hxxps://dosya[.]co/alm0jwwr5kfg/test[.]rar[.]html

Analysis

user interaction
yes
max time kernel
54s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dosya.co/alm0jwwr5kfg/test.rar.html
Sample260930-sb6c8aag92

Score

7^/10

defense_evasion discovery ransomware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1872	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 6 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1872	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened for modification	\??\VBoxMiniRdrDN	LadiX_CS2_Loader.exe
File opened for modification	\??\VBoxMiniRdrDN	LadiX_CS2_Loader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1084	msedge.exe
1936	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{B6862000-5222-4DD5-B871-DDEBA018030B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{F153236D-9F45-440B-AABF-797164F45E37}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5920	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1872	LadiX_CS2_Loader.exe
1872	LadiX_CS2_Loader.exe
1872	LadiX_CS2_Loader.exe
1872	LadiX_CS2_Loader.exe
1872	LadiX_CS2_Loader.exe
1872	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe
3512	LadiX_CS2_Loader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2484	7zG.exe
Token: 35	2484	7zG.exe
Token: SeSecurityPrivilege	2484	7zG.exe
Token: SeSecurityPrivilege	2484	7zG.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
2484	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5416 wrote to memory of 5988	5416	msedge.exe	85
PID 5416 wrote to memory of 1084	5416	msedge.exe	87
PID 5416 wrote to memory of 1072	5416	msedge.exe	88
PID 5416 wrote to memory of 1072	5416	msedge.exe	88
PID 5416 wrote to memory of 1072	5416	msedge.exe	88
PID 5416 wrote to memory of 5336	5416	msedge.exe	89
PID 5416 wrote to memory of 5336	5416	msedge.exe	89
PID 5416 wrote to memory of 2872	5416	msedge.exe	90
PID 5416 wrote to memory of 5240	5416	msedge.exe	91
PID 5416 wrote to memory of 2872	5416	msedge.exe	90
PID 5416 wrote to memory of 2872	5416	msedge.exe	90
PID 5416 wrote to memory of 5240	5416	msedge.exe	91
PID 5416 wrote to memory of 5240	5416	msedge.exe	91
PID 5416 wrote to memory of 5076	5416	msedge.exe	102
PID 5416 wrote to memory of 5076	5416	msedge.exe	102
PID 5416 wrote to memory of 5076	5416	msedge.exe	102
PID 5416 wrote to memory of 3856	5416	msedge.exe	103
PID 5416 wrote to memory of 3856	5416	msedge.exe	103
PID 5416 wrote to memory of 3856	5416	msedge.exe	103
PID 5416 wrote to memory of 5084	5416	msedge.exe	104
PID 5416 wrote to memory of 5084	5416	msedge.exe	104
PID 5416 wrote to memory of 5084	5416	msedge.exe	104
PID 5416 wrote to memory of 4828	5416	msedge.exe	105
PID 5416 wrote to memory of 2808	5416	msedge.exe	106
PID 5416 wrote to memory of 4828	5416	msedge.exe	105
PID 5416 wrote to memory of 2808	5416	msedge.exe	106
PID 5416 wrote to memory of 1908	5416	msedge.exe	107
PID 5416 wrote to memory of 1908	5416	msedge.exe	107
PID 5416 wrote to memory of 1908	5416	msedge.exe	107
PID 5416 wrote to memory of 5000	5416	msedge.exe	108
PID 5416 wrote to memory of 5000	5416	msedge.exe	108
PID 5416 wrote to memory of 5000	5416	msedge.exe	108
PID 5416 wrote to memory of 5392	5416	msedge.exe	110
PID 5416 wrote to memory of 5392	5416	msedge.exe	110
PID 5416 wrote to memory of 5472	5416	msedge.exe	111
PID 5416 wrote to memory of 5472	5416	msedge.exe	111
PID 5416 wrote to memory of 5472	5416	msedge.exe	111
PID 5416 wrote to memory of 5648	5416	msedge.exe	112
PID 5416 wrote to memory of 3964	5416	msedge.exe	114
PID 5416 wrote to memory of 1104	5416	msedge.exe	119
PID 1104 wrote to memory of 436	1104	msedge.exe	120
PID 1104 wrote to memory of 1936	1104	msedge.exe	121
PID 1104 wrote to memory of 3324	1104	msedge.exe	122
PID 1104 wrote to memory of 3324	1104	msedge.exe	122
PID 1104 wrote to memory of 5776	1104	msedge.exe	123
PID 1104 wrote to memory of 3324	1104	msedge.exe	122
PID 1104 wrote to memory of 5776	1104	msedge.exe	123
PID 1104 wrote to memory of 5156	1104	msedge.exe	126
PID 1104 wrote to memory of 2424	1104	msedge.exe	127
PID 1104 wrote to memory of 2424	1104	msedge.exe	127
PID 1104 wrote to memory of 4344	1104	msedge.exe	128
PID 1104 wrote to memory of 4344	1104	msedge.exe	128
PID 1104 wrote to memory of 4680	1104	msedge.exe	129
PID 1104 wrote to memory of 4680	1104	msedge.exe	129
PID 1104 wrote to memory of 2268	1104	msedge.exe	130
PID 1104 wrote to memory of 2268	1104	msedge.exe	130
PID 1104 wrote to memory of 1384	1104	msedge.exe	131
PID 1104 wrote to memory of 1384	1104	msedge.exe	131
PID 1104 wrote to memory of 3052	1104	msedge.exe	132
PID 1104 wrote to memory of 5852	1104	msedge.exe	133
PID 1104 wrote to memory of 3052	1104	msedge.exe	132
PID 1104 wrote to memory of 5852	1104	msedge.exe	133
PID 1104 wrote to memory of 2448	1104	msedge.exe	152
PID 1104 wrote to memory of 380	1104	msedge.exe	153

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dosya.co/alm0jwwr5kfg/test.rar.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffc3840c188,0x7ffc3840c194,0x7ffc3840c1a0
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,4479306230225975434,9626042036681099004,524288 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,10536872703378323962,8928280265835588170,262144 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,8436836113588971780,633947329294326178,524288 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3344,i,6427326994578078150,337726513783569216,2097152 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3372,i,15977600416256772,1263531373437101297,2097152 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5016,i,11354341964746861163,2808994223834168337,2097152 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5172,i,10520098660205128225,17991123544797259958,2097152 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5296,i,11211471893202950645,12126923133937379192,2097152 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,15701219119996887314,8144449920649026513,524288 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,5857541670806455949,17008680526034793598,524288 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6020,i,1362375481781802072,16951743988876924323,2097152 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6212,i,8507925719716329977,13048944908276109637,2097152 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,17629879330798274691,10267029174597742651,524288 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6672,i,13851119988553148907,7900259793458113633,2097152 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,14652885048126189650,6179690865824375746,524288 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7380,i,14064607346225093348,16839595204560099964,524288 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7380,i,14064607346225093348,16839595204560099964,524288 --field-trial-handle=2292,i,3984676362001367365,7091279057224504833,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x27c,0x7ffc3840c188,0x7ffc3840c194,0x7ffc3840c1a0
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,3737185143364449088,776632667168592003,524288 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,12705915009050560726,2726506241179028889,262144 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,10554452923839291581,1249547960982410714,524288 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,14026399512696657261,8434336643957114437,524288 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,14026399512696657261,8434336643957114437,524288 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,9541698583921971762,17644108995204369315,524288 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,13382157220775878481,13951047085247410021,524288 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,15505491918195035606,6634582821436089373,524288 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,7730510076117306788,16054047608666371060,524288 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:8
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,1859439155112972956,7773572483831508625,524288 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:8
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,11896745007047800610,9150713147612477679,524288 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,16138299295776832251,1211202988848134681,524288 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,8539998681410232566,5716621565361659683,524288 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,7602485232728970963,6116031117514087040,524288 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    PID:380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,2277837573160503384,6878331267449280002,524288 --field-trial-handle=2592,i,10527546370492607165,9940714043340862904,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
    3⤵
    PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5236

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap21421:66:7zEvent15261
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2484

C:\Users\Admin\Desktop\test\LadiX_CS2_Loader.exe
"C:\Users\Admin\Desktop\test\LadiX_CS2_Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
PID:1872

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\test\p.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5920

C:\Users\Admin\Desktop\test\LadiX_CS2_Loader.exe
"C:\Users\Admin\Desktop\test\LadiX_CS2_Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
PID:3512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 15b36af2befe35fe915a838fe373ddadc995b04c807ecc30b4341d10033a6db1
MD5 092938ca57c95aad4824564030700ed5
SHA1 503fe833f028578d12ad3657fe13fa1f19816e4e
SHA512 02d0ea2b81625af46652104f4f757f01ff62f80f9fa25da516572b1ddb1968b36176ac8e6a8d640ca5e12bd56e534b35750e329e0fea9615e29267e2cc412087
TLSH
T1E1D0C0049DE83FF4F439303E13280100B0884E930B03204042520A444C503D300D4CD1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3b8b06246305d6d0fd3354eff6a140c2ffae37776ff490ecaf42da651f0a2180
MD5 223b0dc4769c801dfb8095026257dec5
SHA1 c5b40403c9d5e1cbcb897059bd5d0787dae68831
SHA512 a5bd002b364060e424be35512498c3aab6216ebf78e8068db1633bae75c7484077700ab3a72c617c00cb00db9f58b087b2bf91b598a49c4854a6369642af6495
TLSH
T1B8D080D8E5E42E68F956147D31156241F1C4DF546D077090D153525459563B151940D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 20b987c56eb72fd09b50acf77aea4fa403f63d087b7f63a36355c89ff256ce1b
MD5 ae3987702a20fa36da3c515c71f97320
SHA1 a0e69a0e4373d427a031aed80dd54ddd33eedc02
SHA512 3cf1e23f1ef12e9a6fd4015dd7947b96afa268c4889b7e075eb4075cc27c9212f17561b5005ee6334f69bc0d722e552632adf29d1d675903f5f43352d0137559
TLSH
T156F02DF5CD25BC7B18FD5B2910A44746E75113572781898F3B3D810D8FB26778546C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 b52c2aec89633d975261062a7b2fc9d60fb055d70af4844e2e558b524f5b8327
MD5 e33df3b22b1926734bf427a2688c4470
SHA1 26d2f35ae11c6a2fd4afb741a6166a78b055ec64
SHA512 f331a569dd9c0bf332570741ad9ea8963acc098b53b02421079e5fce009f0f3d9bec550258a2f158e633e0d46d4f3c499a8cb0614e36365ecbfe7925755ef2d0
SSDEEP 768:NwAcjlwBJQ/CF4GYhS255nobolzOpvo3eil:NwAcjoJX0S2RzMqF
TLSH
T1C3137F7D36126E16FAD279BC6B9F0A723B30C865C2D01893473CF115727AB4B8B5E609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 c67d0ce77daa1e11670cf25a7327e9549ed95066cca3873fb5e27c8e81fe9fe0
MD5 1e666df4ccea6c161653aaa22285b883
SHA1 8643634ceeabbbd4a97570b6e36bd1b46f4d1966
SHA512 aebafff9dbd1dd949ba3c5b704b90892d893f19cbc2159b66290c5c6ce0130dfcf240a0b0b40b8208ff2d3abdd1f58d4c447620743a274bc5bf2ccaf8c09736c
SSDEEP 1536:/aaQbzL/mbL/mAxODw21chZ2AJTGL/vL/7L/Qy+2SaD0aQj04l:/c3L/gL/ItbL/vL/7L/Q63Qj04l
TLSH
T16B4482F75941A01BDBA852F9A3033A3DD277045D7DD1F99EE2788CD12821B32B7B8A44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 4083867c99a61991d488c511d3dc61302ac05a98fe2f55f3d1f0559e09402634
MD5 de11015d2c810163cb32e715be8a22d7
SHA1 363c56df28d02d781407c3e29eeb83943d19eb7a
SHA512 3e4a5a15e87f2bb84a85b7f1aa44445fb854fca326663a0fd5471dfe500ef2bb992683ea9984b46bde3133f02d79b3ab2d9426bd8133c0eb826c4bf8140cb63b
SSDEEP 3072:3W3nbev51dUH1iIc6pVfouoy2eMgCiDtO2BWubwBJwrVOovVPh33tWSfWSp:Gev516iIcU5DMgCic2AubcJw5ZPu/
TLSH
T17F2518FEC7682C82DF6B8A74B0E0D9077E702083B65DD0D39944C5D89792B8576E92BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 5abb90533662c21cd7ef30c4bf58f9f02e28fd08cbcf0442a9eea735654df865
MD5 84eb856ebe43c189862aaf09914328a0
SHA1 d6a2cd129a82a477da5188ece268f323e9dc07a1
SHA512 f69e8d1049e087c76f909d5aed0e9fd6199ef42b51dc38a2f29c66576dfc1fa77249e841a06a28a5de8475c9dd9ed967412ac613f6828c97ae04c7f8a6c9ed58
SSDEEP 24576:3hw7cD6TmIyGsKZe/YYqTlQlShEK4jDkk9aG75EI5q6odMa4BLW9U9Gl+iyyCCCw:xwxTmZT5kTClYEjjzYG75hIgUUKd
TLSH
T15A869EEDCA789883DD63AE30B5E0ED577C7413C3F991D1D28888C19401A77C4BB9A66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22e5778943b9acb8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\22e5778943b9acb8_0
Size 292B
SHA256 e9c419dbcd67b397f6d2e22b1ff1315ea45ae818aae748f3cc7023c1baacdb4b
MD5 c36f8502fbf0fbf1aca0daad22f54767
SHA1 b7e7b30dba22bcceadb0d762b2c61f8da0c80a6e
SHA512 d0e3383fd4d422f1979c843b3149e3e6791fc69cdb417221fa3be6c6ef8cd6c97211bcd590e67f430e6e0d303bc197594c535f6216158fec53eb9f074c4b656a
TLSH
T1F4E02BEB95583820C126A9B0DFDF234F83E710E66E55A0582214706163E4BB173CE256
MD5 SHA1 SHA512 TLSH

Submit Download

448975f7932def0e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\448975f7932def0e_0
Size 3KB
SHA256 50bdbe558f4923670825f949055050dc4bc6b663909d32c31913ff2b539f5f39
MD5 3add7b6187093114ab521cf5f4cf9129
SHA1 9920bbd8447af38ab137e0155c23f73917bcf264
SHA512 f666d87dc5fcc16e80b38ef88afaeaf805b2656f7dd003b26b5c410879558d22ca5543ba1cf18167bc3f4e276f9b4e66421438cef6fe3e76bbfe8d6cf428a037
TLSH
T1B471C9AA9354961DCB3253F91293462EA336900A7ED3C71710C1EB761D843F3699ED8E
MD5 SHA1 SHA512 TLSH

Submit Download

4f917537811d5a4b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4f917537811d5a4b_0
Size 3KB
SHA256 921274e6f14aab479e351a282cc410d7b7b41cdb2a16f036f084bd1983c827e6
MD5 f927ba70376100c057330803cee5bb6b
SHA1 f1cc3e5559e0d2671f1df4f848ae100cbc4ee359
SHA512 ba5bed2ba229deaef81ce313f420c3b8f064321ef449e81e465787a4f6c6dfff297542c9f29d8915466411b71405f4bbb212145d520adde66f076cb3c090b2bc
TLSH
T1DE6108EEF3A55945CF329FBC16C2161B8B71A209AD92CF32642186511CD43F32AAD85F
MD5 SHA1 SHA512 TLSH

Submit Download

67bcab03e3dbabe0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\67bcab03e3dbabe0_0
Size 282B
SHA256 3620fe70fea9287cdfb003a045fa18027d4876fd64df067f3c1d511ccbe8c51d
MD5 371ceff6e013303f14131e3c79b8d00f
SHA1 69ef86e885a6ac797e89660efec1ec17eeabe5c8
SHA512 d3a49136baedb64563c79e4c956f75b61b18fa984d9ea1a48a94e57d11bb625fd3d11a9f3cf578315433db34b64f2a2b80614b73bf94541dd4e47d8c1ee321b3
TLSH
T1E5D095D7E53E7D24C31C0AF0E3FD5247E3221073479481CE4115D073960506DE7C8601
MD5 SHA1 SHA512 TLSH

Submit Download

754c19c0437b22ea_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\754c19c0437b22ea_0
Size 270B
SHA256 e0806bb962e4d5bd2c892ba55536f03a14e3ee4311a7adc7067c2f14a47e6f51
MD5 3089c6bf75797207f7e813997da9e7f6
SHA1 71b8df6e58581214e523b8c0c45866b5fdd17b70
SHA512 9b8296c2dcb3fb298a89a29206ab37d7e6c6158d83a80a08f708f06f0733ac8d6434306dd11ca5d39d831e07e21264d77af157d9cfa841d660f34b4c33edde89
TLSH
T14ED095EF97103711D3B551B081BD4317836610CF5D6454C564146069531C7F132CF711
MD5 SHA1 SHA512 TLSH

Submit Download

df53bad28ea1e322_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\df53bad28ea1e322_0
Size 263B
SHA256 552ac7645da55e637341c4d96e2d28c5da69d3628e0aae55d52f9e8fcd3111a7
MD5 b082fb6a34d2f8a1b549ffa982bbe253
SHA1 d5ea632d0575f47ee11582a3d24534aab139b688
SHA512 f45abd3c4e6bb50531ff3b298e69e5e1204bc11395ea2b0bf13bf412c6ddb84ba83bd7e551a4568db5b6bef20206f23deeefda389e11804cadd7e4d7540c3c12
TLSH
T111D0A7A390D86A85C61D85F0AA9E126F922390DE889DEACD511820A19544BF5BBC5233
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ac923a806455c37440586bdd9428bd3d781a5e6d892e6810756d309c5aeedecb
MD5 106facb5c35ca708ae9f167187268e98
SHA1 9d557d17d7b2443b9108980cacad683afaf29bea
SHA512 5cd84ab9090bb5e4d94b03c0e0693543da427edda7cede60c74fa86700b446385c8a2599f971e559de85d905492b5af74ebfc365a653862308811d98f6410bc8
TLSH
T17881A5C468B89610FB487CBC96C508EB35309489D3872E0A037CCAF57827BB35E5E364
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d184.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d184.TMP
Size 3KB
SHA256 57e19890f2f30ad28b5a34cb86d89f302c73cb3155cb182bc9654d61d0bf6927
MD5 58cb6db8e1c7bc14bde8a48262d64260
SHA1 63cdc4950b6dc96023970b6b63c1c7af43d89d99
SHA512 6c15ade5d6989e002dd64579b3410868ff3da323a989428ae50d2610918662e5cb4da4a247ea640ff2b60e62dd6ed39931758601dd5eda2657fb4231d889211e
TLSH
T11261E8C44CBD8765FB9C6C7C99D908CB36348585A3C32E0907B4C9F69036F326D1E065
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 a87e316fa8663496b45a9e55abe6e29c636424bb6e8c3fccbcac3746c7120fd3
MD5 3775044911f07b9719dd0ce4c3b1aff6
SHA1 f3bd9ff58f94b45c2ab21a73bdc4386a60367239
SHA512 2e90a1b1e13b2f48193c1247fb0477d90f5dd37e61a9c5f94e1642e727073bf39a84596d08507d0b1dfaa146d694579e3a28b5ef44f97ac70e04c12497318266
TLSH
T1C5E0D89497C6C39DA61834C242386B08D1A43942DBCA7E0727088CC97643041B282687
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 7e436885bb9852627ecd462211e41ce37a74cab127535ec3e989a5a2ccceabf5
MD5 99455d560885e24636939d4eb0906ade
SHA1 1bd9139903a2a12b03bdfb11068cb8bc95eb717d
SHA512 aee0052091f99260cbf17a475789131284d0cb664bb3e103137d01fb51cbbb1bc0769434ebdd214bc616735ead0186b4fab38936fe1299d96f28ceca031e0073
TLSH
T1B4E0260557CCC269D75EB89FD2786B0DE2E0390BA3CC3E0A674C9C44A102A41A2C72D1
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 1e80b1730ed524d96e00d315772739f2ddee861b7afc8d37287180308d9536dc
MD5 fbb426d23816c45d3f6cbbb1577bbc4b
SHA1 c20a443061deb029b15b81f593f42830bf3e860c
SHA512 5f5d609700d773d0eadee50781abdf4d10ddd5b2075bde444e42a8ad299c4104cc82c2813893861a89f1fda701fd83fcfb314a3f4fea17d502b087cff91a1c44
SSDEEP 48:uzBmw6QU1PzIAkHr80DJrxiwWRwomdgHd/zIuATFtZL81JQ/g5/8OPw521FeT8:6BCxML1+wwwomw/zIuGtlmy/g51PO23
TLSH
T1DB92D647AE397846EF852D7F260E10F2CA7791782FA39C5C345548358ABC442E034A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 b99a10c4947cef45bf118aebf21c2e78bea4fdc89fc29cc8f86daba0052b0cc2
MD5 6cd0f41bbd43f113c6259fe86214afd4
SHA1 9369a89001ce31b15fb8d7e62b07b7058fa21be7
SHA512 73b630c561be2d9c817da9bd9d87e79467eb2170e1313db7e71b66289d19432033498f2673e4e0b7ba80326290faa4d64619e1539ba9e37b33ddb70e11aee385
SSDEEP 96:nLRtSwIU+bGz83uy3+u4tgp4DLjGQLBze9z32kjBHMsDEuspU0wbtqrOQpPfR4JW:nLRtHf+G83uy3Ct7XBBKSkH7DXspU3iV
TLSH
T1A814324E5F252711CDBD817669E744E35DBCF03FCB1266CA686114B4CEE2A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 7KB
SHA256 1a31f17148fa5c8016a81ceb91a1ff9e9c0b524f87e56876fa2125d24c07a731
MD5 5517871a4371ee0384d737a8990450e3
SHA1 751cb0db092282cc79674315ebb9264ef3a34aed
SHA512 2f1c594fb9c3debe9e1f92b7647b802dcc4be2c8a3ad7c191ad6ee10cf7bdb7cf5f8292b3f0b175eb04b06a7649811a39eac00379422c03774f5927e87ebac8d
SSDEEP 96:VwRNCY+B2jPjrkyjPJjX6ToUnEpKBKg3id4rBwdRwdMuq6EnNEMEJqEJPlidBCVT:CrNGFBMdni5JhlidB2T
TLSH
T17FF126AAEB954F36AEE38B94FED5204A718FBC17740FDF9A41815F0C09324096B5193E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 74ad054228de83b03c35d625cb778670315e8fbd5b54a1178bb62a204a62d885
MD5 0195ee04f5a318c41c2d4d706642bd1e
SHA1 1e258a81d2becbc798933d7495df8b627e9312f4
SHA512 3206cb02fb24fb56e7dc7018a5fd7b64b74ed511cf5f99cc9f6d2047afb25934c8922a07e2ba33cb53a9d2375f4cc119385faceffc5e24be1fbff69cd79497f0
TLSH
T1BFE0D86086CDD2AA920C204B82287F09E3B03906DBDD3F095B08B849B002008E6C61C3
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 28KB
SHA256 593adbff3a5ca001399119542ff3fc5d5a5c301ee05f122cad507c19778d312b
MD5 e137c54bd8fcba8040697c5ac99ad55a
SHA1 85e69dd73455160ec59e23dcc4d5dc362fd58a59
SHA512 897aa1d5e7573bf5149fe6a8495f57b2c01d601dbfc792e0e1a38c52c4e70e46029f2769c6833660dbbf21cf0f354198ab25ea1b5d3f05d5a5fc3ace6f81ce04
SSDEEP 384:HvfcEAc5yotiq/OcMNhu8gfDPFa/HfhN78V5G:Cqshu8gfDPF6HfL7D
TLSH
T15DD25B2F253021C2C7DF67735CE88523F6489D167293BA7AF84AE9B20EB5B44B506433
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 7e50778a5d8d21fc9a35e49df046e37a40d9536fb3571fa5287d84fa8c661ec5
MD5 9227254024826e5ca857a8ba64b61b3b
SHA1 9b82eda1ff08e341d771a51a4aa39cc48c84c417
SHA512 d1731ae234810391669bd40ddde868006d9b432a539360f0c8ae83507b00e924b4bc63f6d86275d02fb8010b1e4f3cc10d9f8cb72f3311a4e9aaf211b4069579
SSDEEP 384:D14E/g6WMKQr1JeeTdYiXdBowaPgGrFMPMYMV4cY/r/h2eNPnCQ4PwTHDjUw58up:17REjSRlZvd
TLSH
T134529AF7C3F8862E881192F4AA246E1FDD5D0A1A426C3D4A85D8AF4FD3F5470E291D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 529c17e288d5932697f9fec8b7fe08dc3b2584c58cc0de425ac160efee0f43bd
MD5 ba58f9ce0571afda4ea8a188769b5423
SHA1 16942dbda89c94c5d33730f153ccba769aa04bc6
SHA512 bd39395f6a3a01772fb85e45013c066125c2e09cdf70f7f6fa8cac86b61547053255fb7f433e2bc1136b02abc3ad68a8f484ce80128cee9445f42c2b06ea9664
TLSH
T1DA419EA3837FB47B607DC9A71D48B81615F7A8361341A4F4DA9B813DB0C44F73E22566
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 67b1d68128e14fbda55c40c3cac0f635fcbf41975820e97a61c24c913b5b65a5
MD5 5a65637b2505d50b13b585933811bc11
SHA1 d2eca98630100d39a8d42ebfb22066cca9c74382
SHA512 90e24eb2e8e23e3cb7e66ab2144dfefb91cec71589e2dd1bc57609fc9fc1ed8b6e8f13284b7ef2fc002795cca7f3e8e0b399dda2937b08ea6deaf3bae96850ba
SSDEEP 192:sxZJRc9R/fqsbQZZ8DWzodp7lCHW6+WNI5v/YbIjFYcreIgSlFJ:sxZJoR/fqsbOZ8DtUHbu/FRYcKSlv
TLSH
T15742D915AE28A97B4CC7D61DFA59BF53D3F95033A0941E48AAFC8A1C14E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d3e081764cd2320c17871862ce2cf714e3430f8caa98d5b1160f188b2e0dbef0
MD5 ea567a9fa7c8c3168565182109fb5a09
SHA1 f969689cadd125b22a3238dfff39af0a0f256578
SHA512 d5f62e2c6635cef1f66a2430891ced58ed3e2f77e6eadef1568f8f0ba8c4a694af38ba542fb10577f55208fa8c57f2ce2ae14d78327097bb5598e2d4a434489b
SSDEEP 192:sxZJRb9R/fqsyWpV2QZZ8kWzodp7lCHW6+WNSO5v/Y7I2zYc7EIg4lFJ:sxZJzR/fqsyWv2OZ8ktUHbb/JwYcM4lv
TLSH
T12C52C815AD38A97B8CC7D61DFA59BF53D3F95033A0905E48AAFC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d60e7a22be1c18f7d365eb8dd2fc3d5f95807ac05466fdaf3d8223f675e98e34
MD5 7d81cc1001d61a596be74a2feb071353
SHA1 8c7d66641c31cffca1aafa0732ad4a55affd9332
SHA512 d96376d50073a98fe15308ff3805d0c0d5d92dbdfa1e8a6799fd63ab5084e26274b67142246651f709e0e542ca6d15b4d386624aca5490b18d2fef4480285ba1
SSDEEP 384:sxZJzR/fqsxWvKBEP1ktUHbb/JwYcZ4lv:sBzR/fHYKx6HbjJwwV
TLSH
T13752D715AD64A97F8CC7D619FA59BF53D3F95133A0805F48AAFC8A2C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8cb3f132a991ace2f88e22a1fa195b02f380968d3191ad904477b1da5e7cefee
MD5 3a3e93f37d2dc687b9b1cd3e1ed88e68
SHA1 669a3ecebe7485afb6d3f810f5d68e54f3241d27
SHA512 200df043b41da8d3d5fba78153d3fa086e02e30fdd4d7f4f1ba43df23f42fdce36f4bd3baa6ddfa6f12c721094bb07fbf00f07722868325fa59717736135bb8f
SSDEEP 384:sxZJzR/fqsxWv4BEP1ktUHbb/JPYcZ4lv:sBzR/fHY4x6HbjJPwV
TLSH
T17252C855AD64A97B8CC7D619FA59BF53D3F95132A0801F48AAFC8A2C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9c96c636b82d86bbdb2a11cc00577c970a5d4a847b819cff6a4e50e7334429c3
MD5 b8af9ee24882a62aa26f99aa952807b5
SHA1 40fb5f7bb1991cb5064598df778f6eb57f29216a
SHA512 eee71f56a430d2f0d594b3d7775d8f51c347bd4c94e7a06915af9698228f8e2c9c0727c58f062b6e80508328710468dc3df1a65a32eaef95009b8ae01fcb7a97
SSDEEP 768:0RyktrnWvDBtt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroG1K:0RyktrnWvDBttu1jaLWLywf0G0
TLSH
T19DC20A3F640CCB7E5FC01E9D9C6A6F872DE802CBA6548D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 e6bc9bac8b7a41e21e7c43fcf0a2bdf87a67495421b2d7095859ee93da6ad212
MD5 66a042844c38ea9ed09a901e27d37600
SHA1 4b1fb805ebce2b1f1ec9c71c7f939b80dbb6e3f4
SHA512 e64a78c1f7cd8a00b2cacbd2ed2433edaa825f2cf91a7f7dc9d55c14aa247dbc449defb12ea7983a958beb83a2950a0a1ecd44c899cabe86601be52f0e11b6c9
TLSH
T110E0261047C8D2BDB129A0C30634B749B2F47967F2CC3E0E6F81D8447682504B1D31C3
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 245fd7a5ac29caa24f306739516c3d7897ee873569262aec999287e3f9ca4a17
MD5 946ca78a3c6a2f4e3338da017673670c
SHA1 ea851dc0d85f36fa62ab8a10276aad44e9cec3f9
SHA512 5a071fe829b9c50c2340413a6f8fa80789ae12ab459e052143d7fc4611ce74fe2f7c2cf1ce3a6f29f5b6cff6c86705ed53b6ffc69547f789a10e72aeb4609528
TLSH
T1EFB012147B149333E2C51E3D06998F61A200F0023D044DA39D749F280D09658BF01CA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 4c1142e7745978c7e2c038c57c59c18eb9dcbe1481b46867fbc3a665d12ad50b
MD5 504aff7079abd01629b9e57d38cd9c7f
SHA1 73600bb35f18bfdfd6beb77d9f3f3ca61756f119
SHA512 aa0b3d5bf9b1bd1fe2ed5e117122a17c6bbd8a8f536e537c23a4a3ffe050ecef09b41ace1adcd0dd0b31415c74865bc922bc35d19a18db2d97b6c7897f49e7f7
TLSH
T1BCE0D860D7C9D36AB25AA0874268F709E2B2B95BD6CD7E1A6B08ED4572061447283182
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 b21d8712b2b1cafaf18ff0090fa71637963ad63b7af1cf285050ce90fe9c254a
MD5 3ec643aefccfa14e22595babd8bc322e
SHA1 c16648daea3120c3e0b14f12898d5d54e21b71b6
SHA512 686b3750ec83266506caefec384abfeb52ed2063bedebb439641c6e0316715bdbab92b5f30445dedfd506db369f627ed1777687256eb50803b596c8f0ad789bf
TLSH
T164E08670C7C9D3B9A618A083467CBB0DA2F47D5797CEBF4E97085845B181144B2E75C5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 ac7cdec790358af501f18006095d82237fabbe46dadad7ee50fc8fb8341afc97
MD5 bb04e6feb90bec482ab0b68639bcdeb0
SHA1 6dc391e1c9daa71fafe3a559144e4e7c69303e3c
SHA512 7fea4227bc16237847086a924b6a8f0e589097a62826be1e752f46e02f16df1159ec8bf1b5e5ebf6e4211f504e2421866d080d458679d32f87e584e63152874a
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXYPj8Rg:OtfFvpopPxrB4RhfYL8S
TLSH
T101B2301471BA021038FE690C81B5972F464232B37159EA2F3FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 28KB
SHA256 06bb80a34f7bfd7acba6b2d968e984c75d72fd8977b1af31f1192551e8a66836
MD5 ddd7f7f4e1a964bd18e7bad4fabd941b
SHA1 e7d977f93de3c893316aef07145e0260f823430c
SHA512 3538968611efb504dda2e50995fa0075bb281ef29da6355fbe87556de61333a866684e879991ba4d2564341044dfb0074b03583dc1d2a2b83b46d829e2626aec
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXYPj8RfDIbt0:OtfFvpopPxrB4RhfYL8pDIR0
TLSH
T183D2101472BA021038BE690C81B5D72E464232B37159EA2F7FBD14B69E67F085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 a5ffcef82829a215ccd27d0ee1a780d205a63e84ec56a32cba5915e2b7fb6ba5
MD5 0820396be9512b2657ebcd9d91307585
SHA1 16a5a85b9b7f0b3b63becb9113e50213d91fe80f
SHA512 52520ef846dc2b2e65db9ddd978a7cd3e5b0ece5d92289c39052ce731f33ccdb20b4379f13426bb54d4cf868422e4cf4330a8b9f62aff78340be7a8025670133
SSDEEP 192:P+xWIeqIfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxW1fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1B824630A7B747001EDE6D9725CB080771E3CB16DCF22A6916DA254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 6b177920cb259979429fac051b248368381567e14b53617d3b1b3a980f440088
MD5 285002e7df6da89c782d7ccbdea9c789
SHA1 f1565ca0914edce69a604b39de114ef318ab2c62
SHA512 e0c64ce340bcc1eadb3b5c8428d9516080496f8e5558c00e4d1a5193b68b870d49247a58e31405a1480ae4153ee1d3186e8315ed20921fd4af5cada785ebb60b
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBgc/hNMCLIrVhNwxGt:DEK3tjkSI5IUltGhp22iSBg2GCLIrTuW
TLSH
T16F52DD5BB9346112CDEA433196C001E2FE7AA13D8FC2EB0384D910210EB56E1A71EA9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 5523936dff46eca9b0245d21cf51d6cf9d91ec9a7d95a18811e6c0960a95bb68
MD5 b39a643dbd0ad4a9949287722409dee5
SHA1 0a985a2ae99a063a0e042d4b7c518f577470f04e
SHA512 beaf1064bb5237369151e8d3e121f703f225424a085803122eec91d696b89e96283892cf5e0d45ab885eb1d492767b1e48676ac8bfb98e0f18b622af7fde43fb
SSDEEP 384:aDsshR2swT8xV0m4Z4/QpIIIQbwMIM6B7C:wphRwYQx
TLSH
T1DF72D57A27890B33CA9F1EB70BA94B855BE5CC0202E3275D7155284E1DF2B63C5D52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 5d2ff28a2fd1fe9f7310ea356153cd57114cc305a1ff0699e0703384e6833e0d
MD5 887b46662507f156c2e640017fa893eb
SHA1 da29ea37c4eb6550995ed65acc73cd107deafbda
SHA512 057702e45047ed98cd377cd86089194cd43d30f426c23eb727390303524ac93a1031295f2232a8a13607f19b088c8ac944451defde922624fb5dbe19040f1840
TLSH
T1E0E04FD1ABD9D2AEA31A308B46745B4DE2E13A07EBC97E4A1B049449A502548B297583
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 e95270795338859cb7dac08e5d81accc1814a9aa45f45d6b848b6285d8fc4ccf
MD5 17cbf99bbc6be452e6b3274030e04cf1
SHA1 535118a6dae1c18e1b0a6c262c489c29bfded53a
SHA512 6562ed025d0bfdfcef1c8e28dc7d53fbf879faeb9fb12335e8b6239ea39a3082ad609668beddd71c0d5fd2ddf13e473e932c61278bc6fd73994cb6c753046c62
TLSH
T1AD21BF56F320C149E14E863DA06BA7351378E8529FFCEC0F45B964356E72A001E8F6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 de7b723255f9b3301c750a99c26ba4ce9ebbdfecd438ff09e08a591fc802bd9b
MD5 b6b0c8c6fb75ac6b22cb82fb568a0197
SHA1 ad6272c7d78b8a4c94867476abc58516025575f7
SHA512 4e719cee9829ea48347047a754915c77c6199d90d3402a9a700203f2325de36951c9e5eabd9dce749bb59f9b8fc8a5a0f46b20aaa75743a39dd22dc7d99117fc
TLSH
T18FE0D810A7D4C29F921A308781749B4EE2E23D06EBC83F051F01888991025417287582
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 edeea70c32e5baf9353a7f3eb537eab0aff1cc84116b92c7804c8f2cd0683ffa
MD5 0041aa15393876274a9c152747994a3d
SHA1 0baef40465d9f4df62f3d8a317c6768d387e7184
SHA512 71f50bb32528595bcd28ffdc35c43c14c0fb036f2dc94deb6dee97be7e4c677ee3cbb7c3ecbe795ccef339ac04cdd3c40a4665fa03db7b303b94ab10d7a3cc93
SSDEEP 3:MsEllllkEthXllkl2zEflucu:/M/xT02zp
TLSH
T1E04404077FC04405D500103444D1C35017F0D45145D1574334D1C4335CC75400C50040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 47868b195bc521d90b7198110bf91c3f98c05d58d15714559867e6ae3206b1aa
MD5 435718a3cc5e5f221da71257554deebb
SHA1 679da13ca045d7eb1949681d8f6ab7e8ac0a503f
SHA512 a4aaad22664cdcd986d43a305f212c12882881be5bc26bb5eb9a89801bb965f233b15f0809828b3908ab294c75a83452378088a6c062924464cd1a1799dfcc44
SSDEEP 768:jQF0d1wgSN2uBP7+tt05VFxSEwKwIr++Xsba:jvdQo25zwKwIa+Xsba
TLSH
T16CE21772D495CDFBA8EACAC9A64AE642ADE40173848C9ACCD5F47D3C208F5B90707C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 b3b95c5175dbe561587b8f2ef3491fe3f9002932678057712fb51ee0882f3fc9
MD5 b088dffc298ab1cd31877e4c1962e67d
SHA1 92f32f9703818e15776a6807b5e6209fe017ae64
SHA512 e3d049d03015ebaf8c2b779bb2a57649754c497d83293160a0cf68f9ac2e51b2d7d39273b43a98c95f0c8d2675e76e8771a13eb90e1d21e585090caa7865757a
SSDEEP 768:jQF0z31wgSE2uBP7+tt05VFxSEwKwIr++Xsba:jvz3ho25zwKwIa+Xsba
TLSH
T1ACE21771D495CDFBA8EACAC5A64AE642ADE40173848C9ACCD5F47D3C208F5F90707C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b1a853178d58e0ddc7135d4a82d310f95e4a9aeb2f6d9e55914dfe1aade029ad
MD5 8f356b28df29027d27e65156e90fb54f
SHA1 7c95c5ad81b72cab20e3e148fa590d5eb9894c6b
SHA512 dbc722d5406998b5a6d364f663e0f4093b927e6aa7a529d0aea76a03e9ddc99ecae164be1ff972179e6cd1d1cc8857ce31caeffd3f8498b0879ece431b7981c9
SSDEEP 384:nj5iFiZcI63sNs78TUNTUlI4X5mg6/6CK2fLBP7+ttARQaPHzol9o8HKgL/7IzX7:jQFQ631wgFB6uBP7+tt05uo8A7
TLSH
T18DC24A32D8A4DABBECEB8BD9B74A7607DEF40153858C9AC4D9D95D1D009B1ED030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2e9f43274241c2d29492392d7fe24a528889d4e6585b46fcb06189344d9a7a37
MD5 c54fb5125bd7585f0d6cd8655b6fca24
SHA1 ad12775cb480ebc536bb1bc1415213b90583ee42
SHA512 941ce0a532f3afe94249334850ad85d56c2a9138f40eb37acfccbdfaa4bd87495738defe8077f8a9f13ecb7418f1547f819845a4d0e957ce9d4e8db2cddda534
SSDEEP 384:nQ5iFmZcIdsNw8TUNTUlI4g5mgqbtCK2fLBP7+ttARQaPHzolKStgOIwZOyUAgUF:QQF0dFwgSNtuBP7+tt05LSXsaf
TLSH
T1CEC24B32D8A8CDBBECEB8B99B74A7643EEF41163848C9AC4E9D55D1C00872DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 37e6de619d6530757fccb2f5144ac47b6cc285963b042c5e9d36ad7f7b89dcba
MD5 50280a6a6d23a4ac263e2dd8905695f0
SHA1 e9cc782e9fb36ff188f58c95253143eca8928ce5
SHA512 c4c6049b593f6f39259e94ca90715f758227b860309afa2d63395b14116edf11a2e68e5386a10e5c918b1ee135b4f8459cad316969675e3bf26f8d84176204a6
SSDEEP 384:n05iFiZcI63sNO8TUNTUlIm25mg5TnK2fLBP7+ttARQaPHzoFqc7O6R2FeofgL/F:0QFQ63rwgSM3BP7+tt05a17TR3f
TLSH
T15DC24A36E898D9BBECFB8F9AA74E7A07DEF41163819C99C0DAD85D1D008759D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 cdd91b860c3c5d4c2cce620b9f0286176fa5a293388ffdc47cc823dd453040c4
MD5 b7960aeaeb0947ee50e207db3baacc22
SHA1 2baa0e1c08a0e69031256f26223f769e328f1614
SHA512 7be9247b9c38b0dc5f28ba3bc2c07376289a4b00b7314a7496909c9f8279f854faa44a1b93d6c43f85208319684c258aa26b23ab845e143bff128cb37694ae1f
SSDEEP 3:MsEllllkEthXllkl2zEfl0Bu:/M/xT02z
TLSH
T10644041C7FC15405D50010344451C3505370FC100511574375D144335CC75400C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 126ba9ad29dc57d7319dd95b05fba9153d489552561b63516b7371eee3e8852d
MD5 9be6d8dce704f5b4d75178d277d999af
SHA1 4387fdaf773de15d11b297513f356a7a54ae4818
SHA512 f51beae2b9ff17ed7f3855e251ce6b54005be629666b2cfc3877992306e090fe61b820c8064e070cabd0b32a4ac75a7cd2cc070a7f9db587dad4dda64b48de4f
TLSH
T1BE410358A6F91148B3B7BE5AABF6B4AE547B79363E17D49D00010E4F0A22B00C871737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 af4abbce905b61237b0529f76815fe708c32fe065f420ec235f046a6bcbff80d
MD5 4fb30561f370213bb54b32698086e16d
SHA1 0b6c8a5f57d558207e5d4a2ffca9b707548d750a
SHA512 6b9ed5fb0ffacac01740cc8616507f24c57090b8560c4cef43972635c52d74748e230baecd531ca769737d19a11b678847bb8789f2b3f2f7c10076e37bf3bb9e
TLSH
T182518F18BAE91118B3B76E5A9FF279AE487FB9373B07945D10110E4E0723A40DCA1737
MD5 SHA1 SHA512 TLSH

Submit Download

0fc2a63b-b722-4e6d-8650-0e4483a2b813.tmp

Path C:\Users\Admin\AppData\Local\Temp\0fc2a63b-b722-4e6d-8650-0e4483a2b813.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b826efea-9435-485b-8b17-8b0e9ca33d3e.tmp

Path C:\Users\Admin\AppData\Local\Temp\b826efea-9435-485b-8b17-8b0e9ca33d3e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f21c7b27-dcb9-467f-a796-2296a6bffa8d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1104_1786772930\f21c7b27-dcb9-467f-a796-2296a6bffa8d.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1104_579955077\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test.rar.crdownload

Path C:\Users\Admin\Downloads\test.rar.crdownload
Size 57KB
SHA256 e1462357d27ae3f9997f23c4ff3a9a600a70b144524b2a6cf6e0571b53e24fb1
MD5 79569e88019e46eddf684d2f878be6e1
SHA1 37cf84998b7f8489a81bfd0d2a03d50e6e5a7e2b
SHA512 d2f29a8b41726993ed61bbe0211bc0329bef6a9c5600853c47b1e73884b8df1f15237c0b68e6cc5bd14178af71c2ca99a187710d818532cbaecdf9123f37cb72
SSDEEP 1536:rCtTW7AOygWKZNSyvlMDu66DsOmCPiFD4KAKj0L5woLc8:rCNW0tfklgyKFD4KR0L5woLc8
TLSH
T16F43F235F6D7D70DC8F81BE70BF46E15068A67A1836BBD222F636D412242CF64892BD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3964-485-0x000001B51B0E0000-0x000001B51C0E0000-memory.dmp

Download

memory/5156-925-0x00000231DA9B0000-0x00000231DB9B0000-memory.dmp

Download