hxxps://event[.]nexuses[.]xyz/rc72gwp/accept-invite?sid=6a3a7c498e1ff567097b4738

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/06/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://event.nexuses.xyz/rc72gwp/accept-invite?sid=6a3a7c498e1ff567097b4738
Sample260625-cbb7dagy2x

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5328	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268260350869139"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1131776342-1023621610-2767477260-1000\{643CDEC4-630E-4CEF-81BF-B9B229FF285C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 5456	3900	msedge.exe	84
PID 3900 wrote to memory of 5328	3900	msedge.exe	85
PID 3900 wrote to memory of 1616	3900	msedge.exe	86
PID 3900 wrote to memory of 1616	3900	msedge.exe	86
PID 3900 wrote to memory of 1616	3900	msedge.exe	86
PID 3900 wrote to memory of 1780	3900	msedge.exe	87
PID 3900 wrote to memory of 1780	3900	msedge.exe	87
PID 3900 wrote to memory of 2208	3900	msedge.exe	89
PID 3900 wrote to memory of 5924	3900	msedge.exe	90
PID 3900 wrote to memory of 2208	3900	msedge.exe	89
PID 3900 wrote to memory of 2208	3900	msedge.exe	89
PID 3900 wrote to memory of 5924	3900	msedge.exe	90
PID 3900 wrote to memory of 5924	3900	msedge.exe	90
PID 3900 wrote to memory of 1376	3900	msedge.exe	93
PID 3900 wrote to memory of 1376	3900	msedge.exe	93
PID 3900 wrote to memory of 1724	3900	msedge.exe	94
PID 3900 wrote to memory of 1724	3900	msedge.exe	94
PID 3900 wrote to memory of 3172	3900	msedge.exe	96
PID 3900 wrote to memory of 5652	3900	msedge.exe	107
PID 3900 wrote to memory of 2144	3900	msedge.exe	108
PID 3900 wrote to memory of 3616	3900	msedge.exe	109
PID 3900 wrote to memory of 4708	3900	msedge.exe	110
PID 3900 wrote to memory of 4708	3900	msedge.exe	110
PID 3900 wrote to memory of 1476	3900	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://event.nexuses.xyz/rc72gwp/accept-invite?sid=6a3a7c498e1ff567097b4738
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffea17bc188,0x7ffea17bc194,0x7ffea17bc1a0
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,4702037997373993178,1066870252096688629,524288 --field-trial-handle=2084,i,3498159225175532211,8038663771550857044,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,15077161279696163602,11687816907303695993,262144 --field-trial-handle=2084,i,3498159225175532211,8038663771550857044,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,8518877828708450392,6289496570553978286,524288 --field-trial-handle=2084,i,3498159225175532211,8038663771550857044,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,13520702261688646049,781787386600284260,2097152 --field-trial-handle=2084,i,3498159225175532211,8038663771550857044,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,1920267323302425234,9207324278078412276,2097152 --field-trial-handle=2084,i,3498159225175532211,8038663771550857044,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,1797920681331696571,1428125289224476291,524288 --field-trial-handle=2084,i,3498159225175532211,8038663771550857044,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,17721620541198891618,4486292847331548477,524288 --field-trial-handle=2084,i,3498159225175532211,8038663771550857044,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,846851123462639993,768247718380217564,524288 --field-trial-handle=2084,i,3498159225175532211,8038663771550857044,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,846851123462639993,768247718380217564,524288 --field-trial-handle=2084,i,3498159225175532211,8038663771550857044,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,12374340439224997974,11715089069114567695,524288 --field-trial-handle=2084,i,3498159225175532211,8038663771550857044,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,5053988965595246429,1889803827343665829,524288 --field-trial-handle=2084,i,3498159225175532211,8038663771550857044,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,11004037851057492173,9217964078211231646,524288 --field-trial-handle=2084,i,3498159225175532211,8038663771550857044,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,16841809039394590321,6969757545108020772,524288 --field-trial-handle=2084,i,3498159225175532211,8038663771550857044,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5948,i,2333851529709513657,12406287241181245577,262144 --field-trial-handle=2084,i,3498159225175532211,8038663771550857044,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8365d8597d396643eb3cb27ae8751c52f3b1ae3e25576cd2bd50becbaaae5ffd
MD5 b16e94a14013394e81faaffb1edb0866
SHA1 095be96d92aca0f788caa8c464e88fe0093428bb
SHA512 d08bfded37a6166d23fc97a47902156684e9e48ea9630c13d74b30f201e0b1cbdefd310a06a35543c33ad6c261585c043ccdbbaf6a515ba32c8540521104e42a
TLSH
T12CD022223B4AB000E2AB4132E2228740236908A128824604A218C86C4EA00C022C22C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e4479a36b7b992bbec7177088f2e15db8dffdd7e78e85279d2c83088a29343e2
MD5 03578bb8b6e22240ff9f962052e3bfd0
SHA1 e88cfa2a99ba4cde156cb76df3c1e5e4d0f31844
SHA512 14b486114c608d9c481d03eaacc4af4e96cd2250b09e5c1fbb1fe214e6bcbd9291efe72cc52c99c5a4d7d0533399a4d773de86fc6cc9233bb147b5ebe349bec8
TLSH
T177D0C0333F4AB000E2EB4132F363C740337D04A12C824604A25CC87C4EF00C022C22C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 23219ad60de4f26476e214d76347ee0032efe4f02a52380a1b957bc053f8e85d
MD5 20179edb3de673c6d53e24242a7df9a9
SHA1 d3c6addfa4f142ad5b85b9331a7d5579afdb66fc
SHA512 63803fd0debfc722641216a94feacb594272ee9daf8c73eeded2159850489f6fd748eaaf33d4d9b47133f9314db7105b88b674543daac35b6058c9d68c4f8ec0
TLSH
T152E02BAAD831AC2708FE0B5C21900B49EA50131B2751960F7A3D830D9FB467706928EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e8b4211d31a60a8f5f4246b036a0a470e30383ff2536712a726ea9f668e05182
MD5 948ae6fa80fbae4dbedcf5dc6cee401a
SHA1 50be26a73343d57bdea34c2aaae1b048bc0f3424
SHA512 8b0ef6084bd597f76863c3e036d76ccd2b228b79790219dec65bdc04b173935c8d69f700fcf032e8f2100d701c00b6937d31bb0f0232db8277bc0da862e02472
TLSH
T1F081B4E9058043EBE722CAF282D2FE4D71B48034BC13AE352C8020743E81752B77EA74
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5891ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5891ea.TMP
Size 3KB
SHA256 4dea0691954e93fdad2c5a538c0c6c1b9d82d5e239b19ad0239a0d5acba66e9c
MD5 04280c8bd46d7ebd9d922039ddb4f2f0
SHA1 7c3be11eac3b2119a8e0d831d68b680a6a79a78c
SHA512 b2cccce7e0078d09decab75ad06d42d388284779df8e7f26632987659b3b2b5af4e2da1f18bb77d3b2b2be4442cf498ba9451f32b6be9b04667228c0df3526f5
TLSH
T14C7183A9058043E7E761CAF192D2FE4C70B185757C23AE392DD064B93E80711BB3EA78
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 49dbfadfe59367a9a846901ca8f46440448916f44e04764518c61d71b69a26ba
MD5 1e6f8e52982562e6d697bdaabb95a51f
SHA1 9513d19b6890f1028886b1469a66960b6ba6b17e
SHA512 0f352b1dcaf83a6a159c07583c96478f496c1803e7753d31f910dfb3bf88ac5c52ab969b6d11079eb94e7d9dc8a73f003b05f7e7dc039b23f6f69289898eec5b
TLSH
T1FE31C2F783F4856EDA1196F0AA18BE2FCE1D0510432C3DAA85E4AF27D3E3471E045A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4e8cf061826cf67ec0e1bbf3c2a675a3bad9b3906ee690c56b1e5ddc73fb681b
MD5 c669cd2c1aad9e028bc4d9bb2bfa843c
SHA1 2db3a468bdef527b81959ab18809745085144d0f
SHA512 67f0476267123bac39ac3255b067814373395fe5076ac702e1d84e182ec5716e355d831422d9177a6658464b0445e07ce995defde711a257fb839721396d393c
TLSH
T19E31C2F783F4856EDA1196F0AA18BE2FCE1D0510432C3DAA85E4AF27D3E3471E045A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 52d9dffa966f4d93052b1c86fbad0eeb8d129dfe038170c08878f8b983114657
MD5 34fbb3cc7689cbddaebd976433b8c57c
SHA1 487061c8923d6533ede5d415aa271d7704379827
SHA512 333036c901ed2efe39025cde08c081da939e80f76e6e90030f060f6ae448400de05c453be5a249ff0ecc52cb2313ce7a3b2b424b36ee85ec96ea2de0938e18e9
SSDEEP 192:sxZDRyyMqZjK1Ml8UQ5kw/fasj6aCZtqzodpPFHW6+WNgEl/YqaexDIg5n/J:sxZDTq6w/fasj6aEtRdHbV/JlB
TLSH
T17C62FA166A349977CCDBD60AF945BB93D2F90463A2914E44A9FCCF0C04E7ADD620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 92178c6503d66157fbe1df26aa135ab7ed739011548997b638f6e7973a7cf046
MD5 893f574e95c057a42de2323b54ac5d78
SHA1 689854b6c5ef7f124e4459e4f7e30de930017c32
SHA512 a0226f5fbfcd14267f4f2a2dd78e1b1fe7231e1019f10a0d5969d4276190b7f01f3a88a892143ed86c85d2cc34ccf882ef13d0e771bc366547ee71ddb580d445
SSDEEP 192:sxZDRyyMqZjK1Ml8Mkw/fasm+65CZtqzodpPFHW6+WNgEl/YqSe4DIgj/J:sxZDTMw/fasm+65EtRdHbV/yjB
TLSH
T16662E9166A3499778CDBD609F945BB93D7F91563A2904E449AFCCF0C04E7ADC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 651d18d7abaf1b4f4507289af79e93ffe95d6e230d9c89fe5a8aebdede26c27c
MD5 9dd7ae8c57ce3535e5c2baefe9ca8bf8
SHA1 42ae411589278d4b5e0d59c5b7cecdaffcbff912
SHA512 d3970861ce02bd450fc80ac93673893c9c190b78c5522e34d9398cded070a8ea2caf937ed0e05f9dcab65c8f17b0460350ce2b7ac68e6d0f0399bc5ac40ac43c
SSDEEP 768:+IM2tv5WvF32/8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4sLl2cNV9rolDWr5ljo:+IM2tv5WvF32/u1ja1sLUcV2lqrc
TLSH
T1EED2FA3B680CCB7E4F840E9CDC265F976ED4018BA698495487FA494C03C77EB522B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7fa2b5d774c4e3ef1c065036faefe12de85b5e1038b6fd51d3aa87d6a337c055
MD5 172b8057d551c1981aadebdb5d16e6d0
SHA1 1a827894d365e837b2059439466e9b4db97148ce
SHA512 aa97d0c68d5db4a38c4243a389984d82e45c57838214416ddfe4776b405fe90a6effab0a60293933ded4f5536ae0fb7b58168727d296af10faf8f8addb702d8e
SSDEEP 96:KMkAKd6OezWKEADWcKHqy6UgKhCK7+Ko8iq68K3qYKAKjai6oIKp+SaUKXquWJSI:KrFjPXY9/gfrWThFLh/DNTVlff5y
TLSH
T1F5B27016303B12523CFD6908A7E6D6778D8231B33119E66F7BA804A60E67E125DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b143ab857d2936a75a4bd5b4510ce446a5260ea40a8e5a3a6e7e7e2d9ce735da
MD5 6d1404e9425c55514d757218a9e7cb07
SHA1 ce5c95fc33ccaebc0e221c494fc743a59ae74700
SHA512 18270bb42113fc78225601287a3913c398130ddc6d256a57a3ef6a4b67af11d57bf27a9e7caac991a0bc0913d3f8b23bdef89fbb0a48325fb4e6423dc880e947
SSDEEP 384:n+iF1tNn/s3n9Sr3sN08TUNTUlI4kJqn7fW+lTiBf+UGCc1v2PHf+jfZImn15wbc:VF1j+9+3fwgw+GL1YMfOmn12bfk
TLSH
T135D25D36EC54CA67ADE74BDAB34A3607EEE0426396CC5AD8D9D84E4C00DB6DD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 72b890bde13335d65ee8e04bd680a6e4bbd011644d4dfdbfa4df4a9a8645b5e8
MD5 b9dd5f20c9cdf00db730328caa187d12
SHA1 8abc1501e8bf59f363449750a48ecc29749fe128
SHA512 f4d399e597638b754745a7f7ec6622a96cf7cb364010688267dc21095d344c558ba052466cf9a713a85b8d49e7ed913cba6c8322fd2210b3d38f6bd9af80d86b
SSDEEP 384:nqiF1tNn/s3n9Sr3sN08TUNTUlI4kJqn7fWDlTiBf+UGCc1v2PHf+jfZImn15wbc:hF1j+9+3fwgf+GL1YMfOmn12bfk
TLSH
T132D25C36EC54CA67BDE74ADAB35A3607EEE0426396CC5AD8D9D84E4C00DB6DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 57305a6c3452664418b145b0664b6f4729ea7d51c522391eb846554571e88f26
MD5 9e6d830dd354e15ffe7564ec246e614f
SHA1 435d482d622514ad9c0209a33729c762bb7984f1
SHA512 692700a1187b0eefb25e18bc9a9623b7e2d0da81b5b0f5362c2792a8800fd722a03437a2f42e962b32d530d6cbbbf74deb0d9717557471cd78804fc169291537
SSDEEP 384:n4iF9CcmyWCs3sNZ8TUNTUlImkrn7fWm+miBf+UGCc1v2PHdFBe4KV8p0aLwty/o:DFccps3GwgEFGL1eFBI8p0aLa
TLSH
T120B24C36EC59CAABEDE74F99B74E3A03EEE0116785CC9AE8DAD85D0D00971DD0307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b3f7e00f805b87d77d4163318c472c91b8298b2cf0436b7e8b1e5b05da09780e
MD5 6ebf86afd9a4f274479685efb81f3fcf
SHA1 252550af70db47ba0bb2559bad954f0391c7f99c
SHA512 cd08f8cee4fe9cf6c81f35bcba8af0a87cd3ebec991bd06b156d82beb4f1dfe01ce6f56b640620acd81414560ce6cc361657d576df700a99e59abdea361d7544
SSDEEP 384:ntiF9CcmyWCs3sNA8TUNTUlImkrn7fWmUgiBf+UGCc1v2PHf+jnZIe4KV8p0aLw9:kFccps3vwgiPGL1YMnOI8p0aLa
TLSH
T1EEC25C36EC55CAABECD74BD9B74B3503DEE0426796CC9AE8DAD85D0C009B1ED430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ef60e50676fa415847e80ae30a6ef9ff7608a3168e81625dca537446ebbd59d0
MD5 64c711537932b56aebf69451658d5ebc
SHA1 7219660710393881f6372451c45c951bb06a4923
SHA512 f9f6fb6681ca61a5b33bce5bcc0a0af97095d768c80781a5c7eb62580f72b1a1b888d5bbbec7a317df7dde675e38406eefe66030d8357038c9657ab9c5af728d
SSDEEP 384:nOiF1tNn/s3n9SZ33sN08TUNTUlI4kJqn7fW+kTiBf+UGCc1v2PHf+jfZImn15wA:lF1j+9o3fwgl+GL1YMfOmn12bfk
TLSH
T157E2C4F698D78A77E89E4B87A33E2D029AFCC153B5885A94B7D44D4CCC961BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 42a0d687cec268d3b8a9ba85f2b47f505a2e172d64351adbaa8e182fb64be192
MD5 19e030249911035a0d6b2c078610ae8f
SHA1 ca15ede5df20974fac42788bf65617c2a05bf905
SHA512 6aaf7e01635c7a40b8ddb2f273c934dd40e47c04063b7e0ba4e6efd3ed71b32537720649932cc1872982f57608c86832ce0d1e8c6e4c935b8aeb94f911b4cb25
TLSH
T113E00401D1010437C01C077100D3175037F1C00003F34315C110057C7D133005F30F54
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe588f79.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe588f79.TMP
Size 392B
SHA256 884965cb64b4ca34e1a7c0df2ab73517bae3edc388ca7d192da4f45745823817
MD5 77475f058a18d527e30633005ea9cb0e
SHA1 05be4482472fa24668b24c01dadd2da73e3aeda0
SHA512 332ae560ff3d7f8ddef59db73301bd3ba99bae5056fd16f780d29adb747cba23a2968534a211e0ab18c8dbb5caf94e173b23b3138bbc6ada5e1cbd7e8000c937
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 16a1de0167a10236588d278c99e375607c0c45ed932ef2fb387a8b02617221c5
MD5 1f46ddbedbeb397c8f45242153dd75fb
SHA1 bc43f8a6844d9a6cf24a9877b1a0bef65b8fe9f9
SHA512 a6ce6ab185eabe94249e28bba69f16c4cec989ccbab4dddf71f3b0f6a2f80ddd5b8454d957f2b5851127f38850723837f2108522d4e178374784515da272d7a9
TLSH
T17B41095CAAF91108B3B67E1A9FF7A86D487EB8372F06D46D10110D4F0662B40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3172-253-0x0000021069F30000-0x000002106AF30000-memory.dmp

Download