07fe2823f6172c1d72411a3c897e73a359d6342e7d4311904db23874e83b2163

Analysis

user interaction
yes
max time kernel
108s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/09/2026, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JTUw3A4J.html
Size 2KB
Sample260926-16splssfnc
SHA256 07fe2823f6172c1d72411a3c897e73a359d6342e7d4311904db23874e83b2163
MD5 b0bbfde8c8647ca3b640607c47204bc0
SHA1 279d84ecec5e85ef3c1c0b8b9134434782f86e91
SHA512 efd796d82b168f8bcf59b36f8f10f8dda5954fc69a555124e38b6bec77c08ccdc972767f14512c8a20d47cd0351a8fda46a6f169f191f3c2163d0b6ce7224cfd
TLSH
T173415323E904801542B5E244B4E9B71C8023938BDB7248017BB475EF92C7FE1C2762E6
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1924	Ezfrags.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2976	msedge.exe
4676	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{1BFEEDE1-4D75-4CBC-9131-65BA925BA9B4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{088B9F6B-E5A4-4063-8872-636EAC39BEEB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe
1924	Ezfrags.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4792	7zG.exe
Token: 35	4792	7zG.exe
Token: SeSecurityPrivilege	4792	7zG.exe
Token: SeSecurityPrivilege	4792	7zG.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4792	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4704	4848	msedge.exe	84
PID 4848 wrote to memory of 4916	4848	msedge.exe	85
PID 4848 wrote to memory of 2976	4848	msedge.exe	86
PID 4848 wrote to memory of 4916	4848	msedge.exe	85
PID 4848 wrote to memory of 4916	4848	msedge.exe	85
PID 4848 wrote to memory of 5980	4848	msedge.exe	87
PID 4848 wrote to memory of 5980	4848	msedge.exe	87
PID 4848 wrote to memory of 5636	4848	msedge.exe	88
PID 4848 wrote to memory of 5636	4848	msedge.exe	88
PID 4848 wrote to memory of 5636	4848	msedge.exe	88
PID 4848 wrote to memory of 5284	4848	msedge.exe	89
PID 4848 wrote to memory of 5284	4848	msedge.exe	89
PID 4848 wrote to memory of 5284	4848	msedge.exe	89
PID 4848 wrote to memory of 2064	4848	msedge.exe	98
PID 4848 wrote to memory of 2064	4848	msedge.exe	98
PID 4848 wrote to memory of 3816	4848	msedge.exe	99
PID 4848 wrote to memory of 3816	4848	msedge.exe	99
PID 4848 wrote to memory of 2972	4848	msedge.exe	104
PID 4848 wrote to memory of 432	4848	msedge.exe	105
PID 4848 wrote to memory of 432	4848	msedge.exe	105
PID 4848 wrote to memory of 432	4848	msedge.exe	105
PID 4848 wrote to memory of 4440	4848	msedge.exe	119
PID 4848 wrote to memory of 4440	4848	msedge.exe	119
PID 4848 wrote to memory of 4212	4848	msedge.exe	120
PID 4848 wrote to memory of 4212	4848	msedge.exe	120
PID 4848 wrote to memory of 4212	4848	msedge.exe	120
PID 4848 wrote to memory of 4924	4848	msedge.exe	121
PID 4848 wrote to memory of 4924	4848	msedge.exe	121
PID 4848 wrote to memory of 4924	4848	msedge.exe	121
PID 4848 wrote to memory of 3776	4848	msedge.exe	122
PID 4848 wrote to memory of 3776	4848	msedge.exe	122
PID 4848 wrote to memory of 3776	4848	msedge.exe	122
PID 4848 wrote to memory of 2428	4848	msedge.exe	123
PID 4848 wrote to memory of 2428	4848	msedge.exe	123
PID 4848 wrote to memory of 2428	4848	msedge.exe	123
PID 4848 wrote to memory of 3092	4848	msedge.exe	124
PID 4848 wrote to memory of 3092	4848	msedge.exe	124
PID 4848 wrote to memory of 3092	4848	msedge.exe	124
PID 4848 wrote to memory of 2472	4848	msedge.exe	125
PID 4848 wrote to memory of 2472	4848	msedge.exe	125
PID 4848 wrote to memory of 2472	4848	msedge.exe	125
PID 4848 wrote to memory of 1144	4848	msedge.exe	126
PID 4848 wrote to memory of 1144	4848	msedge.exe	126
PID 4848 wrote to memory of 1144	4848	msedge.exe	126
PID 4848 wrote to memory of 1380	4848	msedge.exe	128
PID 4848 wrote to memory of 1380	4848	msedge.exe	128
PID 4848 wrote to memory of 1380	4848	msedge.exe	128
PID 4848 wrote to memory of 2308	4848	msedge.exe	129
PID 4848 wrote to memory of 2308	4848	msedge.exe	129
PID 4848 wrote to memory of 2308	4848	msedge.exe	129
PID 4848 wrote to memory of 2348	4848	msedge.exe	130
PID 4848 wrote to memory of 3644	4848	msedge.exe	131
PID 4848 wrote to memory of 6040	4848	msedge.exe	132
PID 4848 wrote to memory of 2956	4848	msedge.exe	136
PID 4848 wrote to memory of 2956	4848	msedge.exe	136
PID 4848 wrote to memory of 2956	4848	msedge.exe	136
PID 4848 wrote to memory of 1044	4848	msedge.exe	137
PID 4848 wrote to memory of 1044	4848	msedge.exe	137
PID 4848 wrote to memory of 6012	4848	msedge.exe	138
PID 4848 wrote to memory of 6012	4848	msedge.exe	138
PID 4848 wrote to memory of 4716	4848	msedge.exe	139
PID 4848 wrote to memory of 4716	4848	msedge.exe	139
PID 4848 wrote to memory of 416	4848	msedge.exe	140
PID 4848 wrote to memory of 408	4848	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\JTUw3A4J.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdd87ec188,0x7ffdd87ec194,0x7ffdd87ec1a0
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,2038457974622528695,12438462465905138093,262144 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,13616122232909122228,7782974739835906859,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,12548207165011787432,14892972491692564314,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,13996040209313022268,12124207553815327995,2097152 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,8941068351016076653,1447405391107665686,2097152 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,17846442378055545623,14223955238085860059,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,7650691424214551413,3033111399361987506,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,7382426072751899217,13222438572995505170,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,7382426072751899217,13222438572995505170,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5996,i,8441847138888527916,10980479149849921625,2097152 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7356,i,1795441253847763142,16138214894850586661,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=7448,i,15546524153462028787,18023944944403114422,2097152 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7488,i,15574513155071273724,17652396321753700983,2097152 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7572,i,1011013252419433088,11122108820787561216,2097152 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7764,i,11227405162922017992,11181285782714834086,2097152 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7508,i,137155435365693051,7628351769885748640,2097152 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7476,i,10569600801116972304,2668475784965181627,2097152 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7920,i,8111663040139551872,9747325952085053852,2097152 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=760,i,4719386590558573408,8321717318751611060,2097152 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=8396 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=8288,i,8307832176204544040,11343324325319256294,2097152 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8608,i,1421976946216407146,18428401023442827991,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=8012 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8616,i,4021339690024531231,12985173576439405480,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=7944 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8612,i,10183951188056440845,15786034742289521450,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=8084 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=2044,i,5348518885565834255,16374626553530019319,2097152 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8372,i,1984935429098658910,7036641134575491838,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=8356 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,4858871355831679834,7135056126495596981,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:8
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,5004711368507027649,6710347759278030694,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,3724368902773593955,17846365564061943246,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5848,i,5254077597856364523,3959862936206372569,2097152 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,11363655514647801321,5819007999129644669,524288 --field-trial-handle=2232,i,1816619735258067437,7552225540555877472,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffdd87ec188,0x7ffdd87ec194,0x7ffdd87ec1a0
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,17779572584605535936,16812310964129299271,524288 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1820,i,18325047253363321912,14674186029781571512,262144 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,7775705138233044592,6712904752244781591,524288 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4064,i,3975663799033519129,12976840367244759330,524288 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:8
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,6249857684531846854,12487652658084455077,524288 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,6249857684531846854,12487652658084455077,524288 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,12757989215212069210,13219601456734735406,524288 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,8036201291875887367,17888915970215233450,524288 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,12610250157744203780,9567084297271443435,524288 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,9461640602119034019,11489906786890372566,524288 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,14037441899804906590,9782320438288080759,524288 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,12361337160611421599,16191311351316603715,524288 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,3118836598182576895,12816863625429449695,524288 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,9690233687583871003,3417651717910436178,524288 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4048,i,2777698713501154275,15338218959644205292,524288 --field-trial-handle=2344,i,3503195055869187137,10400104178898654981,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
    3⤵
    PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2236

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Ezfrags\" -spe -an -ai#7zMap4603:76:7zEvent20235
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4792

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Ezfrags\how to use.txt
1⤵
PID:5028

C:\Users\Admin\Downloads\Ezfrags\Ezfrags.exe
"C:\Users\Admin\Downloads\Ezfrags\Ezfrags.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bc826aaa75d7da810bfdc30a1671df54c18887a7ddc779d5b9f03835587852b4
MD5 77e198de5db1473b46a54bf11e90ef65
SHA1 d40423f0ddb590b81cb9016394df150361acaffc
SHA512 208c9def9ae2c86b2de012eeb71379c0f243edb53a958e991a05233405a4a20955e43cd9ddeb6944b19a1811ed512d3123f7d75ab4ca5b9a71dca6edca139ba2
TLSH
T1ADD08028B57C7BE4F03D353D0224414C31CD5AB156067545925417554FD155315D48E9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 63883212e8d09ceae0ec4386ea47458e36fcf8b9e3037d73f148d488e3998050
MD5 c3de9665b25c01dbe5298965ad4cd40b
SHA1 ec5e1bdaadf7d3520ec2729ed48a403231cc7afd
SHA512 405f737f561d849ff733ca1ec49123aef41a49a12eea86923b2a0ca3a9f3893e3e8068b6b613ca0760443b8e1895ce425552c473172e6a4bf96d9e2286c734ec
TLSH
T120D080ACF2787A54E42A343C1515524C71CDAB707C07F440E15163642FD766111D40E5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 87bfa5b0cb2b44aee0511012ff60de5640d885bb9ab9b4fd22d1353943e9d626
MD5 ac2b77ce3c3341b727c1aaaca41a6f4a
SHA1 72539bee85ef56527fa3375df33835f16e08adb8
SHA512 f525e6a6ba579d14c493855e4b9aad9bc6527ee0bcba5b30106a22639d7699a967ee7ca585306e07984085bb4dbc59cce2bd131dae15abd9baf1c74581204e87
TLSH
T1BFF0F9B5C921EC3B08FD0B7920A41746FB50232B2A419C4F3B3D850C4FB163B4545C1C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 559b52aaf7c618d56cb52e8e78951d31f2d03e7c8f99712e7033466f69d46361
MD5 282466c4d1cc4da2f8afc58aed4d42e4
SHA1 723d38ea8636960e6cc98ddd597bc6fec38145d7
SHA512 7d11ba79d54e53140d63179f41fee2e3473d309a18decf3df10ccb8e8d8420210403765e92df922d20f27242b2bf21d744bd1273570e193410878d530e703ac0
SSDEEP 768:EOhhh1+7TxCyQ/5Z96F3FGqD/clM4vOGoPLqhSN5LH8Xa4i/IOQ:hhhkTxrQBZcF3FGs5+ILqhS/Z4
TLSH
T16213093DEE9E5C16FAD6003C541B5E316329EC97CBC2825B5E2DF06A362638E544F0D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 a5acece6e068ab228fcb1d3fad95bb01e489143c6089c4d1e4fa1db2a833d07e
MD5 5eea73ece6911d402479c0dbccde73d7
SHA1 de0dff9ad3a1899c7a28edf9ed64d3885452f58a
SHA512 3e0994df3cae520aa7feab3758f0297e3569476e502009c240b8efb7ef60ff330e45056c28788d56e97fe7e4f598151677b2c238d8faead82925b4a292ab76b1
SSDEEP 12288:8L/9L/EaL/gL/YL/SoHL/8L/xL/GL/xBb+Nr:Bl
TLSH
T169B4C5F75952A01ADFAC02F6D2063E3DC177054D3CD1F9EAD5784CD12A29B33A2B9A84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 2.0MB
SHA256 acbc2e195beafb74dbeb344491487781f5ff0b5e6ec527e1ec2878004a679e28
MD5 bf9aa1450c019c08915c478a352f853d
SHA1 0d735918e47fede68c305a34e773758052292fea
SHA512 1f33895b6cf233a9a24ad75a68e6cad2af9213929e3e36c7dd807dfd018498400c5c83b51a70b185939412df834462316e5368306462028ea350dec3297fa6ea
SSDEEP 6144:F9W1W2ytyfCx8MwVMjODwm4fwBOjZQOhzzo4j+YaLQPapdqedTHyXv7GjrzGEK:FSCxJwV5D8fwB6ZQAD10jyXvCj
TLSH
T1C3A56CEEC7682C82DB6B8770B4E0DC0B7E702182B69DD0D39945C5E857C2B8175E92BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 12.0MB
SHA256 945b51e8f2ea84869a6c439c2eb2a1350319265f42b276ba7d081b55ea1ff078
MD5 0ff0dbb2aaca312d1432fc1ad3aaa992
SHA1 bdee3321dc63b751793b80596f2f441115018fde
SHA512 0a5a1d05fb893376db5f6d7dbf4cc0aa8f7dca7cddb0fd803c31ce6f86a0dbd51d27586f12003c9c9596ee80408f52515db9439f86959727c59b67a66d25f2d6
SSDEEP 49152:U6dmuntTl9rXuvaiVW5GG5lmbABABWfJkEdldY:dmMTl9fAUmBGdA
TLSH
T15FC66CEDCA78A8C3CD639A30B0E0ED477C7413D3F595C1D68898C584026B7C5BBAE65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 416KB
SHA256 e005e7c659d8ecb0e22ab812441fe994f65b27ebfc7b35e7e8d60bb12a6820d3
MD5 e1bf2fdbc0f04cc64f4ef4fe99b1f67d
SHA1 14bd8bf4d0d932191b0b0240960c7b0e2719b73b
SHA512 2b743974cbe3db526a377289aa867e34e885c952cf4659a46ce93acecb08bd1d112119906818ed574460784c10e2b470dd035edb73aa47ec805d0177ba4a3c50
SSDEEP 12288:+SHC66TjhX40sJswpxBCeQ5XLQB8GYB0ZspRQIn:hHCzHhX4d1CtQ6++pRQIn
TLSH
T1799423295599B04367B2AB7B09B261337D1AC0336B5F00152E20DE29FCBAF8F9D85D71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 70KB
SHA256 9a86469991c2ac3f8f5fa14a8726f1a07f6b84b82c98537eeac65d5bd4daba26
MD5 9ac3e8567fe7c4adc65fff14104f2565
SHA1 4704e81d8b917f8512b9fd81626c6ea811dd358c
SHA512 569ce529a0b2bc07ba573088bee11352c791052dac7c3d9d6f00ee5200e9b75d06bc5bff8e5f3f40563de2af53204f80e651edfe1b3e9a5210263a7606675c8b
SSDEEP 1536:V2FGskrKgzAThODzrd66WqKJL0yo3ojF1k:V2wpNchQrkqryoYjg
TLSH
T13D63023C2834254E7E39E1B5F42CD193268222B7A398187556D2DCAF387716FE468CBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 77KB
SHA256 d7eeefec4a7895ec7f5675816ed42ae95b1b64cd992117cf8f163412f96031d8
MD5 25192534d660ecf493290fac9f886ecf
SHA1 d715295d4645d407826046737d2ec940d7c22839
SHA512 ea6b55adb689ce6e52e518661c2248fdd44b9fa55503f3a66a5c698d8064051c2b6dbf3ef0ff3d2eac75e67836754c946aaa9dffe389cbe539aa727690ca6f4e
SSDEEP 1536:ddig7kZRrEB8fHmgdCuAdkONNFZYQuHl5G9xWDIj:loZRrEB8fJ4J3NNFZAuxSS
TLSH
T12B7312F856BB42DC3CE1AA2E911D44C0F447B3162AB499F4F8921F2E46FC6459B3648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 59KB
SHA256 ef1113039392e7098919b6da68d1bcaf69106b6035defee747563f221d652985
MD5 fbfc50c1cb187d6c7c98a4646ccf61c6
SHA1 49208d24b5c9797d1ea14ebfb13421497614f557
SHA512 c7c4c3227cd338f6710471956aa82fa3b5bc8497eb06f991302e662442ad780af2a548e7c36e3fa2e6a6ea530e8864b020c68aa9b92a20c6e41f9e8175a4f4d6
SSDEEP 1536:g+DkEn0DA7Qlp+JB3RwcjyeMAt/mQ6yTIh+D6o2q9t:gAn0DFQDK0oZy0h26op3
TLSH
T1C953021818D024895F233655F63A053F92683D4EB5D785C9C1BB4ACCABDB0DCF2B62E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 72KB
SHA256 64e006e29b797b081fd55052037613695818ff7dd221536402900f7cc380ea01
MD5 ad73f65eda8a34d2f8f21c33f560ccd2
SHA1 d54283f91a8b77db68924690e3b3b4a671b9be54
SHA512 6b692c70740a2c7f6af891db9a5f67cc8fbfac964695eb8aee5d924c6842746804f4f336c1c64be1a45e4be9872d08354b7ada9c1f4da3d1e80383bba4446f3b
SSDEEP 1536:iQvpNhY10/XXNi+6RlpG7BYJcu/Ijw6Q3vOZ4iN4Vlyb7IVr:iANhlvNP6RzKuhFOZR4VlyPWr
TLSH
T10B73029194F85BA3D3AD3B7CE1AACF1107D88E877EA346E6B2CEC81141B140586E391D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 7fc162504cd85140130abc138beef7332f9a09710aa4535a679631b0011009b6
MD5 50f1e2ed512cdc15ee4ea8ecff733241
SHA1 d4eec0a1aab86ced8e4734849d30b3aa2f648c72
SHA512 fd6ef76f33a98b8d4c99090e10fb200be9f26678ddc9d2911d0425472f3a287e43f50339f87a73c00c64c0fc6a20c939ee5327605bf2f21fe11f68b748a57dba
SSDEEP 96:ywKIAZSNCwTVJ2melgO7a55cBVO8xIoPAGi+d6tRNH77gvRLc2LXJ6l8STClwil7:6kmv0sibag/6x757AHxqtZpOo
TLSH
T177D18544C8ACA897FFDAC93154E11C82BD7E6A1260939F160ED9C5B7BFB339254483E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a1bc7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1bc7.TMP
Size 3KB
SHA256 28b2943de8144576bbb4d077a2459211bda29bdd8e0042aecc9f299f16aeda70
MD5 8ca10d26ed19482e8f039a14c2c37cd5
SHA1 7223bafbedb524f4ba38f4da7d66abfad51c7a86
SHA512 39dc026986f8f8f804d24c9a9c84ccd32ebd230f83b15cdab3fc9b93dac18590cb8965af89211ef00966127bdccf1496d78bc6bd3d6a16e9135662f5d7a0ca5d
TLSH
T11161C749CCA0C1A7FF9ECC7099D81C87B6BE4D87A5C3EE02049ED4B4EE67350590C154
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 e0c258c7342ac82c813b96bacf684b748d0ad00b8178363ee611941f7125bef2
MD5 34ca7a829953b003e765f38e535854ea
SHA1 7884f9bbffc4f629d5e0ffae7d179a57eaaf0d9b
SHA512 a4e9e83d9a10586a3dd2099e98b15169b3bec6a9b758a27efdb6edf7b3c9bafceab6d1522715998427a0fbb206b8c40504946cdc364c8bb35d2eabccd9080e4e
TLSH
T1F3E026280DCCC26AA1147893827C4748A2D035D2A3CC3A666B0EBC487241B41A387695
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 4e10f8ad945d9e310f747b3484e738e2d54fa123e7fe99390a6c1ab38b075412
MD5 f3b1b502523f46cba18d73fb82544258
SHA1 4c232fb8696018bde90ed2daf7d1fc69577bba2b
SHA512 d1fa734578bd94e580e6e47b62cbc8b967c178159277334496a26f7a175761b22cb17aad9669ed37d93cd363c11ba93372c3c37571d749188cf033a257bc9205
SSDEEP 192:Lj90UbuaVA9gNea/yZCtWJ5xF4yNeqfbuaV:/9g9Uu3pF7v
TLSH
T115D26B27AE367850CBA21FB70299147ACC3BD29E9F728C59361D00190CBC56E42996FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 1328e1e5918d3dc23cf15a0f48bc2b7fe106df3de881b30fd879c8f56b54ba1e
MD5 e9ad6f1711fea82299825aa2542a11d5
SHA1 b9aa05e9feb6ebcd7b51d6dc79eecd3ee36bb21f
SHA512 e02a4ae27de00cb51e046d4e3a3caa1efa1f1469b55d274cd2b67cec135f20dca95bc0193644759478f9d846704a6cce5c677ab132ee00f032c05a6fbc7fb72f
SSDEEP 384:AK9x9h9wu/83uICtTBBx9Y9T9G9c9F7DXspU3iZ:XnXw4ptTBBnYxmkIU3u
TLSH
T16514D76F1F783711CE2C41B625E655E79CEFF02E8B5269D6746200B0CDE1B2A509C8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 15KB
SHA256 f8f3f10dc8ba16b7b3afc1a204c7746b6e00ec8e39b8c871edce02478ad2d57e
MD5 46feee656cce94803fad9e68b75229d2
SHA1 5a675b76a95bd6d0e486184532eaa7d9e589f16a
SHA512 1b05b570ff8b014646b784666691c6e53b6ef2792833b699dee8058e284f66629d1d8acae7938f19bbaf0670246aeb2f3fdd103a4fdd4d1d9b608cd0191b4ea8
SSDEEP 384:n8OvOA095aCaBjSHIBPxIHI8InIZInIzITIZI:n8OvOA095aCaBjS+P
TLSH
T104628A26B5F9060AF2BB5E7BA4B61B954D7BBE462D04C80DA860721D4C31F40CD73B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 386B
SHA256 b580ac294f236f1a34138f076aeda14b6db9bd7207ba91c17e4e1b6a1665dacd
MD5 662ed6436c4427ebc3d25123cac90510
SHA1 f17b683a3324b3e88fae9d5a43897b445eade39d
SHA512 73edfa6875ea3d027bf05a9eef9c24c39492a13e0f4ecbbcbbc6a71a153e3d628e62cd4999f33cedc6a815f766c3adc4e1444db24b4b99fd7a5767ff85c35853
TLSH
T178E068BC48CDC36FB14430A38138BF8AA2A3370AF7CC6E956B0DD85DB481240B26E561
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 20KB
SHA256 2191a5f7b9cf0a02a7a2007762a92f384171e20afcdf944d83b55ef7a66859fa
MD5 85a3c4b43db3a1b2e85df33daa95da1b
SHA1 ef6df3476ec0dafe379181a4991f459f85a54172
SHA512 3dce5bd4c145c2ceaf4d60a859d8c39bd4ba84b6763f23ff5e849a777791b5060d989addd9290d73e26a76af9f14ef35356f99dd94e18fae3d76548f75c2ca14
SSDEEP 192:i47BT5QTbJwRX3moJnrHotnsnIh7OZ5AgMtboVpNDk9zuVeGdq:i41mJwRF1mnwIh7OZ500VpNDk9eeGY
TLSH
T1D292B5F7180CD457CB8568E686B6FE4DD3838D3FCED6ED99D2A8845E06BC03436A2542
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 e262e4a02ca62a51fcf09d22e8a2cc519a790c9c1da0c1f9799c2506167c01e0
MD5 221c973bafea23c131bc3a25ae79a1f9
SHA1 385a94ae0c8e0ab44609c9485eb7d5abbbdfdf7e
SHA512 2fb0d1f1d09756a0deedfee8c30c6f3be0dbb7ac9fa0e8c182fe6e6edcf4463ca5e2afa935d21d310a9015e89011923b48c4e0111922b82747877cc88af14b13
TLSH
T13CE0D8B444DDC25D6148304B422C6B4CD7E0354AE6CC2B1A2B0DA849B145544A3C11D2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 4a256cdb4fe317732440369a178fdf0632918f63f9aa469d58935300fe473452
MD5 3fee80bbe55e5ec1f182f3e063f2819a
SHA1 99f3f31c9e16cdf035ce0500334e58fc5380010a
SHA512 924752d6b718e3d16f80d8943051d4d8a8c4035fba7336ca16c59719fad22f580b2d8aaad15496a8c9671742b01aca6116ff01fc1188a0cc91c55eaf81434482
SSDEEP 192:D17anpVSDQ2VRR23eFFag1cH75aEGkt92z5ehGeqUrkAIBceVVUzVnqLj44rGqav:D17anpVSDQ2VRR23eFFag1cH75aEGktN
TLSH
T1C432EFF7C7E5862DD81151F0AB186E2BCE1D0959532C3D1AC9D8EF8BA3F14B1E141A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 20238cda006eeaa959c3f4b519bebb768b64159d3de1d326a9a253290ba7e1e1
MD5 cb1f01f6cf4b0bd7d1035d807d15c598
SHA1 030017d4e58d7a6af1175e516a8819eac4c4fed7
SHA512 579350f5e7ed61b9411bfbf87ca094993ca47b77e5a9e6a499ff11cf40edca70e3f38bcc082cca148622441bddb433daec7a074b4faee6b7a2ef20316f76793f
TLSH
T1C5D02357130C30B5D96C6DD14055FCCFC3A600740492D9D510D1A99D753185C8F57184
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 77fb7b9697b555d6b8be7868ece20d0f6c0ff9f227aeb2d04997035143351f52
MD5 4dc685373e097e79b26865f886e8ccd6
SHA1 3d3ea092af1c01ee675d275d0a9fa3b31fbd93c9
SHA512 68407faae6d10a370ca947e1f42e2ecdcc08d6335a3da6ae805adb4cec265276a16b6381b32d523004b3772b0b7c062c91d8ad820e7972cc8b82b37c53d87032
SSDEEP 192:sxZYRIk+/f9szhaQZLE8cM5bAHyXodp4kfHW6+WNBmj/Yoy/SkvIgjtV1J:sxZYl+/f9szUO/stjHbC/CSIjtR
TLSH
T19D52E8596D28A97B8CC7D619FA15BF92E3F9503394905F48A6FC8A1C24E76DD2203C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ccf47c7894440691c4c98b5925959aa2a79f172be50f7c99811e45fbb88fe3d6
MD5 c1dbbcc03b45a062dfe22e59f2303972
SHA1 08081f30a0fcebe8152ae7ca00a5977e6ee04a9d
SHA512 63d7de6521a15da7672c72b79a4c741f971414a549ebea697657d9e526a8c6e2ed9d70058bb87838130a049a1bef7400a363e64e0cf744c2e77f5d5a5a2ec0e5
SSDEEP 384:sxZEZmz+/f9sbiON3Nm9Hb7M/2SIstM9y20:scZmz+/fR03eHbS2SbUyV
TLSH
T14272E956692499BB8CC7D519AA35BF52E3F80033CC915E4CA6FCCA1C24EB5ED2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 2e47184336e1ba2d59b2677e367c446d7a4ea1be0849621d7b891ec19284ffbd
MD5 074416cd81e0240e73724e948c4ae3da
SHA1 180a900527649725af6e1e625340ab95f41d7ee0
SHA512 0bf58d24cee31cb7ec7f9bf157f89f7c3c984df9a0b5e44193b3c1fa07d485393792f8d7be8b02fbc406e0e3c4571729879771694fe660a1f13c1e1435079080
SSDEEP 384:sxZE5mW+/f9skWvXYSJ+3NmUHb60PM/PSAeutM9y20:sc5mW+/fJYX/I3BHbOPSAjUyV
TLSH
T18E92D856642499BB8CC6C529BD25BF52E7F95033CD815E4CA6FCCA1C24EA6FD2203C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 9e8d6c9800fd084c49709b246dd82f102a30db3bba752e7b2f3b6acbe224b9fa
MD5 5a7b4e183e08ae7534bb2641fc3e9e3d
SHA1 1e32a50209840ae39e86756bc827bcac7301f115
SHA512 d4603a1074ae6efed10a1c6ef5d25eddb4aaa266f3f28e6b31317a447d11c57756521e271fc727522a86adc9a6e374869c2d993729e7511a460e664b711a0e51
SSDEEP 384:sxZEZmz+/f9sbIOB3NmUHbOPM/gSIstM9y20:scZmz+/fN43BHbVgSbUyV
TLSH
T18B82FA56692499BB8CC7C529B925BF52E3F94033CD915E4CA6FCC91C14EB6ED2203C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b620e7dd2103fb9a8d6709bb7e7f095d38b700c914a031e45913c9a1e462bc1d
MD5 0d409305f55d98f8e34caae82a6bcc03
SHA1 ca6fec037e2eaa36f8cf9cf4ea08d42d7b957a47
SHA512 05f89edc5692a35be3dad1d978ae7e259f69ef099f4cb3520218610990002068f3d59d8a4a0591026008f4938b9edd1f6dbc4d61ef51da251ab0fa535becf042
SSDEEP 192:sxZERIWO+/f9sbhaQZLE80YkbAH7odp4qbHW6+WNBmj/Yoy/SkvIg5jetV1J:sxZEnO+/f9sbUO/3NkNHbC/CSIstR
TLSH
T19452E8196D28697B5CC7D629FA15BF92E3F95033D4905E48A6FC8A1C24F76DD2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 4197fcde22dbf6751f10d8963a8393a7c180b13795618157f6553939d55f875c
MD5 a9e000779a9381f77da0fd3b8287ad45
SHA1 6828eb71820d779ee272e857b5b8e248c6e86740
SHA512 c7f992cd0f946de9a5a648e067fe8da7e1f87156cfeafd31deda5898ea3765338b988f58bebd60683ff26806927f3cc1ac450b4cb0e61d292f84e1b505513fb0
SSDEEP 384:sxZE5mW+/f9sbXWvZOB3NmUHb60PM/PScutM9y20:sc5mW+/fWYZ43BHbOPSdUyV
TLSH
T10892D956642499BB8CC7C529BD25BF52E3F950338D915E4CAAFCCA1C24EB6ED2203C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 1ded177db8190967b4530d2813844b4a77ae5a7f4672d10a44aac4a84451070c
MD5 06126dd016231a749beddf3a2af79a70
SHA1 9a31b5100b07868a1c050eb5963166237c1f8a1e
SHA512 b71b2f550179d397c51f43eeeb86a4e2a5e3b664c167c6313df03096135a0b98344a160681f261642bc95ef1bdd63fdcf8a259ecfde3ed6fdfc8741441fde172
SSDEEP 768:Px6r8j+Wviy8K8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYrooWYbgno2:Px6r8j+Wviy8Ku1jaqpLd4jjoWgg/
TLSH
T1ADC2E93B740CCB7E5FC41A9DDC5A6F972DA802C796588D408BFA944C02C77EA912B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\00a0546f-67c5-495c-b4b6-1a9fc7a4ce2e\index-dir\the-real-index
Size 72B
SHA256 6a9b9953faf113811ce47d00a3fe61e5cea3af4b39e396eaf451b8e315fd4f83
MD5 9319bd44009f79c2adccf1f75dc54baa
SHA1 3cfa44413d5e89ef858918e87794e4ca7b417ce1
SHA512 0fdabb8d2c0e4d9e3857655137c2697abbaf8223295e30c88c66107b1e57b8dfa0b4180c7a75d711766d46fd33f8dfe9b98512043eac1c77d4e2cb01f2eb9ad6
TLSH
T12DA0022446C45025D10612BA259A01513310CF100A01730B46B80A84DD50D5A6D4124E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59909e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\00a0546f-67c5-495c-b4b6-1a9fc7a4ce2e\index-dir\the-real-index~RFe59909e.TMP
Size 72B
SHA256 472fba5b002dfc6702d6c329c01a719468127700ee68686cb164cc30e7192b40
MD5 a9adf059ed6ea682038e61b68c01fa4d
SHA1 c14277ff45540237c809df0536ee4e65e0c6f7d7
SHA512 6ab87cee4579f9b2935a66ac71b04f7b78339f9ca2ad481ecc93f7b292fd4152db09720850d31ac246d1b7c34ebbd653aa79e4c3897ae03704b960e52167c519
TLSH
T1F5A00213A7C4200DD41691F11A5303E51303EC576101134790955084CD544405F7130C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\42bab3f1-b0d4-43ea-869a-f274fbfb1ff3\index-dir\the-real-index
Size 72B
SHA256 8ba210fa3d8240e1f215ec0d8c0b891295063d62f7d11adb573f903e098794fd
MD5 5ca94f50fcd836af3f39c08083d9d6ea
SHA1 7c74d581bba23b6db2fc9fbf640818a9ba6533f4
SHA512 783ed278ac0c612477e6e96593651aeb2c64bfb1356e0be66798c26aabbf2dfd1cd2d39928298ade0ce99a6061d03a862264cc1516aa44bc8a68320595e13917
TLSH
T14CA0021E0E815201D41256B8F8D7554223148A11A2114F064EF80455ECA4742411B198
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597b7f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\42bab3f1-b0d4-43ea-869a-f274fbfb1ff3\index-dir\the-real-index~RFe597b7f.TMP
Size 48B
SHA256 50f4a7e13fbafde44f9120f7a29d8977393a5dbc5c126905b11cf8d55798d0c2
MD5 6fdbe9437241a2955bd451ed677bcd67
SHA1 3b0833433c993b4828004bd03d94aff6315ed5bd
SHA512 334e38df9ae3cdae5901336aaa6ae2243d990641bbc49ec5e5df2dc8318bdae74283e6cb93098d71bbd4960cd1dfd5f64b4868b1f7af2b2703871b1c3032ea4b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6ed6e92e-da45-4e55-9c2a-239cce34d285\index-dir\the-real-index
Size 3KB
SHA256 a639474d6954c8c4c16e7a6f1a58401b7d4b6ef5003f6a0fca4bc7c8692eee6f
MD5 c8c88c295c1e7890cf95e142b00a8580
SHA1 7887ae74e6a3ce22c559dd4029b91771d39e46d1
SHA512 65bd2df64f112b19b7a14d494070f25159d6647d7d40e263b11a5475f48d70525cc7e2979a1a12d44439e3f3aae83db78891fac366a4adb3d88f6611ab92c923
TLSH
T17151F84E0E0B2B6BECA8B27005B50845377455CC13B81E2BA5FE5138F8C7B2D29C976D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5995ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6ed6e92e-da45-4e55-9c2a-239cce34d285\index-dir\the-real-index~RFe5995ed.TMP
Size 3KB
SHA256 2b8afab4618ef190033cda6a27ea7e9196df7456e72c67ea02fed33ac5487854
MD5 52fc7d8064febd4a4f9bb7217ac02c1c
SHA1 57f78115368ea71fe815fa83d71162007cb4c828
SHA512 e57294b64697d3cc672de61520e603a9d040cd2481888c7b19d8645afc99578458236f1339b44c4d66c58e8c8e1934a3fa115ee5e37f5ddd7cb56c1764d7ee65
TLSH
T18C51735A5C030735E894527309EA58A63739A54487487E0F62EDD132F8C375C7C597E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\efc6535b-79da-45cf-8882-832e15f70a37\index-dir\the-real-index
Size 72B
SHA256 d4498c6860b72bc90e7071ecd15774be3d2b34de0fd85054cf28fb3fce4a019f
MD5 fdad2f5ffc8c69a005dbb2021fa31c12
SHA1 e38c5920b772661bbb9e16264751300ff85da11f
SHA512 c814773ee2bceff2dead5bbc5b7c77db8eeb7d52bb47beeae613e2797615f753edc357d05474511eeea6dcd520beb268669c49d63e685aec8436a6bdc8e12e0e
TLSH
T1AEA0023013F64061D94106F2766209522B94DE1102414307849946A59E5515E4D112A2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 73f8202d1d4a4aa0a5c1812c9f37825c7a0d1760e91801ca8182510d290b025e
MD5 6a149d6c39ae138f7b74380d60e4c4aa
SHA1 0cb368dc202b40de1c35768f85804632e7b9039b
SHA512 70b9ae730c485e75ebdb70092cd09c8d3060f688e1fc490ad4b24010b6a89633d158181df0e996c8d8d1cbdac3561c30ca02a61c37bbca2aeb0f597288b000aa
TLSH
T18DF027FB3FF72814F8EFD2D9283154B90612BC68C448AD2F505BB693E0B52062499CA6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 ba742f0a0596e4964b685dc31124399ace1b1fe4796a98169e6acac770095bc1
MD5 8423c72de362b2f12ee7bae2db3db57f
SHA1 c47d1d73f237e6e3239193a50e688530fd6fc619
SHA512 c8d0dc117d9b0cae4a97a10b05661e2f1af02bf23df62535714791790d144c7a5e076522415c86a51959aecc38fcf04fb0fe6dac6f1efb74063056ac0f674d04
TLSH
T100F02EFB3FF71814F8AFD3C9283144B90611BC69C404AC6F5056B693F0B52052495C66
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 11KB
SHA256 657fc22f0bfd5850d505e8c45c2c1a799492c2c97503b970153b9ab1e4bb3cad
MD5 40749718b7c1861c131209aa13b15834
SHA1 d51830de59756c36fb8d59da2f858f4a7a843035
SHA512 ad3c8d106fe5307836dcbb38b870b4b9c2c8630af850bcd55bbcb9a1cd96a0c1ab7a830482eefecc698766b6716e11c4b70e94945365afe1f127b9e9a3457045
SSDEEP 96:F1m5HB6tQjc6dtQI1xtQjc1tQF3tQMTHlRtQU2tQeU345Z+vQN0D+vQeW8s+vQNg:F1YHY/+//1y3tHvoZd+1D+vW8s+7+8t
TLSH
T16732DEE3DB145053C9C9A6FA6039F6D8551ECA4A6FFF47A614BD8F6E52402D23328B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 1bcdf580e1482776fb0d29ea600616579a08d7b59a344c6dfc5eecf22f6e2724
MD5 977d9c9333825e0d6094931990239348
SHA1 7bbb064aa00644ee6f02a41c1d96219b898f8248
SHA512 caa91e71c97d902c329437b3119131e566e5f633763e5089686feb89b38746a4a8159a1ea62544386f446a590e30e02b15fd52d88d84a0b40a471d0d7b4a34b3
TLSH
T1EDE0DFA81ACCC279701530430225974CE3A4756BD2CC3A233F09EC866182704B292192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 9c609edc9b6f2f0c18e2de394a6ec19a074d32f60c09a73747151c640c2a4a78
MD5 3fb15d6116044eb4bcf109d5f8f3b630
SHA1 589a3aa018244b7d5da8720bb6b961da46a1120d
SHA512 f2bb3de81df14de198495577a9bacc6500424f6da23d38d3790605d20b966544a6e668c76b71450bd553b9b0e74b1301ddc70412e72dedd0be34aae9a5317968
TLSH
T13CA002199E5C9052D0600275E0651AC463908C988A4B735394ECD15999551804196458
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 512a29d2d7be1ac19e76ceceda614665858394753b63569e9b5cc264beee5f0a
MD5 9a1e96fd12b064f2f160b77bb0943052
SHA1 d9fd9401437abc91d6c9d0e8331e903b9b35f51a
SHA512 0d0a7643e9d4c0d3bb95d219b6a205565a9c0ce135b0d589c3ca316975729423334bad6420a20458f809c4d7af5b29e7921b1eb8bc150e00e64c058ed4c66d6b
TLSH
T174B02200CC0EC0A0C0B0023CF032088C30088CEE3B0E3802C0FCE02E802230808C308E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5991a7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5991a7.TMP
Size 72B
SHA256 3024882bf328c091b5aaae66b191245332de6865e1c2fe891cf479f4f0299dcc
MD5 91afba3558dad18d8e52da75cb203a11
SHA1 741ed4ae16cc15f3da78d0bb0eb10ba1dbe0859f
SHA512 aad16ab9a0ffa0c3b2bd947ec14f6af0f769a688bfaa0009382bc9fcd51f4b42779c96d6e108ef5526fe7535705f2baa4070b0b7bb53b9456e292360e373c93d
TLSH
T143A0021ADE97A008D442017026359E442A01EE99C4103352C0EC5445CC5004265E5501
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 316B
SHA256 c3ca5b0a63d1ce1ab2e80640d2a6eaeb1694ec678556db9d2af2595c0ae7cb7c
MD5 aff465803978b88bc9ae409717c0527d
SHA1 8c7cc5bdbf3e802bca399d67602bc64108e452f3
SHA512 3bb00141d2516d4d28ae00f27f47f171846eae2cae4c0f07c0d3576a4e3a264f8d6dd56072628434f6a10b37ec84f59e650121fb7aaf27e5a3f6cb3ce80f18aa
TLSH
T1CFE0C205F7604502CC4B3B322620AB206711DA8608119233C81CE8122B929ECBF1B1E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 4d542a763fc762d729098e96245206a41334afee12c0ed39b3514cc4c15bf313
MD5 87f70562819765793010c45d51e982c3
SHA1 ae54c0248b2efaa881e5657e5d9d075d14a54560
SHA512 8a3a4f13f7521ad12cc219922a783d6624c97db4da1ad0254fd84589c01f8af9a6f2b0741d75bab69753af129122ea4b631cc73489b2e9b2395dde8c5c1efc8f
TLSH
T118E0D8B826CDC32AB155308B4238EB4C91B27542D6DC2E733B1DAC85734634073C3591
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 63f97d3724ccb38373332be77d5cdfadd2b8f6a4301a0c38b26b76a72cc3802f
MD5 886f1e8ff647d160633f18adca560ec1
SHA1 d5c19d3ca7f5adf57cd749c2309d890401d74656
SHA512 afe40c88975c74f4c9ebbcb153b080fcc6b9995cc43693092927d41f42e28ab712e4dcb12363bb2cc630c138846e98ee931c7af305a1d1b300d82eadc2ee5c16
TLSH
T1C0E086F556DDC33A6504708342789B4D92F0BD4797DC3B6AB70C544AB1C1348B3E7995
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 faf52979d9b38e2985ce833bdca189e5107d0dfe356b05900298e5b612384c5d
MD5 084b76ed11f0aee60c4d2e2729146571
SHA1 993dda29b5a4bf76a7e1afd03d6afc7df340e61b
SHA512 1cc6af087b8ef0c389433695c71e6e4175988dc4879b57f0b99b3b9bfcbdfa4b6ebf06e8dc4bf7bd4f7bcb499868ca330fd161d88f36b58bedc65b71e96afd39
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgx:ST/2dXOJhJlpfnpp3tNXVrN3S9DK
TLSH
T12CB2115571BB021039FE391891B59B2E168231B33119E66B7FBD04B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\6d258038-8157-4cdb-9884-cd8b6bb5f5a9\index-dir\the-real-index
Size 72B
SHA256 b151ff1fae0b6dd533ab86b754ea955dff0d8a037467cc8346a086b0273f7fc7
MD5 e73f9e6c3eff8ea4d67b1c403fe0b54f
SHA1 96425b6bdc6dee2899e8990b833d55b5a23481b5
SHA512 817678356bf6f8c5260dbcc6e107529862b8c4b222aabc6027d5b89686b9cf165c7ad2bce0ec726afdca089ceb12bebb8459761e5b780d69bd1b5d30248e0511
TLSH
T1DEA0026911651200D4110170541705A332254B10E8152207C5E52294DCD11B5450713D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c73e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\6d258038-8157-4cdb-9884-cd8b6bb5f5a9\index-dir\the-real-index~RFe59c73e.TMP
Size 48B
SHA256 4bff058f16a208e099b283c2d539bfcd13e7c72c75919e659e98e2857c3c35de
MD5 a42c167a2ee03ca604f66a7d8e92ac2a
SHA1 2c7c8d9e4c65dd6d97936d176a752f072284caa1
SHA512 36f51fad31d1fa802e23ce252148479c1ba676e459133acd60a8da7f152b16287276c0c06a56c48c1d3552932807d878928249e06d84305795009507cd0680bc
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 80B
SHA256 6c9267f03540e994027cd404fe20fc9770dbf54efd26277287dabea4abb53eca
MD5 e09d09cd6e37da18cbaf8ade8d74e1c8
SHA1 7c1f146068e610d9faa9159d758635bca32d856d
SHA512 6ae567b7021f853b64202e63f8d5950c87cfdc9ac838ff625b2be9d4801a68fe37ba0bdefd89896865d153471b4db9cb117604f17bac99ac90e188009fb63fca
TLSH
T174A002F7084491AA1F31A9ED3474F21DE04B858D8DD0CEF0E50990523578B761096D14
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 161B
SHA256 b47897498039098ca61bbcd903b196b09dba58eb3c5066857f3ea5ac89a809a5
MD5 a3588e64ce82608ae03a0ee5d7255c1a
SHA1 1bb356c7b96c42806714b7646455d6c691b5b717
SHA512 d8b8790864803bd09269094723ae73ed98af47fa077f8a3f316deb0fcbdd0908484c841de868264a962e560e0f71251ac8027ac8423f8851d27da753dcd010cd
TLSH
T1D9C08CD3076016A6077166D93020720EC1174C094CC0CCF4A40970423078A23C021A24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 155B
SHA256 a8e24a250c16b332a8a6b541505110e4bb6be82513aab3be7f3c1f50113bceb9
MD5 c2a67dae59544992040183b60682d6b9
SHA1 42186febba889df580f0bba0030f3862bcf67412
SHA512 8f0f77a64ec7ece36d40305142cd555e71dbbc8c26ce98729bc0f677fdae29730b5965b1bbf4ac5617426b11c235d0f632d6b7237d02393bdda460ff7048d3c4
TLSH
T186C04CD3479055AA1B71ABD93425721ED15755494CD0CDF4A948514225B8A638461924
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5986e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5986e9.TMP
Size 164B
SHA256 8e0adbf71e6084d5edde3a6276011c28a61b5c45faeaba9ac384ef66ef735d41
MD5 64d84a9111a80b8ffab53b8e2f2e5f74
SHA1 7bc38b2ec96c3304ae76af80a54b85edcf87bc3b
SHA512 23cae1ce55855fe8243747e5f50c173ae11593044690c997c950e7671244ac365379b325e8ad5b009e0c37a9c44df3cec15b57b7e1caa1364e34fe8f4c956711
TLSH
T11EC08053426141551A20DADC6434620CD0535E0D4CC0DC909846F0D174B4651855D618
MD5 SHA1 SHA512 TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 15KB
SHA256 ea2661b53c2c5f5763055681f9d74cc2353e81202bb286facbeef40eac45652b
MD5 63c5b5197f45dca86df3995be009f87e
SHA1 0399fe1b3051e257966c3c3260f66c21b1ba0f70
SHA512 6b36e3be01dec2076927a0d0e1eef66808f50d5955cd1385394e80aeb80013552dee61dd15ff12fed21296875eb841bbc6c289e23c76e341866692c9d7e4cf09
SSDEEP 384:8eEls/72sArQVIII8bMMIM6Bg1GyuOp1p/:Wm/rArQp1pZ3x
TLSH
T12972746923051BB3E1BE2F76126D879497DACC4206B3225D3062680E5CF7A7BC6D42F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 66ef1f1f5fe053217cd1b0f2cf415c72e144393085cd392fae4b8ade102be626
MD5 0bfdb78685536be424a54bdbea312c13
SHA1 a85fca92d40b6baedba3f95c96d8b26862dfb809
SHA512 f821b01671a9ee57f6569b2a223dee825c648c08117105bc2d0e36a9f8cc0955d94ae003e699f5f1e0222e2ad8767c2a8317321d9e51f5ef787204ed1084e92e
TLSH
T1BAE0DF34AACCC26EB155348B01244FCDA3803A5BFBD82B262B09A448B241200B786592
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 cd40d8718b7efc948924329a6a1449305134a78c6fb1b9950b8f27d65f3e4407
MD5 4b6b6cd9d372fd9972190d59b2844ad0
SHA1 b202bc299f25c4d58ad6b9fb5321cf7cc6688cbb
SHA512 b2b32b6034102ed34ae65838f6fa1c40a22e13832d3899557bfe758257a07e389af51dac69cebfb3edc183494a4b3715caa3e82ce8fb4add58b33ab1ce86d53a
TLSH
T141219045F320C249E18E867DA06B9B251338E8168FFCED0F447924352D72E141E4F6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 b72751bcff92913ca1bb59dd34184efe576978ebc344cbd4714dd97fabffeeca
MD5 9532dc3db829ce5c0f405c68c23643b6
SHA1 1bddcc5b24c45b5225f6c79a563adf463b22dc5d
SHA512 8b863668628ad9fa3c935e779299ca3bad9841de67089907eba6ddd95fd21af7d4894377caed9188f397f445cf07427b320e868fce723bc017f431b6a9e75072
TLSH
T133E0DF34AACCC2AFA151348701748FCDA391399AFBD82F222F09A948B241241B78A592
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 c9c6b1b13be6e2b7d07d75f06ea59b001cbcde7484fa9c64aa4fbb96c7bf6de0
MD5 d984e2d7d531d9bf744ac6b9a420c7d8
SHA1 cdc5a26e79ac1dcaa53138e0e1278167bbd789d2
SHA512 a767fbfcaaac554c291941130ea9b809fad0ac93d5ea4046a397a9e454e02a38ec631e94514d77bb12dbb5ac1c9f3f8dda02a69f3c84234e48aec4ab1289b9c0
SSDEEP 3:MsEllllkEthXllkl2zELUa:/M/xT02zG
TLSH
T1294404047FC04507C701103040D1C3D00370D5115511D7C77C5D04537CC57730C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dda9dbdfa4602678ee5fd50d8bdd874bb1417441809d12c092e11eb0cfd3314d
MD5 ef83e3484890d9105f5d3aec9edfa98f
SHA1 1fa3dc650bd594eafde82742c8e2664ef68aaf22
SHA512 3e53b09df35c198dd77c3811f396744dd5b07dbb0e19850735cc5bd8564cd5fa8993a46a005b1e8d5589252dc9161de9c028e21fe34a834878ded531cf2322d9
SSDEEP 384:nCiFiZcIl3sNA8TUNTUlI4vT3KMzHn2wzWfLBCW/Cv5wJuOCiDtgOIwZOy91gL/Z:JFQl31wgChnNEBC2ChIYiDXsDN
TLSH
T1F0C23A32E898CEBBFCEA5ED5A74A7643EEE04163D98C9AD4D5D81D1C00D719E130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6dc26a9507ebb3bb91d7944ebd2a2ef8a6c8ccbaa2f7a47ff2dd94b1b7245c3e
MD5 6723b3cfc0391ff6439b5e145ebc5bdc
SHA1 f48c7524f105b5d14d952e8e52a4aa71b5ace95a
SHA512 076211c1754e07b18f05a49cce38e722a8be5c837ff7d352f1f941e4fa05bfff3b8c69e10bfe12e5535cc3a0cc57d46f5ecb030029db05c9b3d25c2935e28cf5
SSDEEP 384:n/iFiZcIt5sNA8TUNTUlI4vT3KM96awzWfLBCW/Cv5wJuOlsDtgOIwZOy91gL/7d:KFQD1wgCeREBC2ChI/sDXsDN
TLSH
T1D3C24A32E898CDBBECEA4ED5B74A7643EEE04163D98C9AD4D5D81D1C00D719E130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8aab67118b742fa6e2f1dbbe50dc066220cdba207fd8b86c3c7538c0931a7a39
MD5 925e3b222693c5a8c28fde76f0fb2638
SHA1 cb451c340c714c32c78cd1189bd6d0b1619f772f
SHA512 1c056b0ffc334c9d25ad3e2adca0dce896bb51e297803ed4d7353d69eddaabef1605fd40402c2b336472f3d147947051988e332f75f7b5002d9e98ffb8c40df4
SSDEEP 384:ntiFiZcIl3sNA8TUNTUlI4vT3KM9MawzWfLBCW/Cv5wJuOCiDtgOIwZOy91gL/7d:kFQl31wgCIREBC2ChIYiDXsDN
TLSH
T183C23A32E898CEBBFCEA5ED9A74A7643EEE04163D98C9AD4D5D81D1C00D719D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4cb4176efae41f9c700f0635c2bf6cfbb0a742e244ff9b3857ec48303114e97f
MD5 5a48d6899d7238d96ff767909297d54f
SHA1 ecdcb41ec4c35b932ad4a800b20157f3eefe33bf
SHA512 08ed7facc1f89f3f9a2def01643349d67f37f5696c4f04c001eec596de11e4d6db5f5a98c049e383549911e2b2363781babebff71e9e5576be49a7d4614cbb92
SSDEEP 384:nuiFiZcI63sNu8TUNTUlIm2aKMiT4wzWfLBCW/Cv5wXFFy7O6R2Feo2bgL/7IzwJ:FFQ63rwgcSHEBC2ChqFg7TRDsJ
TLSH
T148C24A36EC98C9BBE9FB4F9AA74A7A07EEE00163959C8AD4D5C81D1C008759D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 f3cc85ec84a003eb330e1203c7e60ead4f06c9098619c44611814472090ac158
MD5 792c9a9396b2e9e0383168e4eeb0327a
SHA1 089e1d11aee0a7fe8a7dbb9dff5fd8cc1b588f53
SHA512 e23de3fb2f6241b7bf07e54018c2e370e8a43e2473508445779af3fc5bd60e14e0657c1a0dadb9432b66c6de918f4e77ec7fe1ebc0624a9ed73d7fc723cdd116
SSDEEP 384:n/iF7ZcItfsNA8TUNTUlI4vT3KMnBawzWfLBCW/Cv5wJuOsmYepvV4zU/SmHekL5:KFjd1wgCnREBC2ChIemY8ezUekLiXsDN
TLSH
T1FD034CE194D68DF6D89D9BC7532DAD02A9BCC133B4485588B3E46D2CEC9B0BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 91acfb25d6aeccd660d4851b5c0b29bf51f6a8766167273a20ed92417f184e9f
MD5 8dbdb599daca45ac3f7f4aa2e51a7875
SHA1 2afddfd2f7df00e1e4699ed65af9cd43934dfbf8
SHA512 f596565628e6fe2f1ea3491eef138aff783a87c27c90432729587902733550dbf21b2b7bf0d528625f5748ea46481e557fe82c156526d9ba611ef3d659589d7b
SSDEEP 384:n/iF7ZcItfsNA8TUNTUlI4vT3KMnYawzWfLBCW/Cv5wJuOsmYepvV4zU/SmHekL5:KFjd1wgCKREBC2ChIemY8ezUekLiXsDN
TLSH
T1A0034CE194D68DF6D89D9BC7532DAD02A9BCC133B4485588B3E86D2CEC9B0BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 52b5dd7131a8cdcbee389fef8b7ab3789a50318d832eef7bd7ecb4691f581afe
MD5 096d12650560f377aaa672cee777152a
SHA1 bbe3852f19ce667534084d667e71183d6bcb2093
SHA512 4d05c7409818e45cc927c3bcf85425450da0fedbdfbe83d1783ef4da8285ac005a860853a97d4c5cd92558cf31ccfc5bce7dff062c1b45472fa4af98bcb1aba8
SSDEEP 24:TLc5UOl0afDdWec9sJNyHXY5VRVTGDB5fc:TA5UUDbg3PHXY5VRV6jc
TLSH
T18792C132B9203067E99E5B76F8534C500DFC13AF8EA7B44499E00D911462AC27B950FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0fdae67fdf9b691e518b52dc35ab8eb20400cfb2d00ad659c86e91c97e87785f
MD5 fe8651fdb73acfa90512552deb739ac6
SHA1 21fbc13ac4a3cd8fd7306f32ef8856a5891bf0f8
SHA512 f0818559751199dd6e80ef5f19c01a915a0a702c488349f5bb1ab5e61bf09b79bac29ac25e0c881d908f03576555f083ab26975023e3f7c20c0af6da35aa69cc
TLSH
T1E9E00203930001B6D06C073201C3111037F2813002F342495D04017039433010D34F84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 38a5c4d52237ff0e17825bc5ab95fd922967bc51f5ce095f14bd47c941ce8ad3
MD5 e6e8ff81bc04207f066ab445192d9ff0
SHA1 c4038de47be589cf6cecc30aca655d6218119955
SHA512 a6d7b9329de2695b6a65a7c1f9009c11afc51c39ee7e7ace4f45d5778d75ab6e79167dbcd62566c499d996119c8e7e06b39337a9d57f82d99abeb827718b0250
TLSH
T13FE00143930002BBD07D077201CB122037F2813013F3424A5D14027439833010F34FC6
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c0339778806fa166529cd19dfdfe609f550c7ff9aa2771263b8433a662aa934f
MD5 389d6dd99b1f5feb59d95979cf390b53
SHA1 cb9a2c8ef141169e30d2884b30d360c20c263dd4
SHA512 317b1eb4083e08544ec5afe85ebd4147cc570fee935a2bc0b68eab4425bc27389ec212dd087831a3afc9d691be9065cefeb91ec257ca81c86d41edf06c1c9387
TLSH
T14EE00103930002BAD07D077201C3112036F2813002F342495D14026029433010E34FC5
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe597e2f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe597e2f.TMP
Size 392B
SHA256 ca311c37ed4a19204392da9af0772af2c9978fbb602448553c20809a40026002
MD5 e8c1b26e5847a0693352e9df8678b03b
SHA1 7e713e0604c576d7faf0a381b73f73a31a814693
SHA512 19f48e5d7c0dcf1ee8e0db62663e277180ff2c475bd3e6819b63a313af64b473e41998393aefd6c7fad7bd2f941a382c2fa028a17138fceba873772a202eabf6
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 08748dd80f43bebc0938c6f562ba05df5f992271fec9102e9a99c7e01d802c7b
MD5 4c36f9178a80473410a861c811a73fe5
SHA1 bbc5957debedd22f91c8591debe3c5c823e339fd
SHA512 53c97e61c7d6cdb9057b82d91fb1373d0bb5b7eff1654813a3025dbe13ecb59dcb3c237de701991e341a47994cfe1239b95ee82b337ca55ff17c432c023cdd4d
SSDEEP 3:MsEllllkEthXllkl2zED:/M/xT02z2
TLSH
T1904404047FC40707CD0010304051C77D0770DC11051157473C551513FCC57711C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 36b1e7a5fdc78a36d0782344dd19cd3c9d55fac63f22f51dffd19f0f5c390fc3
MD5 fa06fe2247ed0e02e18bc99dffc3cef0
SHA1 592e0aa827d99aacc484fa3218d6d9773aa7dc51
SHA512 def5ac41581e44898967ea90b133d1fffdd64fea906065d03d87d587f623de4f86fbe2286289e7e6d658ea1404b5cdb5e96a04996fcc772113ef0401664164b0
TLSH
T1B1414D58BAF9115CB3B77E569FF6A86D487BB9772E06D46D00010E4F0A22B40C8B2733
MD5 SHA1 SHA512 TLSH

Submit Download

6de931a0-1dd8-4fe6-a3fb-76965241b8ab.tmp

Path C:\Users\Admin\AppData\Local\Temp\6de931a0-1dd8-4fe6-a3fb-76965241b8ab.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dacf851b-386f-4fa9-821f-e77328af9795.tmp

Path C:\Users\Admin\AppData\Local\Temp\dacf851b-386f-4fa9-821f-e77328af9795.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ae0f4c7e-299f-44d4-9e58-c50be133770b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5624_461404843\ae0f4c7e-299f-44d4-9e58-c50be133770b.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5624_968268582\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2972-532-0x0000022380000000-0x0000022381000000-memory.dmp

Download

memory/3820-1762-0x0000014516AE0000-0x0000014517AE0000-memory.dmp

Download