hxxp://mailto[:]spamproc-p04@us[.]fbl[.]en25[.]com/?subject=ListUnsub_1260946616_7fe2fa5ffc5143a8b5d5755c85d71e84

Analysis

user interaction
yes
max time kernel
33s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mailto:[email protected]/?subject=ListUnsub_1260946616_7fe2fa5ffc5143a8b5d5755c85d71e84
Sample261026-rtjfqsts9p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4696	msedge.exe
5408	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{69714635-206A-4F4A-A715-0CE97963D6F5}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{5DE606E6-A5DE-4D68-9CAC-B65A360AC131}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4572	4756	msedge.exe	84
PID 4756 wrote to memory of 5408	4756	msedge.exe	85
PID 4756 wrote to memory of 6064	4756	msedge.exe	86
PID 4756 wrote to memory of 6064	4756	msedge.exe	86
PID 4756 wrote to memory of 6064	4756	msedge.exe	86
PID 4756 wrote to memory of 4156	4756	msedge.exe	87
PID 4756 wrote to memory of 4156	4756	msedge.exe	87
PID 4756 wrote to memory of 5064	4756	msedge.exe	88
PID 4756 wrote to memory of 5568	4756	msedge.exe	89
PID 4756 wrote to memory of 5064	4756	msedge.exe	88
PID 4756 wrote to memory of 5064	4756	msedge.exe	88
PID 4756 wrote to memory of 5568	4756	msedge.exe	89
PID 4756 wrote to memory of 5568	4756	msedge.exe	89
PID 4756 wrote to memory of 5928	4756	msedge.exe	93
PID 4756 wrote to memory of 5928	4756	msedge.exe	93
PID 4756 wrote to memory of 5928	4756	msedge.exe	93
PID 4756 wrote to memory of 3044	4756	msedge.exe	94
PID 4756 wrote to memory of 3044	4756	msedge.exe	94
PID 4756 wrote to memory of 3044	4756	msedge.exe	94
PID 4756 wrote to memory of 3792	4756	msedge.exe	96
PID 4756 wrote to memory of 3388	4756	msedge.exe	95
PID 4756 wrote to memory of 3792	4756	msedge.exe	96
PID 4756 wrote to memory of 3388	4756	msedge.exe	95
PID 4756 wrote to memory of 5276	4756	msedge.exe	100
PID 4756 wrote to memory of 2524	4756	msedge.exe	107
PID 4756 wrote to memory of 2524	4756	msedge.exe	107
PID 4756 wrote to memory of 2524	4756	msedge.exe	107
PID 4756 wrote to memory of 4316	4756	msedge.exe	111
PID 4756 wrote to memory of 4316	4756	msedge.exe	111
PID 4756 wrote to memory of 4316	4756	msedge.exe	111
PID 4756 wrote to memory of 1956	4756	msedge.exe	112
PID 1956 wrote to memory of 5280	1956	msedge.exe	113
PID 1956 wrote to memory of 4696	1956	msedge.exe	114
PID 1956 wrote to memory of 116	1956	msedge.exe	115
PID 1956 wrote to memory of 116	1956	msedge.exe	115
PID 1956 wrote to memory of 116	1956	msedge.exe	115
PID 1956 wrote to memory of 2404	1956	msedge.exe	116
PID 1956 wrote to memory of 2404	1956	msedge.exe	116
PID 1956 wrote to memory of 5276	1956	msedge.exe	119
PID 1956 wrote to memory of 2908	1956	msedge.exe	121
PID 1956 wrote to memory of 2908	1956	msedge.exe	121
PID 1956 wrote to memory of 1128	1956	msedge.exe	122
PID 1956 wrote to memory of 1128	1956	msedge.exe	122
PID 1956 wrote to memory of 5744	1956	msedge.exe	123
PID 1956 wrote to memory of 5744	1956	msedge.exe	123
PID 1956 wrote to memory of 1928	1956	msedge.exe	124
PID 1956 wrote to memory of 1928	1956	msedge.exe	124
PID 1956 wrote to memory of 1216	1956	msedge.exe	125
PID 1956 wrote to memory of 1216	1956	msedge.exe	125
PID 1956 wrote to memory of 5436	1956	msedge.exe	126
PID 1956 wrote to memory of 5436	1956	msedge.exe	126
PID 1956 wrote to memory of 2220	1956	msedge.exe	127
PID 1956 wrote to memory of 2220	1956	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mailto:[email protected]/?subject=ListUnsub_1260946616_7fe2fa5ffc5143a8b5d5755c85d71e84
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x294,0x7ffd0e73c188,0x7ffd0e73c194,0x7ffd0e73c1a0
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,15697910390568640664,16313784062954753066,524288 --field-trial-handle=2248,i,4644516842865764349,11126158491394817854,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,10988232570108285875,7362589979281343633,262144 --field-trial-handle=2248,i,4644516842865764349,11126158491394817854,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,14526214254028267675,15190537545009250328,524288 --field-trial-handle=2248,i,4644516842865764349,11126158491394817854,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,5832272067199740673,4332367471447292143,2097152 --field-trial-handle=2248,i,4644516842865764349,11126158491394817854,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,17391419169046538221,1723113023149387306,2097152 --field-trial-handle=2248,i,4644516842865764349,11126158491394817854,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4924,i,9308525930035597397,2665086626058760261,2097152 --field-trial-handle=2248,i,4644516842865764349,11126158491394817854,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3480,i,15102376428000389005,10306952483930016869,2097152 --field-trial-handle=2248,i,4644516842865764349,11126158491394817854,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,2515282685211562548,3521333139843258804,524288 --field-trial-handle=2248,i,4644516842865764349,11126158491394817854,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,12408675320208056558,17993119374797725589,524288 --field-trial-handle=2248,i,4644516842865764349,11126158491394817854,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,3426451170095399957,2042456813166637433,524288 --field-trial-handle=2248,i,4644516842865764349,11126158491394817854,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,3426451170095399957,2042456813166637433,524288 --field-trial-handle=2248,i,4644516842865764349,11126158491394817854,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6120,i,3396434301320458969,1163085465330549203,2097152 --field-trial-handle=2248,i,4644516842865764349,11126158491394817854,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3748,i,562427079007641716,1255200104594244912,2097152 --field-trial-handle=2248,i,4644516842865764349,11126158491394817854,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffd0e73c188,0x7ffd0e73c194,0x7ffd0e73c1a0
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,5529433603186073572,2538374641971090269,524288 --field-trial-handle=2240,i,4317235193915279728,6880278654391186807,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,3925811765085752825,9146526065590902836,262144 --field-trial-handle=2240,i,4317235193915279728,6880278654391186807,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
    3⤵
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,7436790288624422720,12830489910534435299,524288 --field-trial-handle=2240,i,4317235193915279728,6880278654391186807,262144 --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:8
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,15039632600688190588,10764192793684374708,524288 --field-trial-handle=2240,i,4317235193915279728,6880278654391186807,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
    3⤵
    PID:1780
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,15039632600688190588,10764192793684374708,524288 --field-trial-handle=2240,i,4317235193915279728,6880278654391186807,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4004,i,5363294671016075758,10906729120878351353,524288 --field-trial-handle=2240,i,4317235193915279728,6880278654391186807,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
    3⤵
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,18302762463643135583,18161849249634075521,524288 --field-trial-handle=2240,i,4317235193915279728,6880278654391186807,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,7387549400777793027,5402956284079956643,524288 --field-trial-handle=2240,i,4317235193915279728,6880278654391186807,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,15273359134363214160,13254905648487543556,524288 --field-trial-handle=2240,i,4317235193915279728,6880278654391186807,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,3839248370177341297,3298920887417574644,524288 --field-trial-handle=2240,i,4317235193915279728,6880278654391186807,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,4759035581401058950,968199480570834517,524288 --field-trial-handle=2240,i,4317235193915279728,6880278654391186807,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,2232253203122423889,5438849653664002142,524288 --field-trial-handle=2240,i,4317235193915279728,6880278654391186807,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
    3⤵
    PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

588d976e-d0f2-4a88-b86c-d6df96929b5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\588d976e-d0f2-4a88-b86c-d6df96929b5f.tmp
Size 30KB
SHA256 914e3018983186b8994a326fa4b780d1cfd9357d3f80b5aa2af27ce0ce1dcfc9
MD5 0061c054694a5e38d20e54c518727ffc
SHA1 c76de45a322f46a761168ddbc3802ef5a84ac94f
SHA512 ce1e9e4243e83731714a3529e107bf2aacd1a43c2e38f3377afcbcdcac627d003b2b7ff2974d190a6d06b6cc602454dd0a66c5f92f014adac7d1d8acde44c48b
SSDEEP 384:nqiFuQkUSviisNl8TUNTUlI4Z5mgiAMqK2fMBVvrWfs6TvXA84lozMKwIr+l2IXL:hFelswgRFTBVSk87wKwIr+l5fLP
TLSH
T148E20675D899DDFB98EACAD5A60AB502ADE00133C59C4A8CD6F97D3C208F1FD0347856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b9d1de3-63f5-40eb-bade-9ecc45946950.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6b9d1de3-63f5-40eb-bade-9ecc45946950.tmp
Size 26KB
SHA256 f66a84b991f954f895f24b7cbf5f0a06681233e2bb6a6e6874f6edb7360ccba8
MD5 7a287cd5cc8ef0064b788ce0ad4ac0be
SHA1 3bcbf7bcaafa8c771a6c262412abc7be86268654
SHA512 d8929b4d1bdb7d97f0a42127db8d7ae54ac73bcdae2dfd2490ebf85c421d3bec20bc2f76c36d0d4e8ea319000f9cf789cdc79bb0f61c47fdec4427836014ead1
SSDEEP 384:nniFiZcI63sNx8TUNTUlIm25mg91rK2fMBVvrWfsL0Msa+VYWzgL/7Iz/oB:iFQ638wgSYEBVDrhgLK
TLSH
T19DC23A32E898D9BBECEB8BE5B74A7A03DEF05163858C9AC4D5DD5D5D008B19D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72ba431d-84e6-4ad6-8991-e30681aa40e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\72ba431d-84e6-4ad6-8991-e30681aa40e6.tmp
Size 26KB
SHA256 eccdf25caf8f52911d27b1102fa72663b6d730b63a3af034e44696da5db0c954
MD5 cf94c4d7d3ae896e83c3d70770c60269
SHA1 d022aac3c9248b1f9f06f4af481ed4d529f0809a
SHA512 c8ee84fabde130fceea1f220a6eeb209c43a7a39257178479389ab573eba0ac17c0c2e09a5d60db2c08dc1f8aed8f0d111e582d453b6dc558acefdf45c5209fc
SSDEEP 384:nqiFzQkUSvUw3sNl8TUNTUlI4Z5mgiWqK2fMBVvrWfs60M2IXwgL/7Iz0IIlx:hFdJ3swgRATBVSr5fLP
TLSH
T183C23936D898DABBEDEB8AA5B34A3A03DEE05153C59C8AD4DACD1D1C00C71DE134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 28b62a3db7a5d2dc7d0616b81259ec388417e0c112ade2395c9934bffeca26c6
MD5 e41e3ae3661d9f8a37283ddbc07dd67d
SHA1 bbe9d4921f3283582d624215ab8cd50831de7e40
SHA512 f5639aa82cfcdd064e05545bb0809d1eaaed3d06bbd7545f75d6c8b57af8446fd7d30e46bcd87c8e74f4062ec8265eb16a2b26492761e618166d8a61c75f2bbf
TLSH
T157D080157D573EFDD6AE7176155C9580B540CF634717155007170D184D5029258D4ED9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 204cee7e98049e1bbb0de1ac996e4f959e4712a4654a218b3aa0a24faf7d77bc
MD5 50db28f1814446e9718bf5ab8173c3fa
SHA1 a45a5c9e5bd00ad80333c8574b9a4454aea44b74
SHA512 051fa80aa07f8cee19ca89ece4987033bd10badb6f6057b1ee863e8040901cc6dc281a0182ff7bacc12cbf5d8ff973a16681d2564fde4ea434faaa0b6d6d90e8
TLSH
T1AFD08029769B3D1DDF8F6173364896C0F500CF574607597016170E14494037559945E9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1bee9600bd5a33bc8f0668c55e5de638af2900d2c5b64b0b6a076944d9d64cb1
MD5 dccd83af196089fa1701326df524d8f0
SHA1 13f464d146d477458e5cbfb269a644033ae23e4a
SHA512 3c03334f587184595882b502100116cbc4a277280eff870b6b7fa3504e1b35e2d10391e179ea984fedd6d9e4c2b85b75e89e8dc8d55fe7529b3a34a2442689b8
TLSH
T1F2D0802576973E1DDF8F6173364896C0F500CF574607597016170E14594037559945E9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

00098968-142f-41b2-a668-4f79f840c037.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00098968-142f-41b2-a668-4f79f840c037.tmp
Size 12KB
SHA256 d1688a4220b87e4f3ec050900b01a3a044f44fca5b7d055a8ef76ce4510b11a2
MD5 c51cbb7ecbaae9029ee21c384b472a52
SHA1 103f3e0ac21d40e9579fe5a157a7acc680e21627
SHA512 60d28ddd6925fe06cc581dd0aea2bbbe88d0badad3b0175fccf457a28877f6a80154bd30f8438ddfecffce5728358cad2eb74a9037152859a6902943039b5912
SSDEEP 192:sxZNRrkm/fSsfQZZ6Bzodp5hHZ96+WND4w/YbIRa0YKxIg5nxJ:sxZN+m/fSsfOZ6qfH8v/FZYG97
TLSH
T15142F9156E28A93B8CC7D21DFA55BF53D3F96132A0C51E44AAFC9A1C15E76CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13d00180-82a1-4605-bf1d-d8529c64c952.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13d00180-82a1-4605-bf1d-d8529c64c952.tmp
Size 13KB
SHA256 694d9f746df7245248f463b41396b91a39edfc089e224c001790ab468d20428c
MD5 17de8ceb8d48f49b77d2d06ef0eb8365
SHA1 35c9356172d43d972dfe20eccf007b7ad7005052
SHA512 0e228f621aaee51ea1b3df37bfe800ca1b8329c9f9f9e75e1bb88a22c2ede203a2af5a3351dac61698dab2fdd009c60a01273061396e0c41b77085171e08a47e
SSDEEP 384:sxZNpJhm/fSswWv442CqfH8v/J4YCJnsb7:s1lm/fuY4IoH83J4G
TLSH
T18452E915AD28A97B8CC7D21DFA557F63D3F92532A0C11E44A6FC8A2C15E76DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29bb3571-eea5-4c0b-bb61-f95e03a95f88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\29bb3571-eea5-4c0b-bb61-f95e03a95f88.tmp
Size 414B
SHA256 681812e4864bd0d695d6090ebc87f14d0d22eea517fe8dae798bcf3aa9067ec6
MD5 52cbcc1728d930c8c102c0b9d4155ad0
SHA1 5f644df20a4a6de5ca8eceb3fc1618ea3f9e84e4
SHA512 6a364a27673a295022a2f795812b2705661c932cd85a700c42c6870abb6f0f9d02f33c3b1ba0a540ff1c3a6242f3fbb4a1cea8f27fbe4669f696e95553231329
TLSH
T180E02BE9C915BC7708FC571890540686EB4113572A81944F773C800D8FB1A37858BC6C
MD5 SHA1 SHA512 TLSH

Submit Download

341785b4-b659-455d-91c9-9a910189a1c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\341785b4-b659-455d-91c9-9a910189a1c9.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

649bc206-44a2-4761-ba45-e093cecc2a13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\649bc206-44a2-4761-ba45-e093cecc2a13.tmp
Size 13KB
SHA256 a78de49d25ad4b36c99c2c7a0b3d9d49db76a739757fe607674523a82ccc91ba
MD5 8ee4a33aab2b822d5117cd230bd1943c
SHA1 b7c1c92ded1017b71939d3bd9f909a7d21fe42d5
SHA512 efd94653b2ff4bcff6f77c58523d7f9d92bf8bd22064650d4fa3d161dd572b12fb0f9dad2c05f9db290e9d6cf5ec450789af7157c843bcdaaee6f89e291d308c
SSDEEP 384:sxZNpJhm/fSsXWvoOZ6qfH8v/J4YCJWb7:s1lm/fpYoNoH83J4c
TLSH
T1BC52E915AD28A93F8CC7D21DFA557F63D3F92032A0951E44AAFC8A2C15E76DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68bf38d3-c635-4f6a-9c1e-40502869ab0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\68bf38d3-c635-4f6a-9c1e-40502869ab0a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 35aac85fd9b628293bcf1354e9e1a9885fb705722d193b23f2cfcec9813a27a3
MD5 6edf55ee02f60c23a4aefaf2076a27ad
SHA1 1e94c04b40f70fe6a6babdd7e397eb8c3e521e5f
SHA512 bcf5fcf2fdfd86215e7a3b065b158249cee06f51a950c20b18ac76f3bcea66d3629064980d8ff7f735ceef16453ae43b382405927f06ace4554db508daf5b4f9
SSDEEP 384:mEUrhA3Ufru5YICqKFZ+393PcUcHDSwyFj0mGo+GlHbIHbE7Km:mEUrp6WIC3nUcUFwy5GOlHbI7Y
TLSH
T10013A2BE73409DA6F3C3193C238B6B7923728932D5E6244F73B6F0595B243829A4E585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 eac9afd0c05b71ec32e7a24c4a75c132992036b778beceec0719a81c351b4efc
MD5 7ae4faea703632e2eec1d11dc53ba1fd
SHA1 8fc1921686ca036906ff38629c5e53d9d449770d
SHA512 17c453518e2834dfe23a9e2394dece5e2938677583e760d7a46000d4989e6d207f07616fb4fa27b4d4a36a6f612b9a719e0d6887691e71ef1cae081d9dcbbcec
SSDEEP 1536:TaSFVmL/+bL/3AXODw21UZDKj/2mL/lL/1L//kS:TZsL/IL/DtKmL/lL/1L/
TLSH
T1E6443EF71951A01BDBA842F5D2033E3ED1B7455E6CD1F8A9E2788C912825F32B6BCE44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 e79325e883380b2eda0dde7c054272ffce52c9e4fe5624e98ab2b654e5c9883f
MD5 16a3b3d2514e8bb493aca60937f005fc
SHA1 e27885f5ebba7af75ac5aec3da105aad29f1e300
SHA512 fe5ef4c713e2d4448eeba1d24eec8f0d7be1b1f559c5ced9386168f002afec1deedb6a7bf4cc85f8009cab67bb671f2ffcfe814a0ad715cd0de5bb61aeff2297
SSDEEP 24576:sswkD6TmIyGsKZeXyHvdRK9MzHdI9Mcx+:VwdTmZTedRRTdIuco
TLSH
T1A4167CEDCA7858C3CD639A30B4F0E9477C7413C3F995D1D68898C184026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c6de0742d79cbeb6ce8527ee3cd0274b2245494cd0df2e7bd86d2f23e6da3495
MD5 d8760b5613aa4e70aa5be34495d0b6e6
SHA1 e7f55330265355eac0eb0ae31436695fe5aa2f66
SHA512 367b4815dca458ace5a117ad8159e9eb8a9814a17a34e2432c8f73528b83f208078d8d3f760820d6958ebc0822f07f7a27115abb6f9254a6deee6e55262c6cf3
TLSH
T156617280C4D04C75FFA8407983DD9E7B37F454A8AC875F4E35B6F9798A0AF80A1440B4
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

2ab37757-a2bd-44b1-9886-877ce19a95c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2ab37757-a2bd-44b1-9886-877ce19a95c5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 a3dd2f7d5cc212015b5737c8053e32434f57d582cc5a9caa18932c1dcc515c55
MD5 f6bc81984f23af3732d12024301404c2
SHA1 0e14de95a91ec367b48477cd458479b8caf885b0
SHA512 6464b6a469524c79e1607ecd490a2a23142391426135fbe7c2face2e5bb59f844dd1e5895f6005d241e8d3c6cf930b8e51de910fe42589afae3b6be81b122c3a
TLSH
T154E0D8D9A9CBC11D69183482422CF788C3C03492D6816D4F1700CDC8B606002F2D6946
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 71dba747c592a5ee9d052c4047c4a3e812b8886a2ed12fe59ee6434ce27b1a52
MD5 7e9cfdff7c900572f928d205039339c7
SHA1 e00bbad6ffa691352aab2da611ec8ec591a7bc48
SHA512 daac53c9bcb04a30c3eaf1a46b06c7252b971b260b26d912dbaf2b17acca4547f9b43cfb1cffb69645bf37bf9298e576a67339872f9fe82e339b4be55c6eb6fb
TLSH
T108E07D8454CEC12DB0DD789B036DF308C7D03493F7803D4E1F09C9C171016A2B2C6680
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 6353e5bd7f31bc3842dafdef3aa72bf594d8bf9cc480bed23ff83be3b9c937ca
MD5 638270f23350841ddac4dcd548a6b2bd
SHA1 9e870bf9461ef1bafc4b98218c0210b932a50adc
SHA512 14454d368e53a8c595171dc082094e4edfd363b4235e8a61d7bd178fcb3694bb815ed1d90dfd50f216e06802c35b0909def1c823615ebd20ce7c3f30e25d95e9
TLSH
T12BE026A158CEC12E761C708B023EB70CC7B03456E7843F8A6B09EE81B1094A4B7C22C6
MD5 SHA1 SHA512 TLSH

Submit Download

38b35708-9d87-4a9e-add5-1a714ce1ff93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\38b35708-9d87-4a9e-add5-1a714ce1ff93.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 e0354e35000f9ebc535977b2491df9dd99ddf817a600061d73665dc60f03cc5f
MD5 d0c9f775fff4f12bd0760f0f92d641ca
SHA1 f98778c21ddab1344a608d7a2758a337e9f5d7b1
SHA512 3c897880ae97306bf852e2850702434b700270fd0ddd738275b5871a98561f058fefd19e18a6592abb901571bcccfe735b64d2563e8e39cbb70ab490195924ea
SSDEEP 48:TNLopFMatSaw/auUOt8BMotwKvnVy2AwH:deMatUaAKLvnI2AA
TLSH
T114923D0D5F346211C0F04B72D8D5846B2F7C101DE3A33A89DE5460F38EA259FF9064AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 6331518a3b19a38d01e29eb072f5c90e10f0399d46b0c7bbd332354b1bd7e693
MD5 3e10d7e274ce31ba0ee82aedca90bb61
SHA1 3148210dea3635aca32bbc1482105ed73efce766
SHA512 f5bf3909e4bf0abc0e793e23b3c3fd415a27af2aa094069c760cc65c257b8b0d3cea61e717032ed38037fa957838a8416ee1cfd6dc3bad51e2a6f6b836874dff
SSDEEP 96:uIEumQv8m1ccnvS6aeBCBJif5nFXHN5C4g:uIEumQv8m1ccnvS6GMI
TLSH
T1E4F2CEFA07276245D98444F0E4009F8FAF16004B47B6B6EC76D447E3F7A21E2B2B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 186B
SHA256 d741db1053c7e14a96d68473a6a9ece08833e93e264662bd737aa7ee388c7287
MD5 d7e4fdcb135063eef9faeb9488593e30
SHA1 6365d723cf34096d63e4a8645d8a3f0a22a65445
SHA512 aa035c5525018438376cdbc224561683117a889617665191c07fc38be749f0ebc6b3ff2e2ca37712c99d281dc0acb2970cdbc652b56317b558a8f8397f037414
TLSH
T1C6C0221180F8F0B2003989BA0EC0E880BA34D034010080F9CEAAC33C60A20F76B21029
MD5 SHA1 SHA512 TLSH

Submit Download

cba241c9-b6d0-4c94-8744-ac4ccfba30bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cba241c9-b6d0-4c94-8744-ac4ccfba30bd.tmp
Size 1KB
SHA256 8c9b9beb367b121da9a161af45af355a353f4f23e8fb9724f389f60b0ccb8e45
MD5 62c2f169d56dd5d1a328c261d0b766df
SHA1 8d7e2ed97e6742acceda572ea71c29e7e57dc32b
SHA512 4ce288b875e1fdcefdbb6e6b9166ead2fe65e393d52c28380b3d84af3054a893fafde37601bef260843761e2148a8a5b4ed0a534250b0561164ce6eb9b20f4df
TLSH
T1D531CFF383F4956E8A0096F0AA18AE2FCF2D0510431C7D9AC4E4AF2B93E3471E04169F
MD5 SHA1 SHA512 TLSH

Submit Download

d129cb48-08cc-4a9e-822b-a3c0dbca49cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d129cb48-08cc-4a9e-822b-a3c0dbca49cb.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 085d4ed00db9443ffd42f2cd22da4c8366f33408ab0a2d92a2075f06a70c1c34
MD5 a9b9ce3dcaba01de97e777da17b5a7da
SHA1 375539ec285cefe323a1e076d58b20ffe0aab1e1
SHA512 8822008a8e28113ee0eb6243de191315d8b416246dbf938add6d0aa213b31d764e65bae47ac22828ac8a0a8dd7e081e8685d6b758cd689dc765894edc8bfada8
TLSH
T1F5E026A016CEC1FE70DA64CB063DF30C83E4B8ABD3C43D4A2F02CE8061C6506B5D21A2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 55ffd8f90afa78570c719fceb455978a308448efa62a8719e2a3a3416904eb6d
MD5 ef6eb88b40e43e594e4cb9a66c44594e
SHA1 2b3c207c6feb181b442c86e12c41a423464f6e1b
SHA512 d93c22d329f83774919e0aaa56b81826a0c15ad15146339eff1c8d6ffe6fac6a9a5cc826e6601d59ebbcbf3ef3e661df9adcbef0b434781463c273d965c7ac46
TLSH
T1D2B01250BB046105CFB5163A4340C780E290F42B10005C87C99A8F1C1D3E5A83E80D8C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 cb00269a799e00a28fd70b6d5a548da75d19e754e39cf66f8dd887d526104f27
MD5 987493436d1bcfb03930c9f9b9048aee
SHA1 1e7b07c8c48d771296445af3128dd3c9e08dc3a6
SHA512 93fc4ff5f549c15ace17a06b1571b006f74db276adf8ca5234afd8d011a28582cac36a351fe20375b4858d1ad6875f170300011141f77dad212ef77933d0befd
TLSH
T130E048A026CEC22F718A209B46ADF74C87E27456D7C5AA69AF09D6C0B20A645B2D3541
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 824bded9b77d74bca08baff9c1b0434ce6e36ea4d70f6df45c44f53aa1ab17be
MD5 f3facb1ea78e9a98a50c969aa15200dc
SHA1 21e89fc182bacea0dbed8edededed324d9f2887e
SHA512 3d59759a8191da6b510727c70bf04acab5b5c193929142f2b30b370d6495a5c8139045fd9500571fb07d387c522d5f0799899bf70c6f9fe22aea7ffe78200ce8
TLSH
T1DBE04FF056CAC23EA18A7483067EF70CC7A07856D7953A9EA70DD8C0A205145B2EA590
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 26f87416e454409b559cbaf536f5da2b1e77360e9177c191a88682767f0d0dca
MD5 78c8da94982fb69aafe450c1dc2c13da
SHA1 13d3085c4c84c61fa3007d94104b87b809f2e291
SHA512 3709b7c8bdd3da22c74e15cecf249716a8adff18ff7781622d85e24abc519bca3460737931fc4b06bf1a33d0c0e533e715befe45a25277ebb1125eaedf5db6dd
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXE7vk:OtfFvpopPxrB4RhfEzk
TLSH
T14CB2261471BA021138FE790881B5972F064232B33259EA7B7FBD14A69E6BF045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 8ffc3de9b7da88f5c895a9f2ae619824810cc17659f9f42d7cc26ff9a821b7ed
MD5 ccf034e447efd7aff3dbf31956b10830
SHA1 1bc460fb4f6732accb65df3737acbe729778aaf0
SHA512 12c61047222943a17b1a132f95fc2fb1d14c44d6b57c2086cb9369b3207e510871cf52f53514a37c57bef05f3e4397fa1adc7f4cc31e0a648de1052072398046
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXE7vkDX0Hg:OtfFvpopPxrB4RhfEzkT0A
TLSH
T179C23114717B021438FE290881B6972A064231B37258EA7F7FBD45A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 aef9823dfc9717f87789b01af1e120d4a5ade78fd160230d0f81b20182a65972
MD5 8a52607be22e8aea0fe5ea917e0556a6
SHA1 3190c538278773a758a3f63b040e5802c3a64a08
SHA512 ed5122823d5860771abf3e1b68e072b0df91773ad7983515373375ff78e69f33f7c4fdfa5cf61c92b343e10aafb28f51a43506be8afa038dc91043c4559cda47
SSDEEP 192:P+xWYNufT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxpMfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1B024740A7B747001EDE6E9721CB080771E3CB16DCF22A6915DB654698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa7be058-3d86-47ba-b51b-98599e534ffd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa7be058-3d86-47ba-b51b-98599e534ffd.tmp
Size 12KB
SHA256 6d140f93efdbc8008a9d0b6cbff50327d404ef9bca86eda7a4e20e945d215193
MD5 963974adf0a766094202476176e42b67
SHA1 402839a9d2a11e5349b3d36b24b846125add1d3b
SHA512 153feed0845f660698fa941ee460538ee74d193da50152278f54996f2786c659390095d7404186a224a9fc4caaf2c66d2e5824b57383d401d0c91f227c73c855
SSDEEP 192:sxZNRrkm/fSsXQZZ6Bzodp5eHZJ6+WND4w/YbIRa0YKxIgjxJ:sxZN+m/fSsXOZ6qoHov/FZYGj7
TLSH
T12242E8556E28A93B8CC7D21DFA55BF53E3F96132A0C41E44AAFC9A1C15E76CE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e78b6e80-46f5-476b-b212-fb2d555f18fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e78b6e80-46f5-476b-b212-fb2d555f18fe.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 581ff476426d41b2ab11c4636b8fc8e5ce414c0804049a3009430171ed776083
MD5 939cc597c0ec0b8c6a95805d9765b028
SHA1 d5b5d9ad92cd61eef602629746a183c2c3672b6a
SHA512 e6e608e845b92d7642ac44e6dea8968679a9e20ffd571213352f28bb067aec1c246608b133d8dd18f0a354693a46613f62dff3ba3138666352648dc1e09ca78b
TLSH
T1E051A4C0B3AA549C7EC9B941C12EA503A4E13EB6230ED9B5373E85F45F4891D0E6FE61
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 b1f9ca086fdbf227b5900397be9fc636bc1bc7a15686e5e789d6f00c4ffd04c6
MD5 e57e51792424d53b6b913e293b7fcfdb
SHA1 4a6325567bf6c89db9a391fe80436259564bd8ef
SHA512 8d2253c0099cacebcdd5cf060598b0bd2e1fa30b35430fa95ee886a18767d96fbb4cdb41a01d1f551183d698936e52cae619ce4a5aff02a0972683d475e1f87c
SSDEEP 192:42ODTAs7lrNUQ2s5WPIBDYQWIIIhbFMIMbqYcYf:aDsshR2swZQWIIIhbFMIM2BW
TLSH
T1BC52633D27092B33C15E1FBB166A4F945BD4884202F2326D72A1194F9DF6B9786C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 37ca37e8254a10f189a070aad7cb121608955118823aa0d729efdec79653b1a1
MD5 f504fd428cd4845355723086285f9e30
SHA1 5c0266cc35a0556b5d4c05f2fe2a08435403eda2
SHA512 e8660d3bfb311aa499f3dd6b9e31e72292415be7df29fc4a1a65b902536fa1aeac93bd1f91abedfdf5a13676f4c620ee7442ce20f7d6dcda30511f3922a900cd
TLSH
T1B2E02690B8CEC2BEF55A3087012EA70CC3822C53EB98298E2F08C5C8A005101B2CA191
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 e95270795338859cb7dac08e5d81accc1814a9aa45f45d6b848b6285d8fc4ccf
MD5 17cbf99bbc6be452e6b3274030e04cf1
SHA1 535118a6dae1c18e1b0a6c262c489c29bfded53a
SHA512 6562ed025d0bfdfcef1c8e28dc7d53fbf879faeb9fb12335e8b6239ea39a3082ad609668beddd71c0d5fd2ddf13e473e932c61278bc6fd73994cb6c753046c62
TLSH
T1AD21BF56F320C149E14E863DA06BA7351378E8529FFCEC0F45B964356E72A001E8F6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 6bde485fd2c43d26a0166a88c19c41bd3e00e440252c49ccd8298f2a7db4abea
MD5 126e9839bdcd70d301611f4c4f99453e
SHA1 57f8043057c405475840b8334900aa4ffccbfaf5
SHA512 b1a396bd58e898d2f6e54b7b17afb2427543f9cb77bb4c6ee2ad6f1b003fdc636f55076cc68eba87a706a31ff1d848c245d121c5be3993e0f0dfad3a49d11100
TLSH
T171E0DF90B9CAC12FA1993083017EE34CC3933892EB982E4A1F08CB84A145542B28B591
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 6bd146622aff2251d40aa4240b92e9c132b9652c7d3110ab327d051c7f99d3f2
MD5 436398fa59e718f98ef94dffde89ad3b
SHA1 e7bfecdc49fe489ac562b3b888bb1f6488cb8f31
SHA512 3bdbfce1a9a134406f4f27b758107499445fd95f5dee5c0216f27bb743b94e511740ebc9ff1f4dcc2f7c347a0cfaf92c15dbce323da080f4c81b84fc609eaf45
SSDEEP 3:MsEllllkEthXllkl2zEfl59Q:/M/xT02z8
TLSH
T1674404147FC00407D551103040D1C37413F5D4140511FF4374D144335CCF5400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 73a3eeb950c2505d49828548c4da7e93aa981f19a34054626b82e3d37e41b1f9
MD5 210821bffa2934493a6642c73b22dbbc
SHA1 36fca262901c21f40b946f14f5bba462a8f029a5
SHA512 7351503b85d5dfa0ec294b4be1c857f1de8ac03b48f1536ee3da06ec4f847f283f0a18d6a92b0e65ce2cde4c881833d4409492a5ac15dcf00a4b10451cdbd147
SSDEEP 384:nqiFuQkUSviisNl8TUNTUlI4Z5mgilMqK2fMBVvrWfs6TvXA84lozMKwIr+l2IXL:hFelswgRATBVSk87wKwIr+l5fLP
TLSH
T107E20675D899DDFB98EACAD5A60AB502ADE00133C59C4A8CD6F97D3C208F1FD0347856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 330fc8ba2d9d30a5075bb48b7df8b6ecb795dc142da2148c621b17c93f5f17f1
MD5 dc3add04577f388d172ced954070f117
SHA1 6ed84b75c1161e9d2c1141cb4eb9e2d83187348a
SHA512 5e89601ded6ab95fa85132b649e7e0b0e425f3607e42dff9398f46b6cf0dd6b83eff928fa18fe52cd68b98c8b1ac339657cd626eaaeeca586c9516a482e115f4
SSDEEP 3:MsEllllkEthXllkl2zEfltBKll:/M/xT02zoBK/
TLSH
T1B44404047FC00415D70450704051C3541370D4100515D7F334D14C335CC75400C01010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

c54c6754-8e3e-4b9e-84c5-fdb26ae1b325.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c54c6754-8e3e-4b9e-84c5-fdb26ae1b325.tmp
Size 26KB
SHA256 ac88bff3d54dc88736b092fadf737488fbf9b169df5bcb91d7911b3486f0bef3
MD5 794a71c2639a79998f5b85b9c67c449a
SHA1 574064653da582b8504d41c69d08f68067a18a02
SHA512 4351587cd891ae400eaea05ddc7468d94b0d42362714c87d3178dd03c15a33333873e4623b3adf24e95a68f55d3f462e7c9a57b58e5f736dc8e0d0141c6e3a76
SSDEEP 384:nqiFiZcINw3sNl8TUNTUlI4O5mg7WqK2fMBVvrWfs60M2IXwgL/7IzpoN:hFQS3swg+9TBVSr5wm
TLSH
T1B9C23B32D8A8DABBECEB8AE9B64A7603DEF05153959C8AC4D5DD5D1C00871ED030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9ab9ace-ac08-4492-b118-ce628d058923.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e9ab9ace-ac08-4492-b118-ce628d058923.tmp
Size 25KB
SHA256 2b4077b8b88fa8b9a06ef8d186d02ae0f1602bd2cc8a3851dcd8dca2278dccbb
MD5 7a1edffdc0b2248594eb2606fd4c6ceb
SHA1 7df5c1abd10fc85cfea713161620626b130afdb0
SHA512 f095b6592522b88f04e713d49386b7e1490826042db25f9dd59c3bd2b7959e2ed18d8bd6cc01ad79949e0f5c92cf614089bfde98dfe94d17ef9d0401fcd6c57d
SSDEEP 384:n8iFiZcI63sN08TUNTUlIm25mg5qnK2fMBVvrWfV8sa+VYWzgL/7Iz/oB:nFQ63FwgShQBVE8hgLK
TLSH
T1D0C24A36DC98D9BBECEB8FE5A74A7A03DEF01163859C8AC4DAD85D1D008719D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 4KB
SHA256 cb5511c211811cd695515a54584dc800c9b905ef953d9f75004ab61d42ae685f
MD5 4e353b6813e6c6ae94b4fb68fe6e26e6
SHA1 616a36ed70ddf1590fd8381c46e7f8c06e51c2d6
SHA512 2279adeeeb3d4a7e8b9faa6b73bddf8cbd75168f609f1ec9a9ddbfb2f94fd51fdf9202084de5014e05d59e3f811ed04bf9d6b3d1da12f927bd03956b288bf978
SSDEEP 3:W93llQ/8QuQll/lZAOSl5eqJ/cSFYojpuyOV9RUIU:E4/ZlaeyEGy2
TLSH
T1709112425601C873DE842B3F35C6009ABF7219010FC5E80040748D920BD56057608A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 38a738d8b727677188cb4d47a12ef5c153742dd77ccca590ca00e8b7d1d10923
MD5 539c2783cda2b6af2716ab66f22ee9bc
SHA1 90e13ce6d5b3412f89f0b6b0dcda398f3a450997
SHA512 e5d1315965a499b9a3d0031fc59c5f5385f83e4cc9c288501c4f5a221bf7e4915dc1740b0e69be882cb7b3cf2b539c413c5c7034aac431fdc913b9b416ab9628
TLSH
T14E41FA58A6E91148B3B76E9AABF2A86E447FBD772F46945E10010E4F0A26B40C4B1733
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 770ad068f721a95dc1b9470e374bdb8eb305f00e54eb3a5e435b672bd1a3a06a
MD5 283921665959666000fd27674d381980
SHA1 ac9bc636ea1112cbaf416af01418415b07f2302f
SHA512 c5f9472e0ec9945ea9890e09c50a990959bf2efee00642a0faff3db215d412437ba217b66472af2730c6328139e9708ea304a8b6e5cf0dcb123b2a7888eadd5d
TLSH
T1FC513958A6FA1108B7B76F5A6BF2B56E987EB9373E06D46D10110E4F0B22B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

5652cf82-5865-4517-817f-37e646f7812d.tmp

Path C:\Users\Admin\AppData\Local\Temp\5652cf82-5865-4517-817f-37e646f7812d.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 594357a8ce0eb72e8a58eafbc5588d91e2954d2fb583a5c2013c21561fb4a2ba
MD5 0f3c9b2aecefeeeed6565efdfadeba70
SHA1 5d50fdab7a9c855c95963d63b0fbf3589fe57932
SHA512 fbcc22ee9fd22f166c75b675d9e166caee6fd7db517ac786a25bb612af77721c8db9a1f7a0dcea8d32da8731a3f27accb1822cf43d22e36ede8a666d1401e92c
TLSH
T17C4169D03936BA3B8BCB4BD960260C942561E190133FAA4CEE475474BD4CEE2572E7CA
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1956_1242808542\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

9aaeeef0-b0f2-44b3-a316-18c967921073.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1956_13965915\9aaeeef0-b0f2-44b3-a316-18c967921073.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1956_13965915\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5276-204-0x0000023B18FC0000-0x0000023B19FC0000-memory.dmp

Download

memory/5276-772-0x0000017CADDD0000-0x0000017CAEDD0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads