hxxps://cheater[.]ninja/minecraft-vape-v4-client-19670

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cheater.ninja/minecraft-vape-v4-client-19670
Sample260628-1dgrmsft2j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2096	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271559288388052"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{A5AE3A7E-ABC3-4F7D-AC99-2F63488DC9FA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{60338A3C-9AB7-4002-ABD9-1BFA5230F08B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1760	2500	msedge.exe	86
PID 2500 wrote to memory of 2744	2500	msedge.exe	87
PID 2500 wrote to memory of 2096	2500	msedge.exe	88
PID 2500 wrote to memory of 2744	2500	msedge.exe	87
PID 2500 wrote to memory of 2744	2500	msedge.exe	87
PID 2500 wrote to memory of 3428	2500	msedge.exe	89
PID 2500 wrote to memory of 3428	2500	msedge.exe	89
PID 2500 wrote to memory of 364	2500	msedge.exe	91
PID 2500 wrote to memory of 364	2500	msedge.exe	91
PID 2500 wrote to memory of 364	2500	msedge.exe	91
PID 2500 wrote to memory of 5112	2500	msedge.exe	92
PID 2500 wrote to memory of 5112	2500	msedge.exe	92
PID 2500 wrote to memory of 5112	2500	msedge.exe	92
PID 2500 wrote to memory of 1316	2500	msedge.exe	93
PID 2500 wrote to memory of 2492	2500	msedge.exe	94
PID 2500 wrote to memory of 1316	2500	msedge.exe	93
PID 2500 wrote to memory of 1316	2500	msedge.exe	93
PID 2500 wrote to memory of 2492	2500	msedge.exe	94
PID 2500 wrote to memory of 2492	2500	msedge.exe	94
PID 2500 wrote to memory of 2180	2500	msedge.exe	98
PID 2500 wrote to memory of 2180	2500	msedge.exe	98
PID 2500 wrote to memory of 3752	2500	msedge.exe	99
PID 2500 wrote to memory of 3752	2500	msedge.exe	99
PID 2500 wrote to memory of 4184	2500	msedge.exe	103
PID 2500 wrote to memory of 2244	2500	msedge.exe	104
PID 2500 wrote to memory of 2244	2500	msedge.exe	104
PID 2500 wrote to memory of 2244	2500	msedge.exe	104
PID 2500 wrote to memory of 4524	2500	msedge.exe	105
PID 2500 wrote to memory of 4524	2500	msedge.exe	105
PID 2500 wrote to memory of 4524	2500	msedge.exe	105
PID 2500 wrote to memory of 3320	2500	msedge.exe	106
PID 2500 wrote to memory of 3320	2500	msedge.exe	106
PID 2500 wrote to memory of 3320	2500	msedge.exe	106
PID 2500 wrote to memory of 4444	2500	msedge.exe	107
PID 2500 wrote to memory of 4444	2500	msedge.exe	107
PID 2500 wrote to memory of 4444	2500	msedge.exe	107
PID 2500 wrote to memory of 1612	2500	msedge.exe	110
PID 2500 wrote to memory of 1612	2500	msedge.exe	110
PID 2500 wrote to memory of 1612	2500	msedge.exe	110
PID 2500 wrote to memory of 3312	2500	msedge.exe	111
PID 2500 wrote to memory of 3312	2500	msedge.exe	111
PID 2500 wrote to memory of 3312	2500	msedge.exe	111
PID 2500 wrote to memory of 5200	2500	msedge.exe	116
PID 2500 wrote to memory of 5200	2500	msedge.exe	116
PID 2500 wrote to memory of 5200	2500	msedge.exe	116
PID 2500 wrote to memory of 5212	2500	msedge.exe	117
PID 2500 wrote to memory of 5212	2500	msedge.exe	117
PID 2500 wrote to memory of 5212	2500	msedge.exe	117
PID 2500 wrote to memory of 5448	2500	msedge.exe	119
PID 2500 wrote to memory of 5448	2500	msedge.exe	119
PID 2500 wrote to memory of 5448	2500	msedge.exe	119
PID 2500 wrote to memory of 5760	2500	msedge.exe	125
PID 2500 wrote to memory of 5760	2500	msedge.exe	125
PID 2500 wrote to memory of 5760	2500	msedge.exe	125
PID 2500 wrote to memory of 5828	2500	msedge.exe	126
PID 2500 wrote to memory of 5828	2500	msedge.exe	126
PID 2500 wrote to memory of 5828	2500	msedge.exe	126
PID 2500 wrote to memory of 4944	2500	msedge.exe	128
PID 2500 wrote to memory of 4944	2500	msedge.exe	128
PID 2500 wrote to memory of 4944	2500	msedge.exe	128
PID 2500 wrote to memory of 5624	2500	msedge.exe	129
PID 2500 wrote to memory of 5624	2500	msedge.exe	129
PID 2500 wrote to memory of 5624	2500	msedge.exe	129
PID 2500 wrote to memory of 3168	2500	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cheater.ninja/minecraft-vape-v4-client-19670
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffad1c8c188,0x7ffad1c8c194,0x7ffad1c8c1a0
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,660634092359386004,11641645061452007830,262144 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,5565321988300342708,4373940925226578973,524288 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,4246582252065842104,9913531852991582796,524288 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,11014450644359783980,17871995130125139940,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,2387426714406489631,6261758595771622700,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,4617142883771444536,18197688671747735791,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,10250569438162295005,1403399087497129344,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,10612628655789327401,14627588015007354764,524288 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,16246856533906786935,13261900791250710820,524288 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,9254317803039680139,10014007230451752155,524288 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,9254317803039680139,10014007230451752155,524288 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6184,i,4925263562196804016,6926338895725060300,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6324,i,10547232722463144425,2716844643822388138,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6504,i,5107778639669699317,16351868132571441208,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6696,i,14245373690083193443,11828610037185481468,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7132,i,15725870680364163533,6048587215377376454,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6132,i,9764780640752674629,357914628376419974,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4264,i,8939380802976676479,17076437753178494346,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7600,i,7845321753746218194,3233109269611461747,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7604,i,2545887977139093031,4563915625433590207,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4996,i,8030727173441890571,14436836777969478596,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7432,i,25833818974060944,7239981207456239275,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7084,i,939547648498072564,17782075397534602450,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6404,i,15254160314915654767,12652407022517702505,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4536,i,16702341842201916195,2471523600339807994,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=1728,i,9429705681371169538,14722078801415496261,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,14399272296928128320,8741124404923142777,524288 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,3479954510035445597,15991043394638598603,524288 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,1554391009920136141,16621897903700289325,524288 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6148,i,10560194416089872150,4838502282018954415,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7604,i,3155246614618509775,17706726782203422446,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6324,i,13644940891021116454,9528679473122058863,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4984,i,3323026775959087386,16480173251727866322,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4516,i,9179647008660993680,5302245721580471043,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,18153115131371381583,3176359749109919189,524288 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7624,i,6376202445671859903,3732703747781505416,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=1728,i,1392673019484245838,7874181682987440236,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5664,i,17478991802459761446,10355416771291549715,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6180,i,8828482031769581662,9631407331075572809,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,18215945996817980026,18278387960815607684,524288 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,12964348696343173032,15011036054935576008,524288 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=6868,i,4469410274205355668,731873688133185938,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=3996,i,14304342860714239106,16737333655455939827,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=3544,i,12879871443198297109,14318937470236345324,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7284,i,1331865123016637136,1317047644802573524,2097152 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,13887073770833044908,10995641446287973432,262144 --field-trial-handle=2324,i,16906698021026227105,2442478554293654035,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 53KB
SHA256 5a14e5a998023863105327e60ca1477782315e0e7c4cd53ee12cecceb35544d7
MD5 41b5e617f8d101dc10791a16ace263f0
SHA1 e374ec25d151fa3a22d3c4606305be7e138ede56
SHA512 8b46c81b62c3b4eae5f73aac20593b2c23068da6114a21e1b90fc66053cb2d157509876f5f23d406dc8289d01e962e464bb6f7c3f23e7335ec2b47452e353ce7
SSDEEP 1536:ne8EIpbLuL2SAmkzfwk2yRW0OZqrKHEXjgRiYgfaCsd:pEInua6o4kbRG+KHEXj/JG
TLSH
T1F233F265F6AEF0712F32A93C07D5B1BEB24CCD578A42F22B778A766903D07712293119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab
Size 33KB
SHA256 9b0f533a0e261fbc85806de2c3a5050bf91b9cace3889addaa152808597f388f
MD5 536fce81c30cb851d00cb90a3d9ff469
SHA1 05727462a574d23bc97daa2d36cf7a5180354f6b
SHA512 c0afc19a7d44c58ff8260285f99eba11960f9bf458a7a9503b848e8272c83dfc5224e033d544d77c746cff6325db77507369a97763776a3bb08f0c6a73a833c0
SSDEEP 768:rwBhzDBMAHVY/A+Wzlr26UeKJuLkVbQAnVXWoXZ+7hZvM0:u9dVCX6r263EC4QAnktZvF
TLSH
T1BEE2E10525749D4A2F114ED196BD074F719F7BB3A3B42838C1CA8224DA68EAA29F3790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ac

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
Size 100KB
SHA256 1e54d4346c6822d2aa2c86e12b65ccfe1281957797adde95769d873e14bc7318
MD5 0e8a514fe418b2a458c5418d84a27c2b
SHA1 fb6dd0e14bee6488d92bfd07f6229d2ddf707a70
SHA512 fc5ffb2f20ae31621442241e1626cf93d2945b5b8b2f18cedbd22acc1698a39fdc6075bc56ed10aff83b627fa3e34d504af8b1d25e505dc9504df2ec07d05c63
SSDEEP 3072:xbcRllBOwidgrs2ntg9Q9kOEBX+NTi6+6ZKqTvtvnz:KFxrs2raBONuFsKeN
TLSH
T137A3121968607A4926443712B2D6D70CA56678303CDB4DA8BCF5A3332B3FBC52F5B958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 33KB
SHA256 5c677af2d6e78de58c66b09577213d4b1c23cf0409822378053f1c457ff465aa
MD5 68eae8ae528b3cf4965c780505e8274b
SHA1 23eea22c5ced491f0933dbdc428503548ae48636
SHA512 7fb225df90deaeff597ea4513985545b5ca6d3b4478dbe5969554f15ff4b2c1652c6220b970304884adfc2860be045599130534f1c45586a7adcfb29a8e72ac7
SSDEEP 768:9jlkCoC13VkNqcPyuMGV6lChDWaLGn7XfTpaY3UGJ0:9J913Vk5YlCRU7b15y
TLSH
T1F8E2F23016BD271E0D371D51A11984A31D0A86E5764A4B23DB20B0FDDE706E16F5FF6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 881KB
SHA256 13da46f8e9749704bfff6b6f51a202c87facf593280dfde4127e5858c28aaeaf
MD5 e0edc621e4ffaa368d2e0677d3f137e6
SHA1 e374bb44d1834cf6eb688eabe1820aa5f7c827d3
SHA512 d60643fe87788d76dcf1cd941002ceef18390cac5eaa683bce2e2dbeaba684b6fd656a94187379b71105333590412d65b3466cc9c37cdaada7e009c1c9f8435e
SSDEEP 12288:ubjDzI8Psju4mzEetRorWpuJl48nnMtu9sHj3i8W0:urzDn4etRoqC4OMu9sHj37
TLSH
T1EB15E6C7A3EC5E8FE4113D3883806D0E32D6663896A58265FFC7595EC0B88E4C765FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 26KB
SHA256 153fc85b70298beeb1d61a5f723331649e7f23bb77302a66e61cb3e2fbdb5e79
MD5 7660bd9909fb097989b19471a75f1b7a
SHA1 a389d97de580a2d6a3723112234bd2b3839ce0db
SHA512 7bc82b1ce3a44194677166280ed864f9a389a7d6e8df630db42ca11ef42be41603c53d6b54771dd904e55e73f4048571a61673902817db2e1b4a58848c6b0cf4
SSDEEP 384:IMazUGXW1v0QxaJODxEG9vSTTZdxpUU/JzmYcNgITcay5S65C0a5mlAPXoAONIRC:aUGGGQ84KiSTld8UoxQW6ja5Fvtun
TLSH
T121C2E19F8B31F4BB89817CBDE67ECD049BD88005F277667C4E7C1571448AA2988491E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 43ba606d3ad9df525255074f796582e2fe3d5b6889ea8ed2a469e3409f412226
MD5 44b0d37364ebe3cbab770577b698b5fd
SHA1 98891b0b9cbfc87221e172c3bb8c4cdc26766961
SHA512 e6a6c0129d66308fa8472a162636362b1c367d124a2a61b7c8d2bcc14e76cfb8089a36ea6c17dbf6d8b741eb778f5ad94d52fbcf9453d9e56f0f8124502c3c92
SSDEEP 96:Y24pxiMz/CDYlF9LH/wJP8/d/K7Sj/NN3O7Co/o0WJi3D/0IpKPfuz5/d/k:YjpEc/CDYlT7/z/d/K7Sj/T3O7Cow0yp
TLSH
T128A1A6398E854AD1EBC8393041EA0DC77336C2DAF1AF3E5E8D1C59BCD92275E6A21405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 b5e17dc1ac1486a821a24b80fc2de7112d0bebaa83d2ae258f3a7664bccfe40d
MD5 a40f5dd32ae58a637d2ec87913d2fa35
SHA1 924d4de4c46f734e1fc77eb6903b711e2765c592
SHA512 9ca9fdccb217dba8a5ca9298b1970faac582dc300e77a02c7e6ddeeab599aedee20eb03060769978233a83271c5805cc1cc0a7b54c9c2098f4661c7f9cb8cf81
SSDEEP 96:e2437irkD1D0rYlF9L4wJP8/qK7S0NN3C7C6j/oMPBstMBliv0IpKPFOORz2qB:ej3egD1D0rYlTcz/qK7S0T3C7C6jwMPJ
TLSH
T197B1B4398E9546D0DBC83A3041EA0EC73B36C2DAF1AF3E0ECD5C99BCD52275EAA11415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595ea1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595ea1.TMP
Size 3KB
SHA256 46e52202585c59fb95669a15143ae2238a8bc10256649b9a1c069ee2d88ea571
MD5 3f0c9440638dad88ae8e371276c5cf61
SHA1 6f058a4aaf9a63514b028806c5422ec5c23d3de9
SHA512 9660612922ef8bdfb05676b2f65c6ca6297c73fd2ac68b6cd66e87ab7f5b84618178c411da04d336b7823f91c35cd6707242a8e726ff9c0d9258ca78c0950b4c
TLSH
T1F571EA388E0646E0E79C2A3182DA01177036C3EBF6677E5ECD6D5DBC2111B2F7E26009
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 3545f1fd1fe23eca2357513ea72f3aec6b024401c3946956de82c903712aaeb2
MD5 a204d7c05a2046f5ff21cb4366d91778
SHA1 52f57a4ffab6f7593bf50e969a0966d73b9cf582
SHA512 dcc6fea091de44e91bac073b89e787de7dd13138da22d12940c0593d3871734a1e2e92ee6580bfc959b6aa0580d159c3187dcb672a73031ae03a0bae5f91e8ed
SSDEEP 384:Dhs/+bvSQbC36WoFAV/eP61ePwJAs9RAB8wHWPLkG6BAiU9HpOHa6Hdu73Itb02w:CSWiHAB
TLSH
T1728281F7C6E9C66EC92256F0A7147E1BCE1E191883283D2AC8D5AF4B93D2471E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bb09605dd741b8670e4e59313109d6773e60860871364ec638d673dd8a5a400a
MD5 08214916047aaa95e38cf8e78944f118
SHA1 28f7bf0087f93fb0ccabc86768209fa4ef4a5b2d
SHA512 301689f230526b165d5b643b1926a89b1bf72429932b358adcee68d5eca41506b9c9efb47b1b01a107c2be99965e6f0aed98639f7a36374b921622576d72499f
SSDEEP 192:sxZWR9yM/jK1Ml8Mkl/fdsKocIdpVl8iOwfuy1JHW6+WNsPRMeQFN/YCFUrqUIg9:sxZWdMl/fdsKoFw8Hbi3w/Ih9
TLSH
T11652E552A63459B7CCDBD219F941BB67D2F85472E6904E44AAFCCA0C05E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 730b6c080d950f3415ce7c9acf954f9c1f6df86a9ef31e477d39da7327347eba
MD5 0186ea090c549c19459b1c54c48d5e69
SHA1 529021084b1774280f34acb94b6fc25896904163
SHA512 b9ee8af734fdffccad4cc68bb0272e5cdbdfecaffe3cb5e9686f1a214c1ff0a832d6f9f8b95fb329f25a27f21e6e0ca2c2d68c1c6fa3c986f26829410ed6e466
SSDEEP 192:sxZWR9yM/jK1Ml8Mkl/fdsxocIdpjsilsiOwf1y1OjHW6+WNsVnA0cMeQj/XYCnS:sxZWfMl/fdsxoFESHb4Y38Xiht
TLSH
T14662E553A63459B7CCDED219F901BB67D2F95472D6900E44AAFCCA0C05E7BEC220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 fc6c68e835a8f52e537faf9bc5bc1ced6736b6e05c3280ee6b18e5bc1b001c5c
MD5 b8e2c9bb242c61c0c4794c34c7a90973
SHA1 e77f163021166fd4f44f9022399dbbbb8ea64a01
SHA512 cd8e2a01e6e30ea5b568df9fe050ebb30cac82367a50b5fe036c91f8637e4a48cb52c31a01ef49e015d52d8922ee99da196ccc33f491fc38a2f4d271a615446f
SSDEEP 192:sxZWR9yM/jK1Ml8UQxkl/fdsxT4IdpNsil+i9Owultylny1O8HW6+WNsVfkAP0cD:sxZWfqCl/fdsxTJ6XHbQ3Zp/9hj
TLSH
T1F172C553A53459B7CDEAD229B501FB57E2F4A462D6D04E44AAFCCE0C05E7BED2202C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a87056ffb59d568c9eb885f583678896f468ec20b1f97af00661de67e9d7b9ff
MD5 f5e1d538dfb1401b591240250d864629
SHA1 1874c030d75106d4f4c973c341c142d41baccb86
SHA512 4f19d5ddc6561ece68ebd699d6a336691dc72b5abfb1d23196dd72d1954ab0a2e4d7b4839f32f0efc56a6e2175c283305aecd35d1d93f73314c564098d18ec7d
SSDEEP 768:P48bqn+WvSC368F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVxroP:P48bqn+WvSC36u1jaCZLbWVKP
TLSH
T1AAE20B3B280CCB7E4F845E5DEC26AF962DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3b16b48b0a85b6e7432c17a2b8d53731e8200e0e\a446e989-d49a-4598-870d-ea2d93568ade\index-dir\the-real-index
Size 72B
SHA256 2f628ce0f35fd05d73e4ffd2667f598a5265426a65bab630e306f077d7a0c255
MD5 99c9500b0a8c8ade43fb0636d1fee3d1
SHA1 8cef6e949d71e5ba7c5ff33a0996f38201842dcf
SHA512 ce7ad839e00a3f78a241a29b4f61d54fae24171f94793ffce37fd03a5b829f0d5139475b736c85270239062db45f0bd9a3b94f5b76d1ba50ac47c372b41ae9be
TLSH
T164A00225A2801416D4D4C3F475C75180733599155B024382C4D130A8CC54BD88162482
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597e2f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3b16b48b0a85b6e7432c17a2b8d53731e8200e0e\a446e989-d49a-4598-870d-ea2d93568ade\index-dir\the-real-index~RFe597e2f.TMP
Size 48B
SHA256 16a310e0b4aeda98b2fb7bf8197e85651b01b03998c6dbee4b5d6c068c24f5ee
MD5 246ef88090853d7981b0572b3171d37c
SHA1 b1eaba81f39953efc2b80dabb8d8e4141ab7567f
SHA512 49cb425b6b49c07834cbb1ac63ae6e2b019b04842e76c16417521a83c7b86c4ef1c5b760eed24bfa0fc39f96c21a2b56d5a9627e704d66fcb7eb1a3dc2f8c26e
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3b16b48b0a85b6e7432c17a2b8d53731e8200e0e\index.txt
Size 126B
SHA256 456a21528f2b596b217c1732b1f4f3ccf23aba461a38bb82c8a478bd76a343d9
MD5 0d8ff4a76cb94112457d964608211f01
SHA1 448229291deb4ab78d8064aafd0c952f595c03e6
SHA512 93d7ec0ccacf1b229b8f8b25934555a3bc88d644ae4c7423af0b02d2939b0b3aa4d5e30f3849d320a0e233f770a94e2424c18301948d62f419586fc59c06f9ab
TLSH
T1DFB0927B8B1CC216EF42DBD2C4AEA458AA0360461E429C84CA3BB21472B51B56083A05
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59c55a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3b16b48b0a85b6e7432c17a2b8d53731e8200e0e\index.txt~RFe59c55a.TMP
Size 132B
SHA256 97068ff57f727814f9cb1d91a791d40bf68820e087a9cd6926db920da542675b
MD5 fa02e184bcd71601b3506db139b5a9d7
SHA1 5ef95278d2de56b3874c8ab7e10a3c953042574a
SHA512 727dcb2ab1cb6b2af54a8b6dcb8cbe54fcc0eaa11d9d81c12061e006bc4a33fd5b1719a663899c11f2f985698e3fba9e51fbb15b52dad7f27131a0d98bddf2e1
TLSH
T184C092778B2CC115EB42DBD3C4AEB5899A172C041F429C84C63BB11472B41B6A182A06
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593afc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593afc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 33811d5c609e133b7fa2dd14cdc36a3e523acb4d8256e992ddb99a54de2187d2
MD5 fbd8fdd891cae11e8b5decaa72558ca3
SHA1 3a7a5baac0f81319aee798e166f1a19162b8e2c4
SHA512 b66bbcdffe3dc7b31da3653881bd8be54fdaeb4cac114ad210fa2d123c5f48e37c30af206154cc5e3acc644363024cb046d1e8b3fa1563028cc8616e47589928
SSDEEP 384:ptNn/s3n9SfsNGBPVG0s2Ea+XOkjuzmn15wbAjEO8eyf:pj+9UP/slauOuuzmn12bfZzf
TLSH
T1D2928C32A8385C735EE29188F44B371B9FB890A7D7C92A54D1EC4F0D01DB6CC231AA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2ef5f33b6e53aad2bb65be5d04c574a4529daf0bdf099df874ab378e855973a0
MD5 bf7c3c67384ac700e31018739d397788
SHA1 289d163e817719a6a2133d0f5364c5acf4479901
SHA512 051339736b9577bdf3405b172a3b9bd6dfc32ef89233453c561765871d7f141732a297237069063e11c7ae751430abed1e5a1727afc6f9002525e61b061c206b
SSDEEP 384:XMiF1tNn/s3n9SAzsNG8TUNTUlIluPVG0s2Ea+XOkjlzmn15wbAjEO8eyf:X3F1j+9vLwg2tslauOulzmn12bfZzf
TLSH
T173C218F258D78836D99E8787B77E2E078EBCC0A7B5852950B3884A0DCDD61BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 74fe787c8d36c8a8cea342b30200d77ffbc5848a631f12ed07ae555359e4c26d
MD5 ff0a10bce97706e92ab373d9b2d3953d
SHA1 087c4d353c2a03557b3a8df0e20339c92e34867a
SHA512 9778faef6d91e66f98189a9c98088a17df2ae30706e54fb728f3ec5534f907fc7a26883cb3d7cd651bea0d1e27531f693ea10effce9f469a1f33547864dddb1b
SSDEEP 192:vONi6Db6QmiUyQiHBa+jLOmLtmVERgWcU6:vONi6ugHBa+XOkUzU6
TLSH
T16702E93969786CB79EB2AE49F88737179FA4207BD9952F84DAD81F0C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 67f085796563b595679d811b617a1fe961057da7816c56d673a8e8a5509ee03e
MD5 de59dc3dcfd38c50d4cb919c4eb9a51e
SHA1 20d4d6be618925f4920a959bc46f75dee0ee7dc6
SHA512 a63d97254013f92dfc0fc432d932b2f030a1d008e85adce5aa70073b80a2865f742899922bbbc30a19f21ac8847523c948216fb77d55438664444a7b3b623ea4
SSDEEP 192:FON/6DbiQmiUyRipBa+jLOmLtmVy9NzgrqtU6:FON/6WDpBa+XOkjTzU6
TLSH
T1C5123A3679389C779EA2A584F48737139EB89167DA8A7F90D5DC1F0C01DB68C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 88038515ed25870b6b76b0a19ad5e14ac9de5027bddf1fec46df833d91a19a66
MD5 ce6a30c6be9d6e056428ba5f5ebe2e8a
SHA1 9ed8ed08def481d7d54080944e90c05567f6d85c
SHA512 fee40fc4eb442ae6756de4eea33a5244f844bcd746c051145384a28601126d0caa2e91a084fd1e02cbe37e2f457155a295fc2e6470f66ae3c736e1f7095f69ed
SSDEEP 384:JtNn/s3n9SfsNGuPVGzs2Ea+XOkjuzmn15wbAjEO8eyf:Jj+9UqAslauOuuzmn12bfZzf
TLSH
T101928C32A8385C735EE29588F54B37179FB890A7D7C92E54D1EC4F0E01DB6CC230AA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cf7997ac508bd20d2cec0736e8976ceb046d62947efcc0f05da9331110ee2c54
MD5 95c9a7f0099d4a50bf79f78e9fe514af
SHA1 72ba093cee2ee892516be67d126d92ac930c46c6
SHA512 39ca31cb853df874f98369314013515181d01a944e0048aa0b6a445335c4f8e436dff05ee5864f5ac6919c4d544ba0195fa8a2083b8b3ca8176565bb163db120
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 30d4c4ae6e89c9e26eb387d3683148df9898cedb6f7f78ee595064d2c025e60f
MD5 0b0cb177f84e1a7abe70739ecf6af0a3
SHA1 2e21e3d1e31e2438ec02e829bd12cf1490b264e0
SHA512 d9180988609fec9427de88abfdf823872c3e224c54e388a8306196b98dad99566c3f08152fa1379ffb02bf738fba5406565cafe4e747129c00cb6b98541c1c9a
TLSH
T1E4E04892E32822FFC068077600C72B6837FBD13107B30A4F4D2909753C033A42E68B81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 35c663c4495b818f82a4c040728aaa842f75fd7a5522757f3ee18be0634f3f4b
MD5 1007961a24e38508819fd074db793d05
SHA1 a1820f7d4d087ea98c9903fa919bd77704d48147
SHA512 6df569a367d67d376226567d4313e9f8aafd14e8a68bc90e87355b041444a3ab1dea772dae5aa1d582ed8ec8a50ed115803ec6c5549ed9a4b532f1a517448759
TLSH
T1DAE00102E72422AEC030077100D71B3427E6D5210332030A452145A83C133201F207C1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 829ffe5c0be97b2cce9f8395380601ebcc4a6fd0b809c44c0ec4cc1c569bc487
MD5 702f492580ff972c270a50f5e8cc9e78
SHA1 aecb51764d5bb82bd4b2d3434ba7ed5eb90d7e92
SHA512 9885b9e90a26137c0f17a8ef6ae8c01deef5338369764d9237bd7757d138819f5d3b825b9f30cdfa92c46fe27c6601c9c87e177e404ca6b792ba56820e29f697
TLSH
T164E00482E76822BFC0290B7640DB1B6477FB952107B3179B492249A93C133102F65BD1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 338bea0ff35a27c5d5e1928dd698710d4f8c9a8d140cab63e03a3c6234c3d47a
MD5 bdaee5df3cb84d1ca6ad920560ce0149
SHA1 b4bf8eacece0bae68ee16e9ed943048b409af034
SHA512 58b99cfe29b66783c394a0d501e1bbf34a0470c8d4fd8e5e7dbd90388368592e895d46a12a249ad237e4214fc24e83f3492ff7d64a6a284917d3e51f3dd672fd
TLSH
T17AE00982E62422BFC039077500D71B3437F6952113B3020E422245A83C133201F34FD1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c23dea3e859c87cb64cc1abcba4144365c35d2734e2575ae5cb616c101fdcca9
MD5 008419be830d435b41aef72a6389dd52
SHA1 98b060b5e054a1894158972060f89c404f767e22
SHA512 4c019eb995024efec75db828609a6743f7a365b0d5ebbdd03f7881172807247947e320a7583b923eb3f063d699c5471a0b8948e2aa4dda59f5260411e2430ff0
TLSH
T142E00482E72822AFC0390B7540DB1B343BF6952103B3031A4A2249A93C233202F24BD1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 72eb3a98be882967d562ef05afd0ebd50b8d7fc624a0b432fa90dd113c505927
MD5 6ac91e6a0827906619086e2fd9342a95
SHA1 845f6488444378e32450b93f4e5e3d0bf50f2318
SHA512 bb22887cfd2d39148338308385ab378dac1dc547ac68e05cadf44303dd0557cc080b33bbcf4850f7728391939df786ecf013faa65f6387b10936f10c53e9037d
TLSH
T1B7E04882E32422EFC028077240C72B2837FBD13107B30A0F4D2109A53C033602E25B81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe588d85.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe588d85.TMP
Size 392B
SHA256 0d87459c376d07d2f802fae6495f175c50e2705d1c2ff13ee6e6203834ab04d1
MD5 2b441d7ba90ce806be49510380f6b295
SHA1 1aa9e0168a162010a1457cbaf7be601e053e71b3
SHA512 b00172f65da5a156aee20b834e156661e7b70017ad44f8d8d6d65e4915c602e481187da7ee6d115fcf57369146eaf5ce5536cdfe97872b0c86447986ead10c85
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 129b8767e1feb45a1631ab1130ec44406a13bc862d8f5ec0799d105a1fabd332
MD5 726089175c61f4d258f366c595eed5a8
SHA1 de34c872f9389d95218d59eeac33d6ccb1e43d6f
SHA512 9e387a3ab8cc51de7db0b6e972fe81c593a24957caf544531f5c77ff3aa73a040f2123fc4d4af7c592a2775924429a931d0ad1a8499aff8f8310d7b090659493
TLSH
T1FD41F958BAEA1148B3B76E569BF7586D887E78372F4A949E00110E4F0773A40DC72B37
MD5 SHA1 SHA512 TLSH

Submit Download