hxxp://salinewin[.]exe

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://salinewin.exe
Sample260620-pc65csfz5s

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
264	2312	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2312	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264311728423543"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{06476304-7038-45E2-888B-440230C0A9FE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4368	4492	msedge.exe	86
PID 4492 wrote to memory of 2312	4492	msedge.exe	88
PID 4492 wrote to memory of 4700	4492	msedge.exe	89
PID 4492 wrote to memory of 4700	4492	msedge.exe	89
PID 4492 wrote to memory of 4700	4492	msedge.exe	89
PID 4492 wrote to memory of 3832	4492	msedge.exe	90
PID 4492 wrote to memory of 3832	4492	msedge.exe	90
PID 4492 wrote to memory of 4028	4492	msedge.exe	91
PID 4492 wrote to memory of 4028	4492	msedge.exe	91
PID 4492 wrote to memory of 4028	4492	msedge.exe	91
PID 4492 wrote to memory of 2172	4492	msedge.exe	92
PID 4492 wrote to memory of 2172	4492	msedge.exe	92
PID 4492 wrote to memory of 2172	4492	msedge.exe	92
PID 4492 wrote to memory of 4572	4492	msedge.exe	93
PID 4492 wrote to memory of 4572	4492	msedge.exe	93
PID 4492 wrote to memory of 4572	4492	msedge.exe	93
PID 4492 wrote to memory of 1392	4492	msedge.exe	94
PID 4492 wrote to memory of 1392	4492	msedge.exe	94
PID 4492 wrote to memory of 1392	4492	msedge.exe	94
PID 4492 wrote to memory of 752	4492	msedge.exe	95
PID 4492 wrote to memory of 752	4492	msedge.exe	95
PID 4492 wrote to memory of 752	4492	msedge.exe	95
PID 4492 wrote to memory of 4396	4492	msedge.exe	99
PID 4492 wrote to memory of 4396	4492	msedge.exe	99
PID 4492 wrote to memory of 4396	4492	msedge.exe	99
PID 4492 wrote to memory of 4036	4492	msedge.exe	100
PID 4492 wrote to memory of 4312	4492	msedge.exe	101
PID 4492 wrote to memory of 4036	4492	msedge.exe	100
PID 4492 wrote to memory of 4312	4492	msedge.exe	101
PID 4492 wrote to memory of 4272	4492	msedge.exe	105
PID 4492 wrote to memory of 656	4492	msedge.exe	113
PID 4492 wrote to memory of 656	4492	msedge.exe	113
PID 4492 wrote to memory of 656	4492	msedge.exe	113
PID 4492 wrote to memory of 964	4492	msedge.exe	114
PID 4492 wrote to memory of 964	4492	msedge.exe	114
PID 4492 wrote to memory of 964	4492	msedge.exe	114
PID 4492 wrote to memory of 5248	4492	msedge.exe	117
PID 4492 wrote to memory of 5248	4492	msedge.exe	117
PID 4492 wrote to memory of 6044	4492	msedge.exe	118
PID 4492 wrote to memory of 6044	4492	msedge.exe	118
PID 4492 wrote to memory of 6044	4492	msedge.exe	118
PID 4492 wrote to memory of 5976	4492	msedge.exe	120
PID 4492 wrote to memory of 5976	4492	msedge.exe	120
PID 4492 wrote to memory of 5976	4492	msedge.exe	120
PID 4492 wrote to memory of 4248	4492	msedge.exe	121
PID 4492 wrote to memory of 4248	4492	msedge.exe	121
PID 4492 wrote to memory of 4248	4492	msedge.exe	121
PID 4492 wrote to memory of 2744	4492	msedge.exe	122
PID 4492 wrote to memory of 2744	4492	msedge.exe	122
PID 4492 wrote to memory of 2744	4492	msedge.exe	122
PID 4492 wrote to memory of 5420	4492	msedge.exe	123
PID 4492 wrote to memory of 5420	4492	msedge.exe	123
PID 4492 wrote to memory of 5420	4492	msedge.exe	123
PID 4492 wrote to memory of 5624	4492	msedge.exe	126
PID 4492 wrote to memory of 4028	4492	msedge.exe	127
PID 4492 wrote to memory of 4588	4492	msedge.exe	128
PID 4492 wrote to memory of 5812	4492	msedge.exe	130
PID 4492 wrote to memory of 5812	4492	msedge.exe	130
PID 4492 wrote to memory of 3136	4492	msedge.exe	131
PID 4492 wrote to memory of 3136	4492	msedge.exe	131
PID 4492 wrote to memory of 3136	4492	msedge.exe	131
PID 4492 wrote to memory of 668	4492	msedge.exe	132
PID 4492 wrote to memory of 668	4492	msedge.exe	132
PID 4492 wrote to memory of 668	4492	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://salinewin.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa3985c188,0x7ffa3985c194,0x7ffa3985c1a0
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,17604251320574554726,15371090044143360067,524288 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,6158172445457762004,3921800548427027225,262144 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,3023767043575240928,10116322042712776577,524288 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,3880809908174719471,3878155335031937966,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3312,i,1260697254979266098,13919639563018913506,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,16467876443910588424,271735689584717478,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,16031650776313529765,3086831665747107239,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3612,i,6034639476272883291,13028996931894750535,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3580,i,9182633989507881906,16476444176650616212,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,10430937849908351200,10276887208908786367,524288 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,11274835801264080778,16155206512987161254,524288 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,9394522732811687339,3708281836228594675,524288 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,9394522732811687339,3708281836228594675,524288 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6232,i,6377759995193789844,5581292978254397443,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3704,i,4342364164916624455,5109754248993692843,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,8933699308993168530,4384022907789084482,524288 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6728,i,17900123163488539122,2126413511526903158,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4540,i,9150270809221926731,5318358488730557066,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5056,i,10440737517954243097,17816401614323405271,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4956,i,18290454867417172349,18302358463265695851,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4004,i,4948330572978728582,7757594520737900251,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,8544034153597618046,1327418603961137269,524288 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,7559585079379419695,16236551220503115908,524288 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,237881814711040006,7065853415110375823,524288 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,15824593204623767212,18054902509711337660,524288 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5476,i,2320762161009172425,11097657021812652541,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7280,i,11406131931762981444,11080041684946406236,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4568,i,1512819306524599900,75163530106766652,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7044,i,2909473668561553112,12168012295256370350,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6880,i,5332743305945740480,15186586608152666419,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5460,i,15457414483791090326,3877868419966146055,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=3744,i,17239021597051600251,18326904961366694589,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,12151273751625187886,2379142389816336977,524288 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7028,i,11907639614863294998,5096021208304366445,2097152 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7840,i,13543967944686494896,5152701107274064276,262144 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7948,i,16301073131447512251,12734726638923035009,524288 --field-trial-handle=2324,i,2629230771015873730,13167841512318341763,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:8
  2⤵
  PID:5548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 67KB
SHA256 6a40cf4ef883645d8aac1ff07d15a9126683b31733b69684dee77dde6e92709d
MD5 8c3e389d3c501c507dd52dda749a6203
SHA1 c2cdec984bd048eac554eb12aa57f452a3c47b86
SHA512 2c2d65b80cd61359440f1de18ecfbd5f0e05e5a140da1b400db86fbe5bf24a98de0a70f1f80d58be438e91dff3d4cd2315d9516b136f130cde659bf6d5f4dd25
SSDEEP 1536:OHfu3iISLaL3JuWry2BxxQdJ7otPGmB+3XyPtO8vJRbrGT/W:mLLazoW2P9q+3CPtBRbrKu
TLSH
T179630291D782A8D842B9BB775D9DAE02072D84FA406B783C3A2B487EC30164FB757858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 96KB
SHA256 11de5a5aa3d08f69e1db14ac9c5347b7d09b8ec8fa89a4dd48a53ac13bfc3af2
MD5 601873d8a87f7b6dc6d2be569d361b63
SHA1 90ddce036c5ac461fc0e2ad6d2549625f35fcad8
SHA512 8d0aa2ed004fd07ff6c8cf0b2f96bf2addadcc481e811d3070d206a2862ebd154f857021dc0186eff184667914b6e23239b3886e18521bbe109e9c70df09ea1e
SSDEEP 3072:TY9ViJr6dK5Zi9YhM9Dic9o4EKgg3Wn41QA2kCISlb5:EeV6dmIx9lSg3c4FCIgl
TLSH
T18DA3020ABF4FE1AE46B742548AB607CE7A906241D0369997871107CEB1F78FE5C183D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 16KB
SHA256 b17b23990851346a40d733da642788136fcc9913a5e690865be124637f16bf66
MD5 e97f51ffddb5102e601f568bebbe6656
SHA1 80b1ed86320c70b9a17f9d5981a132b9a4a6afeb
SHA512 0561e3a1f680d2cf8fa0d19282359588fbdb3a508831810aa5059d6b7b072c840b06323d4ce4c66464ab016fdca47bea6eedbd765acf8c6a503ff2edf91d5fb8
SSDEEP 384:PUsJMhkvuJpDKSNflVDtakrzt2ro/zvllLMZ3u:8bz7Y0ztmez3LWe
TLSH
T12872D0A96EF500237B2B8CEE15D083948E847AF36D6B7DF642883067849C6A17D1858F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 36KB
SHA256 d9546128594ed4fa1d60162a2a4df67e174d2dcea48a9022e3b2e3e0b8d023ef
MD5 ca340521f0fa6e68c9edf319ac8614db
SHA1 555ab0016400c52225f778738d2f6e59e334d38a
SHA512 4c4f4eef2a5370f9ce0bbaf286759535ef50c27879b0bc7c41dff93773c058bb65e35b65184a08019c7b9589ead9490c3f79b6f2c156c00cddc1911de3aa7d19
SSDEEP 768:QcARQx5dqqE0R6b8xYm5NCfWrbxVpD1ZoowKYQjMiclfpORteCxhBBFewjUWhO:/kmfVE26QFtrbfpD1jKQjMpCtdBj7jM
TLSH
T10303E1E3B945AF499FD3DD06CC684232D3952766A2C53E443E6621D2737FCDA388B412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5
Size 16KB
SHA256 6fb27be59aba920a35ab6fc4fb3c1e81972fbc534cb2ffcd1b315ae0f41398c9
MD5 79ed78036c513b5d9555dddbaaeeca3b
SHA1 082fe871f9d7907fb1db7146375c16ed84469523
SHA512 1038659580668259b5820d22e5096c06e89fbdcc75501a9d5c5a4f2bad60387621ab717301c9622a97713bf9a481785cb29d1b26e31caaca60ffa2d6ce846329
SSDEEP 384:m44/bmgTnvF333x0yovp8L0WO4Rr7gJfpJwMud4hZUk2As:x2mgTnv9B0J80WO+0fp2MxhZwAs
TLSH
T10B72D18B04C244FFF7D4BAA1230336B58398556BBB9486DFC414C2DADB6D5115CDD623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ba

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ba
Size 41KB
SHA256 ea87b10595028b71472fc84d7604f0ffac1036d6a59c45f2879923eff332fbc7
MD5 038e0836e6da6f629e878ca25d914576
SHA1 b1cff45e6d0dc2500407626d8a66dedc5e6a002a
SHA512 66b01e91cddf48e5096f72a194ea2d8b48c94c27ec8dac66b55aace814d93b07ffaa835b870efa05870ac8c46de0c64fb1e3bf246d4755bdae83ccd41e0716ec
SSDEEP 768:hNxxCSwA4AALOFoe2TjYxRQg4WsLc9vQwluB0P3VZ+yWZMGasXuGG0cP0V:hNx8SPE6F6kxRQg4WsA9owluI/VWmGZD
TLSH
T1B213022C81007C7486D779E0B45CD3DDE1A89595E93FAB0232C592C9E5706E9CCFAAEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 b8ab772580b75247a9baffd8a5fadd8bbd919150d67c944cea8fbc879d48e083
MD5 5d1a62e6f3f671e973447e1e0d267c32
SHA1 4012708e57b33103149615289e60152b985af8c9
SHA512 82d000f912a304c518a1ec98c8a5fd6c764ef32091329c76e9662054300e0808a27f6d795c59683d6c50ad8493ef70c24df7ad55bde5923e82dd37edeffb8f95
SSDEEP 192:1gpSdbegEOZJJ+YfZKDjELPoc6zikCIU/9plS9toxGzLYMWWMxsJ4Vf4jsGG7WEt:1wSsgEOZJJ+4ZKfELPZ6zikCIU/9plSu
TLSH
T1E602DA7281C93497EF7AC83940E0184BB7BE50E5F12BDF4244EA59B85F53BA2C17116A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59090e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59090e.TMP
Size 3KB
SHA256 100f68b7d2f77271b280722c218c71513f849e92082ec3a4739142a76be5b006
MD5 018b1bdeaa41b6667921cacb86072423
SHA1 d4690d1f7bccf32446f4d7dc8a74f64b28b03f80
SHA512 455945a088b9fd57963f12152c86ddca9a7ddbd49aea8cd22e544b7745467cf50b45ac8d5637c65723410c262c46b42e3cbb818ff402d19cb407cf3b93bd07dc
TLSH
T194714E3701C940C2D782013A94F16284F8BD82EAF53FDF5150F76A7E4B93711815A1BB
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f78c4cb1d28847256f1cfc935eae97111fc01e929b067f60ce064fab13cb792f
MD5 b235ad64994a076334c9dcc349162866
SHA1 d4284cf712af771194c12db0e83d324b341b0840
SHA512 eb06404219e94f2cd7c18667ba0ebea89dd131405db64fac7875de7e27128633e94e5689a1225628bcc8955ad481e1f360ac6ce1561fb73f4483f444196957f5
TLSH
T11C619BF3C3E6826DD91155F0AA287F1BCE1D0446436C3D4A89E4AF4BA3F2471E152B8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 205B
SHA256 e36794283700ba3ab2d10dfd64693bfcb87b626b03bbbdf38b8b43bdfbc0bcb9
MD5 9bc26e282fa3ca35c8d86066a65a2dd0
SHA1 3f52b29bde344cc2d0fa0ac3dc4adbcf14d3275a
SHA512 d380c5cb0a1abceb344001931426eb7557d3327d80ada0398aeacc768f0cddb01eedcc533b4d3544d5fabe58c38e3264e956388c0ca563067e8969966b791960
TLSH
T198D022231200F1BAA56C3E8344BAEC8FC72610200C27EDD520E09D984A3946C192B144
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58d646.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58d646.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3b9b6487175d12f2f16e937643b8cfcb36b0f48b185d6279148ed17d2e96b901
MD5 54724f79b84ce6030e892030f79b3fc4
SHA1 d8d740100277b706b9492c265114463d4178328f
SHA512 beb93b1c7f6957d629ef7843f2e7b518781246e554274a79f95bc80c6b17a9001c9f0d83e57ece59715b06557dad3207cdf810b32b4198fa9886557329aa549a
SSDEEP 192:sxZcRPyM/jK1Ml8MWOF/fCssxunYnb42dpmarHW6+WNBnj/YzTcB+iIgrJ:sxZcPuOF/fCssxuLWFHbh/xl9
TLSH
T1AC52E812AA34597BCCDBD209B955BF53D6F80572E6940D48A9FCCA1C04E6AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 4f194b40c759b8e97b8af13d867d840c99d4a47f00fa331053decbf3e7903a51
MD5 3fb50705576784781f8ed4db7b0bf8b2
SHA1 09dbc382ad687989a0d5a53b65c18cd04a6126bf
SHA512 d07b1e03679603d9f3ad497336f242e14c32eb3d22d57c0fc11df9a84bb60ba2d6702ec5c66784b879b402e03540fc8eafdf85662f32fcd3d709532730e5fcae
SSDEEP 384:sxZGnMJsm1F/fCssXuN/pLHbz8/ulTZ5x:sYMOm1F/fyuNhHbiu5Z5x
TLSH
T1D58209526620897BCCDBC118FD25BF57D6F80562DA950E48A9FCCE1C04EAAED2317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 21913db6835a72fe1b08f76075da8507ceb16ef175c3c8b8d118b48548a408df
MD5 fdbb8e394c156184a24110aa0a7180d0
SHA1 87b52d0be26bcc50c140c5e1732b4b39fc88807a
SHA512 88f5101737b721e1dd59c392fe885e0086499c1ef743523aac0dcfe8a19821b9dc4fc1ae0a278e144f70568687ed40f2dd3436d93fba02e4b58541bebc45a64a
SSDEEP 384:sxZGnRJqSm4F/fCssX5G/bsbHbLu3/ZZklVZ5x:sYRQSm4F/fy5GSHbIa/Z5x
TLSH
T1E392F95265208A77CCDBC519B9217F67D6F40462DA950E48AAFCCE1C04EAAED2317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1f1ad3d75b4f4489379236b8efa2174834e9f6f5096e79c9cb8091640bd39194
MD5 3f9db8a60304ae9fb34191a399890555
SHA1 df88c0a51e3624caf062187dd28e4a6c865a7731
SHA512 a95c0b7e67df73c08c6339875acbc8761ad9b488ff5b0a12dfc4de401b14ba6b772582b39d1743bca83caee7189b214eaaa94ba17da268b5930b6564e4eba110
SSDEEP 768:xUW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj4roIzigYi:xUW7kf0Wvqidau1jaa5LA3jDBi
TLSH
T1B3D20A3B680CCB7E4F840E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 3KB
SHA256 1d846bbd1b2169adc1f2872bbfc9a8188db2f91183d367398800e63e21bd3a1e
MD5 9b471717eb089a0b14a5ca86de7ecaaf
SHA1 78df343cddfafc27f2a51924c3df12dbea15bfb4
SHA512 0036664292b327dce2d778ef6f88a4718e437e70a0a6eda6ae617cc9e91214f289c6aeba64bc2a946409bb1787e3daff5997129695e25656378a6ee543ca9a1c
TLSH
T1BF51C95E8C573F97CDAC217364B108883735B5DC6A448E27A4FC8138ACC732418B9758
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 648B
SHA256 81a3899ac272facd4eebf3d21f7af994dc454cf916e8cf9a3e6af57b180f5068
MD5 29f3e7a00d2ed7056d995098a15a1c76
SHA1 2324a5e1e0653affd1dfe81fdebdabbb05dbefc2
SHA512 07e4fa6ba31ee55684d8eebf0bbc044e0a91c5ff226e8436ece49b619adbe7fdea837bfd088c34b394163b14e82ecc52e7c8bbd6166491af574684db6e7dfafd
TLSH
T1E0F09E165FA1962BDBA485B224FA50A53370EADC2322C457846C796A2C2A348A85B1D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 9c687be46cfd5239abc0226fafb5f292718fa4fe9bc55b703f424bebe92a62fa
MD5 ea968a879ef1c249cc504f20c84b22fe
SHA1 80a4e59969c538494965153c9cb781a0ddebea68
SHA512 6576d6185903bcab6b296ef7a8f058f72b72671f51260cc179796bcb4a16145aca798fb9ac957bf78a7c6cd9bfb9ba9aed6724958f5086a32ba3813f13aab146
TLSH
T1094174B69DD26A5BEEB5197320F614983332F6EC2B16DA17217C743D0C47364399A288
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5882a8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5882a8.TMP
Size 648B
SHA256 2e641546fd7354f87a6f16076f0e8a8675dabf242778999fbd45067fad64e896
MD5 fac026ef901c9159939393955fc75c7a
SHA1 bc38b370672e0e3e1a392b9384bf4689b38e8663
SHA512 c1f1d11411fd20509fcd57af5bc7327898270fffdaf2d20815d5ba836a7e67f546a0f1a828bd70d6eab66b02c8d0508bcf20c2aacb294ce8bd65396f858d0235
TLSH
T109F0239B87A28A67ED5089BA18D450F9B330CD403332F49350AE7E3E2C3E38859530D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 303ff9d764022145b3665149316fd2d54261c0bc2a5ca36036c1b21707032246
MD5 04a4746d5e1065157397fb328f5948dc
SHA1 1bee72b8bda5d0fd71ede8400618866d348f5952
SHA512 f9dd608bababa96c2e7e4a5dc2bb3bb70695f16ee4044f7e480e6b553f2eda4b9bc7c4f47dc0c1ba08318f84e40eeeb17f54c2d23a8369b72ea936ac2e7d32da
TLSH
T1D2A0022403C48446D03219B19E5202513304CCD02200671780D90045CC544925DC110E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 1c33a9ca6ce10dd417ac778923d14aec7eff693b69c8387d9aa4dc6c71952bbd
MD5 4f735cdb1126b3bb8ddb65bbd91be824
SHA1 a62ea0aaf5139bc6400d13e95767943c8ee65cc9
SHA512 eddb837d02961c90f620a0212bb0376e9a4bd66c5c413b6e360bd714d78b569293a26e5d2852c9e6e904f72f9f08b30931ddc91c5c4e72f0e74864d68743a74b
TLSH
T19CA0021406C11033C20A62B435D6017232104D50E311534641D04285CC55A7A855BD0D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0312a5b26bc38193cba82282a301a3cd59dfaa7962f2a80b43c51217b0eddacb
MD5 cb171de78c441f510fb04aab8b804956
SHA1 d90dec94888ce3fe2220bb74180afc3a3a9855d9
SHA512 6da3d2e904ff14b5ffbe7beeaaf9d2c7d43c24f6068f4bbe477d5755bc2f3d54560b4c326cfce595de41f2b19e67c1093da9ba933fd8f6c35d97cded9343096c
TLSH
T14DE068BB2DFB1828AD6F87D238B165B0818638188500EC0E3027A28730F2361280AC21
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4f8dd1acea01ca36b67bdd26ba6a2a8496b50920f399b6dc172cfcfbb845b356
MD5 53a0f148d71488477de91d556e6be5f6
SHA1 0eaaa01eb51dc25223f9619ee9a490e316003016
SHA512 617989b18c10f7b1ee1c4a2b6584436719015ccc0a674431a62614004a22fb9aa95063d7261c376f6590115d852575059679f51aa3af2d9897b2616a8ae89ff3
TLSH
T1E4E0D8BB2EFB1824AD6F97D638B165B0858639589504EC4E3567A29770F2762280BC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 427d1dda3264e957d9e4fbfbfe3888ddcc491546e6d4c7368853de3e25717d36
MD5 c2791ff2a5133da1fcb4c8b800413e6b
SHA1 fc64371c2f40c03e7c502992bfe7f148a08f1953
SHA512 93dab844ee8a99ee55b4b53cd187ea9ea6eafbfd42fb1e216f56b1dc8a9145821142db5825ffb787778c5088fa5758f3460b99289606f0fe85b0dd3351bc64ca
TLSH
T13BA00213825C484EC00842B0B34102857263E8104F05272190E4C065AC5514595330CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58da8c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58da8c.TMP
Size 48B
SHA256 d231a66f690a47d9110d5096620a60ca458ab07e9191b0e8f9fb3324af15a4be
MD5 e2e04a8a97792f0ad82046def5a89c3f
SHA1 3cd02647daa1cb674758c37a0f03d17a157e1c6e
SHA512 236962bc31bde7c3a6173b9865b84d022e1372d30a5a9339d9a564e7d2f86464834f9fa17938924163b931393269fce73884a31bf003cd845c1d36a9907a93bc
MD5 SHA1 SHA512

Submit Download

d8802e2d-246d-4672-91d6-a227a241c6b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d8802e2d-246d-4672-91d6-a227a241c6b9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b1f96d210823363a9b66c426672e312cacd3e24844aa26642d5c4b83d6cc1fb2
MD5 9ec4c5bcfe79f5fa96a0ad6469657e4d
SHA1 1fc81c85a28fcf02b9507a5976fbce85304e65f0
SHA512 1cfc031ad91cb3cea430f1842e83f81acbcfd020bf499ad88dd1edda2ad0db531bd5b2ce353674318d96be62a10c77611ff12c0ca5df41605d2747a1bde058a1
SSDEEP 384:NtNn/s3n9SfsN9UoTNQrfbb0I2bM2oaITGT0IBkx9G:Nj+9UZ70IIzoai+0jvG
TLSH
T18A928E335C35ED2B9EA29195F44A3B0B1FB441BBA1C52E44A5EC6F1C05DB3AC231791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 cb697a57f34c24845045c04876cbbb74305d980db0ae82fb9e8842b7bc74bfda
MD5 95012bdb6b6768760238afca4b117013
SHA1 b265f0694da015e3a5de81543956f6a0fca21f69
SHA512 877d95ea4a37d7314da99b2f0fa694a5400c2c5cd86078b26e3d296df9f6c8c0d50c1238c76edc49188ed823c98fe68f0e1dbf85a8829dbb958a76b1ea604594
SSDEEP 384:kSiF1tNn/s3n9SFzsNu8TUNTUlIlJTNQrfbcITbM2DaITGT0IBkx9G:YF1j+9WbwgS7J/zDai+0jvG
TLSH
T178A26B735C64DD3FAEA69A85F54A370B5EB401FBD5C16A40E6DC6E0C00EB2AC131BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b323ccf41b0ef4d77631585fb015148212e71e5e49d0a015bea86033913c08c4
MD5 e112eedbebeabb560ef693159af6cb02
SHA1 01949c4af164b6c67d99c32460e88a0073358fb2
SHA512 023cea4b6f8b1661f1b962d7a29ad7b53944fdff3144c9d76dabef94e6e5a9ea0c54467121deaeafac48e65e49f55fa5787ebf5ca44e57bc179b6b87d020ac36
SSDEEP 192:MONo64BAQmiUyJ1AW5GBPK7hCI9waDZXU6:MONo6eAqmWQM5ZU6
TLSH
T18C0209356CB96C7BDEB2AE44F48637175FD8116BF6855B40E6E82B1C00D765C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7af90a398146fa771027961d327f4837bb17e6417e8da4abae0d3a55619c7909
MD5 3067910c9418a48274b5a27b81765014
SHA1 928a5dd533ddcc6728a9bf8fcf330f0d78b8fc8f
SHA512 613d60f42bf1b1cf8309125bb615413582b831440fb0228bef81d2eb5d8e1942c44ff48865f1f56b25d0f793137187968b7b16a058d31cf91fd2e62ac86af80f
SSDEEP 384:M+tNn/s3n9SfsN9UJTNQrfbcgTbM2oaITGT0IBkx9G:Nj+9U27V/zoai+0jvG
TLSH
T11C929E735C75EC2BADA29195F14A3B0B1FB441BBA1C52E40A6EC6F1C05DB3AC231791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6a14354d504a77d253e532b48c442a88cc6d52bacebd8d712df20e1998e01820
MD5 8eb93101b1b1e9223102f4e7f5867a52
SHA1 e813001db3275b6c0d0472d4ec52e9348e1ce7fc
SHA512 81abb2b853e7001862b33272fe0917a0bbd9e2ad56accede4484a2300c8bb989e2a90880e280a3d7e313bd8bfb67a341994699923e3e163496b0ecac9150b748
SSDEEP 192:JONn64BqQmiUyqA15GBPK7hCI9jlEIWwdqLU6:JONn6emc1QM2uaU6
TLSH
T15C122B766CB89C3F9DA2A180F48A37075FA5416BF6856F40E6DC3B1C01EB65C230B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f8709593cec0df982422f5d1ba3ddcb988c3578bc82f47be03841cc8026a09e8
MD5 aa18e7268770c4cf08c62db02a30a7e8
SHA1 30f5b71403d8842ea88e8183f275ca1285397901
SHA512 ccab1a288ed4f9bde97b79e4039b8358d290a5794bfb96d4be8d2b72cb09e59fd670838d0ef80892110a87dfa2fd6d6c60c3cac40d5aece0b8a9b73c9d6d0624
TLSH
T1C0E00247572141ADC03C0B31004B173D97D3C03405B24707092105541C132401F71FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e5e2c271883e2658809f112acd33c4bf7d970eca718fb160145315020ac5ff90
MD5 c979e86de53452e6ab57d27fe625c359
SHA1 e6dff1b0070f8696e02b3bc51d9e05543384e131
SHA512 18117c52ed9e362c6daeb49fe04edbc502c868cf6f0b62ed0311986ef7ddcda33fe97dc7aab1cefaef6c0f35e4a311e5271ab28f6e14f8dc5238e80cc92d57b6
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58b6a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58b6a9.TMP
Size 392B
SHA256 0f53cd796012e6bbb065dfa70d707f5e4fdb7f6221a98b215d04166d6a395bf5
MD5 36518d0dfe82084c7ffc1b49b764104f
SHA1 65c77cec849a1cc9ff017ea38f633e0a8bfb7a3c
SHA512 b26cbbe6335a7104bd4f685de863a32382e21cb423444a6f47d1444493670ddcda0924896d712cb44b578f4656ea5096d0a142faf58ab2c851da6add48a91f08
MD5 SHA1 SHA512

Submit Download

9f884771-ba67-4654-a61f-ed96905cc7e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9f884771-ba67-4654-a61f-ed96905cc7e0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 201ec621fe37986e4d3a36f8ee2b80d5bafc533f3e9d2a4142f9dc02065966ef
MD5 3ed739901c5940821777aba1a54e8552
SHA1 36bb6f5ece571bb0ad8083596cb17d4c3d88c63f
SHA512 cb4370342618b93dfafbc8bdd901b6716e124d1427e23f005ebdad6ca60839373299bd5cc1b99dbbbbabddbde8e369e53dc937de40e367d62499320b480ec1d4
TLSH
T1BD41035CA6EA1108B3B36F599BF6A86D587EBD372F06D05E00510D4F0A22B40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download