01c644aa76c644e78f559f2b4b8d1580c2334d821c79e0de222da56d5a96ecaa

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
Size 16.3MB
Sample261006-2sbplsxt6j
SHA256 01c644aa76c644e78f559f2b4b8d1580c2334d821c79e0de222da56d5a96ecaa
MD5 678f497b3a7b75103593d696a8e2c7db
SHA1 1829b60eea6a98c66d85889e82e740a235735a3b
SHA512 278f6b590cb558f6a390b2037725ed89b702202300d45db538d16d7284b702fea0c4ae0ba78c01687c18b2ba58136a42056540a77cfa0bd325bfa06d025d8767
SSDEEP 49152:x3jgtGW5dyrPVOrnFGrluruKAPUevnZtDOIlHtLVLrsZRJw3IwI8qSbJcGQ5nIIx:6dyDXP9NIkA5kj2
TLSH
T19807D5037348419CD867E370C4B16E6522B03D9E8A347BBB9EE46EA45F163957FA9F00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1748	msedge.exe
4328	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{49EB63BF-54CC-4D8C-8715-ED6A37B2C767}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
4824	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
Token: SeDebugPrivilege	5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5500 wrote to memory of 3036	5500	2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe	89
PID 3036 wrote to memory of 4400	3036	msedge.exe	90
PID 3036 wrote to memory of 4660	3036	msedge.exe	91
PID 3036 wrote to memory of 4328	3036	msedge.exe	92
PID 3036 wrote to memory of 4660	3036	msedge.exe	91
PID 3036 wrote to memory of 4660	3036	msedge.exe	91
PID 3036 wrote to memory of 5396	3036	msedge.exe	93
PID 3036 wrote to memory of 5396	3036	msedge.exe	93
PID 3036 wrote to memory of 1736	3036	msedge.exe	95
PID 3036 wrote to memory of 1736	3036	msedge.exe	95
PID 3036 wrote to memory of 1736	3036	msedge.exe	95
PID 3036 wrote to memory of 4252	3036	msedge.exe	96
PID 3036 wrote to memory of 4252	3036	msedge.exe	96
PID 3036 wrote to memory of 4252	3036	msedge.exe	96
PID 3036 wrote to memory of 2824	3036	msedge.exe	97
PID 3036 wrote to memory of 4880	3036	msedge.exe	98
PID 3036 wrote to memory of 2824	3036	msedge.exe	97
PID 3036 wrote to memory of 2824	3036	msedge.exe	97
PID 3036 wrote to memory of 4880	3036	msedge.exe	98
PID 3036 wrote to memory of 4880	3036	msedge.exe	98
PID 3036 wrote to memory of 5084	3036	msedge.exe	100
PID 3036 wrote to memory of 6088	3036	msedge.exe	99
PID 3036 wrote to memory of 5084	3036	msedge.exe	100
PID 3036 wrote to memory of 6088	3036	msedge.exe	99
PID 3036 wrote to memory of 4540	3036	msedge.exe	102
PID 4824 wrote to memory of 3620	4824	msedge.exe	105
PID 4824 wrote to memory of 4116	4824	msedge.exe	106
PID 4824 wrote to memory of 1748	4824	msedge.exe	107
PID 4824 wrote to memory of 4116	4824	msedge.exe	106
PID 4824 wrote to memory of 4116	4824	msedge.exe	106
PID 4824 wrote to memory of 3560	4824	msedge.exe	109
PID 4824 wrote to memory of 3560	4824	msedge.exe	109
PID 4824 wrote to memory of 3448	4824	msedge.exe	110
PID 4824 wrote to memory of 3448	4824	msedge.exe	110
PID 4824 wrote to memory of 3448	4824	msedge.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_678f497b3a7b75103593d696a8e2c7db_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --disable-logging --log-level=3 --noerrdialogs about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff88f7ac188,0x7ff88f7ac194,0x7ff88f7ac1a0
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,8767858501704868524,12978411783151964131,262144 --field-trial-handle=2416,i,7075746177080108931,11750943348710253345,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2412 /prefetch:2
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,1696824801735396857,15209910547732840410,524288 --field-trial-handle=2416,i,7075746177080108931,11750943348710253345,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2456 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,14778564917484379113,336722074542166709,524288 --field-trial-handle=2416,i,7075746177080108931,11750943348710253345,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3048 /prefetch:13
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3720,i,6397464740102009285,2627183785769080350,2097152 --field-trial-handle=2416,i,7075746177080108931,11750943348710253345,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3704 /prefetch:1
    3⤵
    PID:1736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3744,i,2995521010507552040,14528538974494249505,2097152 --field-trial-handle=2416,i,7075746177080108931,11750943348710253345,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3848 /prefetch:1
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,6548823482559194836,15268225140483692903,2097152 --field-trial-handle=2416,i,7075746177080108931,11750943348710253345,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4520 /prefetch:1
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,6076341015515729602,7376157484024240126,2097152 --field-trial-handle=2416,i,7075746177080108931,11750943348710253345,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4524 /prefetch:9
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,11599454292477976922,13103225804704451620,524288 --field-trial-handle=2416,i,7075746177080108931,11750943348710253345,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3888 /prefetch:14
    3⤵
    PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,15926572247124660363,17575966629761541602,524288 --field-trial-handle=2416,i,7075746177080108931,11750943348710253345,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3796 /prefetch:14
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,16686320113389204651,5143691621615426876,524288 --field-trial-handle=2416,i,7075746177080108931,11750943348710253345,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,16686320113389204651,5143691621615426876,524288 --field-trial-handle=2416,i,7075746177080108931,11750943348710253345,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x234,0x7ff88f7ac188,0x7ff88f7ac194,0x7ff88f7ac1a0
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,14825516632185575710,8029531010834487658,262144 --field-trial-handle=2324,i,17620260864520508897,1356796750758659973,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,9186427733771335599,607536076978469496,524288 --field-trial-handle=2324,i,17620260864520508897,1356796750758659973,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,12488286565471089821,18249569399907235542,524288 --field-trial-handle=2324,i,17620260864520508897,1356796750758659973,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,12668712719206837894,2549203713831926226,2097152 --field-trial-handle=2324,i,17620260864520508897,1356796750758659973,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:9
  2⤵
  PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

32b1e4ab-43cc-45aa-a957-e396581fd249.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\32b1e4ab-43cc-45aa-a957-e396581fd249.tmp
Size 37KB
SHA256 54ec1859124a632127abac7eae58e8dc86dbbbf0c6749b01dcebbc7863cf8b8e
MD5 f6b3a9d75e4eca6fcccf1690757b428d
SHA1 35676d1922699e0a5afcab9596f3e2680bed95f8
SHA512 4dfa8c412f7248b7295d8977051ba6309efddf4a9bc2fb4ebaa7f8da29c41d80fb24df356bfdc739fb41e625dc98174ef9dd47422f83395c430643f949713983
SSDEEP 768:X/UxvxjgC+H3V0EOEA/9OA9at01j0iq00+Ia2/SHxRz:KZj3+H3VbCHq00NasSTz
TLSH
T18E03C031ECA19D739CF7B384730A63979FF44663C6C96AA049ED2A0D05876AD1307CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87869419e8d38a3223b3734ce44a8a263d00885bd826fa56643a2fa3cee935ed
MD5 754acc48a289fb6dc6c30aeff2540697
SHA1 363e6b060f553f69dbf3945204b5d4145ab1660d
SHA512 0d8f4ad46fea8d2fca37d83f0b8b02d269a9122226985a8cc545bd44d821ec89b30a1124e99059df1932a813c711002813b29524a2a6a4cbf5eb7d1dc92d763c
TLSH
T1EFD0803665795FE7F064517D42B011507D95F987EF4602C417115C164E701857451AC5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bd6f052adf82ae27c0cb23aaa153f721aeaa80150cb878fc9e0b89c67a9c5907
MD5 bdbc708e5bcff23d39606b55516b88c9
SHA1 3da894fc053c64b2a8da8db58495d5325603190f
SHA512 571fbb01ac90c6e34d048f503bbc569fb435e76ef21035f4e81c2495daf6f08deaac8af4f880a6141ac2baab205a7ab89494e736848c7629f4ff34e3ce515418
TLSH
T18BD02B3671584D13E0905274007011713882F405DF0601C013224816099024831101C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

0c842f94-112e-4986-a365-e822caacfaff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c842f94-112e-4986-a365-e822caacfaff.tmp
Size 10KB
SHA256 6a4bba7f4d5a43c2d48a90c585642af688de9af927c2c33d6b24eed1b5b5665f
MD5 18b504e0e40030e3dfbe4d686be11adb
SHA1 c1a57248f6eba1257cc28758ecf3bd5728c7335f
SHA512 0c2f804e839060e511ec09db3e30a78b266c95f942206c8cd77fd317f045688193c63cd6dd4f2e59396944db4b59abcff9ab0599a732b0333091f97224ae740f
SSDEEP 192:sxRIr5ssHEzoV8pi/g6+WNIYoiTqukwIgEJ:sxRIlssHOi/5ICkMI
TLSH
T1AC227215AE68A97B8CCBD219FB66BF53D2FD503261951B08E6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23744433-2044-4f2e-9cf6-cb3e410d0eb0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23744433-2044-4f2e-9cf6-cb3e410d0eb0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4088b965-90c6-4107-bc87-78f49e2d4cff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4088b965-90c6-4107-bc87-78f49e2d4cff.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6f04d849-78bb-4fdf-84e3-f3dce8a2b758.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f04d849-78bb-4fdf-84e3-f3dce8a2b758.tmp
Size 27KB
SHA256 8937b3b3a654bbfb4870755f5987d2c438062fd7c5242a2e9241b659f49734bd
MD5 246754889e92948b7b2c4dc64a9e5f38
SHA1 750dc6dc19aae7a1a18f850c17e01a65002d217c
SHA512 878125eff676532965ed5a08d2f9bd40250b71cc89b1c094c5df745183d74858086d172ffc95faf56f0543ab0d330a91a02520f857c3baa37bce1d145376a935
SSDEEP 768:p/wWhO7pLuLbOnWg/Xf1p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtH3mPro47j/:p/wWhOEbOnWg/Xf1pu1jaIXmc47j/
TLSH
T172C2E93B740CCA7F4F904ADDDC197F9B6DA802CB5698CD8047FA985C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 623ddd166d9b10497a8187bcd1d54d0417ab8c8b7ff3ef6941c0ae51ea8aeec1
MD5 b6f007d76d3ba9210f9d71bfdec97b84
SHA1 12b08fe6572d6e3f6ec5a3b7364304155be6f124
SHA512 190cd337752de7dd92882814ee3787d08a8fb4aae6a43313a0ae92c421b65f956b62305a53f4b406cf559a0b883a1fbafcbbc2c5ee175a6d3e113c8f73e32b51
SSDEEP 384:ErdI/oT2eQer03MYkk9W9kNTEWEPFK/UwF7EdS926:lALA8lyiUh7EA
TLSH
T1ED13F97E760D2D42E6D6A03EB88B4B762339C575CEC86E9763B9FA45D3B43210D4E240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 685605ba48535e279eeb6b74684a0b414143827dde081a90d70f01b337d9b0d2
MD5 48c0a558ea8588b39e03307338d17e15
SHA1 38037d036dfe93df810182473a338a56c2fd3309
SHA512 5fd07bb4a69d72d378369dd3d13ea480e8ac00236eeb525df5b4b37de9294f4e1bc3932334eb500ff79214489ec096382b6e40303fa25663ce82ffba2e27caff
SSDEEP 1536:p5xL/ShL/77wr0BWaTMPUXDoxdyUUWUBGaZlSItEFiL/rNuL/XL/:prL/2L/gBymyUUWyZEFiL/RuL/XL/
TLSH
T1FB442CF70951A01ACBA852F5E2033E3DD177052DBCE1FCE9E1788CC16825B21B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 248d4e726b75106ecaf12a83c0c28c6f666bb0e192efd5d6ddefb51af7425c54
MD5 dac956a17e0333c5d38bf750db2fe433
SHA1 c40f16c61a1644c2313fa2ae4e8ff42bb5d20491
SHA512 d0561ed3d609ee3afe0dec6094faa5ad4340a531a1783b1ea5c9e2a13b370f950b3c35dd53e1cc46d5c11b311f311059cf981e09debcf6a628e68f804f441bfd
SSDEEP 24576:5goSqBuhLIvqUd2yzGvyHbKDDr1Qm+mmOEOFNmg:2oXVFTmf1QmYHoNJ
TLSH
T1A8866CEDCA7858C3DD639A30B4F0ED477CB413C3F965C1D28898C584026B7C5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bb3aa0bc51ac7ac32fa0b550621cc9bc3e9d1b0348f3eeaab121772076ecd437
MD5 d9870c3905c67f553468f6a36befdb2b
SHA1 33c9a2923dfa4e9b11c43281992891b6dc7067d5
SHA512 d5392260e66296a26060e39c8a9e5a7098be0469995034be834ab8b9e110fde4743854e2e9de95f2429c2965dff44be913511d2f845cc6f6c5cc6407cd0924b2
TLSH
T198711C4EA759C059E7AC4938FAD0108B3B3083B2AC8F1E22179BDA75F476BD84AD0C55
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DIPS
Size 36KB
SHA256 5222f6b49ff8536b915d3216d9e78a6cb3d4dbdeb2f5e1c7e1ed43a0f4f1927f
MD5 2f78f08c9c0f31af278af5caa18a0ed6
SHA1 16a4fcdbcc9b897456e3fc509b1c4cc9e3424aa8
SHA512 530cf99bf8a6ac9295a3bef4a32b58cc317bb8dc4ea657985a147969842c62b1ce3a6914561f238d49604029d16741127eda08c568fc71bbf7f059e233886b9e
SSDEEP 48:TLQq3qhmJPG44pv3tY8uaLNW9WhmcU1wB:FEmJPG4K3tLuaLNW9Whme
TLSH
T181F20347CF793C61E9CB867689C189E60F7D4358DB5B2D7858B804615DC154980BF0FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DIPS-wal
Size 20KB
SHA256 bd329e7e18a87077bb7c63ae74be30e7d583bac2673ae833d3fc84fb6372e796
MD5 75de0bccfdb30973e97daf147ac6c6cc
SHA1 a93bbdc868c0f1e72ee9eeea17b37e805f141e32
SHA512 c5c313691e2410253466a58bee967bfe02551277c5a2d2fcd719310663cb4ae5833cae73c56870255afc03b30c3f24acc951887570c831de8b8b7751b79d80d7
SSDEEP 48:ILQq3qhmJPG44pv3tY8uaLNW9WhmcUC2g2M:SEmJPG4K3tLuaLNW9WhmuJL
TLSH
T109923546CE683C61E5CA83B749D04AE60E7DC754971B5D6C54B814215EC2B49807B8FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7cc0b54a-c4ff-4f9b-9b5e-9cb24a01f640.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7cc0b54a-c4ff-4f9b-9b5e-9cb24a01f640.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 87893c3f948ef423d2058a289a24d7358f98cee2c2ad13fb8c1ee9b96f38eae0
MD5 dc2cce2d045547e4cf8fae777d617ed4
SHA1 b2bfcc1365f052dd6821e83b206300f31c9524e5
SHA512 7cbb670194b2fe845c1cc0f977adb9d3c6b459ed652dac74b334b090fd0cbfdbeb09746c13b03053ae26361c688402107c3a81c58034680aa53fdb2d18345298
TLSH
T102E0D8E494D7C31D651874C31124AB48D39034D3E7826F4F1704C9C5BA0B141B29166A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 319B
SHA256 ba631e4ca0f4f88bdb0cc35b7b00a0f9ee29e286274bf47dc8a60f50b1f84f08
MD5 642e32c020fd0aa3f7da76e0f35d5466
SHA1 16edb67815b21f87fcc442fe8ee3c4ce5e3e9379
SHA512 0da8b2d59d5adbb0a2459a9d2ef786272a110466523cf7a922b95e0195db296dedb017cc115e6e1845da0cc03778d7845cd9a23e4cde273e9c4dbbb88d3c24c3
TLSH
T1F7E026A454CBC32E62197487F2A4AB08E390385BE7803E0A1B0CC845B002284F2F63A6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log
Size 304B
SHA256 1f844da045ae4e4e56937a272b1c4679f12badfc99e892895bf61bcaea111fc6
MD5 e31621408f289cd9771b4a7bee72f0e6
SHA1 730336e9c21b7f4f753b1fd9c4cafb9d868be5e9
SHA512 a0fe5b23623294e52f151bac2e1d57ecdcaaad55297289ddf3657329e75744e6776ddf4421e5d7e89f899f72465181a9e33dd8e0ac64671678ab6126344a1f60
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 323B
SHA256 cfad0879b6b913b57f5046439027c27e7944c77154b5ad9dd7330e9151e1508c
MD5 497a80b512523d5ab8953c5e1448000c
SHA1 998443269628f02740b52cf7203c006dcd83cc5b
SHA512 8119ec2bfe750513953d96e811303c0f007d9dace6d0b34fefb553e146db8b891494dedf214e14a4e174ef52d343512742437730d4505f39ce1a3ccaa6ab389f
TLSH
T161E026A848CEC36D60587887D278AB0CA3D03467AB80BE0E170CCC44B046380F6F23E6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 2eaf9b892381e9cf522c189795e3593902805c3168e56697b5d5cd20450215d9
MD5 79eb3676389030e4a75da11b6010190c
SHA1 cfef84c5696d91c5e322667d593e1aa9ff5dd389
SHA512 4cd8863fb1ed24fbd008aa4c93cc6243f62457d3082f70ed43a2f5bbff3fc79bbb5c079a16e3c86aa6d4331dcb9e9cbbfdd9257aea2dfa8b7553246df08ab2f4
TLSH
T112E026A415EEC32DA018A8D382B8670CA7D034A3A3803E0A574CDC64B102781A3E66AA
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 0a60c8429eb647d77253bf95c0da13bfe7335f481caf3c7284020589d0d2e31c
MD5 da0f3edc582152947d8b2820e6a9dc5b
SHA1 d03d567df260249fbb54549fd1eb6fcc3ab8bfd4
SHA512 0697dddbcd6f65f28fd868ba673541750b34b689e8cac7bf18abbe0e225f3e8aa445db71b5e1b1401a6ed1da959b9e4884ab319f69b86c9269aca9c66c2b9281
TLSH
T10EE0D8F044DEC32D6268205B12187B08F7A03457F7853F891F48D949F407144E6D11F7
MD5 SHA1 SHA512 TLSH

Submit Download

8be7759a-026d-4f1d-8d41-8649617e3a01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8be7759a-026d-4f1d-8d41-8649617e3a01.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 1e3919aba5b8402b4d86aaad200e72b785d6e39424719de8fcdd1283bcd9f833
MD5 ab70480481196373f9fd1c204b440d79
SHA1 8f6bc794a901948ad5556f5936f8edc8c1a8b2f6
SHA512 b7f2029ad56880fd6d1f358b0fcb101f1dbc13c8321b7e2843b99814349791fff93cbb0cd5209585e65edc0b0869f2351c2b6bef711c2cf20586617477c74527
TLSH
T177C0221980BCF4322027087A4EC068C1A636E0382002C0E1C99683BC70C10FB6F8202B
MD5 SHA1 SHA512 TLSH

Submit Download

b3ba2a14-f870-4ee6-8063-0447d1fa8a70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b3ba2a14-f870-4ee6-8063-0447d1fa8a70.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 13bc6c3a42afa08f4bb36c6d11f57b9e1d324cad0faa323df53d26fddb188775
MD5 3a881d522191375d7df68242f96b66d1
SHA1 e335ba5ec9fa58efe27a37c8102994ce7629996c
SHA512 35215a6c8930af6f2880a2b6644479efb30327913acae8fc7924aafe97d3b0fff4d7dcfaa11bb20188a3b983aa92223373a10e6e58598d587dffd21ec4daa925
TLSH
T11CE0DFA005CAC37E711B248702259B08F3A87467E3C83E0E2F88CA44A547784B1F61A2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 678B
SHA256 bcdd1d15f69f05f0cee74d165871f0fed5d502982fac1c1c19d8cb2fa557005e
MD5 f116f76ba7c56d090dbeb3a5f2f75816
SHA1 cb7514caf4fa4a9b006d8c068227d155fdefea08
SHA512 e24cc7a3764a0ce331ef53485621f275313dd023c37c47ac46a2d44e1f20331cd273a821df4bc6d786c58f856b77b9da337bd07ccbebbc4061299cc3c21d961c
TLSH
T10101D1EF0A08A44ADD5EC2B4088277A0A3738ADC0ACA8DC3974D218B3406B327815C57
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 316B
SHA256 52272d15146fc8a2d80cc72c249d2d55000fe2fd347cec7e285f9f55b6fc959f
MD5 34b7fa94faa28d155f142c38c31d0cfd
SHA1 309df8de3226033d302af3d83180ebdafdfcf553
SHA512 f287d30cb599ecefe47281bbbd6b89b0d1c5e67c963d3c652ccee5b2308e6406b4d98622e39dd901f028c6f68f818dfd440770de804308e1960b8c65d0a0b70c
TLSH
T101E026B844CAC32D7258645B12246B4CB3E13453E3842E4A170CD984B606281F3E25F7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 31103c87b52ef373cada1eee8b2aa44545baac261b5ee9a7bcd2ec77906dbddd
MD5 5e1912f41272c7368a04bf96aec50fdf
SHA1 30c5b158cb4ba2fb7f38456ca20ec94358ed767a
SHA512 b62d25106450667a43b882586a05c5e55e5a4f1bc76cf095f196bdb8bf66d3317e6dbaf0e08470c5d7e67944795c41c87c716d13e794c511d1003686119acef3
TLSH
T172E0D87015DAC72F714920875236F708E7A27463DBD92E292B0CD544B64B280B6B3166
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 e08934faae7b447ef02b334549b410a67991eeb03509b0b66572bcf4943acdac
MD5 68665b34f6bca4f6774c547fe27e55ac
SHA1 6239c85a878039c4c5024303ed191bcdd9533a9b
SHA512 f8f093f785e15c3d6f8d9e23e2ec6e7410f64672e7611c8370500bd49886cad1cbf2db0117a6bfd485e307a440c59f30347126f6204335b9ef440c8346344cb5
TLSH
T12FE0DFF045CAC33D6108608302B4AB0DA3A1786793823E0A570CE448B606280B2B66E2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d810bd514315a6753a06cf037aa84f12394c2de0e041cf45a6bc1b7806c51478
MD5 a581461bea2500469797d1fe54a1b5f8
SHA1 aa43398475941dccf1594d931b106797ae133ac6
SHA512 5ad85d34a05182879bf878e69cd15ff6e5889e3a1e8f7a025f33e77a4d9980635948d32cca40509a5f1ff330d1c05ed399e95bd954a4dcb2c4eef9780da1e3b5
SSDEEP 24:KQe52gsIBKyho1KSLcUSyXBitSEgIVK2h81eS/oJyXcLPmRI+N9hBx81BisIT9xP:KwXIBKEoMpyVLIVKg8wny5YIHKJ+sK
TLSH
T1DF913224317B8341393E3A2840A89D17899171E33059EEBF77AD45DA8D2BE049EFD4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 af55d69756302681cedd841ca51e5924af20179ca442f3bafd69255085023e34
MD5 8011b269e16011015c8b4ee48ffef7c1
SHA1 1de9cff9332715ee75a0165dcbd5af68940124ab
SHA512 266927fff430f80212482c5c07dbe2860e2eb36cae1145fae38cc9658d7e6f6d64b43bebe40e8e5b0e6b5594451015342b2a0e58cbfe0ffe562add8ff326a457
SSDEEP 48:KwXIBKEoMpyVLIVKg8wny5YIHKJ+sVRIZKJ:KwXaKEog2LeKg8KqYIKJ+mROKJ
TLSH
T1C3A12324317B8341393E3A2854A89D17869231E33059EEBF779D45DA8D2BF049EFD4CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 99b45c0e9019884b44853d0b047c6dd4304471e996c5658ba39d0ac5ad9e2c64
MD5 d66fb76c347171149f1f2035e41e9e96
SHA1 61be9e65bac5cbf61fcd843bdd12af84f9d212bf
SHA512 357bbb7944752e1bb52c2e9efe8eb5425ac5a4772108926074093f999bfa8278ef8dad2dcd18058b7924dc42e32b19a9b999054cf675fbbbd1d3f15f6713f676
SSDEEP 24:LL0OGxhK3thdkSI5QjUsEGcGBXp22iSBgm+xGt:zEK3tjkSI5IUltGhp22iSBgm+xW
TLSH
T1A452579BEE743212DCEA83319AD001E17E7A903D8FC1EB0255D610115FB5691A71E59E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 337B
SHA256 aafd8f216eab9d360f5459d8bf631ee2d9838ba3a80c8bee4a4c20597ff9735e
MD5 b86036adff446eb44d1456770e030cc3
SHA1 f17f2a92be09fe3fc07d4110f54042907cd76c38
SHA512 9b8a302d0182ad29f67ec2d1fbcc16b61eefd849997625a953f957e694ca60eb0d4323390413f9d3be45150db0f4982f5eabf321d8a46017d6f069c05a443875
TLSH
T148E0D884134BA242B64C9B60412C3C03E4A81FE3220E4DBA330DCAD88E0DC04AF3DCB7
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 478B
SHA256 b4bb797a1517dc805671031f95b1ceb13fad1cd9f4d1655d8c2d6c14a4548690
MD5 24161612b576b83d2bea40c92611829e
SHA1 ee08f8100f95473c0ac7403bd81c63a304907e75
SHA512 f14abe0e2e9ff99f50b308d17bb9681f04fc067f1a058c80bfd75a290c6bc16e98d5f83afc761a7a99f592df2ba865cfecda04d10a1764128cd62597fc7d291d
TLSH
T1A0F0CADB6E03097BCC02903145336B82FB2189CB4024A8AB438D216A6A6D2F1C9DC0E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 0bd759966a99e5ab4cf0575a11506424b4de762f05faf663b94721064508c7a6
MD5 39c51979f75af50a0b7d74ee74fbbbfd
SHA1 bb26d53fd5c068e9435f6115f73716d264d325c4
SHA512 49cde49c1a41dc725ff93503f284514760ea24d91921bc9545831c2a8ade0ad634e746066e500ce3d75a61bbef817539ca74f36d1d74f9eae7d5d89417c87bfa
TLSH
T149E0D86454D6C31E741C608711A4570CA3A13863EB902F0D1B04C448B5072447795663
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 cdda70b056507615e182f273cc1c2dcc2c072059fc860ee5f11bac087eebcf3b
MD5 e3cced88da7a320e8d9ba16bbf986731
SHA1 78fd1b08c8f37d55051cc913f36447dd704c0989
SHA512 a48bc218f579a5cca796644a59a25f74494caffebaf04143f5d11c8d17818e9c69d3441aea99bd2ba2f28f5be398094713d6c677ebd868bb9f6b952657bd77b1
TLSH
T1B021B156F330C118E14E827E607BAB291738D8468FBCEC0F88B920746E75B480D8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 c778325841242af2c02cfe581e6b208119ece18f80737b1f75d4cfc3fada44e6
MD5 fd39c295579c3da59f609a4efe21a96a
SHA1 296510db3e171718abd843b212bb25b0b0f53e18
SHA512 cf516cd2c8fd2c423180ed75bcac5f1e12903b79575497de863341216cffc8b815c55982eea081213358dcbd9e38b97a81ab441e6b471d180812aa9263fca3f9
TLSH
T1C0E0D86465C6C31F6018208301B4A74CA3963C63EB902F091F0CC948AA07281779A663
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 35e2387e44aebfec45febb40ddaeffbe153f0e8f1e54726b7161c41d610affea
MD5 d5f936842c731246980a51d92bedaae6
SHA1 c8a78da6774bfead4b9e0e3e565bd83f948b5924
SHA512 6d71ed4fb66b6059ebb3c0a34dd061f47cfa85af22c498fd643dfacbe8373d477d7fd09d99d2e7ece445bed700a2ad0d5cd1aa3ffafce358a4acec68c47a3a7b
SSDEEP 768:X/UxvxjgC+H30fEOE+36C/9OA9at01j0iq00+IaXASHxRz:KZj3+H30ZICHq00NaQSTz
TLSH
T17703C031ECA59D739DF6B784730AA38B9FF41663C1C559A489EA290D04837AD1307C77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

af660ddf-c0ee-4f52-84d3-f30d19d592c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\af660ddf-c0ee-4f52-84d3-f30d19d592c2.tmp
Size 39KB
SHA256 479904393e3627198cddfb48c95165090b89fe58b4821906fae4a1c235335ff8
MD5 1dd41c50be81209c7a8a261f91fc2d6c
SHA1 ef571f0b7a99f06d56b85c1cc6bd2faa7c1a7647
SHA512 b5f3f2d2b30c68055fb1bf1c6fdd502269f808fa4e469764e2adcf6a6b0f5cb83363a79d58260e456f144a0ed2fd56ee5f27d096e185363caa9411f5cf44c8a7
SSDEEP 768:7/UxvxjgC+H3ecSOE+36dQ/9OA9at01j0iq00+IaEVSHu8:uZj3+H3eYA5CHq00NaoSO8
TLSH
T16803CF30ECA59DB39DF6B784730A63879FF41663C1C919A489EA2A0D04877AD1307CB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5500-269-0x0000000140000000-0x000000014006F000-memory.dmp

Download

memory/5500-258-0x0000000140000000-0x000000014006F000-memory.dmp

Download

memory/5500-5-0x0000000140000000-0x000000014006F000-memory.dmp

Download

memory/5500-267-0x0000000140000000-0x000000014006F000-memory.dmp

Download

memory/5500-268-0x0000000140000000-0x000000014006F000-memory.dmp

Download

memory/5500-0-0x0000000140000000-0x000000014006F000-memory.dmp

Download

memory/5500-10-0x0000000140000000-0x000000014006F000-memory.dmp

Download

memory/5500-266-0x0000000140000000-0x000000014006F000-memory.dmp

Download

memory/5500-1-0x0000000140000000-0x000000014006F000-memory.dmp

Download

memory/5500-4-0x0000000140000000-0x000000014006F000-memory.dmp

Download

memory/5500-7-0x0000000140000000-0x000000014006F000-memory.dmp

Download