28b84b4eb243e93edbf28276fe33688e18eb55a609441a2ecba22351c7653cf2

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zenin.exe
Size 23.7MB
Sample261003-p4e5yszyfv
SHA256 28b84b4eb243e93edbf28276fe33688e18eb55a609441a2ecba22351c7653cf2
MD5 afe9325793eb9cce96191c738a2e4174
SHA1 e57d7efdd7124bcef39bd7aba2c3cf8c421436b2
SHA512 1338b84b74c180e636765931baa91dda46ee3e3232ef743a3fb22a8d5f2c2c9a9c5ccb0c8abaf5d8edab746ccd1053ded66141f4262069449a8ec7e9e7d82b41
SSDEEP 393216:IOkciKwwjspDnO1jTzJjH/bbM0JxbX9q/K6vFTBGiBgrCh6nTJkC384i7cVuZfes:GciKwwjspDnO1jTVL/M2zGNTByBbMbm
TLSH
T1CF47331478B795A0E0D7C7950095325EF22F3BFDD4E8AD09B668AD9C7D63E28632D302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_1874831277\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_618919858\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_618919858\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_618919858\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_1089909038\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_1874831277\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_1355638439\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_1355638439\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_618919858\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5936	msedge.exe
4480	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{65AA4B0E-0517-4E98-AF69-52187C239607}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5564	Zenin.exe
5564	Zenin.exe
5564	Zenin.exe
5564	Zenin.exe
1708	msedge.exe
1708	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5640	msedge.exe
5640	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 5640	5564	Zenin.exe	90
PID 5640 wrote to memory of 2380	5640	msedge.exe	91
PID 5640 wrote to memory of 1640	5640	msedge.exe	92
PID 5640 wrote to memory of 5936	5640	msedge.exe	94
PID 5640 wrote to memory of 1640	5640	msedge.exe	92
PID 5640 wrote to memory of 1640	5640	msedge.exe	92
PID 5640 wrote to memory of 3136	5640	msedge.exe	95
PID 5640 wrote to memory of 3136	5640	msedge.exe	95
PID 5640 wrote to memory of 5680	5640	msedge.exe	96
PID 5640 wrote to memory of 5680	5640	msedge.exe	96
PID 5640 wrote to memory of 4788	5640	msedge.exe	97
PID 5640 wrote to memory of 5680	5640	msedge.exe	96
PID 5640 wrote to memory of 4788	5640	msedge.exe	97
PID 5640 wrote to memory of 4788	5640	msedge.exe	97
PID 5640 wrote to memory of 3052	5640	msedge.exe	98
PID 5640 wrote to memory of 3052	5640	msedge.exe	98
PID 5640 wrote to memory of 3052	5640	msedge.exe	98
PID 5640 wrote to memory of 1860	5640	msedge.exe	99
PID 5640 wrote to memory of 1860	5640	msedge.exe	99
PID 5640 wrote to memory of 1860	5640	msedge.exe	99
PID 5640 wrote to memory of 2588	5640	msedge.exe	101
PID 5640 wrote to memory of 2588	5640	msedge.exe	101
PID 5640 wrote to memory of 4924	5640	msedge.exe	104
PID 1708 wrote to memory of 5472	1708	msedge.exe	105
PID 1708 wrote to memory of 4376	1708	msedge.exe	107
PID 1708 wrote to memory of 4480	1708	msedge.exe	108
PID 1708 wrote to memory of 4376	1708	msedge.exe	107
PID 1708 wrote to memory of 4376	1708	msedge.exe	107
PID 1708 wrote to memory of 5308	1708	msedge.exe	109
PID 1708 wrote to memory of 5308	1708	msedge.exe	109
PID 1708 wrote to memory of 5424	1708	msedge.exe	110
PID 1708 wrote to memory of 5424	1708	msedge.exe	110
PID 1708 wrote to memory of 4416	1708	msedge.exe	112
PID 1708 wrote to memory of 4124	1708	msedge.exe	113
PID 1708 wrote to memory of 4124	1708	msedge.exe	113
PID 1708 wrote to memory of 4812	1708	msedge.exe	114
PID 1708 wrote to memory of 4812	1708	msedge.exe	114
PID 1708 wrote to memory of 4924	1708	msedge.exe	117
PID 1708 wrote to memory of 4688	1708	msedge.exe	118
PID 1708 wrote to memory of 4552	1708	msedge.exe	119
PID 1708 wrote to memory of 4776	1708	msedge.exe	122
PID 1708 wrote to memory of 4776	1708	msedge.exe	122
PID 1708 wrote to memory of 5756	1708	msedge.exe	123
PID 1708 wrote to memory of 5756	1708	msedge.exe	123
PID 1708 wrote to memory of 1976	1708	msedge.exe	124
PID 1708 wrote to memory of 1976	1708	msedge.exe	124
PID 1708 wrote to memory of 5408	1708	msedge.exe	125
PID 1708 wrote to memory of 5408	1708	msedge.exe	125
PID 1708 wrote to memory of 3228	1708	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\Zenin.exe
"C:\Users\Admin\AppData\Local\Temp\Zenin.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/seedcr4ck
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x374,0x7ffdabc5c188,0x7ffdabc5c194,0x7ffdabc5c1a0
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,6728295459992060513,15884224888015556335,262144 --field-trial-handle=2204,i,11016844299922378651,12487026865756958589,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,4273071678743120109,6246753934260421820,524288 --field-trial-handle=2204,i,11016844299922378651,12487026865756958589,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,5220633428860294010,3631343527272251467,524288 --field-trial-handle=2204,i,11016844299922378651,12487026865756958589,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:13
    3⤵
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,7786670730583811419,13857464032788917104,2097152 --field-trial-handle=2204,i,11016844299922378651,12487026865756958589,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,10418207288598205534,17919962933710772787,2097152 --field-trial-handle=2204,i,11016844299922378651,12487026865756958589,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,9912370854238111722,655142077442752686,2097152 --field-trial-handle=2204,i,11016844299922378651,12487026865756958589,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,5914090507900533945,3350041758596697028,2097152 --field-trial-handle=2204,i,11016844299922378651,12487026865756958589,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:9
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,13473526846634817693,11393631661479989198,524288 --field-trial-handle=2204,i,11016844299922378651,12487026865756958589,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffdabc5c188,0x7ffdabc5c194,0x7ffdabc5c1a0
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,8854635843215495404,16350585200066112988,262144 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:2
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,7480332000034489448,4353796435768788577,524288 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,6237143397245025073,14739531562312008272,524288 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:13
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,15182654474536219245,620865358563771848,524288 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,11724311528327653507,18203973400304597545,524288 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,11724311528327653507,18203973400304597545,524288 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,14075017570872034984,12049423222201557138,524288 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,9873498305415674785,11901303451522411367,524288 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1200,i,12464569413741555050,14759516340863737170,524288 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=1344 /prefetch:14
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1204,i,1730938409725380230,5636478786286700085,524288 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1208,i,6275061106118437275,8177862400744784149,524288 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,2876962708696302058,9656946902390005742,524288 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,13835099992768164632,12837225146707362031,524288 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=1328 /prefetch:14
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1368,i,681362856684197354,10008873874897190385,524288 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,11727737873626070581,13533718876273646528,524288 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5312,i,5647305977288796760,1123472263013917652,262144 --field-trial-handle=2752,i,16376527083897036832,17158850815300022553,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

11bfaace-20e3-4cdd-839f-aecb2a4f9c08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\11bfaace-20e3-4cdd-839f-aecb2a4f9c08.tmp
Size 39KB
SHA256 eb6ac154fbe45ec2927a1f097fa1f3142ac334fc0cd8027dd169eb69de8ea648
MD5 7cc4f9e4b2c1d2ea9b91ac7ea3603604
SHA1 ecfd09e89238f59a023dbc6b3f04abce872bff19
SHA512 fe4e51e4964d92f902873d273ef2953d19eab06ef773061c17c8632daa7df32674b369582fc56e83d93a9e12ae54f58aedf5d00b080a80c54be6c83cf79afd5f
SSDEEP 768:U/UxvxjgC+B3X78Zgm1phtDmGA5b65Q92RQMPbAFj0O:BZj3+B3Le3AF65dQLFQO
TLSH
T1C803C036EC94AEB3DCF95680374BB35AAFB84473C1C552A049E96E1D06C768D830B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

703b4685-0fbc-4c14-950f-5df2f8212a48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\703b4685-0fbc-4c14-950f-5df2f8212a48.tmp
Size 33KB
SHA256 dd265f78e3bf36cca7b52d98979e38e0b1977350d50d64f46ac37408c6a8aa02
MD5 554eecefbe32505d02df6d11bcea5b8b
SHA1 ca32da2d277d2332525ffc908818296a9f231a83
SHA512 a79fd67c0071e5a76951f9863a8fe2e1d7e0eb2dda163f5cc9b8e446568c7005e51da134fe680bd545d0c9d3f8f6ca249cc1b60df763993f1b3bc8ee4e3026d2
SSDEEP 768:fP3ORgm1pQsL+DmGA5b65Q92RQMPQgCO4:fP3iLWAF65dQeCO4
TLSH
T168F2BF72ECA0DEB39CF996C17653B2056FB88127E5CC46D049E87B1C0587ADE031AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

887ebbff-f89a-42c2-9a68-43489ac3e17d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\887ebbff-f89a-42c2-9a68-43489ac3e17d.tmp
Size 33KB
SHA256 b606982f28a27dd421176cb9322d888bebcf5b379cc659700bc2d0bfb8c00e0c
MD5 a0eacd750bd7d770e9463cabb16948ea
SHA1 55a03fb6926bbd55e841b5700f9f280ac8a63af7
SHA512 fe7aa5e8ffcde6c3ec7d6ca4871b5dbb1cdbd466fd17aa8cb010f5fee425573792373b6111059d9c1d5ed0e49c57f2ffb4a1b8c2236bd4ad6d4cce8737f217eb
SSDEEP 768:9P37Rgm1pQsL+DmGA5b65Q92RQMPQgCO4:9P3xLWAF65dQeCO4
TLSH
T16AF2BF72ECA0DEB39CF996C17653B2056FB88127D5CC46D449E87B1C0587ADE031AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e77c94a-238a-43bd-8405-6570b1112029.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8e77c94a-238a-43bd-8405-6570b1112029.tmp
Size 44KB
SHA256 3df5de5521f5113afaa37a07c3fb85d43642a694ce0ee769397c3daaffb2aa07
MD5 a4143998cedcf8ed773dbc7ff9d8240f
SHA1 54f1a60bfcb4b21deb14ddc549aefb0a8cf4dcee
SHA512 be701f4b7a680a5db849920f6c8244bd7dd2114a7c0af95374e3471b48dc1def825ba295e10f5cfe4df1559a4dc5cf07b76af413b98d33d68ddf62924f2f4b84
SSDEEP 768:L/UxvxjgC+C3LRgm1pQsLLDmGA5b65Q92RQMPbpJ9aMku:+Zj3+C3hLNAF65dQAeMku
TLSH
T15313CF3EDC50AD7F88FDB744260E62166EA84237D0E454A4C7E81F0CC5B769DF30691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84008e1469627cb4093232f4804bdd66e4ec134b6c5cfd3954f47a2c08da0a1a
MD5 f4ef72cb96cdd191595a320a0e432a6a
SHA1 d09d73fb6a5cc5e5d22e0a69dc1141c4e57964c4
SHA512 6c46da93fc11bc3892647a319799058970cd3cc6b9dd9b1e26d84523bc6fe2e5bd8244ba977dcfae72c45220eeef0d957d4b87ee7aec70148ba4d1cca8d955de
TLSH
T1EBD080325979ADF1E176117D01D1455065BD7553EE0502887711C8054C742465671F9E
MD5 SHA1 SHA512 TLSH

Submit Download

2e4074c7-b24c-48cb-b8f0-4df270806de5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e4074c7-b24c-48cb-b8f0-4df270806de5.tmp
Size 12KB
SHA256 838d6e92b38414d0291d62db8b688def2c23cf6d9a111f8eaedfc080320a6a5a
MD5 ce045fbf51d26fbbd101355284de0c2e
SHA1 6afbbf843012e7954301e7e0ba38100b18eb35aa
SHA512 5309fbfd19005c9627595b3859c4b502f3f1d1065f4c1dfa950b20a9f8c5ee400dba9b08d6154242204a30ec48709ecab0b1857ae51d03875ea9da8a64f95f82
SSDEEP 192:sxRsRhCr/fsMsDWpVOaZK9LqzoA8p85/g6+WNQsLE/YaqcAGKIgvtJ:sxRsqr/fsMsDWvOMKln8/5A/N+/
TLSH
T10442C845A928A97B8CD7D61DFB657F23D3F9503290D05E48E6FC8A2C14E76DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e78572d-f7b6-403d-b009-d538910e7071.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3e78572d-f7b6-403d-b009-d538910e7071.tmp
Size 12KB
SHA256 57da2ac658827129ddbaa311bf9dc02ec24aab2865b4279e20fb008d5838caaf
MD5 047dd747438e369b29f73eb04df3fa37
SHA1 c63878d86a70513d4eabd855c50bc9d9e1a7a743
SHA512 4314c895207c58012c140dcee851baea2814a4383af6fa6658aa5137ce3b7f8680c8d19f902cc267b470609d6ed20bd3bef5ed985121f760400b7370eebac8c2
SSDEEP 192:sxRsRhCr/fsMsDWpVnaZK9LqzoA8p85/g6+WNQsLE/Ya4cAGKIgVtJ:sxRsqr/fsMsDWvnMKln8/5A/7+p
TLSH
T19842C845A928A97B8CD7D61DFB657F23D3F9503290D05E48E6FC8A2C14E76DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68c268bd-5ab2-4a54-929a-d71be0cb929b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\68c268bd-5ab2-4a54-929a-d71be0cb929b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

69db1555-8c80-4aeb-8252-e4dfedf4a017.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\69db1555-8c80-4aeb-8252-e4dfedf4a017.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b08c606-ddba-495e-b4ac-d528d80004e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6b08c606-ddba-495e-b4ac-d528d80004e9.tmp
Size 12KB
SHA256 7f733f865bbfe07b9cd53efee74ea0b57914ac6195b02772121cbef29d191b74
MD5 2cfc08351f1a45942cc34e70a784d77f
SHA1 040349541bc927abe6d27e3dce119c3f1dbd36e7
SHA512 e8f2620606eaeea67402f2e60fcf808a811ad8e226ec3e4f9aa8b53ff79f209e880d3ba0e6a089c0ee834f7f0e3f227aa83a10bbe29eead2d735b1de5d46d16f
SSDEEP 192:sxRvRhCr/fsMspWpVnyYhfzoA8p85/g6+WNQsLE/Ya4c6gKIgVFJ:sxRvqr/fsMspWvnb28/5A/7u9
TLSH
T1EE42A745AD24A97B8CC7D61DFB697F23D2FD5032A1D05E48A6FC8A2C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71aac2c0-7b21-4863-a18f-574fc573f5d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\71aac2c0-7b21-4863-a18f-574fc573f5d7.tmp
Size 12KB
SHA256 731e20c252ba080c537ebe78c3399c283cb88a4257248ee179a0d7cf8f075f14
MD5 058226b86a62fd68adeb33b740e156e3
SHA1 a8ac5c77e4edbcefa65880373ef001fb8047b6de
SHA512 b0022881f9fbd49970c7426e468c01438937c471318dc6d3c89b7c8f76a2f7b616912a05a4d633d2954e1b8056ee341133dee82e3f60385d6acfb7f91c6329bb
SSDEEP 192:sxRvRhCr/fsMsuWpVnaZK9LqzoA8p85/g6+WNQsLE/Ya4cAGKIgVtJ:sxRvqr/fsMsuWvnMKln8/5A/7+p
TLSH
T1C242B845AD28A97B8CD7D61DFB657F23D2F9503290D05E48E6FC8A2C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 895b055fd56390ae4a804f160a0da676f2bbfb379048f9fc7e85c416675c318b
MD5 ea32954ef6f8184a29fc03c2bc5b1419
SHA1 b14f59db656204ec92bb1392de5cf97f1d12819c
SHA512 acbcbf646ed01fded4a043547bbbc3e8dc78311bfd1d3163f48d423b70f4b6603212bcf5da7cf775bc7cb8b5e99734a2cb62c372f09d09f26afc32f8836f104d
SSDEEP 192:cmfr8klSdsEh6WO4lM3LKqmvuCs26oakBC7SR2pkjMl:cU8klS+GlM7Kd+26V2R2p7
TLSH
T17713A33EB6505E26F6CB94BC66178FB91376D874D9C1803BA3F2F12A9B453241C0F60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 fea9772ad2236f09fdad44a81690370688fdf3215127994c10ba768e7b1e8396
MD5 cfb1f27bde63a02ef3ea4ea75569a76f
SHA1 8a78280b48beab235ebbfaee072dfca461b315aa
SHA512 cd3f7b8a7c8bc23cc7a32032e444037fde9bb23acbbc7f7e1e173c4656727b9b6dfda8e1c022b7b4018afdccfedd4e3127bf1a3599dbf4dac74cdc5ef27ce3e2
SSDEEP 768:9d82TNB7RknXL/q6VL/gChb5vIsRbnIAP6lJ/53TzHU5bGEPvoQNov7xieE/soJ:9d8umL/qeL/gIbBT6APoR/U5bZPgQNk
TLSH
T103443EF74951A01BDFA852F5E6033E3DD1BB455D7CD1F8A9E1788C812825F21B2BCA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 e8957773c6a26e172f065f4899fffde35ca325271e8a48a745eeb0056dd97ad2
MD5 c9c13d4d18cd144a55976afce4308c92
SHA1 10202260d5ef0f0a42d2270f64ba4ab8b404b06e
SHA512 1b114f63e882d1b87233c7415dff3a008ef74f775175b68d5158319c20865a8f6f704a3c4c62019df190fb48361384208019215f6f27d91de7cd7cd5fe2f4515
SSDEEP 3072:Lv9G+bWNFRM+ZM6ESkctv9i7hfouoQBHHKih+r:LQF7ZMmDtv9i7xtUih+
TLSH
T1EA254AEEC7682C82DF6B8770B0E0D90B7E712082B69DD0D39944C5D897D6B8575E82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 d5740d6dcc02f791ec694312718a89df9e310dda86f3c3c560919185ee490334
MD5 bf5c6771be3a4b370b00a8df1bbe5304
SHA1 956688a882a1195d7c0206e40fd5aa39856a6793
SHA512 3c0c9236465a3f6d34799cc52d2a4b2c9ad7a58eb1d9bfee17d50356ec11cc30e56ed954a4982a5ed2662a2b346f9a0d7deb8820f1997f145d951b29e3f443a1
SSDEEP 12288:wkSM59eOz3zYom7lNIMJ+DrTvZptjTrQ+mwDT/QVYzw1gFgBQnAnU+O7hHJhWbG1:RmWKTb+AKRmRYbKtIEGrYqTN9+rg
TLSH
T122167CEDCA7858C3DD639A30B4F0E9477C7413C3F995C1D68898C580026BBC5BBAE669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 fc88d210d20af42c3a092fb8253787c65f569286b077460f0b6d3e180b073743
MD5 3f5e3a302dcee5d7ae83fbc16fd02166
SHA1 868454092220dd426608a83b93ae2e29781fa4d7
SHA512 c42099ddbc68da620c3da13206af309bc386055f33602b773f9bf592c35f593c6b1f951668647f9a8171769287952addd6f924f9effd37e40d07b58438bb6317
TLSH
T14251728142A86A6ADF74057D65CA2EC336B444BC5E6BFE72F0E8FD6953C6314003E083
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 fe221e2e0ef59dd14909ade29021f086998680a5a4b3d5cbd546f35c07ee9526
MD5 298b1343a981e06d845d676259dc44b3
SHA1 d7fc1c2ca2bcc436e59e7d345aa02b54c1fc5331
SHA512 bbeeb29b4c9460d36a445308944d3951dd20ea07fbec004e68847fcd806c0fdab575c21e4ec14280053257659365d6f206f08a24d148c7841df0b5dae0e071c8
TLSH
T15151718142996A6ADF74017D65CA2EC736B484BC9EABFD72F0E8FD6853C6354007E083
MD5 SHA1 SHA512 TLSH

Submit Download

beb032b6-27ac-47f5-b016-a2a5fdecf72c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\beb032b6-27ac-47f5-b016-a2a5fdecf72c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 fb93d957382a9d71fd24b43176af1fa60bd5e4f576cb43d96ac4c7c819af8398
MD5 7eacdd0b325f40a660b1d60cca652d63
SHA1 c50e3dc4529e36027a1fd1bc48fc0e9ba6257bf7
SHA512 09373e9caebef5c4bfbc8bf51303d55704669f8550a1b7bd56237f67554c4267dc88441ce09ffafc5f4b853c60331af39446d4e6263bd48c0616b9321eca3ff2
TLSH
T1B9E0D8F9F8CAC12D5A5434C622687F5882C87452D6D1AD4F1F04C8C47F86001F241556
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 6cd12a8fe182a0ab95bc79eee5e9de48cd26e4000cde8750336d7198e0c8639c
MD5 cdde50b738c0839a82358dc2e60407db
SHA1 39cfa3c2a7d17a854e174f23edfe19e3033a0d1b
SHA512 40e53c213b78071b6e8d729bb5d89513b16a36409a910b44029ec153c006ac1dde0e39a23c75a51718b57819334f59d7546f6daddcefe7311242cbdffd4235e9
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj2ZQN:TdD4jJ/0UC+lf5KY
TLSH
T11AE2A04C3E21F511C4ED733CA0D2C5D09EBC647C478DB67142386CA68D52AA2F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 319B
SHA256 d3b1259a86393dca960d04b1025758adc550086d48b964ea6477b86f160f2d55
MD5 596b7223e2a762b83665a7140ff45886
SHA1 db15bde977f31f29dd1cd0fa5c7412da5cbfb1f6
SHA512 412b9bb536f68120165d73ebbff2213922f9c39c61bacc94b7d50d176a775af724e38ecb5ee6fc232627e7ac5f9691cccbba44fbd43aa68c9eb8d424d22095d3
TLSH
T1EAE07DA834CEC12D519E74C383F8B718E3D0781AE3C03D0E170CC9457201104B3867A5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 323B
SHA256 4540b76c9525ab351de2fbe30abd0eca7af8f440e37c4d0408fb985783031347
MD5 ab21e38ea8c4cbcabdf93e416dde9661
SHA1 7706394aaccbd49fe05ea79650df6ff75dd90d4b
SHA512 af5b787e7f54db2687a41de7859334cbf91d4cf7455f023bed3333a8564843383cef4236ee7ccc8dd0e3d66c36aa708ee61a0b5df587d2e36f15c4c8c00d3e1a
TLSH
T13DE026AC29C8C12D516B78C303B8B30C93D03852E3C07D0E1B0CCE646245200BB82BBD
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 6241c480e5efdd72bbc20f8f04c30e7b50e690a0771a893e693ad1a81ba04733
MD5 a6333474f304f40035e12913ac2ea1ce
SHA1 1db320d91335282a256b0738931fff557e89c158
SHA512 d94f1f5b7b6b9f551c676f11a4f36ccf62aa603e00ef4ffa9d12a1e5fe59b5dd77133ac8d4b7473749c3fb0806ca9e63c8ef07f5c111c8a1b71d027c14447363
TLSH
T196E026B8A8C8C12D915C789B03AC778CC7D23812A3C03D0E5748C8887141341A2CFA90
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 71c033e8655d625f52cc413d6b783984dd6409c807a6cf231917565541806181
MD5 7daaf05c239e63779e11a113d8000bf4
SHA1 65927646494073d0928e36b9303dbc7ade6f3d34
SHA512 0d83dcf72eeef5a0c7454cc52d6eeb1e62411bde53ced69eb5878be0bc185007e662434e9ca6818dcb923dfa49da7b2e7bb090a650da44c722d407f46785d148
SSDEEP 96:r7KAtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/8XbbEOVpZf24JkMfXSFR+CFqD:r7K/H+bF+UI3iWGVoWN3qL/sVVV63
TLSH
T19324001E5F243712CDBD913668E744A35C7DF03F8B5326DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 8KB
SHA256 4c66380daacc0c420c29d12d0d46111c530dceeef240eb2a39e0e9cb899af6a7
MD5 7cc8ec0fb0cc0b7cf64012a7aa99f463
SHA1 0d713fa492e1a48d524739d2851eac2b0399dc3a
SHA512 e7730d54b5d15b9b8719b0810231f1f635ac9cb199b67335d8b0c9ae75a1035ec71762c81b910f706e9427243fd41db1aa694e545714b3430638a319ccd36f15
SSDEEP 3:by993lljq7A/mhWJFuQ30VkWUBtdwenqFtjE9SFcTpL0WWaV1vGrV9RUIp:beG7/Vkpd4FS99pLTB1eBf
TLSH
T1FE028C922B60A8B3EC4DAB3DB6C781EC1F723D0CCD52C845820CDC110F02ADC826845F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 58bd29053d287668d401912d478d4e3eaa22c41694a6e98498da4898a6433813
MD5 f5432acd84cff92d4e4b0b00dcd62755
SHA1 14965b7cdea97bace15ab87fece7653eff64e41d
SHA512 3a20030eb362a29b3aa012cb73387550dd2e4d67bc6790cb08d9d8b65c2c719228fd3f508d4a1e8372f1c85343e12e0350b84a0831e2b80b58a30da6e23a8dc9
TLSH
T156E0DFB465DDC52E634CA08B13A8771CD7E4341EE7C43E0E5F08DD48B949044A6D22E3
MD5 SHA1 SHA512 TLSH

Submit Download

099dc4ae-677c-4674-b702-e3691526a9fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\099dc4ae-677c-4674-b702-e3691526a9fc.tmp
Size 2KB
SHA256 fa182dfeaa0f7072047c3e6876fd9c644cbb8cfd1710d77759f745ae05a9d6c6
MD5 ffb1794d2791178b9c2aeb8cc61f3381
SHA1 5b8dcdd78589dee29a44142eb840c932f45ae4ba
SHA512 da9afbe634c62a4cb6b9ff3ec3109ef519560166770f618635c52b33c1fb68d03d99a74b66fde24b90a39bfe820815df3d0844be4271ed1ac4e21744fa6c215d
TLSH
T12241C0F7C3F8863D8A0195F4BB186E1BCE5D0525532C3D5A88E4AE1BA3E34B1D14099F
MD5 SHA1 SHA512 TLSH

Submit Download

166b06c3-2e8a-4da1-83fa-5c2efcb97785.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\166b06c3-2e8a-4da1-83fa-5c2efcb97785.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

4eae93c9-216a-48cd-88f3-ad74e9161221.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4eae93c9-216a-48cd-88f3-ad74e9161221.tmp
Size 2KB
SHA256 d34a522da4ba27c671ccf39990ba479c84ac08a2986c6ef96af7a8f4e0cc8d8f
MD5 cd12c9b1691a1a95b64b2d6fd190776f
SHA1 c755fb678652bb050e6bbe4e366e39237c762acf
SHA512 ba46a6175411587b82655dd74392d34689b68f5fe62e1a3539cc58685f29d22ec319fcf445f2263d82c7086cd9b68cb913f59347d557b63027523347a3e6b5c2
TLSH
T11D51ACF7C3E8863D8A0195F4AB186E1BCE1D0915432C3D5AC8E4AE1BA3E2471D14099F
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 acd93d0d0eb5cbc1d09a6478e31d7cd756540698ce3b55e8d73bc9ef12c934a8
MD5 5654fd304fe3f9a78c71c049955bb0fe
SHA1 d023d86ac67f6e93c593a60abc921f09083daf74
SHA512 a334a726632b8b43f685684b7eb79182bbf05312b7f6eedc60d4edefaf7caca929a27570ea5174e2151876886a7674b365f3468c772e4b63f061aaea1eb4750f
SSDEEP 48:Txk/LopFMaty423w/a9NUuTbwjoEoYLXeJo5wO+p33G58:qDeMatha9lTOXecuGW
TLSH
T168B2614D2F303622C0F14B36DDD184272F7C111DC7B32656A95920F3CDA3A6BF6164AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 768a526e9cbb2b21d5d0cf854fda2dfbc5ba371191aaf245d19463d77f524f01
MD5 4066e66ff276b9cac6145d0c9641e914
SHA1 66adb48c42d0cbcda0ea2dddf2485148a0538236
SHA512 39b8e04e897a3202c86cb6ed06850f3a341bbb2fd510a536eca3a4f04169e926aba9e98c9e9dee9d6f0e2b96bce002a27cb4493d2a76481501445523285d99b3
SSDEEP 96:uIEumQv8m1ccnvS6xjewIGcf6CnF3ci4g:uIEumQv8m1ccnvS6J1U
TLSH
T1AAF2DCFF07276205D99444B0E4009BCEAF1A010B47B6B6EC76D44BE3F7A21E2B179796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 84396dae8531ff553a04c32142e0fed2fc4bbeb5e2c89f650c081e086e21b556
MD5 394d7ed15720c9601a329940486dc90a
SHA1 005c5045f803c7f98c7b16d620ea6c9a53b8e9cf
SHA512 2064236f406952db8b4626f699f28170f43517e4e6a111a6a460c5cf63a98f828c62598106c434845a06518f49811680e7a25cebea51cffcee550e95d4e9e1cf
TLSH
T168014727C5B9A03730A98E6A1E94BC086DB9ECB00240D0F0EA9792BDB0825F30692412
MD5 SHA1 SHA512 TLSH

Submit Download

dd028ffb-85a9-48b5-a920-1af6275eb93d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dd028ffb-85a9-48b5-a920-1af6275eb93d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 990ff39f17bddf623ee90ac984a88902c22fa95f70460200e3df2aff0a2a6648
MD5 dec48c4f3ded39fa6d55eda7a991cf06
SHA1 fdd8bdde53702157999f32e53f77eb7873d749d2
SHA512 109e0591eb963cef1f94441ecbba09772595428c709420574161c590d9b2a869df1294a53d873198751b7637f857653706cdc4dfff1ac7f7212936dae52a6051
TLSH
T1DAE086E425D9C6BE625A214303ACB31897FCF427D7C43D0E3F98CF556546544B2D2591
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 8d1504bde81a240a50a9832b86257ee300b4ea8a83ceff6c02b440fd9b78fa2f
MD5 ed427b5678b7281d038a32ba00bae85a
SHA1 0817a1ec79cd7d7e365f00e884ad87567054dfa5
SHA512 737aec69cd5da61aed7ece2df28343d8d9754a4bf7567c061bbd06b41890ddd276c7e0051f7c0d63b96022021c87e7f00c2869383b4f1dccc60e3fba2026d679
TLSH
T100E0D87439C9C63E629A20871358F708C7E3B413D7C42D1D2B09DE84620A1407383550
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 b90906936bdb7d66e28115c45d78b109c79d61151200315e7e2b6e324d7a7c6b
MD5 e89b370dc96cdbe92c2adb7c3103ffa8
SHA1 dffae7b728f164963d94f8d91b95072f66c02b49
SHA512 7ec18df056b4fc803ec45b35a346b6a524a7e51bdb73526b93ea70327077895f565f7556380a4bdba7e81ecf3839b8f30f106ff1689f074961e8851af62ef007
TLSH
T103E086F465DEC63D919960C303F8F71D87F47816A7C47E4E57488544B505944B2A65A0
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 1fc1283817d61537d73fcc0c35e537ddb507bcaf0b0c250853b508f2bfd20356
MD5 bc9218677d0aeff289196936802c264f
SHA1 9987d923c148408585efe2d18d86a6a9729d924d
SHA512 f2e8faf59fa054cea5b87f54edc6af51a082ade0558efabdc18a3195a9df2f007d74f5d40893c525afebb1c0980616c280e9178b2e8b624f8863800ae988ac4f
SSDEEP 384:DNrRZyCSDnxTICQcMUSMEhIKyll7svbFKfk7:xFZJSDniVcPyI1l7svbF9
TLSH
T1FF44740A7B747001EDE6D9725CB080771E3CB16D8F22A6916DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9aaf555-34b1-4dc6-a663-db638d6b9753.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d9aaf555-34b1-4dc6-a663-db638d6b9753.tmp
Size 27KB
SHA256 699c37cbcf30b76328c0ab467afa411642a0f73d6b7c1dc69d9d1d39d6941a0b
MD5 8b0580c258829c0896630028f1b311b6
SHA1 e5ba7abacd44ec9434c0adfb95e5a4261bd95a53
SHA512 5b18ec9c2ba4f4d3431bdaf81a2b74d9c48411a4017dd8d307457e980212f5efb1eef8053878920461d811d858754b671c5eafcac0283b70d3ae9e74065c83a8
SSDEEP 768:L7aasW7pLuLb6DWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPdNMAroHu:L7aas2Eb6DWgptfvDu1jaWrMLO
TLSH
T151C2DA7F640CCB7F4F900ADD9C197E9B6D6802CB9698CD8047FE945C02C6BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 5c1c5ec4c42e3b29d001e5313cab0c88b7f30986067d9a7d3aa8630b6a0f80dc
MD5 3fe3d8e722f845c796eefb04c50d23be
SHA1 5297ad5ee811d89f8f574b429ca843d4e95302dc
SHA512 9e85441ea2226c632beeb7a0867319d8a4eddc297ae5de93d17dca12ebcf434fd6cae794faabd3d1640e6e4cd81b8485f2cad8be55f683db7b872b1457a6814a
TLSH
T1A8F0A8DBAE4309B7CC0295328133AB82FF2289CB046464A703CD212B5A2E2F1C9CC0E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 49f9eccfd87e8cd46cb5c22e580fe3ea976483a10b0c96f7357c9227254f9173
MD5 80378de2627d1470225961240b2c016a
SHA1 e7efb3f0edc94c7d8f50dacebd9cb4c7048d20b6
SHA512 624b23831efac8045b52163c1b9707f07ddcfaadddf5636f995d6fa34fdcb4c36b84f4f2a48c1d54fdf5fe584c1e7b7bf5ad9e764dc66aa165dbdd61e53f1fe3
TLSH
T14AE026A4BCCCC26EA25D308712AD730C83CA3813FBC02E0E2F09C548B605500B2EA191
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 15985559389787bd99b155cd9b2cb614b9421b91744b7726d85d3bae8b93c12b
MD5 bbecead6efe2bcfa813c48f00d0f6d1a
SHA1 b7ac24bc611cd5c19eae3862e55d46e4b4532bec
SHA512 25dfcfe35ec473890821a228e41561b7f1b440928950960e9a7d8324e4d10572c83d59728119e84a300a544bdda8219a42c3de072ede1c749513247ab14339e1
TLSH
T10021B156F330C148E14E867E547A9B2A1738D8428FBCED0F847920346E75F051E4B6E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 1d2f66db0a6abd3e38bd4cceb07f1c93b5e33bfea413515fa4be8d9858061caf
MD5 36f8d28d134c06f9a7af95e040bec2e7
SHA1 1f98a028edcdcf934527f7ceba07b9268b6e29ec
SHA512 33caea05a168dfcf10cef251d467e40b2185e80b013b58ab3729fb4ef8f0b22fda1b2bb0daa662384a41945790c89a2d73d2a68906b079edbe17594a5887f866
TLSH
T1F4E0D8B478C8C35F525D309302AEB34883DE3C12EBC02E0D2F40C988AA092417386151
MD5 SHA1 SHA512 TLSH

Submit Download

18e1ed3e-89c1-456c-855c-07bb92c84bf6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\18e1ed3e-89c1-456c-855c-07bb92c84bf6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 d555beb425bbd8773661db80e93c65488d72acadec02fc2e737e52afc7ca4de2
MD5 ea0b4052e0c2c7c3202642fd2277d261
SHA1 0188c7c57599cd6ffb9f3e8bbafb290e716d472b
SHA512 99a932d1b23b3a91881456249bc0ab902753cfccb371be7025997764b1d6f189826811c91b8d302706a89d8b0339a5365366c2ba6a183d5da237eb998b364242
SSDEEP 3:MsEllllkEthXllkl2zEflKR7:/M/xT02zD
TLSH
T1A64404C47FC00C07F70430304051C3701370D4310511574334D544335DC75700C44000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 54e7a0af3c1ff07f5781857e6e561d6934daf491c63545229a226e8c75efff2e
MD5 d0c4b891863611d751bea5f83ee368e3
SHA1 80ad15913acebf661b4a22301861b1fc47ea3db6
SHA512 06b8654156c6ace146642b09670dd7c88db6380a06faba1bd685a3ecd8612eeca19e4ac64e4cb5532efc869d478b0e2fd600cda06f0fc5c7da7d91577163a128
SSDEEP 3:MsEllllkEthXllkl2zEfl5R7:/M/xT02z6h
TLSH
T1FC4404047FC00405D70011344051C3501374D4304715574734F15C335CC75504D00140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

1f65d027-9c21-4ca9-9708-beea6301aaa3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1f65d027-9c21-4ca9-9708-beea6301aaa3.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

57a2a71d-5889-44ef-90e6-3b3c4688c218.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\57a2a71d-5889-44ef-90e6-3b3c4688c218.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

6d6503ff-7149-4cec-ab96-d6dc1c83e527.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6d6503ff-7149-4cec-ab96-d6dc1c83e527.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

aee27c08-dc4a-42bd-a3ff-09ee8eb3fbea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\aee27c08-dc4a-42bd-a3ff-09ee8eb3fbea.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

e1d6a4f1-3b6c-4af3-9c2b-3bd67397257b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e1d6a4f1-3b6c-4af3-9c2b-3bd67397257b.tmp
Size 61KB
SHA256 4a844b257ef55a2d75c7ddd22aaaf7ec5a81de990c74a17233b0608bc108fdd9
MD5 3957d6218c5eac1af26813b829d30ab5
SHA1 b008d00ab3c6707f7ae0a579cdf47b402eada212
SHA512 db94f2c39a7e025502e7981790c741d483070ed9cbe293004c488cddb1b09f9c152a2e2cfe35f020591ff77d04e1b64104812eade1e628209e63d73ac5f5d7bb
SSDEEP 768:VFSP3Pwg2SHeXDmGA5b65Q92RQMPtgbzXggSY32yf17AHsT6XmrRpikRr+IYO4:+P3UAF65dQJNS9yfmS62DDRaRO4
TLSH
T1145349FA88E389BBD8AD5B83577D6E055DBCC167B0A88484F7C51A0CCC525BFC306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e761635e-b19b-47f9-9472-c7565ae8b08c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e761635e-b19b-47f9-9472-c7565ae8b08c.tmp
Size 35KB
SHA256 095f1d114af6c9b7a31f7c80942bdb8aca5108d09227e3a2e96a89a03e0f43d1
MD5 00a0b5c3bdbcf45f53e767bd951386ff
SHA1 199116e81ee5f16e53bc08e89e366869b361db71
SHA512 8a38d948bfc594ad2c2990f49322c35e726fbc74658b1202e65d60b8927e0e8534c3fe0eae6282853c4a92d74e778f7319582932fb2909ba5231e2b52a7464ec
SSDEEP 768:7P37Rgm1pYDmGA5b65Q92RQMPQpikRr+I2O4:7P3qAF65dQXDRaRO4
TLSH
T10BF2CF75DC619EBB88BDBB81264AB7055FB8413BD0E84594DBE46B0C44639CD5303D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e81072b-7be1-4021-9125-3b34e23159fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5e81072b-7be1-4021-9125-3b34e23159fd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

cd8928c6-f5ac-46a4-a524-3fd9035b25c3.tmp

Path C:\Users\Admin\AppData\Local\Temp\cd8928c6-f5ac-46a4-a524-3fd9035b25c3.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1708_1066202920\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_1089909038\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_1355638439\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_1874831277\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1708_618919858\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5564-6-0x00007FFDCB9F0000-0x00007FFDCB9F2000-memory.dmp

Download

memory/5564-0-0x00007FFDCE3F0000-0x00007FFDCE3F2000-memory.dmp

Download

memory/5564-1-0x00007FFDCE400000-0x00007FFDCE402000-memory.dmp

Download

memory/5564-2-0x000000014007E000-0x0000000142589000-memory.dmp

Download

memory/5564-3-0x00007FFDCE410000-0x00007FFDCE412000-memory.dmp

Download

memory/5564-4-0x00007FFDCC1D0000-0x00007FFDCC1D2000-memory.dmp

Download

memory/5564-5-0x00007FFDCC1E0000-0x00007FFDCC1E2000-memory.dmp

Download

memory/5564-7-0x00007FFDCBA00000-0x00007FFDCBA02000-memory.dmp

Download

memory/5564-25-0x0000000140000000-0x0000000143D35000-memory.dmp

Download

memory/5564-50-0x000000014007E000-0x0000000142589000-memory.dmp

Download

memory/5564-12-0x0000000140000000-0x0000000143D35000-memory.dmp

Download