2fdb4377917e6802f2890866f11c56ec04083c54641286b1a4a259085cbc7a44

Resubmissions

25/09/2026, 16:11

260925-tm1sjs119p3

25/09/2026, 16:07

260925-tk1prs116k3

Analysis

user interaction
yes
max time kernel
102s
max time network
102s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LuaTools.exe
Size 489KB
Sample260925-tm1sjs119p
SHA256 2fdb4377917e6802f2890866f11c56ec04083c54641286b1a4a259085cbc7a44
MD5 7d03ee132fd694bacd10ffb76eef80d2
SHA1 974fb1f199ab0a2ec8837aaf14567556962a3a01
SHA512 40f7bcdcbb0a7e9a84369c76bbf4a280946dc361670917edfa5ea5937bab12483ab5d9b8ddf77136857d59d6884940bc10a50424c50f828743706b644783a046
SSDEEP 12288:eSJJkYLauS67aQ2UWIgXgCtgLz1uXe+OuhKDxiKgMZBF:9uuS6eeQXe+XTM
TLSH
T186B49D327B41C0B2E04770B19E3CD72DCB5AAF111716CAF36E9735BCCDB82914A62699
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LuaTools.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3968	msedge.exe
596	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{1BAF0C03-3743-4E6D-B1CA-E696A39E9009}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{53F0C1F3-B697-4642-9A95-A3A0CF45CE3C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	taskmgr.exe
Token: SeSystemProfilePrivilege	2500	taskmgr.exe
Token: SeCreateGlobalPrivilege	2500	taskmgr.exe
Token: 33	2500	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2500	taskmgr.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe
2500	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2500	taskmgr.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 5640	5028	msedge.exe	93
PID 5028 wrote to memory of 1240	5028	msedge.exe	94
PID 5028 wrote to memory of 3968	5028	msedge.exe	95
PID 5028 wrote to memory of 1240	5028	msedge.exe	94
PID 5028 wrote to memory of 1240	5028	msedge.exe	94
PID 5028 wrote to memory of 1920	5028	msedge.exe	96
PID 5028 wrote to memory of 1920	5028	msedge.exe	96
PID 5028 wrote to memory of 3112	5028	msedge.exe	98
PID 5028 wrote to memory of 3112	5028	msedge.exe	98
PID 5028 wrote to memory of 3112	5028	msedge.exe	98
PID 5028 wrote to memory of 1276	5028	msedge.exe	99
PID 5028 wrote to memory of 1276	5028	msedge.exe	99
PID 5028 wrote to memory of 1276	5028	msedge.exe	99
PID 5028 wrote to memory of 1072	5028	msedge.exe	100
PID 5028 wrote to memory of 1072	5028	msedge.exe	100
PID 5028 wrote to memory of 1072	5028	msedge.exe	100
PID 5028 wrote to memory of 3388	5028	msedge.exe	101
PID 5028 wrote to memory of 3388	5028	msedge.exe	101
PID 5028 wrote to memory of 3388	5028	msedge.exe	101
PID 5028 wrote to memory of 5356	5028	msedge.exe	102
PID 5028 wrote to memory of 5356	5028	msedge.exe	102
PID 5028 wrote to memory of 5356	5028	msedge.exe	102
PID 5028 wrote to memory of 6080	5028	msedge.exe	103
PID 5028 wrote to memory of 6080	5028	msedge.exe	103
PID 5028 wrote to memory of 5784	5028	msedge.exe	105
PID 5028 wrote to memory of 5784	5028	msedge.exe	105
PID 5028 wrote to memory of 5784	5028	msedge.exe	105
PID 5028 wrote to memory of 3648	5028	msedge.exe	107
PID 5028 wrote to memory of 4516	5028	msedge.exe	110
PID 5028 wrote to memory of 4516	5028	msedge.exe	110
PID 5028 wrote to memory of 4544	5028	msedge.exe	111
PID 5028 wrote to memory of 4544	5028	msedge.exe	111
PID 5028 wrote to memory of 2420	5028	msedge.exe	112
PID 5028 wrote to memory of 2420	5028	msedge.exe	112
PID 5028 wrote to memory of 3704	5028	msedge.exe	113
PID 5028 wrote to memory of 3704	5028	msedge.exe	113
PID 5028 wrote to memory of 2664	5028	msedge.exe	114
PID 2664 wrote to memory of 1412	2664	msedge.exe	115
PID 2664 wrote to memory of 3260	2664	msedge.exe	117
PID 2664 wrote to memory of 596	2664	msedge.exe	118
PID 2664 wrote to memory of 3260	2664	msedge.exe	117
PID 2664 wrote to memory of 3260	2664	msedge.exe	117
PID 2664 wrote to memory of 2080	2664	msedge.exe	119
PID 2664 wrote to memory of 2080	2664	msedge.exe	119
PID 2664 wrote to memory of 5152	2664	msedge.exe	121
PID 2664 wrote to memory of 2708	2664	msedge.exe	122
PID 2664 wrote to memory of 2840	2664	msedge.exe	123
PID 2664 wrote to memory of 2360	2664	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\LuaTools.exe
"C:\Users\Admin\AppData\Local\Temp\LuaTools.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4788

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://luatools.exe/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x318,0x7ffce3d7c188,0x7ffce3d7c194,0x7ffce3d7c1a0
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,3563269151111039374,14165134048336718850,262144 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,2278811854143976288,2351080529161985544,524288 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,7636288503748932821,1667275808311171285,524288 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:13
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,12542565706997117590,14762687184760136451,2097152 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,16452170336984160332,3987838182476666845,2097152 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,3460444905534277579,11421791004017056696,2097152 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,6667505386088071032,5625279959079878021,2097152 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3680,i,8326840117686086331,11618567766298208029,2097152 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,10474379761432929913,17070505153218734367,524288 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5168,i,2064623717139879857,16238749106079691697,2097152 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,6919823349100115089,2287792937471128452,524288 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,6919823349100115089,2287792937471128452,524288 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,15160823275617455686,6888436877891129634,524288 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,9351288456145809097,5286982507738109081,524288 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,6107510036128201430,12517931170554570770,524288 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,4801371628342690462,9938004790854920373,524288 --field-trial-handle=2296,i,15024730808083484697,4375986950959345776,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffce3d7c188,0x7ffce3d7c194,0x7ffce3d7c1a0
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,14287513110164737687,15603047546296529331,262144 --field-trial-handle=2712,i,11121691526345299546,13401530426912691681,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:2
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,6797442963350092271,5156023082739703039,524288 --field-trial-handle=2712,i,11121691526345299546,13401530426912691681,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:11
    3⤵
    - System Time Discovery
    PID:596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,15775527747937825168,14175587042894201870,524288 --field-trial-handle=2712,i,11121691526345299546,13401530426912691681,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,15176378615029479318,14473305051252757499,524288 --field-trial-handle=2712,i,11121691526345299546,13401530426912691681,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,15176378615029479318,14473305051252757499,524288 --field-trial-handle=2712,i,11121691526345299546,13401530426912691681,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,9666035686781873786,8482574840673355575,524288 --field-trial-handle=2712,i,11121691526345299546,13401530426912691681,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,16931768508669000080,9464064617462172016,524288 --field-trial-handle=2712,i,11121691526345299546,13401530426912691681,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,5433800693579805239,17960056880777054477,524288 --field-trial-handle=2712,i,11121691526345299546,13401530426912691681,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
    3⤵
    PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 25559293c954898f2da344ed5fe3faf3c076ca2a1868befb99178bedacb3d026
MD5 7921e958d547711c39f2211be9d582e9
SHA1 d327f17351a129da59733ef73c24b256addb1b88
SHA512 29c83b34cc319b93140a7156f0e4fd32fca94b626b32f9aa46eb5471603b5bab4338ee0313db91199b04ee0ff93fc3dd5d552299e129f6c1cd750f4211244525
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T117B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 341070819381f219d4c5de3f905f318f8d3d3391a5eaae8b88bd5d0b7a51e562
MD5 e9d04183eef2925272036050da023efc
SHA1 cca0e819ee0b11bd24246bb53f7de055bc89bf8e
SHA512 3e163c982bccd064997c01e99f4984d31444d3a8297be25310db616b643fbb2e291dda53a154e3e9edc5fd91ff17a7b8d1b84adf4e452a9295a91cf990d7732f
TLSH
T1CDD08078DA6C57E4E073303D5334115271D95F41D747124998C405295D615D302B6DBD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67602acebdf95f848369453222d9a3848505e16b8f43e49ef9ab8e2fe743a408
MD5 530a928b052537f9b39f458519ae5a28
SHA1 fc53cc8db2986c44aa0239e5b15fe71a49de53a6
SHA512 c5a6b97e0a706d2e2448e757ff9a5575dcc237feb64abf25eee93921206da522e56e130469461bb08096b759c0d3ae57a6a8c1c288ba43de62835cb8aa12a9d1
TLSH
T1A3D080FCE6680658D153247C6215625171D5EF04FE077144D4C1513935166E21375CB9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

4f84e1cc-2b6c-4ede-803f-9a413072e83d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4f84e1cc-2b6c-4ede-803f-9a413072e83d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ab078cc18f15f54bda7a32b84484bd131d454543803ca5a93e2393709c60850d
MD5 f7507b1b01b25290765c20e87e4ec3a9
SHA1 46b5459b1acceec789d3eee6daec508ac3d915a9
SHA512 d84a2b81a921bcd4e3514d361083f3e84e54edbf0e2bab0925f4fc992b6c9a497229f5800765ab2f6ed165cdd30157dfe14f493a5d6981a9fda8e5e96467919d
TLSH
T16AE0AB9ACD529C330CFD4B2C90441786FB1003462A00790FB63C421C4FB033681C699C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 34a62c54249bf7a767481fd3860b41f01dd642f0ddd21d2860d00d8ba6519b19
MD5 017063724e960545b2cf4d057d8938a3
SHA1 84deff750af64b6f2e9c8cf86e7bd2d4a4b28888
SHA512 cf3098ca85d1a71c22a8caffbecc5a2e9506b50789e3c99b31f7ee0bdb90b8f4564eeaae527d92ac377139665a8e084a159c26991bea1a6ac61cc90f48477121
SSDEEP 192:5uKxWX5NxLi4YAh0rcNSN9uWsLttQVpaE7T1HNBv6E0Tm3:5uKxWX5vnh0ryS3uWsLt6VpaE7xfR
TLSH
T1CB137D3E93153F8BF3F7063C28571FB593B9A94BDAC4046B5070F80EA660B144C6E25A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 867837ee163abe8b0c3681f2cba2e35bf4dc61faac3e9dd05a0c33eac2092cb7
MD5 4585b2d25a7fbbeb4ecbcf14716bdb53
SHA1 99410e80cf405d5b19ef341ee40162e6142ac5b8
SHA512 f37ce04bda4b48f98bbb288c3b6b829253a3cf410a703a2ea448a3692b19f53fbab342bcb8fc7428a3b89a3ebf210e82960c909cd27a771d856d525815794d17
SSDEEP 768:QJx2NQezL//HeL/N67nt5rzPebKkps6qsnTpGAUUdUkZN:+gL//+L/N65vEpcy9Ry
TLSH
T1D0445EF71951601BEBA852F6E2033E3ED1B7015E6DD1F8A8E17C9C812925F31B2BCA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 6b1c6c6578909323df65103661b5b768a33f333b540ae15bf833baf3452c4b82
MD5 96693d54893d4d24f63ae874f1a11fb5
SHA1 e98e11f59c587e818c309e07d4fc80ae5f57143e
SHA512 75a9ac0c5bfcd456076bb5e330a40112442315dbce830d2a29c89e75040064fd0a409151e31ff1f905d99ea91a851a67785ae06d5248041ecdba8995b940da0d
SSDEEP 12288:AH9GqPTs2v2E4o0uegdWQcPETzufaYsJLvugwDVzIuLcgJ8O47VkElLFqRe+gQy4:AbfQXAQnpAN5dGx2K
TLSH
T1A7165BEDCA7858C3CD63AA30B5F0E9477C7413C3F955C1D68898C184026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6f0c356b0ad326c02034aab0d7e8fc6ef7716754410ae34c825d70c020333059
MD5 34f57263d50b05aec2340926ea6f9786
SHA1 41c81e86e3f2194bff551199300931c84b52580a
SHA512 27292a06a9f48f173ea19dc40ad902f4c5e977193e0325822f0ad93fcd60b27a6833032b55ade032e10e16aeb3e598cf88b52a09961eb5c5394a1becd8931370
TLSH
T1E751CC735593C093FFFBD53280C52B9737309D8AD5A79E928D68E4BD9D0EF10A284094
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 f6fb840af712b341bb66cf6ce77deff61e93d736837195ddc02fe992fa507b0c
MD5 63d5d1ed819effe15677c8d2d8c6aa7c
SHA1 2596da4d9f3ab99e3d191d47902a39d3edd02cd4
SHA512 51fcebb7bf7cd84decf75223ae6ff4c0c6e42915e76a2c9df164b11a3e044ea945844746423271e803bb95856b1285f06edbc7b24126eb859cf7ef9a9e15a23a
TLSH
T11DE0D8D8B9CAC15D5A587483923C7B4CD2D036E2E6997E032F0C88C47647001B75154B
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 4e5c191ed8664c25cfc0ffac7913d8c90a758f38b925223d9092cc167108b5c3
MD5 5d82e3942c561ccc374aeb1d08089c90
SHA1 ebbef1d1f8a49cf66efe1e8b3eaa4693b9d3d63c
SHA512 e2510931c8e3ba2bb16f9f6fd542029e12869144f7edb53a6f0abd4090af5a4acfc8f9746fafd267dd3cce087ed1770babb90c369df1b270ca1348d8a469acfb
TLSH
T176E0268854C8C2299658B997C37C770CC3E036D2A28C3F637B4BD8446302A81ABA6285
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 8f604625b50813e5594138c914e6f4e6d3dd29a20b260d2d1d8f02622ce4c510
MD5 960efd9372b199fbdbc215e2f682e979
SHA1 4f836975b16d4edfebbd201b1c92a72f17980175
SHA512 f37bc9de17334230a3dd52879724615db81982cbb7e9b700830a88b96c8a282c93f8ec5e25a8f30e50e820088fdcda8e66c2c78ee2a5df73113f6fbf23abb688
TLSH
T1A0E0DFB4E9CDC16A634CA04B832D7B0CC3A036A6E68D6F422F05AC99B247104E7832C6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 a2cc6f945a39900573840add0ace21efa5c51694ebc2a08c3c22c92d3b0abdf5
MD5 048d47d82ea8d98bee566f8f048f165c
SHA1 bbf53371c3e83b07434a1d26f094a990eb465107
SHA512 6a754b3013a757832bf3852128fb01d9587f58474e04cf1ea167b16cf27175e0766185bc569b8330e7457ab8762a6af49aced910b88215c95308cf2e0c8568c9
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7oM7wP5baSc:qDeMatha9RAY75Sc
TLSH
T15FB2314D5F306221D0F08B77EDD184632E7C201E87633649DE1460F2CD935BBF50A1AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 56d9152aa2675810d4748fe99c00eef247996e7436f6da0cd3517e99e6001b9a
MD5 896d7ad3e0647c9795bafdfa34d81cc7
SHA1 5e19837dceb3a476da8000c33d98ee5eeb55201a
SHA512 e2077e94f4141156187e53f31607f562852afe192614dc39dc2d48899db3dd0a905d62f215f62d65d7ebf458b4b2aa34956a18a383b66594d5a3fec9fbe76858
TLSH
T1EF41C1F7C3E8853D8A0195F4AB186E1BCE1C0955432C7C5AC4D49E2B93E24B1D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 28fa375a5e6f5493323b90354a9b1d830c4e96567eb8b545fa46421307877ebc
MD5 50cea2c221e5994c4a94b8d914fa7fc9
SHA1 6b892a64b2f69250220d77a42bc896830daa1bae
SHA512 d465cc16cfa5059bb616ca26af48ffb82576d42f20a79a89ee79d445657125bff50975164d5efd49892b94875c37621aee9e5e67d5e91f21ee3b3590bec3cb6e
SSDEEP 96:OIEumQv8m1ccnvS6RWGkacf6CnFcRERT4g:OIEumQv8m1ccnvS6da9
TLSH
T1AAF2EFFB07276206D98444B0E4009BCEAF1A404B47B2B6EC76D447E3F7A21E2B5B9756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 5ab1a1bb9041e2d4c6f4d99f782f591986be3ed6abb52741c0a2cb6822cdc1f8
MD5 79a57713115e1b0756ccf41ab91c1739
SHA1 840fcd17a0af0d0205e1e14418a1aa8273d1bde5
SHA512 93df927c95a778a7cb26d456a7fa8d32c81bbbc98ba58542c537fb4c4a3c887373687e11025388c496350ff8a243e3706958db6259056101e2c9eb329a814d50
TLSH
T105C022A3C0F8EC360078843A19C8A880A6F8EA340000D0A0C895833C61C00F75B0242A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e5c6a8e390d3e4dc4e7189cb2e920a53c9c6fada947435734611752446675384
MD5 edc45f23bdd7119d0241017b49ae0662
SHA1 86e1d5e528e1a77f5b811c9198d2c2906909b157
SHA512 e190496ef8ceca6bac0517792934300a955f73bb44e54f4f1bbb92399d7c338242689a4d7c7c9fbd5a51de5bc9bb8e4e712f88c2c3767cb4e3e2c7f722636ff6
SSDEEP 192:sxRPRYC9/fosDWpVbHDZ0BzoA8pMZ7/g6+WNIYDRjgNIgV4J:sxRPV9/fosDWvTthMZ/5Iji
TLSH
T1EC429719AD28A93B9CCBE61DFB697F23D2F9103260915E44E6FC861C15E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3bd57496fc759e1f4a49cc855f1387f86a1e0271304b5201cbe8f1acc7d81cfa
MD5 d76d12711ee81417b8d9daabe0a8f467
SHA1 363df5b83f12194af5e605d89d4b7886e90b4faa
SHA512 dc4b647afde959aabd6684854593c8419a0aa924af8a4bbc30f00939eaa462ede25a6c7f01d145754169d95d58e220ff39d49a0d0bdc29c53e3da5bc220ab530
SSDEEP 192:sxRPRYC9/fosPWpVbJDZI9lBzoA8pMZ7/g6+WNIYDRyjGNIgV4J:sxRPV9/fosPWvdtI9uMZ/5It6i
TLSH
T1EC42A619A928A93B4CCBE61DFB697F63D6FD1032A0905E44E6FC861C14EB6DD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f73ec5d2524bd7f205406aa04dadde08ddf34a1568fe6b9d9e8cfa3b48006e4d
MD5 49f411436e6ef8cf0f9fad78b8214853
SHA1 5c53577c4a42eb728b3057401051ea8625904a0f
SHA512 bca7f753c2370640732f86ad9429c35d7f26527b0f30a723f699461718c62cff0c80ee279023d0eb871fe4530b45ef18988643c9299dff70a6d3729b0e14a9bf
SSDEEP 192:sxRwRYC9/fosWWpVlJDZI9lBzoA8pMZ7/g6+WNIYDqyjGNIgvWTJ:sxRwV9/fosWWvntI9uMZ/5I86+F
TLSH
T14352A759A928A93B5CCBE61DFB597F23D3FD1032A0801E44E6FC8A1C15E76DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a8ccd7a3c4a767e8d050744704bc8278f5d670a07bfe39eab73f012f793f3e09
MD5 cc22e1ff56a338ad88eec2eee27a25d5
SHA1 3e05ead73a9105cbf3cafbe642995c1990278827
SHA512 12bbc3d1a732a599b262c070cfab833ffead3b0b4c5449c64f8dbf9e09f4e4a01c61c0142fa68186c613654718023096cce2b388925e9ec635b0d7eea4d86363
SSDEEP 192:sxRwRYC9/fosWWpVbJDZI9lBzoA8pMZ7/g6+WNIYDRyjGNIgV4J:sxRwV9/fosWWvdtI9uMZ/5It6i
TLSH
T1AA42A619A928A93B4CCBE61DFB597F63D7FD1022A0905E44E6FC861C14EB6DD231780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 86ac90c257ec830444e714e09859d9ade8371d82d91e40d691921087e199cff9
MD5 bb86ceb95bf6943e410b9496a55a6ed8
SHA1 ded86bfccf77f1fb90567180d2522f55f42140ed
SHA512 d6d2033eec7314476b213a9c484e80c1711e207dc395678aa154322c74fd2492858ba247ac6e57867fc4aa25cecea94f313e9404f2a865e0b26853dfae2eef3c
SSDEEP 768:SzYbDR7pLuLbxUWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OVfQP8WSyroG9ML:SzYbDHEbxUWgasfA6u1jaUQPtSpIML
TLSH
T1ECD2DA7B640CCB7F4F804ADDE81A7A9A6D6802CB96D8C98047FE945C03C67EF511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 65bfa0e3d448cbda26b16b1c68c97b9a22dac71f895862eeacf221cd73037ca8
MD5 423fd6eb2199f7b54c796fdfedc4169b
SHA1 d7bcb6695ae83291d7f4a0a6df728cad54d4557f
SHA512 d54d63bada118a3996a8f60d9968af0b32468b39abf4888b4e4f177a1246cdfe0f79178f1c85f093671725ab4c080b2264c618c1a94f6322c45f2b0fcdff855e
TLSH
T1E2E0DFD895C8D27D635E6043023EA70CC3A476B7D2CC3E03BF099C846143604B2A6182
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 acf34857d20a3aca4916aae02e44b88d3043b2d0d1f195903063d00f6be9b56c
MD5 9e99b1add6341c3bc85007b43bc90393
SHA1 547ea1f4be345887a9ad64e54bd4059f62de2e88
SHA512 ddf670d14c9f7a336daa036e4e09c1737152b475a2380f07f8f2df1c8fa289c78f93b5dd93ef02cfdb41c9bc9ee27d752cd60182b2c322bc42b2dd2167c71ba5
TLSH
T179B092487B209A13E4AB1A3A02844FC16362A40200020863C9846F944D053693F99C92
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 a6021fb0183997958a96317613f81855fdc17d446a15686cf71db72dea7310bc
MD5 848e2af8f8bf40613b5197c604d56233
SHA1 431a8e1b14ed7e697218d3b55069c5fed85e8c4b
SHA512 86bcf6a6b1db2e0a4f493150ece10deeaea8e6088798dd6d9a5f769923ed0e40489999ce702b34c7dd36a1388315448a33092f6f81e98ae74e7bfafbe89f4baf
TLSH
T160E0D8E465C9C63A63997087437CFB08C2B276A7D7CC3E22BF0DA84462072407357241
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 bb008658eb6050f8ac2af00d1c8f6bc1ef88a7d1d2267678ed8e75ec7bddeeb0
MD5 57b970a1dc803d78d28c7269e5beac6b
SHA1 00778e5cfd4db5f7760111ab54247390a4d57fcd
SHA512 92f7743a4c9babea9bf516af2a4cd7cd42a02d6add5f22f4446ae17530b659f23cbd46d2eeeb0e2a5d9cebf39537e7bedf851381ae98d8661bc8b116365799ff
TLSH
T1ADE026F9A5C8D6395148F08343B8FB1DC3F07A9793CC3F127B08AC95B142200B7A6181
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fba7d27da12f5418c296114e49efef96550d70acb6a80c434c83af17798bebfa
MD5 5ef98655a7b12596716610d894d9259b
SHA1 6afbb481b8280b4331c95c242d84959a5b93f382
SHA512 7f8375df7c1556c7c8ee694e44f6c233e1fd2b1dd5db26ecbfeb04053ef37aa16c9e5d7c2b91c6276948fa3ca99e1bf59c814491d8fcdef295be5448f50f556b
SSDEEP 48:K0nKzHJp5Sbx8hISXSK9X19SxXCY0lHbyLp2Np2sp2hp29p2Pp27p2/p2gbp2Tp7:Kc0AKtyeehqKKo5diKGAKR
TLSH
T166913F4670B7461139BD698886F0862B024231E37154EA3FBFAC01A68E6AE141DFF9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 dc206b42bc55c41d3250c949dde42b86c18e37f29c6e099aa130df6863454aa2
MD5 16b19e4735536679ad6f542fa813d31f
SHA1 7619d91e77758c91f67a4d4a3a3ce6409147a2b1
SHA512 5d4ff0e16fc6a71a06ab95dadab43b45f1d3818cbbfe35fe7bd6f749486828e49ea0dab84524859851217486b762fc37c2a19aecb2bff8a4ba284a5153334b04
SSDEEP 48:K0nKzHJp5Sbx8hISXSK9X19SxXCY0lHbyLp2Np2sp2hp29p2Pp27p2/p2gbp2TpA:Kc0AKtyeehqKKo5diKGAKGlyKW0oSwKJ
TLSH
T16DC1125670B70612397D6D8482F0962F034231E37154ED3B7FAC11A68E6AE245EFE9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 1007358f84bcda160aeb42fe2814acd134e5ed5be7539c85f2586e55ee3043af
MD5 7075f4673ecb72ea68e594d92edb2d0c
SHA1 3eb1a77720cf9ab7eb842bf2d490bc228ae8b525
SHA512 9d03b6856e7404914dd335810a727c117ac501d19afc6eb7c2cbaadf57cb48d3245ebfffc76fa7bc50b52eedd0a27011ce7b7e9c6e973d5019425350a169ec04
SSDEEP 384:DNrRZyCSDnxTICBGMEhIKyll7svbFKfk7:xFZJSDniuXyI1l7svbF9
TLSH
T18744750A7B747001EDE6D9725CB080771E3C716E8F22A6916DA254694EF3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 488B
SHA256 74ae94f19df88955417275e29f6d22817ab313a84f3ac6e5bcbc621a0ee1eed8
MD5 bebd51245d0a2dd85657b18f69083982
SHA1 5e579c57e40b4f81494ca0bc6935a6e1b663915e
SHA512 44b8efd23f206bce1002820748db0f156faaabc216d8bfcb5056a1d7705ede96499b770c5eb32796184bbfa5505efcafad23762257838a3a3b9c0d639637d58f
TLSH
T181F030C172BB60557BC8EA90C3641A0791943AE6264DDD717B1D55E84F4882C0FAFA26
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 6dc362d36e89ac80cf8c4fb8bdf0c21acb904e4f4d1e2b7277ae1ffaa7bebeed
MD5 69d501d7f5efa3353444e8dc164348be
SHA1 b4b6ff3c755ccbd4783251c4a7e129f71143f65a
SHA512 4ab55b9c1a783b88bc8962360415905c051c0e1ac696f595dabaadb66dba3f33f34eb6c3fcbb5191551b8dcf66c8a0747590bd405b70a73b3bf046d968f58372
SSDEEP 192:B95QkIIIbbLMIMNsYcYxoOw4Asnli0+rsKa:B95QkIIIbbLMIM2Bowhsl6s
TLSH
T16142945E6A091B77C05E5B7A136B87545BD8888200B2A13D31566C0F9EF3E9782D62F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 6dc894b912c7d6c30659996cb957cd8e8ebd3676e27ed5b7243e8328f8056265
MD5 fad3e474c3d61786eed70f0c3a9f1ecc
SHA1 244e6e3a83f7bf6024db53a29980480b69e41025
SHA512 5886c8e7de4da00d68f1ca85140efe91a841e137f4c87723be2d162a997cfefe11dbd5069e7c5085fb8e9b133e22ffd31b989eaec95f2e9d0588b23d0e3df570
TLSH
T140E02054F4C4C25E7258718B123C6708C3D037D3EA8C6F573F02C44863025407B55142
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 20b04f3cfcb80f3145311d5dfa83a32f6939f992c5dbc3937ee39fe4c626f77f
MD5 2a5f0717ea84095445d149a4820d2a41
SHA1 0b334aa9c5437a22a6746353dd0e11bf10252cc8
SHA512 0717aefb37bdad87221919e615bd9f6493d9966264bc672a18661c6e65c522a9e72146010a3c2e1a52bdec932e3714467b5fcdb5b74889a30437399802259c3b
TLSH
T1A821C455F330C548D15A867EA07B9B3A1734D8168FBCDD0F94BA20646E75B040D8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 eda6e92ba349e76d13a92347e3b336c6311c93d055faf4d8a484beb522b348bb
MD5 89ecf4faeb1687f12103837eef2ceb2e
SHA1 7d5874e0ca239afc8cd978157cf3ddaff19030b7
SHA512 3a3fc2267eb54953b26bb0f3d0b8591932239d7018baf980b7ad581307b47abfa2d163d865fa14b0895ff93f377f507abe26febf2f29ffd3204868cfe7d12eea
TLSH
T1C9E0D894B5C8C25F516570870278BB49D3D13A96EA882F423F02CDC85242981BB46146
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 9826f3f7110982d9ef6c7fbbd9a8d0a5cd8abe290067984ca85a43fd0c51ffb5
MD5 8c1a5368a1525d57e348cbd3bef9a7a2
SHA1 40e941f1bc88f252d6d055dc848cdce390a18573
SHA512 88a0ea1024c3cef83706dc7d32320e2e992ca247690ed2f18f02c3ecd004ca75221686520aa8e10a819e0defb7958f8602008f2210a1c9f9cdea89379ecc3739
SSDEEP 3:MsEllllkEthXllkl2zEfl:/M/xT02z
TLSH
T1BD4404047FC43415D50C11304157C3501370D450053157C334F14C335DC75500C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 06e409e57a022f6097fa120faa3522cba5d729b4ebd547182e68ec71d893557a
MD5 da49c4429dc7353579041c7718f8740a
SHA1 c4798c4fa5ade92e939e1a94185674f9d2fdd61d
SHA512 e32c45d6016b6030825fd97f7757b7194dd7983466f95a861b9799f2c06e59c9d1e494ed0ba0ccffb30a747155e9a2b89670bfe121444a20a892d18f9559d1a9
SSDEEP 3:MsEllllkEthXllkl2zEflk6Kl:/M/xT02zL6Kl
TLSH
T1E3440404FFC00405DD041030415DC7501371D410071157433DF14C337CC75540C01400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 096110b949969020479b4e39431d26e40fe3731f091c46c336a8d77930dd37d5
MD5 dc50c7438d36e97e3501327ecc543f1d
SHA1 72e02cbdb54fff7c8b79b84fe6f632bd68a26669
SHA512 145df97971890bdb45eb3b753b1b070087d441dc16872b6b72555b579d7878c82beaa03b674b427be867bba98b6afbf28376f97821e79a9814193cb7043bd355
SSDEEP 768:Eg3ep1ybNbK1DztyOeRFZD1fTos7Rop2sMM:Eg3e79Y1fT/Rs2sMM
TLSH
T142F2AF3AB8E48D734CFEE245F24AB643BFF4517389C9498494D95F1E0487AAD134B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 20b9a803f2d24f1b0d17127f422baf546a4619e6eddadcf1a13836a165df2f99
MD5 d9db4053967a030c64ec27f53386b7b7
SHA1 f303ac2af514f9fe9224e9db1d04985cbab2d749
SHA512 422aa6e9fc403621b63fb753841b18204def4ae749b1970e0285ca51c0e8e7734c35ac34856a0c73ce3d8211849e7a799d0fc579c97bfe28c874a0080e26a63b
SSDEEP 768:z/UxvxjgC+k3rt+ybNbKDOeRFZD1fTos7RzDL/+Pu:GZj3+k3rcOY1fT/RLKu
TLSH
T1D703BF3AF8D45D338CF2E244B24A774BBFF455A386C91A9809DC2F0E158B79C130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8bc4f3ba210514dcd6098c8c49181c2569652952c80cf612fe4553ad7e0d288d
MD5 72d524ecafff1e6e06488dd71b0c8d03
SHA1 454d11ffa5604ae8c88353f23c64b064da27e448
SHA512 8e451f308ad649e78ffa91b67a978e51d38986a2a43279f8a719e0e32d0657eef03445852898d8a9f055eee55ee408ee3d1b13ccd18d68a9b8390e48c2b5a023
SSDEEP 768:M/UxvxjgC+233h1ybNbK1DztjOeRFZD1fTos7RjYA+pN:5Zj3+233z+Y1fT/R8A+pN
TLSH
T1B903BF39B8A49C3348F6E244B24A7787FFF415B384C95D9899D85F0F0587BAD130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 01d000c10be7a3a0b681eb75c3614f56758cdbd5a6e0b42bea5af013c7af8475
MD5 10b0a008a6a44b5c0b0cbae510eea2de
SHA1 052200ddf834774d0d2032d0803a00f87925570d
SHA512 755edd02a3b9e5da5de916fb3ad10aaeb4f8fb8fd58e8bf0b83b5d2ddd5c5afa763df9d449ec8d274645779a7c084bdc6268b2eeb8b4b15c8805bf22d4899d4f
SSDEEP 768:1g3eK1ybNbK1DztjOeRFZD1fTos7RjP89D22sn2:1g3ec+Y1fT/RTo22sn2
TLSH
T1A2038D3EACA04D7F48FEF344A24D7A166EA84277C5B45584C7D81B0EC076A6DF34782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 f18dc8213fd3d2341e6bfa4ffa13c52d38cbb2c14ba1d218123264075b2a68cc
MD5 48d08ce4e2978e1d167b17ad326571c1
SHA1 f4af8ed652dff39c031fe79688034665c4b1dc43
SHA512 539b7330fdf4760768cb351d45f6ec296cbea7d463d236668877f43d8749b8d71f258cf329a827ad53ae89e1963b938c9aa13875f67ca2b394430a0a6560a6fc
SSDEEP 3:MsEllllkEthXllkl2zEfl1R7/:/M/xT02z4
TLSH
T1894404047FC00405D50010344451C3505370D7330513574734D144375CC75500C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

f74ad6df-adcf-43fd-9840-4f64d6974993.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f74ad6df-adcf-43fd-9840-4f64d6974993.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 f35a4f569a8d6e9a53c7abbb2fdca981cdaaf4108e2934925648d90000b72a42
MD5 29f0806ef1eab44a9cac51d6178104b2
SHA1 da9a041647bf896631ff9a3a1470aec96da1eeb0
SHA512 02d7f20c525765b0a77f7738b19fedba3472edd6c259dff60db5beb1f82ebbef1c72f48fa68ede5aaf452b953f8d1b959494e48c37cde60ada7cef9e322eec56
SSDEEP 24:TLL4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uw/sufL:To/IHRH34kWqB1kQnjhHmr6ITmUuL
TLSH
T14C23896EDA2CB9A1FEE40B3DD7D1D4127B36AA0EC2E4D9F1099B406746C540405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 af40c29ad0f224499ab611f34bcb1abca6d9e3e51e87b596504711a7bbf14ed8
MD5 b58143c9107a704d5532eabf095e98f7
SHA1 e3469ca7c2659c772fa7df7c1aa667d19b67f5f4
SHA512 bccca081c0f870cff5c16e9ca9e6091ed79d5497238f894c9fa89fe59f04e180e01e2a2515f7c3cee77fa726bfacec733020669515b5f1c10d1532b3a7576bdd
SSDEEP 24:8Zs/Pf+JqLL4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwJl:XUqo/IHRH34kWqB1kQnjhHmr6ITmUyl
TLSH
T16E42896EDA2CAAA2FEE40B3ED7D1D4127B36A60EC2E4D5F1095B505747C440405DB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5028_2012598283\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2500-9-0x000002353B000000-0x000002353B001000-memory.dmp

Download

memory/2500-6-0x000002353B000000-0x000002353B001000-memory.dmp

Download

memory/2500-2-0x000002353B000000-0x000002353B001000-memory.dmp

Download

memory/2500-7-0x000002353B000000-0x000002353B001000-memory.dmp

Download

memory/2500-10-0x000002353B000000-0x000002353B001000-memory.dmp

Download

memory/2500-11-0x000002353B000000-0x000002353B001000-memory.dmp

Download

memory/2500-0-0x000002353B000000-0x000002353B001000-memory.dmp

Download

memory/2500-8-0x000002353B000000-0x000002353B001000-memory.dmp

Download