be014074f7498f4c2b8da68548932bfb3a5240d5c63d253e1b7527c4d692d920

Analysis

user interaction
yes
max time kernel
106s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IT DEVICES DOC LVR4KC13P1.pdf
Size 97KB
Sample260930-sxpbtsybld
SHA256 be014074f7498f4c2b8da68548932bfb3a5240d5c63d253e1b7527c4d692d920
MD5 ba9c676df2a0432605a77176f332b1f8
SHA1 7db59653784cf6c3f9bffeb08adbc3fb370dc8b4
SHA512 28096d6ca5a9e31d9d971bf35a32db11f6e87898369a5b2cec37be196104a4d4444be5c163461b45868b02065fbf77ae07ccc8b2dfbfb322df6d7247c1b280a7
SSDEEP 1536:QRf6/iqFIYaLzdLDaR9/NTpKJ3vUkrBWxVvG6j5PL0ioNz9jBSJuZ:QQd1aLz9aR1OukFWxBPPL0bNn
TLSH
T18AA30262E678F46CE4488B03DF6E3E4D1C7876F26AD06CD010A98787DC1D9C9DF9248A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4324	msedge.exe
248	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{A8350993-0C77-4E35-8EC0-D225DD23BC27}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{3326DA68-2C3E-485C-B40C-9CC8F1BB4BEC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5908	AcroRd32.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe
5908	AcroRd32.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 5908 wrote to memory of 5604	5908	AcroRd32.exe	89
PID 5604 wrote to memory of 4992	5604	RdrCEF.exe	90
PID 5604 wrote to memory of 4784	5604	RdrCEF.exe	91
PID 5604 wrote to memory of 4784	5604	RdrCEF.exe	91
PID 5604 wrote to memory of 4976	5604	RdrCEF.exe	93
PID 5604 wrote to memory of 3832	5604	RdrCEF.exe	95
PID 5604 wrote to memory of 2720	5604	RdrCEF.exe	99
PID 5604 wrote to memory of 3420	5604	RdrCEF.exe	101
PID 5604 wrote to memory of 3420	5604	RdrCEF.exe	101
PID 5908 wrote to memory of 1040	5908	AcroRd32.exe	102
PID 1040 wrote to memory of 5580	1040	msedge.exe	103
PID 1040 wrote to memory of 4144	1040	msedge.exe	105
PID 1040 wrote to memory of 4324	1040	msedge.exe	106
PID 1040 wrote to memory of 4144	1040	msedge.exe	105
PID 1040 wrote to memory of 4144	1040	msedge.exe	105
PID 1040 wrote to memory of 5784	1040	msedge.exe	107
PID 1040 wrote to memory of 5784	1040	msedge.exe	107
PID 1040 wrote to memory of 3108	1040	msedge.exe	108
PID 1040 wrote to memory of 3108	1040	msedge.exe	108
PID 1040 wrote to memory of 3108	1040	msedge.exe	108
PID 1040 wrote to memory of 2152	1040	msedge.exe	109
PID 1040 wrote to memory of 2152	1040	msedge.exe	109
PID 1040 wrote to memory of 2152	1040	msedge.exe	109
PID 1040 wrote to memory of 992	1040	msedge.exe	110
PID 1040 wrote to memory of 1080	1040	msedge.exe	111
PID 1040 wrote to memory of 992	1040	msedge.exe	110
PID 1040 wrote to memory of 992	1040	msedge.exe	110
PID 1040 wrote to memory of 1080	1040	msedge.exe	111
PID 1040 wrote to memory of 1080	1040	msedge.exe	111
PID 1040 wrote to memory of 3292	1040	msedge.exe	113
PID 1040 wrote to memory of 3292	1040	msedge.exe	113
PID 1040 wrote to memory of 2276	1040	msedge.exe	114
PID 1040 wrote to memory of 2276	1040	msedge.exe	114
PID 1040 wrote to memory of 3664	1040	msedge.exe	115
PID 1040 wrote to memory of 3664	1040	msedge.exe	115
PID 1040 wrote to memory of 4228	1040	msedge.exe	117
PID 1040 wrote to memory of 6036	1040	msedge.exe	118
PID 1040 wrote to memory of 6036	1040	msedge.exe	118
PID 1040 wrote to memory of 2932	1040	msedge.exe	121
PID 1040 wrote to memory of 2932	1040	msedge.exe	121
PID 1040 wrote to memory of 1408	1040	msedge.exe	123
PID 1040 wrote to memory of 1408	1040	msedge.exe	123
PID 1040 wrote to memory of 1408	1040	msedge.exe	123
PID 1040 wrote to memory of 3320	1040	msedge.exe	124
PID 1040 wrote to memory of 3320	1040	msedge.exe	124
PID 1040 wrote to memory of 3320	1040	msedge.exe	124
PID 1040 wrote to memory of 5844	1040	msedge.exe	125
PID 1040 wrote to memory of 4980	1040	msedge.exe	126
PID 1040 wrote to memory of 5976	1040	msedge.exe	127
PID 1040 wrote to memory of 4436	1040	msedge.exe	130
PID 4436 wrote to memory of 5752	4436	msedge.exe	131
PID 4436 wrote to memory of 248	4436	msedge.exe	132
PID 4436 wrote to memory of 1628	4436	msedge.exe	134
PID 4436 wrote to memory of 1628	4436	msedge.exe	134
PID 4436 wrote to memory of 404	4436	msedge.exe	133
PID 4436 wrote to memory of 404	4436	msedge.exe	133
PID 4436 wrote to memory of 404	4436	msedge.exe	133

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IT DEVICES DOC LVR4KC13P1.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=670341BDD99FF6DC45B354DD341DA14A --mojo-platform-channel-handle=1788 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4992
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4D0A9035590CE5D817B4957161F26858 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4D0A9035590CE5D817B4957161F26858 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4784
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C6F0AF9735FB2FE13EB858FEA05DABA3 --mojo-platform-channel-handle=2372 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4976
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E110D645097C1D9FC579378D960F5E1F --mojo-platform-channel-handle=2484 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3832
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BB45E79EC9BD128157FCE20C6D440DC2 --mojo-platform-channel-handle=1912 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2720
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=073581BDB19D167FE0A9C14EFB11314E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=073581BDB19D167FE0A9C14EFB11314E --renderer-client-id=8 --mojo-platform-channel-handle=2488 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://clubdenut.club/santan/iTfLCy0cjouoMDe1NlhA5m4MI8h1r01zgCUs
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb3bf5c188,0x7ffb3bf5c194,0x7ffb3bf5c1a0
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,8263613713171485123,4743489214820544289,262144 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:2
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,10152142582780160722,9129051644229406261,524288 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,15729366012729450414,206994153891451674,524288 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:13
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,16386493378929557278,3682206212535735041,2097152 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,10026215581923699398,14574710682021880916,2097152 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,13554179986474584307,15533381525582315746,2097152 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
    3⤵
    PID:992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,15679515746773006167,9614493253732652093,2097152 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:9
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,3054985235658507531,5431187592495427087,524288 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,4050089815987526448,9935721697761065217,524288 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,9411938794985519852,2795874272046644981,524288 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
    3⤵
    PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,8460524332566394231,15276012449294693614,524288 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,8460524332566394231,15276012449294693614,524288 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,4785935777076792465,6744913292805927236,524288 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,8564381974015207991,17495638825098311217,524288 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4328,i,7091603029631914486,12297851597442772757,2097152 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4284,i,14118015806380042005,8258933330795018566,2097152 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,5977505786559353449,17617074672123938242,524288 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,6839859256336566659,12482581472153064327,524288 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,6874962495671255617,16457524866823522132,524288 --field-trial-handle=3032,i,1390350645980518212,15046894796646391542,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e4,0x7ffb3bf5c188,0x7ffb3bf5c194,0x7ffb3bf5c1a0
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,16627466783698720636,10793493302105019487,524288 --field-trial-handle=2212,i,10437987090088892462,1386322576131082243,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:11
      4⤵
      System Time Discovery
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,5211672715773551829,14321371610702501223,262144 --field-trial-handle=2212,i,10437987090088892462,1386322576131082243,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
      4⤵
      PID:404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,9696271007818397667,7241464223320785812,524288 --field-trial-handle=2212,i,10437987090088892462,1386322576131082243,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:13
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,13981055571178986227,16310302417116249636,524288 --field-trial-handle=2212,i,10437987090088892462,1386322576131082243,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,13981055571178986227,16310302417116249636,524288 --field-trial-handle=2212,i,10437987090088892462,1386322576131082243,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
      4⤵
      PID:5424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 056d1b3507b592b2651073c6ae81fb6d44d8e75b80060527794681e81ff026b2
MD5 f8f5b0bac14284ddd9a95d8613a2fddd
SHA1 5cc70e7ea3efccc4b3d5e77512d35a56de6edfac
SHA512 6b9a3cacbcebbbca4fdbbf56ca8d8a86d090e77a781ae35b084ea383ff45967aec9eadc897be3de612395da507e3c720e530904e224d253d3e99d4c1789ab503
SSDEEP 384:yerdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:O+eUZsLQCZsL3hUS4
TLSH
T10753CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 341070819381f219d4c5de3f905f318f8d3d3391a5eaae8b88bd5d0b7a51e562
MD5 e9d04183eef2925272036050da023efc
SHA1 cca0e819ee0b11bd24246bb53f7de055bc89bf8e
SHA512 3e163c982bccd064997c01e99f4984d31444d3a8297be25310db616b643fbb2e291dda53a154e3e9edc5fd91ff17a7b8d1b84adf4e452a9295a91cf990d7732f
TLSH
T1CDD08078DA6C57E4E073303D5334115271D95F41D747124998C405295D615D302B6DBD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67602acebdf95f848369453222d9a3848505e16b8f43e49ef9ab8e2fe743a408
MD5 530a928b052537f9b39f458519ae5a28
SHA1 fc53cc8db2986c44aa0239e5b15fe71a49de53a6
SHA512 c5a6b97e0a706d2e2448e757ff9a5575dcc237feb64abf25eee93921206da522e56e130469461bb08096b759c0d3ae57a6a8c1c288ba43de62835cb8aa12a9d1
TLSH
T1A3D080FCE6680658D153247C6215625171D5EF04FE077144D4C1513935166E21375CB9
MD5 SHA1 SHA512 TLSH

Submit Download

59f65cba-ccb6-4007-8602-fff1ade00990.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\59f65cba-ccb6-4007-8602-fff1ade00990.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0c386832f2752bfe3dd774902028871ff10afefc8931f3be43474ab177a26370
MD5 73eb750fa368409c5b0757ada6396755
SHA1 2ecbed4ef454c4eed85bd6a26adfcd87e45f3557
SHA512 76f71dbb5d725209ad42fd163c20518c8a378a68abd2513d1e4559effbaea738e81f24e92c3597b11db5a694336e0e7384800323e0bfdb4cab63270e6035afe3
TLSH
T179E02BA9C861AC6B09FD075D956A0B0AE75403362A40848F7B3E850D8FF063B4B95C6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 26490178a9a6066de2a363d97f5c3fbe42e351ad21b0ffdbd97f67d733c1980d
MD5 9f3abccddc5c536bb558ff9c3d7a34f2
SHA1 4e3590e702e1c6ba51e0d292137f24f26290736c
SHA512 f79ffe9c2fcdbfe66846abf20cfedb73fd1f9a47a755bf83a516eb3c1e8b6bf760534886cfe1c2bd044144efa53b371c8102637612b70bbe847fc42805ffe6d4
SSDEEP 192:4lf65YRWjijufYz4q8NhK+Vs57Q3ItyMFMrdTb7Gt1v0q9hQkv72OXb8+:4owWjijuwz4vKy1It/SeEq9SkTBr
TLSH
T11F13073EB7269EBAE6F3963C944B4BB5EBF0E031D5C255274670F6007B0036A0B0E546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 694e540b5be205039f96cee8baca680fc9404035e0bcdbdfbde08f6ce9a464c0
MD5 0e857f930ab9a96e99584d1a461a316d
SHA1 988b72bfa5ae135975753e10f1db9406a208788a
SHA512 15a5810a9955c79fb9165a4434fa8405f84ba5b385678ff66e42f9bb166688c1e179d17094591edf72bca9bd3673d3c7df3c62b99c48831c5fb0beafb1fa8b94
SSDEEP 768:7Jx2NJq2L//H2L/NrDntIIU5nb3YXqYjgYaEJu9f8W3n9M27VMrqViAO2/hH36QQ:tgL//WL/NlIx0XPUog9/X3CbKX3Rtr
TLSH
T12A4440F70951A01BCBA852F5E2033E3DD1BB015D7CD1F8E9E1788CD12A25B35B6B9A84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 258d294ff9fb9efa52214e5e2d092158569f87c0fc0cdd483b04acbe4b380f23
MD5 4b8438570e03de30aeef787078ce7046
SHA1 e022c21de11b9f46d28bd1075e83b3acb32ff454
SHA512 62195beb5dc2b43c69e8b06e7766b085c627573b16e365c3c69708661851a8a097760738ae641e44f93dc7b1985e842ce657f6d2c74e7b0799732902569c641d
SSDEEP 3072:9v9G+bWAmwHvb5MlYeFsEm2BOG0htHEfouoDtmO7:9Q9yMicsEHBOG0htHCwmO
TLSH
T15A253AEEC7682C82DB6B8774B0E0DD077E712082BA5DC0D39984C5D897D6B8575E82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 335067128a6eb18c68d1f19d75768f4c522598d2e453f92c59a2cffdeaa7d7a9
MD5 ca1d048f1b832bbf54fd198fc22f12de
SHA1 fab7407774f5f4e44aeba331f51ecf0d4587bbde
SHA512 dfbc550202f9272052e0f9642bd3228ded7a908579d0d074b511e72346d965b5c26e982950355e9a5d9fdf64536e8f02f8c9ec233822888e3dfc08bc4ff57487
SSDEEP 12288:bH9GqPTs2v2E4o0uegdWQcPETzufaYsJLvugwDVzIuLcgJ8O47VkElLFqRtJgQy+:HbfqhAjEeHsEDyqmkGPvMK0PtYqTnvb
TLSH
T154166CEDCA7858C3DD63AA30B4F0E9477C7413C3F555C1E68898C18402AB7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1a11f725e62c7a616f5fe2f37b526667b485ff1cd131965c79dc38098e9e2cf8
MD5 66ec18f64153b2d723eda448ffcb9873
SHA1 e5d86b9b8a357db2b1e4da974590dc88d7d8c302
SHA512 2999c4ebb80d00fa2b534447f7211506ad938167a00ffd1f355287e027feb164afee2767c715270ff2e3890a4030f4ec09f5ecbb51411d789bcc4002b4ca1a34
TLSH
T1A56173D799E19970E3F820F05CE6034BFAFC49B1CACB0E421094D4F96B2E36D6305A14
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 01e3d0bb5c89e2629220b4f3db93126ce41a0841129397f3562765346e4d3c69
MD5 cbd0c34a84c018fc7c93e7dbbb37eb59
SHA1 39cebcadaa88bb833cfb641a2affdf1580b77837
SHA512 38d36c896265de53b68f02fb22de5a4bef2711965b78bd5f22efe11a91b5038259707936772e3f195b07e5e1175f7ad7ec80c07ec052a598b6f73db18417dcb6
TLSH
T1BF6152DBD9E1A970E7F820F05CD5034BFAFC59B1CA8B1E421094D4F96B6E35D6305A14
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aef24.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5aef24.TMP
Size 2KB
SHA256 b33d347313e80a4f42dd92767789f19d777269f03bee9020104bbf3268c84fbd
MD5 eb13232721330cb15f061deb802bfdc2
SHA1 7f4f0e78a8c92ff278e28e2eb93230871b2cb761
SHA512 1063d87ce3de613969b938ef2c154276f44f1485361683a31999f55e07bdfd6f8e148e57b91d558cc0443a738e905ab160cf88c90a66e79126c713cb222a432d
TLSH
T1D851A4D799E19974E3F820F09DE6038BFAFC49B1DACB0E030094D5F96B1A76CA345A54
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 c5c9a74d4036e8e3f47cca77fcd633363dc27d5c3bea0f7406f1f4fbc09d9083
MD5 29684cbf7e96d483be5eab1dd1f25af2
SHA1 1608f8371fefe04f4a06f3ba2a329415475be854
SHA512 1780a3cdc1f5d191ba167065158dbec3e881254a9fba9d19a62e55e4679eb18366e8da8efcc865ce7c12adbda9e568a12c25915f44de3a42379f0b3bb6a814e4
SSDEEP 3:MsEllllkEthXllkl2zEklQTueq:/M/xT02znQTueq
TLSH
T16E440405FFC00455C55014344071C3540375D450051377C33C5104177CCD5410C43000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 6cd12a8fe182a0ab95bc79eee5e9de48cd26e4000cde8750336d7198e0c8639c
MD5 cdde50b738c0839a82358dc2e60407db
SHA1 39cfa3c2a7d17a854e174f23edfe19e3033a0d1b
SHA512 40e53c213b78071b6e8d729bb5d89513b16a36409a910b44029ec153c006ac1dde0e39a23c75a51718b57819334f59d7546f6daddcefe7311242cbdffd4235e9
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj2ZQN:TdD4jJ/0UC+lf5KY
TLSH
T11AE2A04C3E21F511C4ED733CA0D2C5D09EBC647C478DB67142386CA68D52AA2F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 6e55588824f08a55742b5af525745702bd535dfab89539c1272d9e2e439af570
MD5 aa37e86b7cf4a2b31d1a1e1b9855a807
SHA1 a744f207d37c44ebb725fc1746ea22a933af7827
SHA512 f53ac7964f001a1977595612784dd7cd62b6cf94173886eb09b1311938770cc053d3acf7e18f65189c5772f6f76f8b5bc0cb4ce30d390c3d478f8313483af08f
TLSH
T1CCE086584ACEC62AF41C6CE382B8670E83D1398BB7CCBE52A70DC8446116649B6D66C0
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 fa7ffc24b2714c35643b9cbb816cb6bab8e5bd8157b703c208cfaff2dfb12669
MD5 6c281719224db95ea66f64f9ce0b3866
SHA1 d704ace9486a92eff27a7b54479e857769e82f39
SHA512 9fe3157d280d296ef708cfc88286371492301426a5f877ff1faf6a49085f1e067cd9d95fadf80b073aca075246abc8d1e962b861019a949ab83e6f46a86908e3
SSDEEP 48:uzBmw6QU1Pze+O1+sPXLaa6LmivT+p+sPpH:6BCxhOcsPX+aCoQsPV
TLSH
T12992A6579F383403DB412D3E362A5878DF3BE22CCFA2DD44703898611CF4986A0795AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 80947906ddb099bc82177024a1198461368868b7b6b25c52772f2b3255ed1ade
MD5 37def4e81d5309d20fbf287c17d0945f
SHA1 c0b04430a8403ec126ef524630990f73503c06fe
SHA512 e42c2190325883c5cd7a8f553be82390b37dc81380a901b28282188a8095a718c7c42741ea7faaec74eb6be7a760ac737bdb3270d1d039228e4ad1062828ea41
SSDEEP 192:CM0wWH+bF+UI3iWGVoWN3qL/CG2VVV63:ChXIkUI3ijVoWN3qL/OA
TLSH
T1CB24404F5F742212CDBD513928E654A75CBDF03F8B5366CA786204B4CEE2792A01C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 302B
SHA256 ec111a28874d9adae3747ba1d81e53056247ca58f6e85e1240084d5032394c4b
MD5 d00a2218ff08f43237575835d99df294
SHA1 72a297c4302919f82f5800e2a7e462ec3e087d8d
SHA512 05c73cb262b66a11ae59a3891aec3b467690ca7716bdd50d0e443411ca3574214059eac959c7df6ceb7ccfeffb923952a08b27905c4c39ec986f39928261bbc0
TLSH
T105E04FF24519C063F30235D897D4F158706D52FB4995EE8CF29D44412E433AEB445010
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 41a13898b06877163d5afa551136b16edb3880367e5b95dc112490cd426d87a5
MD5 19442a98c4a02d24bdefdb7563c119be
SHA1 599ff1c0304ca387cc0936bbd4bfb660fe986e93
SHA512 eb2cff2d0a6dc6bfa80f73aa5785b626fd8703b90ff0fc814bc73db753812d7de1460812693138503ceaf6aadb730a30e086841b64dab03e58b7caf0c9a22d29
TLSH
T130E0486487CEC25AD24C649782697B4CD7B4391BE7CC6F83EF049840B547148F7E95C5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 32KB
SHA256 b5e8d41aa0c97ac40057071a4cc8f7c340d0bc808cafc75dc916a9deff0130fb
MD5 99be9b6e5e7e5187ff67533fe76ba7ea
SHA1 07340228b12705a911bc4fe7df31bc564665ab93
SHA512 05baea19fa83e8fad79cc8fc68cc0ce96d35c9f49ac23cb40689aaef10fbe8f5f7effc02516d9712c31c85acdbd86d112a737d6ea23eb534d7b7dfb76591830d
SSDEEP 192:DDLaTaFwKIjsW3ycEw0YC6im+Ptll1dR6d:TigIPF0DF71dR
TLSH
T1A8E21BCF19343115E7D72E3696958505FC3D032EBA17BE9D74AE58F08C7278DA102A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 aa4ce42cd4beb3e5148b26e7aa19d8b91a1d322898ca0f3a4dec34a354c59e28
MD5 847c2b6f3ffd3b76ddb265dd09a2a688
SHA1 8b56752df736fdfde4f85d1bc9918c7501b5d0b2
SHA512 160c580e5e6d249bdafb6bf05c1882c99a184acc4065f077ffcb96fe4fb08ccbd9b165e0d6f86d6cca13c210506ee538307710e692b0f284e7762618c8444181
TLSH
T13C819FF3C7F4856DC91196F4AA186E2BCE1C0914432C7D5A85D49E1B93F24B1E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 d78af21c5b895f7c6d16c065afcd1c8ae7c1a0f6039dc4ebe239c69ae776398d
MD5 5266b7df4ce468bdb1cfaeef68c6f1c4
SHA1 fb9432583a1846cb1911544640aad0d33589742d
SHA512 1ac8c5f4c94f0356f0337627cae78628c2b96b4aa22042b3187b1f51c3f4271387bd2d758556e119ae9fa76761b89920ca39cd43c902034343545ec212d2948e
TLSH
T18E217F97C17F647B302949671D8CB48599BB9C316155F0F4CBE7822CB0805F72623069
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8408e428c264fb49d7fca3d5a82198d89a83bfeb3b361d440d4389ff3ee8eef2
MD5 410451a3de9fc631faa0731a7d1c8cad
SHA1 e8f7e6bcbaab6485688545a0295b19c58aaf08eb
SHA512 428627dfa188ab373f377639085dddda8be99d94b831bb0ba58551564c6a5c0fd981dd624e9bd6582e0eb94a99e7c04b75f209eec1f6b0dfab855f4caa43db2d
SSDEEP 192:sxRVR9At/ftsmWpViC5Z+6RzoA8pXWFF/g6+WNJPHZN00i/egzD58YgjIgD90ZJ:sxRVUt/ftsmWviCX+ji/5Z6/eCSyD
TLSH
T19352B656B978A97F8CD7D219FA59BB16E3F8103260D05E48A6FC8A1C10E76DD6203C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ba2ca1be166887b0c3bb7bf7540ff9fe9f3ea1d4b23d9d3e8a717afcb9bf02f9
MD5 2db5fc3860b662265301c8358411648e
SHA1 2dd7ae4f9b7b784d02dbd97913be9459d7e98cff
SHA512 dfaa9be2eab2f7cc3e6b721a8e430762fce44ca9c10abb2844d744744195759c5ff9d3c2ee3e3c06037d63e290288f56561048dfd6c4653bff96639ada65cd9b
SSDEEP 192:sxRaRZCt/ftsZP5Z+VRzoA8pA9/g6+WNWTk/egzDkyGjIgV0ZJ:sxRaut/ftsZPX+q4/5f/ehGD
TLSH
T1A232A656BD68A97B8CC7D219BA59BF53D3F91032A0901E58B6FC8A1C04E66DD5207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 30ff6ad754499e85a4250e233fbdfd1bb821c73236c25a0761f6a5342e3b337a
MD5 cc4bed5a2cceea40cb1c463d0d7a68cf
SHA1 6522bce334b2163922217cf9c1c197bff7cc3f2c
SHA512 58b40f619a98e26d7b0d637abd558abfcf42bcb0eab0ca8d449b7db27abc1fc9ff5d8101c5694da4ede62b60426b5aa9dae287bbbc80de6c627cd4d83c1d62cc
SSDEEP 192:sxRVRZxDt/ftseC5Z+VRzoA8pXWFj/g6+WNWZN00i/egzDzDyGjIgD90ZJ:sxRV5t/ftseCX+qI/5q6/em1yD
TLSH
T18E42B756BD68A97F8CC7D219BB59BB17E3F9103260805E48B6FC8A1C14E76DD6203C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 097ff1527aa212ad9e135a786e266a85f35a67dc19496e74fc4699e519e1fe0d
MD5 82c9edb52b29056ab4c1bba0983ed89f
SHA1 389d896731a70f3fbf2e9d9d6cf0408aa2294d32
SHA512 6489091e1c20c797dc7d83abd2b537e6f60dc67a74ff51ee7086b3bcbc8e7eb0c443bdef488da720e9e4e60401e9dfcb0aac828379f1ab96e9428f3b1918d628
SSDEEP 192:sxRVRZxDt/ftseP5Z+VRzoA8pAFj/g6+WNWZNXegzD+yGjIgDv0ZJ:sxRV5t/ftsePX+q6/5qXenwD
TLSH
T19D42A656BD68A97F8CC7D219FB59BB57D3F91032A0901E58A6FC8A1C04E66DD5203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 dc47d733b49b6e86702eaf29ab02b3a685776421dbde8d119642e1dd8e06d4e5
MD5 5979a3b78a6b15103debdf765e0e8fb6
SHA1 a294430d3fde9426fbc926456a9ed6ddfabdd9c1
SHA512 304cdeddbcb01e07f57ef039e575d90d299f61d5b52be6a8aea49409f37cacc3888b9686abc52e83ec87850ce9154f30fb84481da322519f401c60eda12662b7
SSDEEP 768:SzYbD3R7pLuLbxUWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OVeCw8WSdroGqtH:SzYbD3HEbxUWgasfA6u1jadCwtSWPtH
TLSH
T1D9D2EA7B640CCB7F4F804ADDED1A7A9E6D6802CB96D8C98047FA941C02C67EF511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 78feeabb6f512b541d1b4f324e0478f59aee1fd65de74c93e97263285f3fe7d8
MD5 16f9d1ff77896a8057f4fec7d1ff7279
SHA1 ab9431a9e569af00d7b3607b71be3c898e63ca88
SHA512 1234f843109920756a99760a3e852986d81226b330f3205f49cafc165d34bf8fcb8ed3280ac1428769882883cd2262ab4dc85fa54a89de69f23e03e5377ae2bf
TLSH
T1EFE0869047CEC67DA05D21D78274A70993E4BD1BD7CC7E42BF44D9406153958B9D22D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 184B
SHA256 94de6b9512f0bbbefa7ac17394a9b4456e8a192f23dda409f6c861c21c87b236
MD5 4823494e5e581dc65116ef0f31f65f30
SHA1 16847dad046520447afef89e8ea54ac4b914cdea
SHA512 ab8770282b74bba10a7028d0692df5dca55547f5e146dc5b8cc3809d9006a8f42b384fdcd700e63bd6a52ef1b3f065dad04851fe23c2f8423f524cf19e99a5bc
TLSH
T16EC08C473769D356CAAD4A304B906BE2EEA4EB4350880953C82C8F200E676187FA0CD5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 160020ad127aa3d6db077d02d26d08408ef6954857831cea3017ab712a6bba63
MD5 2f88106a7da05583120aa8c9fbbfbea1
SHA1 2b73cb04ea0ee38c10be01965d144ca00dc331b4
SHA512 934a959e36101c02a926a1ca891db33cf855727528309de1559a1c85638a9596a64062a8777001cac1bfc5caaa3d25e68ea58c3f2da15a7ee5cd5b36a42bb390
TLSH
T194E0D86457CEC72AE18D24D7C224F70982A27D0BFBCC6E916B08D444620714C7A83180
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 90826444393085fd8f7b706ccca95146d979e6b5cdd3d0d321acb4511e8ecba1
MD5 d8c3c834805bca88983a8a96e14668c2
SHA1 10d8ac13f4615d63c942e88e17ac164805b838bf
SHA512 061277cb80d5d987caff8f945e69153a63358e197d13a319220dc32fcf0564f1d147aa94a65c9aa24173c63f2ae958dba564e4ddf71faa5eb8e3d17840365455
TLSH
T1F2E0867087CEC379A54C64D782B4AB0E83F0BD8BD7CCBF969B088440A107148BAE65D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1529381892ea77aacd11996327b3def8f0461b57b71eeb4ac943219bf03749b6
MD5 ad9d1cd82874e89a202bbaf722d4f2ed
SHA1 2dd1cfa63f866a0f68d938e736825cbd98a81409
SHA512 9235bf06a8b1257e1b69b582a11daceb1f231e629cc0e04f05be78d8268f2fa5e79a526ffc255a76d6b29b5e656aff78e288c0accde7dc3476e72e244d39c314
SSDEEP 48:KQ/IZKAos/yVnIVKM8gqVCWo84gc0FzI5OgKW1Owgyewf1Qmty1z:KQ/WKAouenuKM8tZmKKgK+z
TLSH
T1F491CF14303A03D138BE251CC19ADA2E174131A77718EE6B7BB944B74B6BE486DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 0559e714ef50c08f872b0dfb15eae5f38649ff34d3e85498cb73941154383f57
MD5 e0f629e64b2267831a009283d7aa2ece
SHA1 2203fa6376d2913b6d7ae99dc2f3fbd7949f3b53
SHA512 78dedaffdc927129f54190c1f9fa3b9735abf5b1b87a6e36afca13308efdcb21a3e9897b9edb8cf80ec432175f6a5e83a2e6815a5e2f4e359c43860e6dfda3dc
SSDEEP 384:DNrRZyCSDnxTIC8MEhIKyqTg2l7svbFKfk7:xFZJSDniEyIaPl7svbF9
TLSH
T16E44830A7B747001EDA6D9721CB080771E3C716E8F62E2916DB664694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 c22e8433980723056502fcdd4fe33e9609010a26f566b7a8becb28f2a11c37c9
MD5 20feed01a5dfcf48714ed43bfc9203a7
SHA1 ba7b5bd7c1a1a5e5de4d9a592b91b5635abdeccc
SHA512 0d5fe6fe45dee83875384f16e757f43d1da648e39300ee88516a80003a116946ea9e210ad336024915b1a1f418580593e10322daf8400e3a7156f6176071c02b
SSDEEP 192:UnQpIIIQbwMIMSvLYcYaI+OARAsOl8HPrsLW:+QpIIIQbwMIM6BEASsM0s
TLSH
T17A42C86E57452B77C8CF5B36176382405BD488A100766D2DB2562C0F8DFBFA782E52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 8ce9b6b853576a55ddf15f396457de7258274dc085e2a6df659c2b8eb1967df5
MD5 7cb515424170d2615271d4e5ce63edcf
SHA1 7fc6f25a2842834be1066e10778ab21ff298d2dc
SHA512 268747d636de8908ea375a1deeb5d1f69bc4be2b81e0c0f36411ccfa8859346eb9c5039fe6a48843c03e0f2a84c198fa3f552b403d2fcd3474a8f534579ebeda
TLSH
T19AE08658EBDEC27FE01C61DB01646749D3913E4BFBCC6E866F05DCC4A106148B6E65C2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 3ed1ab26591bed9b918d7f7199a76e286a40625a6abe13115dda52af9ee32deb
MD5 55e045c1a86b8d3ec7b981fe05a2d5cf
SHA1 490ee18f0797884f90d863d00a6c0a677c42044c
SHA512 98f135381bfea451451f4e32360b803ec5f20f3ff85d5af49ddf278b91ab6ecaa4e7443239e9c4253d900127d4c6d73108136d8a3015c88273ea1ccd35296e14
TLSH
T14821C495F330C109E15E867AA47EAB3A1778D8128FBCED0F947A20646E71B040D4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 5fd8ec6acefc279de8574da803a09c48ef9941ef2cc44b9e0f223ad55ca23a92
MD5 855697354a86acba71000bbf8773cad2
SHA1 d60e642155afc2433bc1dc085fe5c13f293e42a6
SHA512 f2a2946ded30e09ab375155154853763409161d24f08fc890d19134ee2d223ac3e9a370ab8b5332f90569c14a2c883629136c6849e80571b1a94a780269a2c65
TLSH
T145E04F54EBCEC2AF902820E30164A748D3963D5BFBC86F465F058984A522159B7DB5C1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 81d0181d8bb976bd398a0b09c0313e2d68415b63ee11f8a8c0008795e86c3c67
MD5 21385539576669d4613405a368927034
SHA1 758a8456020bdaced1fb5c13c85edba9183fa286
SHA512 0a6d6f0f5900df9ec2f9b3f8387aabf5d23cc68a55d3e2fdafa547e5a56aa3e4d5a28b3a1efda5a59b2a28303bf566bd62d6c0995a18d8d7c20e42a5f2877077
SSDEEP 3:MsEllllkEthXllkl2zEelY/:/M/xT02zNY/
TLSH
T1A444040CFFCF1447CD5410304011C3D00374DC50151F57C33C5105137CC75414D40005
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e76a0a1977e5eeb1814f9570eb557038f0ff341d4956759daaea0f8393732b0c
MD5 39da9f2c2a9e820541d98d28f278fd00
SHA1 07955267e0ebfe22cd8401bfc183fc2e95e4267b
SHA512 a736dfa9127379888605e359ad401fe241dc949b717ae800025edd3fb167b333a9943794308005601eeabc19ea16cbee00e7c1ed1b374cc83c2831d5bdf0c322
SSDEEP 768:eo3AR8/DybNbAREzt4OeRFZD1fTos7Rjh2sid:eo3A2bOY1fT/RN2sid
TLSH
T104F2BF35B8E49D738CF9E245B28AB6877FF451B3C9C9498854D85F1E0483B9E134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7ad0a5631fab4d1e4dda6b5ec9a8167912f2e15d029aab79036561c42cc14864
MD5 ff566bb936363bd6828c4944f5a33dbc
SHA1 33e98e5721594f8eb1d84c23829fdf1010e0813c
SHA512 cec0eac2b216f9ec307124cfc0b4e7a54bef4bbbd7376f63c2693dca37c742c645fbd05c4eb4618852c48047ab033edc3e3362e0300797203045a4941c2147c7
SSDEEP 768:yo3Aw8/DybNbAREzt4OeRFZD1fTos7Rjh2sid:yo3ArbOY1fT/RN2sid
TLSH
T15AF2BF35B8E49D738CF9E245B28AB6877FF451B3C9C9498854D85E1E0483B9E130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 07fd7700dd96814d17f3e576f4608091da4235ec1dcbec3e5d243405153b214f
MD5 f24cc3fdec3698d9e5b05e225699c9a6
SHA1 ca6cf13087ac426aa599fc102f899c593378881f
SHA512 ed742f903b54335a75ccd35afd48d5e25671cadb69fbaa06eef08e02d455e663565bed75f5c3e03bfb5cbaaeb95f72d155637fa546f65e012d45e7ec2e99b2f4
SSDEEP 768:yd3Ay83dybNbAREzt4OeRFZD1fTos7Rjh2sid:yd3AtNOY1fT/RN2sid
TLSH
T172F2BF35B8E48D738CF9E245B28AB6877FF451B389C9498854D95F1E0483B9E134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5abe2c7f0f197069e5a18e7597b4c8323fed791ae3141ccf9f28f950d007485e
MD5 028504d5a972eea3cea9619c87830849
SHA1 653a8642aa3c15e4c12e99ac5128c1f2f2bd9149
SHA512 3a6a34181944ce2be860c57e0e220272d643125b4f1832d7e61cc2d4ca832588deb14972b001d7df4d16ab03fe966881f46351d5670eb6fcc0dd9e70f0d10c93
SSDEEP 768:6o3AR8cDybNbAREztQOeRFZD1fTos7Rjmmkkr+B2sid:6o3A2YmY1fT/RynkaB2sid
TLSH
T1AB038D3DACA48C7F88BEF304624D76466EA41173C5B94988D3D85B0EC473A9DB747C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 950cd224d8ee1eb715f004ecfcd86ae3aaeeb573fe24d3280525aa2558e975e0
MD5 e133e388ce140332ad9c2564d5dbf9b7
SHA1 13c7b0cbce7b1a98afedefabf0965c34fa5c751e
SHA512 e14de967edb06ebfeb980d1a9f40da56154210b8a4d4d7960ea9ffb367d3dcec70f8a91ddd089de079d148179a7421ea02af026685861b3762a70caf154690ba
SSDEEP 768:z/UxvxjgC+k3UwQybNbAyOeRFZD1fTos7RzR/+Pu:GZj3+k3ULzY1fT/RtKu
TLSH
T11F03CF3AF8D46D338CF6E244B20A764BBFF055B386C91A9809ED6F0E158B79D1307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 dbe6e7abff9963819176962a42534bcfab434985eb0f4dc24a319f4362ca313c
MD5 5e1a59c8036f7fb32963be527358e6b1
SHA1 d1038a29df72b102d1d685e35bc2a54ef49b9945
SHA512 712833f5fc3770406058adc3c7baa3d2dc945a9b575348905b2fd7e4acbf596514ccf3b383094e2fe5747bfdd9afc45e8807abe337acfef3f0f95570704a6c9f
SSDEEP 768:y/UxvxjgC+k3Ay8rdybNbAREztzOeRFZD1fTos7Rjh2sUt:3Zj3+k3AtZnY1fT/RN2sUt
TLSH
T1D703BF39B8E45C338CFAE204B28EB7C7BFF414B389C5599845E95E0E0587B9D134B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 eceba74adcedcc95d16c977b9eaa30436c85cb6521836a95e8333ff439f26b1f
MD5 80262eab8646c33e292f0e3536e78140
SHA1 c5ceb996b307036e6828db7346e0880bf54839c5
SHA512 b3dec9cb93f99a1af6ea97d2186ba16aef789ba53cd6bb10ae7aeb8492b26935e5abd8b2575e24ae453736274d6eb1a66305923094faddd608ea92e23caebb24
SSDEEP 12:TL6KeJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3is+zAXrdQAmQQtuy:TL6Rj0afDdWec9sJVUOVX1q7+jy
TLSH
T17292F1166D312033E8DF4B36BC5349900EBD065E85A779519ED448210EB2BD2A2552FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 34839c07c81b710e3577232ad6f83140f54801d134f11559f2587982375c4e9d
MD5 9343f305da2850b4e3eb2010b099443f
SHA1 1b039adb1e49aaaaf44c9d3cd3367e327aa0977c
SHA512 2868ded7f27a6793e4c486dc35b8e5922f20bb8969f89d6c5d074a1287277ff9bb67f97aed316863e2a9fafd7926673b24584a1a500667c4260d91e3209252da
SSDEEP 3:MsEllllkEthXllkl2zEelYFR+t:/M/xT02zNYFRq
TLSH
T10944040CFFFD1405C51471304411C35413F5DC500553D7C374550413FCC75410C10010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

7f2966ee-b8f7-4808-be63-3784a6f990ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7f2966ee-b8f7-4808-be63-3784a6f990ea.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1040_1099793043\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5908-126-0x000000000C9D0000-0x000000000CA20000-memory.dmp

Download