537045207d057a892a2a7ac1bf14f83ad
MD5 f7e27a7127e5305f201d107326cc3d28
SHA1 77167b1085ce2fc3bdc5f73837c1243979c16e79
SHA512 84de74d88b9f76c672d1262bcb4c66a61a244a9c1e2ba0a145115720abf2655f90da6d1415618c199ea9bbd5342efea2e23f8b56ca4c2a43b7261c5875b5b433
SSDEEP 192:sxZWRsCW1/fdspdGeMwbbLDdpm8sQHW6+WNMq5mqU7/YadYOIgrJ:sxZWs1/fdspd/MIvvHb+B/T9
TLSH
T1CA32E8526D38697B8CC7D219BE18BF53E6F9503291D41E89F6FC8A1C04E6ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5cbbad65a7326a6f1f0977aecfe002814668d65884b31ac49e7e9ec80401d92d
MD5 d7dc187a0ac4692f529879dd95f2654b
SHA1 12e668c6d5669175ff4f9b30bc43dfa1c61f4e80
SHA512 cc6e31ff110f5290e4a1020e784ddadcaa41ae28df79bb283aa41224167770b58fd2d99c402f6df5591710105c668f357949bdd1b02b2ad1928bd9d920781dc3
SSDEEP 192:sxZhQUnPRsCn1/fdsydQekOCVrpPbTGddp6ByBKZO09SYQVuCW6+WNMswO75mqU7:sxZJnPV1/fdsyd1kOCrH4FBbPUB/k+
TLSH
T16362074368241A7BCDD3D159BA15BF27EAF9403295945E99E7FCCA1C08F6BDD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e2d718ca5aa9cdf531cba18cd14365e6ba4b0f238b7932fd328bf54a2e3e620b
MD5 37277fb46c41280d4788bf415861855a
SHA1 5ef25d741e024dd3c72c5b00095e6a59ca485798
SHA512 69a625291cc7d07942c3c1d56ee75ff40b5acfb7b8405142ce813f8b697949decb39d75e3ec5c74898ab41eeafef7bcf600e8c454f0d5167a06553284b6ab7ed
SSDEEP 192:sxZhQUnMRsFt1/fds3eNOCJr5NbWunodp6ByBKZO0O0YQVuCW6+WNpuwO75mq7vT:sxZJnMA1/fdsONOCXIHMBbGUifey+Q/r
TLSH
T1AC72E553A8341A7BCDD3C169BA15BF27EAF9103295944E99E7FCCA1C04E6BDD2203847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 836897a8e6ce759627ac1fd4e65f4efef1f753552396e5309348e3aad4ace952
MD5 beacf3c1911307a51f891b9c6b311ee2
SHA1 83b60056c8b3fcc08ddac928c11fb7a2390b739f
SHA512 9f3cb5b9bb2a65a7e5d514d80d1a4a2acce05b48f73a515ca1a12f5f0a46dd01e0f0da82b8a3ec3fdb6a61141b9540298ad8a31a17544e1fdbc950b8c39b1a81
SSDEEP 192:sxZhQUnhRsCW1/fdsydtefVr/9bTfddpJP9SfQHW6+WNMsQxD5mqU7/Ya4YOIg56:sxZJnhs1/fdsyd4fRN5xHbg8B/eU
TLSH
T1A052F8036D242A3BCDD7D119BA15BF17EAF8407295944E99E7FC8A1C08E6BDD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2b92dccbb2ffeb71bc922eb42bbab0b927d6a6bb0688fa211dabcf99306ba67d
MD5 439bf59307676f6e5f2c7c8306adcc25
SHA1 749cbe74c0bf7dd54947a460caa8610da6c8d619
SHA512 54934fcfdc07a1f5d1ee31df25c8f61882197b4eea18826f8dcf4c6a7c76e752f05236bda8680f61fdc1c5b00deb9dab5f2711241f2888da17b1ab6a1ff32518
SSDEEP 192:sxZhQUnPRsCn1/fdsydQekOCVrpPbTGddpAByBKZO09SYQVuCW6+WNMswO75mqUG:sxZJnPV1/fdsyd1kOCrH4bBbPUB/D+
TLSH
T10D62074369242A7BCED3D158BA15BF17EAF9403295945E99E7FCCA1C08F6BDD2203807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2abc0d940322187c7f3b5642f1076788dc42acedebecba020ae84ee5d2d9caa7
MD5 b98d5b8fa5328064df8873186b3fefbb
SHA1 ced62909daa08c191180bec53db08553a68e943c
SHA512 5585541f3d4b24950fd0ed690c2ba08332ee4c258de24d1a4b29301713edb85898516432375add55c196d4d6a1fee89bb0f2e349228c1eec8f4461e2eaaa525d
SSDEEP 384:sxZJnMA1/fdsOJUOC68/8BbGUifey+u/r:sBMA1/fbJUOC6zBbkeyhD
TLSH
T13172F747A8241E3BCDD3D169B915BF27EAF9503295904E99E7FCCA1C04E6BDD2203847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d966e2696089650111aa49d83a691f5ddbeefb1894386636a194d1c473da43e9
MD5 cf419407aa563bd15f43c49f10c5dfca
SHA1 4707cb983bba1c26ffbf1b135b3c3da1a6f1d054
SHA512 1351b315d13c49daff4a59031bd1d4c6cf9540eb713140a692317b44670cc0fb405878a43b03d4e41ced19873e929e3eeb0aa54c2c67bb519e1e120ab0749c4d
SSDEEP 768:bEyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3QrowZzV:bEyQRbrWvvlpZu1jaXKLf337wZzV
TLSH
T115C2F93B640CCB7E4FC01E9DDC6A6F976EA802C766588D4447FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index
Size 3KB
SHA256 be7d75d17edb56f22911ba1e6cb50f37e0f948217ca5314174b03a7402fee67e
MD5 ec00a529e71dea3720ccd1fcdc7a68c1
SHA1 7357d83a8b9bb60e4814a543c9391c0d380e11e4
SHA512 fe17b70dab4596d1cb1f22dbc6ba8f9b58e40fd6a82e3f1b3ce2d0c7c7e5d782e15c12db6d8c1eb2dc62f3ffe28f2ffa3f934fe129ef99ee8eba4d2dee512780
TLSH
T17351C70E5E53676AECB812B214B2045937B862DC23445D2F54FE5134FCC3B6E2C1D238
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index
Size 816B
SHA256 c21ad359024f632e0734e6c54fe19ca4128d1d925eee8a51b1d64c7657e7a1ac
MD5 3698e94c87ce50dd38c438bf5fc4d2a4
SHA1 e4c3aaffcf418cb2a71fddbfacd43ef3faed579c
SHA512 da647c7c00469a1f50b74ac91d5026ca79e70a74381d5877735c958bd1664b90d7d6ea464ff00317f41c9b02cfd22f4bfa964bfc4b11998093b27624a5e66477
TLSH
T1760147C91E534A5BFD700335603E945862B401CC13017B4FB2AEE1268C93F007E01BB8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b7f1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index~RFe58b7f1.TMP
Size 816B
SHA256 dace1d372c0a7a4b022d5c752f62386425b6093ff2b57e0cf2367931d389395d
MD5 6304be84c5d48e7cde35a77f192f3eb0
SHA1 73e3c06b657487c64d62548174b6c64fa8c36f47
SHA512 6f79f86801f1fc6cb3af3ef1a8470e821ea4e130b4569ff1549de974a6d9ef7d545d9912e48efc5e228f553d65461e6f314532a0e8ffe4c2615923ff4a4da774
TLSH
T1E70126D502538F46FC440371D92D9515617541445360778FE3EB6156CCD2B806F43FB4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2a544f4d-a007-4f3a-b210-5e4ea2a29b4a\index-dir\the-real-index
Size 72B
SHA256 195f9687e6519f83b9b53b71eaa736ac2cee6c6cbda234602242a6e4d478a902
MD5 ee42e2d5187ec9958557ab62473d71dc
SHA1 fe1f4a52657708ddebeec114cc3d2e67098b95f3
SHA512 11cee182916033f64a46cd81ee6ff8bc199bae50255f6c29f9632f34c0cc4d0a2ccc92c070fe56cfc71316cae9adb8f03022a94e6429f623048e188212f11a00
TLSH
T1A5A0023142E0254DC0471EF22FA24B832315CC7E1301235B42931154ECD29404AA130E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2a544f4d-a007-4f3a-b210-5e4ea2a29b4a\index-dir\the-real-index
Size 72B
SHA256 7b423dee5c66dc5c12d58c300ceec2ef6c948d5df3c90a08e22a4a8d1dc97294
MD5 2c77c582a40b9056c06d359bf4ffd9a6
SHA1 792140f92fe210643e188cbb158b63c744396231
SHA512 d9602e7637a4e050262bc2a26154ee835634f2677d42bf80728c9d8bc1975354cbdb49463fc024d1188134449a7e2294a5ed57bff59e1b0750c3a40eff8aee0a
TLSH
T189A0021142E194C5D4033BB56BD257437714CC2E5312234F43D30094EC50540896634C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2a544f4d-a007-4f3a-b210-5e4ea2a29b4a\index-dir\the-real-index
Size 72B
SHA256 96551176ec537c8c0dc6ccde75bef0cbdcae32bb9043a3708dce82335db0f33d
MD5 24d46952b73d8fb545064c2cac8fe72c
SHA1 83fb790648edaad851c56a5e231ee6f4c8003c9b
SHA512 2776352d0b0378c58c1e4e231e77014c1b99d99a7c144b6c5a24fee70b991bbc357714a96442258e6a376df8251b3004a2a5d73af7fee310c77e35570429c59b
TLSH
T1D4A002100BC64005D12B51B1155226F22340C9256600234F54934145CC7B9445E5141C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 a04f175b19e3ec4efd272c70c9bc6c34d1c56bc81b914b14368c1218905beee8
MD5 6749d6302cfddf373f63ad3a505b5f6f
SHA1 2df20744f3ea218234f320c19552e650759b9f14
SHA512 ade41c7e8f6e694d65dff294941d10687cf53b4bbbbaa78cb3ff47a2fb2f5402bd4ac210c1c0c0069c999ffe7561d3ca6801ada5149040e52676819d0e3216c2
TLSH
T15EF0E2B63EF72810ACBF97E5143144A54415BD148949FD0F512AA29614723922476DB3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 fc9ab818834a1134f75c2cb29e2f96e2f10b99ca49ff91f05b06eef8bbe820f3
MD5 2d065e5fde034dc75bc9a455d38aac4a
SHA1 46ee12052ed017986774a56a4f9fd1183aa8ebe5
SHA512 23cb582f19e46f871a42afcda3ae6eaddd97846b043772e06eb17074bd935ea7f8ba06a77dbb495cd605c8113e5e2ac29706e614e0684169d319ef83004d76d5
TLSH
T159F022B33FF72805B8EF97E9243104A50419BC448859ED1F9126B29654B33152439EB3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 59595f040586817af37ed64e634287ec1183e79d92f32359a62a96af84bf4439
MD5 f1b3e4dd30975849ed6df337ab65e0e9
SHA1 d8980d26c32d08b8cc528d0817301604bc6d6ba8
SHA512 810768b562d7c2b72d2f122912fe9a1c0e7fe086615bc6c987d2500429c0d5457ae643c91bb6feef03350a46bb871b4411c2ad9cad03d9d6efb58576fa9e9f1d
TLSH
T100E0DFBB3EE72810ACFF93E2193144A50505B9549999EC5E502A92D750A13962876CB2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 860ac206b039791bae4ae4ab4e22122d6f321ef564a12eb697af7f8b5cda44a3
MD5 c1c980c748f748d3f4fe04521c6f023d
SHA1 075bc8e60d7cd229c7305d27a4e7dead64432644
SHA512 8d1f56731070e51258cc4da07402105d74c451d98463f099176f6b07ffe45228266f8c445300a2a7615684cf990d144c549ed2503cada9814f9bc9a0107cd30d
SSDEEP 48:F2em5HdYlvSNYQ6fWVNHI6R0B3QIff50O93QbI3QI650Oy3QM50OV:F1m5He6Y5+VDGB3Qcj3QU3QA3Qi
TLSH
T10AB101E79B145053C9C966FB6039F6D8581BCA4A6FFF47A650BD8F2D42412D23328B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 8c06cf633fb7fc2720fa934e1a7a9f187d6901187c331a97f0de69679d35b46a
MD5 74d55d3f89e2c56f2d461cb5d3638d23
SHA1 ca5a96360bcfd81cd40cc48e1ecba3f17c09764e
SHA512 ca0f025a6752970a232aa0b99eb60de86cdda15496ea921c41feb500fd192630d5b4381b05781a154f6b40265f43d8a616e3e7066568ea00df6d864a596a4948
TLSH
T100E0202805D4C2FD71162387456A874882D87A1BD2CC3E871F01DC44B683A04725E651
MD5 SHA1 SHA512 TLSH

Submit Download

67a473248953641b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Size 130KB
SHA256 b2706470b0e997048eee97028f5a87e7d9069d1091a08eeb8d39a01a3dff2cce
MD5 7d74e79c30e3d6ae13d031eaef65c318
SHA1 81d09055eac18fae915a618174ed0e985ed7f4d4
SHA512 31910886db05ef92390d91ca68e1fd7ed63eaa20603030740241aa6439f03ca5f6cb7881a71961cbbe98078b77de0af1df8e0e0dfac211ab823d8a9e833f557b
SSDEEP 3072:YItl9BQxPCx1joDerhZL/x3eiPMiiZL/fL/gL//L/GL/1QHcbus:YItewZL/82MiiZL/fL/gL//L/GL/1Q8L
TLSH
T113D38933769D50AF0E89BAA45156B50392BC7467B8449038F214A7FC25DBFB013FAEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67a473248953641b_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\67a473248953641b_1
Size 227KB
SHA256 272b4f4c14d2e6c66ff0fa0408f5928b5fc98a64b67351b816410713a6124973
MD5 fbf27c91d1ac4598f3156446296d51cb
SHA1 8ba7742d01f7039c9534dd6c88524114adbc9938
SHA512 7dc423b97cc28db55af208d2eb47ada026ea4f1ee2c0c645c5f1e27e21d112f6c2dc866c91c51e8be1d2d7840ed7d6c7765abcd63e137df9acb3ad7c47972b34
SSDEEP 6144:hbPN53kCS9ljld5b0ArxAMAvBNdXeL+FH3L/8wtdruwol0CWRi5yiN6UL/dL/4Lb:1V5eOL/z5iN6UL/dL/4L//L/UL/Ps
TLSH
T190343B22371621AFCE1963B911239B0373F4410ABEC3D26997419335385FBE35AEB963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 bce30b9d4e64d8c6ec8689f034a6111b496379da4c25d803dd4ac9af5cd1f4fd
MD5 81f93c281d13670fb927fd72714c03aa
SHA1 49331d4f0cd356456929ecd4aeb1da7d54b2352b
SHA512 5bba26061a810779a2d16df45c097301a1e27b44caa2ef42c758e8353ab127a50444ffe4a6638aeb59bcc7e453242c7d242fafe13f064c8bf22504790af4e81f
TLSH
T164B012718C14C491C001127884B1034970190C5C1B1E200240AC4010CC2424411D144C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5925af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5925af.TMP
Size 48B
SHA256 6cbf8c275db040f6e41d119abf021c9142d06f3152ad7919de61b1f15d2b8d8c
MD5 9426e49f1db8ff443fb17c44d1c6c57b
SHA1 e343a84fad06557b0fc414202833b4e41ff2ecee
SHA512 544fd361444ad21d1b7e70fc6b598b4d0e3f3bc039ca84676ab6c022bcad8005d75c06122bf101afdc129260498132a1f2f1278f8e9f7e78f76703a49acd217b
MD5 SHA1 SHA512

Submit Download

Session_13434420575259564

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13434420575259564
Size 68KB
SHA256 714398f5a1b521528d17898d6ea0ffcd479fe5f1842e23849ca9560adba8fc8f
MD5 a297a58a099e8ed583e758782331aeff
SHA1 a21e05c7ad443f61fd3444f5a7b1be5b50a9708f
SHA512 122ca6c20ba6b2ba453cf9811375a0f0b94290f201b0252b37a6245f6a1381038885135dc567cfb7ed249630e5f397bf3be9c44ea66b469d014f769a949d4a7c
SSDEEP 384:OFRTL7KuoxyoQ/zHq88QhCKRIRDR24jT3vSR/88888mjT3vR00Qa7q1auq1aO:s7KuIyH7jH2VNjTAfjTlWYJYO
TLSH
T12A631F575DF5013DE2BE857CA4FA1172AD36BA2269D0DE1E40A042090D93E41EFB2FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tabs_13434420617381341

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13434420617381341
Size 11KB
SHA256 5229d0e34c111d6258c54a4dba75268b86d0524557e52e3771657d46d75782a8
MD5 cf62ec498424bf90869ee2b7a313c663
SHA1 917e6406b4185e514c0734ce6a22e9c0c8fc32b2
SHA512 6af1784e58eb74955a20823a78af6e5c54ee83827f03a2b705eb63217494127a4a9ec408940b599553467a0520845a98a0361522abb6734825d44746cc7d99fb
SSDEEP 192:30Lr+q/txaHiSegu3WOT7FRT3ZheK2/jUdS+BBTfasdi:kL/RrjT3vd1a1
TLSH
T1B332766B69F4013DE2BB8938E0F51076AD72BE113DE0DE1D849042060893E51AF73FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 7d68d517bc8c34349cffecdb1875a865e335db903e5eb4e27b726659b5f830bf
MD5 a1e24fe12c85aa5c0983b185f6c0e9e3
SHA1 53f2e39d3a13d2f61071ce45b7218632debefd5c
SHA512 c703d564adc57304b4a13600dd691f21a71cd80942faff9ea3a4e0e5b1ed64a02d02799cb518f18e68c0ba5b22d81d8a7ec65d73e0b4807dd089b44e5ca1d1d4
TLSH
T19DA002B083404141C2190671118153416B94E8145506075366E65048DC916A04D56404
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 100B
SHA256 0f6f06065595ad34262498e0492a6a90db020a8ed7209bbcdebb10b97d74b098
MD5 6806f77a46fc1dda0d100a4e02f4a1ad
SHA1 13063fdc3768359256915147e3d696b9d5cb87fe
SHA512 ca41c354043282a0f6ba43e677d6fc5f4bb79740fb75101df75ee58ee4f42a8fd6882e0bee8ffa4edf63ee3957c0cc185f70a866674fc10e96ab1fef5978c2c3
TLSH
T11BB012043351D021C448097300745F512310B053028A42074C708F344E656683E0D1C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 964723e30ae2b8e38a9ee6718b04d79f6ac980849554c5aa12e3b05fd6b110e3
MD5 d1a51a1d379366196cc58834d5f9ec60
SHA1 177e276ca18042512a758f8326f2d35800547167
SHA512 089f968882ecbff873a2c23956958b614d4c5941841d8078e03400f01efa776586598f1df246ea432779a277bd095b25bd5eb473605327c5ca733784c28b79cc
TLSH
T1D1E0D87815D9C26E714662CB8329D74C81E27A07D6CC2A522B0D9944B307340724FA52
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 bfbf308037d210b55bbadb537b87f9567fb4585ee40b95293418ed17dbb919d7
MD5 80e24e322745247f589e5cb2a69e8a8b
SHA1 43b876f78b3bbc437a10178b44a95260908bcafa
SHA512 1ba7dd406001ffc316eab9a4ea425224ce8bbb666c2d562ad83d1f92cb5acebccb5604ea244c5134dd7c09b43aa67273f2ae68b94e4729dd034ce1da5b8be7e2
TLSH
T1E9E048B456D5C23D600461D68665DB0CC2B4798BD7C83A4657098845B242344737DAD9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e95a6aab7143baeb8861d104946e3cef30634aed836376037e86bc33004161f6
MD5 7e81357d065d3ecd1f7b22508ca38e0e
SHA1 0c84245516f4677ab5d7df353de200a9aa9a1a80
SHA512 f99d45d4d1d897c5c3d58bc01b5aa5c6e6d6b761c2c3aa6968d58bce10273f7d1ac6c4e83e07944a897133cdac04d9435476b19de00892a45e4044cf9d9ce11c
SSDEEP 48:K0Nsh9P7/gbTmzIS1gK911XgxlwY23ttyL6lI064I5bkjUIS8AIXKxukPyxoIXKt:KkyAKvqe2daAAKxumCowKVu6
TLSH
T1BAA1021531BA0218397F259D80E69B2E878136737118F66FBFA804625E6BF040DFEDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 ee153035b4a8122e47c1d95bbcc6d152b32803458942f0a9d81f94be3277593b
MD5 a52e3b4115fa4cebdaec8dcb0d587506
SHA1 97c2056423db63c010aa273a503ee44a7ebe0990
SHA512 d5825bcdf3879f9d1229170d656ad56cd32015f4f57328d6b74aefd5c90dac9453063cdc4c8d9364b4c1717a062f6f92fdcec12bcb24f9f027b0aa21196f6e64
SSDEEP 48:T3j7dojKsKmjKZKAsjZNOjAhts3N8g1j3UzufVaFw:f7doKsKuKZKlZNmu46yjnfsFw
TLSH
T1BC03029F7A6891F3C0F2C57BE98206E5FC7A720C43127CC011ED07B95E5C0327165165
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 4290f97a9703ee6253f8e519835546d6b16f6a82323496b482e9ac6b0f28f260
MD5 5f2075ca18ea7178f9fc93c33ab4a7ec
SHA1 30825600f8e2c112a28cd47bfde36f647ba88be6
SHA512 cfb45eb75ffa4a5844b7ba0b9ec9e5de638397a2c8ee84515424c5437cd310a5361cb841e82b7626df8778fb6295af02f3275381bbccd6afa852d31c63d0c3d5
SSDEEP 6:E/VYikD8R5KsR/fuj0tdndTj0Ndkgubh4lIKyU:kVYikYp/fvttxj8EoIRU
TLSH
T1C302C2EB7D80C472CA8214B6D1929EE868237E9F1552FC8425CE0A5D6528563F82B200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 140KB
SHA256 b03f78fe12bbd80dc10084d9ea2b9638ef38caacfeee4af8624ec33afb125854
MD5 d51eca9879c2a595c1acccff528f13e4
SHA1 dce0345dc304f2a6bf3df7b4d883e899a2a4c749
SHA512 613ac6df977a42440ae303a20b010f4f6e1d9faa8a8d33f150acc20b4008c67925908f5f6c5095e00540d27fb305ab8a9eb2b6d194013917a80ac2e8b5959c7b
SSDEEP 768:98GyQvWlAPKGiQSdNICELoZ82HdawTGShZ4COqjgpdT7kbCvhgie+Ry+0EjlaPUq:Cb9EBxwRZgkue7U8cPo9eihb9yYny8
TLSH
T19EE340F75C05A0BECDCE90B4E82BEF48907315668620F8E5EA7D08C37B79A123E75594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 4.0MB
SHA256 347cb873349fa37366602c18daea4adf43659553e5e2d14bd55ca957a01a4e0f
MD5 24ccefcf9c8b4dc05e2b5954d70207b3
SHA1 bf018a0cef87fbb2741affd25613180f4a1a4d87
SHA512 8cdb8f43c9805db9cdf457b78752300865223a87677c1241fcb4dd06a0d694b9d1540a1570018be39b8fb89a75cd88179a7ca59851ed782b62a950a77302ccc3
SSDEEP 98304:cL1CyfTnrJQ/jq4sLLVwnoNdWzZs/bX9GS:G
TLSH
T1FC162BE73D05607ECCCF8434EE26EF8C946336AB0524F5D5AB6F08836ABC9127E24595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe598582.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598582.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 750d9346d773a0d7a796100a8e12208220e51c4db961c86b10f1ea44894b7f2d
MD5 6d958c86aa6be4351339c9059e21a2eb
SHA1 3ef90b887d738f446b570952c417a9239c96c11d
SHA512 1dca17e09897d991a8adebb16600142cf05953db2cf5c8ab99b10ff3fcb6a809ee3b2a211f9dde332af862098cb8b56ccdef244df907139bed0e7be1059643a6
SSDEEP 384:MiFPZcIgTsNo8TUNTUlIl6T+sEqip5u8iNLEABkwc0aboy:3FHcJwgPTkiABkuabt
TLSH
T16EC22AF248E7997AE9AE9743B73E2D028E7CC063B6845A40B7D8561DCCD61BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1099a14d50bf0afcd256dbba2a6a78ac2399561be08448c928ab1f5ed6ef7f2d
MD5 5441cb1d47896a5bb4541d1daccac95a
SHA1 c61c643a190f2b9aa7d2980743661983ff4e17da
SHA512 f4432edf0366605c7884bea902ebeb88bbef08da5b695c50f7e3df5629b3ab0d69cb4628f678b21c25a622d10ccca60e469449f1287d1bbb19b837a599e5a48e
SSDEEP 384:IZcI9sN46T++Aqip5u8iNLwABkwc0aboy:29bTkiABkuabt
TLSH
T1C4928C356CB4BC7BACE7E155F8473A03DEB8806793885F80D5ECA71E01DA6941307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 af3ca85207ee50159342e63098b24ed6eb4a79acf26805ae71f37d71876452b0
MD5 6a3739b69b37823f31c0161c28f5ed7e
SHA1 ae7dd177b1c34a04094c7279ac2c3b33d0745c69
SHA512 ccbbbda0d4c03360269cadab009cdf931619ade8b9698a27c71b737ee8354951083c50db6ee7d0252f1e0ffb0215568587fc1021550721cf3abc296907ad942d
SSDEEP 384:MiFdZcIgTsNo8TUNTUlIl6T++Eqip5u8iNLnABkwc0aboy:3FFcJwg9TkRABkuabt
TLSH
T1AEC22AF248E7997AE9AE9743B73E2D028E7CC063B6845A40B3D8561DCCD61BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7d521df8f56e38f53ff8af9c3492a3de5a59f6390efa500342223e812d8df957
MD5 81b417d1dbf4064f4c0eb70864c5fdc8
SHA1 a400a64dfe2ddce794fd95d67aa8d25e241c1e8f
SHA512 020fa23a24bb4fb8f18d4eec02a9e99582c6df10125d10c74f2db53bc4130e7b5358e2f7f4934b715ab8100d2d75b32df47d067afa38ee3bc58e24a17a01f14a
SSDEEP 384:nAiFPZcIgH3sND8TUNTUlIlzT+Ytqip5u8iNLFW02GPqoG:bFHy3OwgBTkKGiZ
TLSH
T10CC2F8F258E7983AE8AE9707B77E3D028E7CC063B5845A80B398561DCCD61BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d7cda30016f8e1bd458baf62e5e67c44b6de1c5d58c0c6d642845259f35816fd
MD5 d6d4565055a98865dc16b1f2fa75f9c6
SHA1 d62047a82bc348c3e968efa0ba382bc36fe45231
SHA512 654066d79f529334745047f10642c06b6e3f99f74e599a32b11eeedc3edda5feb4488635e69ab6c0da085723951ead95c0ff05739395469932d0244adad73984
SSDEEP 384:nAiF6ZcIgI3sND8TUNTUlIlzT+Rtqip5u8iNLFW00GPqoG:bF413Owg2TkIGiZ
TLSH
T160C2F8F258E7983AE8AE9707B77E3D028E7CC163B5845A90B398561DCCD61BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3ae4549cd8ef94f02eb58d06f0fcb9df3788a3429519d6bbba40d21846c95cd9
MD5 848743e46ad97dfb5a4e08b6bfef54f6
SHA1 ea68b750aac69eea9fdc9aa70680ca3d741c0431
SHA512 ab64c5477132127b123cbc429ca3792bf352017705a6d4e9e6f7ec6c22c5f7c9c7fb41abd648e1099ded044a29e63f91d79e38e4df25915439880c211f268b2a
SSDEEP 384:nAiFMZcIgH3sND8TUNTUlIlzT+Ytqip5u8iNLFW02GPqoG:bFay3OwgBTkKGiZ
TLSH
T16DC2F8F258E7983AE8AE9707B77E3D028E7CC063B5845A80B398561DCCD61BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4d3aaed3f3929738e7e842611436425df83678521264d4ffe1297a5fd489941f
MD5 d09c74247e1dd14c9b696dab5ca118c4
SHA1 473ac0f9152027fd0860fab0b75eed64bfc399a7
SHA512 e47a7b2040e9e454fc94a8eb25cce2548612896ed2fd8cf7541669f3921c89168ac9f19cd46832a6eddfaa099e780e290bb70aaf63f6a9deac96da8190bcbea1
SSDEEP 96:PqONkwQsjpfwDISp5ih/cIPURHl8h4otop5TmDuBfPGxvw45RxmJm78lFOxVeYuC:SONU6iDCQmiUyMOHq5u88PN0SqYBxsU6
TLSH
T1C402F8386C687CBB9DE3AD05B4473B175FA8113BE7942F84DAE81B2C01D768C2303922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 c25bc4be1a0bf18021aede840c408bad8cdd2a595b1a1f250976685f5c9d4da7
MD5 e3e9bf939cf16a9e4095dc9b764fa602
SHA1 4ac0a67973019f7cfdadac2416b502066449af7b
SHA512 9d2ad688b2de1aaa1620bf0d4fff2e6428efe09dd2f40429807c564f0d93cdd05ac5ee22d1bd9c0e51b5c99dd6bf452bb718ef63932a399c40751d4012fb34d0
SSDEEP 192:uTSsN4yQgDPpqQmiU1c6qB4p5u88PNLbetBlAc/Jtd5kHQc0a3KpsgTR:DsN4yzs7qup5u8iNLzABkwc0aA
TLSH
T1E5624A356C74AC77ADA7E564F4073A03DE7885A787882F84D6ECAB1D01DF2982307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6a9f315365f40d26b83a17f2191a93a3d850bc61b5fa86adb9e8dd10ba289ec9
MD5 4fcb34f8ab34a3ef47da6a17a3bb1635
SHA1 472a81ed6000eb4c1f096f2b8b2038da423a7491
SHA512 ebd68d6228882b45c206dcec64c5aeecf1ed1b871b59078e91806814126e6fa2e7fdae7fb16ee2e6dad60a25fc7c38f967a65cb55c3d1ef2203c01012c623e0e
SSDEEP 384:/ZcIcsN4zT+3Hqip5u8iNLwABkwc0aboy:XcYTkiABkuabt
TLSH
T153928C356CB4AC7BADF7E155F8473A039EB88167C3886F80D5ECA71D01EA6941307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 bf75eb6186fb7b6855c1ada7e40dbf8f4f15b9d857f42dc71df0407949f82cb4
MD5 84a877dc378850c42a823b67eff550dd
SHA1 6482cebb7e90f5dd2807d59cd8f56fad38330058
SHA512 7b7869dff6359ddc0ad811d793b59bb1ca6989e69dfe59bd9a1890099085c0f70e24a3308ad93e7e0e18ed4ffa50bc910b44daf6c69eb68960073e4961b03205
SSDEEP 384:nEiF6ZcIgI3sND8TUNTUlIlAT+RaqiCDfQu5u8iNLFW0kjGBkwc0akYoD:fF413OwgAVUkAjGBkuakY4
TLSH
T174E2C6F598D7993AE8AE4783A73E7D028EBCC153B1885980B7D85E0DCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 861dd603f1e40cf1d23d12c07c60e826b9910333f95045fc8109bb3ce928a6ab
MD5 3fe16c8d8d0765bc88496902daf3b975
SHA1 77e92b10e2c10a9315cfdf2daf779f3f643b2763
SHA512 c941fe629586c89b4bca3934a0795455467db4527de9a855127afea4de7f24f3d11ffb45b7eb9f3c1a053e27c032d7d49d1613c6eddd8f883033f2742e3e2666
SSDEEP 384:FZcIcsN4+T+31qip5u8iNLwABkwc0aboy:9cVTkiABkuabt
TLSH
T1AC928C356CB4BC7BACE7E115F8473A039EB8806793886F80D5ECA71E01EA6941307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7b14eee055a487f8416e9529f7989d46bfca8ebbe5fbcb0c0b70950d9e8e9e79
MD5 5d50f36b09b527211391f1070fefbc7a
SHA1 db993b007214b41906e9c097fdb67e61d73dbd97
SHA512 c53cfa5b642fbdfa3dab73479778c6e7b198512a54f44c87adc9e9c477328f84ea11145294078d49721180bfef5067f3fb9b6de1bfddc5cc45afad13c6abbfda
SSDEEP 192:SONp6iDnQmiUyxO9q5u88PNLbet9uZc/JU6:SONp68v9q5u8iNLTAU6
TLSH
T118121935A878BC3B6DA3A865F4873A135E64427BD7886F84D9EC272C01EF59C130B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 8de4bcafc86bf27b40e36f7e30e4fd8bf985b57c38bc6158143b0f01d1d0a77f
MD5 e201bccb84556cab65de634d68703f89
SHA1 6e38193a6817dfe86effa421bd655dfd40322601
SHA512 600680fe80aa6a82edc4235af3fcad30949c408240d92ac70478d22dfb3079da81f831a39ac8edc5b5c67ede7ba21d4c2e277bbbe93c2292f829d0e1c1135a7e
SSDEEP 12:TLNaPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isSumQQtydyzmdwGzcQT:TL85UOl0afDdWec9sJ3XkGDB5fc
TLSH
T10392DF23B9252023ECDF4B77BC4749D10EFD12AF8AA7B8049DE44D6109A2BC266951FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2da8ad179ff7869c1e2f1936a0d40e9ee4f423c06b90fc8e3b59cb2a21f3b2c1
MD5 674d15e2ab1775c9ca1aa4efdb43fbfb
SHA1 6db59e0d21d7506819e684b4993da20f78a5deed
SHA512 cdccad2990674dd0251eec1d9d51971da536dc5f835d9fa61bc4b44cfdf9b76857d7768f916d40edb53aa04d96bf06b848394e300ad6b10a41cd35920a6fe706
TLSH
T119E00112D30010BAC538037800471F211BF2852402B203C6AA3041681C733003F30FC5
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9f75a1ba20834fbe79e6beb8c256861541768889899c3d27c9161125e44c314c
MD5 84ffcd98918a1286d58290a7a109c1d7
SHA1 3030da8610d1553ff7dd9f1bed959e9274f35142
SHA512 527a902041dc705d956c9664e586750d4cd4ad9a12bd7a24aece356961f7d8abf76c6b56eb9ee3af5b017bf6043447e1ebd2e585d3dcf7c93b2f8b3159ec8d4f
TLSH
T1BAE00952D30020AAC628037800871F211BF2C52402B20787AB2041A82CA33003E20F85
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2520cffb94df8ef1f14e4dc06f81ef36f06d46ee7d942129094cd4165cc960d6
MD5 d55797781100aac9be04780a1e42fd60
SHA1 3c3826427a022727860662229fb923a492ef4d22
SHA512 a4f4c5d531c8366b174119ab5768e3a92fdd60a055d00bd2b4c71f5b028ad4693e5827bab3d52b74de6b0fcff77158d6eb50218968f51e32b2912f75ba559f8e
TLSH
T18AE00456D31025BAC62C037800972F212BE2897802F1479BAA2066AA2C677006E31F99
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58e318.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e318.TMP
Size 392B
SHA256 6e91e7df05e6c54bb59f3a7cee429c156923041ce2860bd8596ff2802a11b62e
MD5 2283623e5176208643b84b970ffdc04c
SHA1 0d842a7201df549876a6b6630b4c59ac34841f5a
SHA512 81b815d13952d325a92cbf0fa1dd84933f54bdd2e42ae01e3fe6a84a32764a48b6182c48391c035780729d1dc4e06852d83f82cf4d0e9d4d51f933414a794992
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

15c0bd4d-baf0-46ad-82da-c8c2fa86b62f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\15c0bd4d-baf0-46ad-82da-c8c2fa86b62f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4d355bd8fea9e8a855bb30daca8b5b703014a254fdd58fd3e218dcd5e6d9b735
MD5 e2c5850f36a77a88af18c205516acdcc
SHA1 4564a682c6cefb21555453126b7808d77491016b
SHA512 01e051207f5d2e93eb5cca141002fdb2efd444dc26ae7f75fc321d01919c77e3a4d20b9c4b72c8f03a99c05add9a42e91ebec404e8696cc7f32ef0051b7e53de
TLSH
T108414C5CAAED0158B3B76F569BF6A4AD487ABD772E07D45D00010E4F0E26B01C862B37
MD5 SHA1 SHA512 TLSH

Submit Download

792b4765-55e5-4512-9b2b-20dbe3cc1f43.tmp

Path C:\Users\Admin\AppData\Local\Temp\792b4765-55e5-4512-9b2b-20dbe3cc1f43.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9bbe2010-79ab-4fbe-80ad-a90fa4ee7289.tmp

Path C:\Users\Admin\AppData\Local\Temp\9bbe2010-79ab-4fbe-80ad-a90fa4ee7289.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3d766fe-3498-4368-8ad5-a7afe1798622.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2784_1432862937\d3d766fe-3498-4368-8ad5-a7afe1798622.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2784_1567223231\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ledger-Wallet-4.19.0-win-x64.exe

Path C:\Users\Admin\Downloads\Ledger-Wallet-4.19.0-win-x64-v2.4\Ledger-Wallet-4.19.0-win-x64.exe
Size 438KB
SHA256 18842c0fcb3642a3ddc3deb36f84b5152fe614b94267a55171a4d80a856c17b3
MD5 bb0ad23d7a345c346188745eb747eaed
SHA1 73a3e1dca1823aa97ea800b7286d22a6054ed17c
SHA512 347c1249f5ac5cfbbe988dbd22be61a7a6b12b6a9bd9ee85360f90a4c83989b38266a2c73188e2e5c405bf74886a02b0c05c29a4fa16e3ba2986bc74727174e9
SSDEEP 6144:rU76Lz2eTvC9tpMSlTUEvcnzH2PNI60jqI/r2Q9B0OjY3sVn8qa17k/H:A76WtGUUKcnKPweIBYOf
TLSH
T17FA47C1AE3A404F4E0A7D2B8CD535906E6757C4A0371E79F17E8A6662F233A09D3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\Downloads\Ledger-Wallet-4.19.0-win-x64-v2.4\runtime\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\Downloads\runtime\legal\jdk.charsets\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\Downloads\runtime\legal\jdk.charsets\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\Downloads\runtime\legal\jdk.charsets\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

memory/2012-3013-0x00007FFFA09B0000-0x00007FFFA0AA4000-memory.dmp

Download

memory/5856-2713-0x000001AB3D0B0000-0x000001AB3D0B1000-memory.dmp

Download

memory/5856-2714-0x000001AB3D0B0000-0x000001AB3D0B1000-memory.dmp

Download

memory/5856-2712-0x000001AB3D0B0000-0x000001AB3D0B1000-memory.dmp

Download

memory/5856-2719-0x000001AB3D0B0000-0x000001AB3D0B1000-memory.dmp

Download

memory/5856-2718-0x000001AB3D0B0000-0x000001AB3D0B1000-memory.dmp

Download

memory/5856-2724-0x000001AB3D0B0000-0x000001AB3D0B1000-memory.dmp

Download

memory/5856-2723-0x000001AB3D0B0000-0x000001AB3D0B1000-memory.dmp

Download

memory/5856-2720-0x000001AB3D0B0000-0x000001AB3D0B1000-memory.dmp

Download

memory/5856-2722-0x000001AB3D0B0000-0x000001AB3D0B1000-memory.dmp

Download

memory/5856-2721-0x000001AB3D0B0000-0x000001AB3D0B1000-memory.dmp

Download