hxxps://linksnappy[.]com/home

Analysis

user interaction
yes
max time kernel
298s
max time network
275s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://linksnappy.com/home
Sample260701-e9hg6aev4m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2528	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273543174817335"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{8792E517-156A-4358-A9BD-8BA5B2080730}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 4712	4488	msedge.exe	85
PID 4488 wrote to memory of 2528	4488	msedge.exe	87
PID 4488 wrote to memory of 5384	4488	msedge.exe	88
PID 4488 wrote to memory of 5384	4488	msedge.exe	88
PID 4488 wrote to memory of 5384	4488	msedge.exe	88
PID 4488 wrote to memory of 888	4488	msedge.exe	89
PID 4488 wrote to memory of 888	4488	msedge.exe	89
PID 4488 wrote to memory of 1296	4488	msedge.exe	90
PID 4488 wrote to memory of 4904	4488	msedge.exe	91
PID 4488 wrote to memory of 1296	4488	msedge.exe	90
PID 4488 wrote to memory of 1296	4488	msedge.exe	90
PID 4488 wrote to memory of 4904	4488	msedge.exe	91
PID 4488 wrote to memory of 4904	4488	msedge.exe	91
PID 4488 wrote to memory of 5756	4488	msedge.exe	94
PID 4488 wrote to memory of 5416	4488	msedge.exe	95
PID 4488 wrote to memory of 5756	4488	msedge.exe	94
PID 4488 wrote to memory of 5416	4488	msedge.exe	95
PID 4488 wrote to memory of 5496	4488	msedge.exe	97
PID 4488 wrote to memory of 5432	4488	msedge.exe	105
PID 4488 wrote to memory of 5432	4488	msedge.exe	105
PID 4488 wrote to memory of 5432	4488	msedge.exe	105
PID 4488 wrote to memory of 5520	4488	msedge.exe	108
PID 4488 wrote to memory of 5520	4488	msedge.exe	108
PID 4488 wrote to memory of 1916	4488	msedge.exe	112
PID 4488 wrote to memory of 1916	4488	msedge.exe	112
PID 4488 wrote to memory of 1916	4488	msedge.exe	112
PID 4488 wrote to memory of 5300	4488	msedge.exe	115
PID 4488 wrote to memory of 5300	4488	msedge.exe	115
PID 4488 wrote to memory of 5300	4488	msedge.exe	115
PID 4488 wrote to memory of 2380	4488	msedge.exe	116
PID 4488 wrote to memory of 5812	4488	msedge.exe	117
PID 4488 wrote to memory of 5016	4488	msedge.exe	118
PID 4488 wrote to memory of 864	4488	msedge.exe	119
PID 4488 wrote to memory of 864	4488	msedge.exe	119
PID 4488 wrote to memory of 864	4488	msedge.exe	119
PID 4488 wrote to memory of 1752	4488	msedge.exe	120
PID 4488 wrote to memory of 1752	4488	msedge.exe	120
PID 4488 wrote to memory of 1752	4488	msedge.exe	120
PID 4488 wrote to memory of 5296	4488	msedge.exe	122
PID 4488 wrote to memory of 5296	4488	msedge.exe	122
PID 4488 wrote to memory of 3616	4488	msedge.exe	123
PID 4488 wrote to memory of 2392	4488	msedge.exe	124
PID 4488 wrote to memory of 2392	4488	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://linksnappy.com/home
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffdcbf1c188,0x7ffdcbf1c194,0x7ffdcbf1c1a0
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,6928332411558431464,946033051780561344,524288 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,2637296147515496004,7583281022259374075,262144 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,2999988287183111824,9698720112593856794,524288 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,10798438405077140905,2921155530657604095,2097152 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,16194973870065445992,11368363984928223595,2097152 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,17712545973366291590,11112561301643249272,524288 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,2439356261335261376,8070877982071224135,524288 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,10344430318292191309,11913585067154693362,524288 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,10344430318292191309,11913585067154693362,524288 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5688,i,13899909114601822227,13512514288834789930,2097152 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,15085416923685555516,617389962302910310,524288 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6404,i,816340218825828691,9461244179508841440,2097152 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6492,i,744709667118934438,16654204017217022595,2097152 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,4379751745873448834,11043428501093193506,524288 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,11765967716544490186,12233280197651746144,524288 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,4549373238423745837,7265317868234042650,524288 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6920,i,2786009708136316098,15219280015993230890,2097152 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6476,i,4324737397604036097,18382452643780681884,2097152 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,15440155195121736200,585932926260445204,524288 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5320,i,2529310419894974431,15741985894508871634,262144 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,2002107622997222761,7475942271928367651,524288 --field-trial-handle=2388,i,10650166667730861094,6059976898950078417,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 146fb7fa3d4b689771d102c13500069fda219c6e48b65ce2aca443890bb26214
MD5 80351a4046da29f131c39ba82c8a6e77
SHA1 2e33dde5f9968f5255439b10ff89ba295dc8c408
SHA512 2273720e19422b5b70a908241385a4dab331efb345495a70b61c55c94688ef8b833afc7a2619bc3606ee284b9ae9b671b38ded279cf8bcf9be22122e9c705999
TLSH
T12DE02B76C822EC3B18FD4B2964098B46E70413177A409A4F3A3C92098FF163645D5D5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 17KB
SHA256 5eeccf648364b5036d751b7de1ec22336e20ab748f37d8046b26000c9d70cc21
MD5 c58de45f56b72985d8ad0f155e92fed3
SHA1 dca96ac905802aa081f7afd3e04f2c91eefc1f27
SHA512 0b5e7ed6002fae1ef0541f8cbe9ac6d7a08cbe3107d520d91827601974c719f16e0964869cab9475b8d45821f1bbeb2c45a41a247bffd05bfc06a224c603bb30
SSDEEP 384:N7+vANCQpmBKaGO8DG0EW377qbY0GANxEzMZ7LXNKPsGLe7Ae7oBhf3Oi4:1gOCYmQaG310Y0GANx6MRD9Ye7j723Oz
TLSH
T14D82D05643032AE6F3EB618D3537C8851E8EA895CD45C706EA90DF3647D881C73A709D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 3c267c1e8e2d1bb37ec3bcaea271191da5eccc02dabaa450073908aa3bd876f8
MD5 8c38dcfba2c9c5c9b2abe49cdded6095
SHA1 6ea9e9b68ef0f532660f0a4c9e17d78d62d09e4a
SHA512 5a37d8a5f484c8fd78cfb9dcd80a1ddf53c10720ce19dfac895df06d5f5a74d4902e3c210ae2aa33b8b7c3c128352a1b0863a3e9553342f2e1223a35c01fad6c
SSDEEP 96:yNjaBkK0b9UdxoKdqmczLkX7w2kWQUYRsaX8c7psS9aa6MwL:yNEkK7hwfzLk02kWVYRZ7pX9aa6MwL
TLSH
T115E171F5A6A9E190DFEA2030B1E0A801BA7240E4F0C7FF962331533876123CD559DBB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c416.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c416.TMP
Size 2KB
SHA256 35df4989dd32d75e3e56bb1b74980c5cc56564b81ccae4bcd04f5568be1f37ca
MD5 224a99c0e81165d3f29b85017965992e
SHA1 586f73fe5a228a9c43101a6d61aae9b3f0e0e9ab
SHA512 06e2f4c225ab16da97019d523c86e40c756337c8cb01cc8f3296d95e286952696fc2a6fae47857f3ef061d6d85c1f0da375bcfbf913cbdc2eba9c2fc8bb24f4e
TLSH
T1A8519478E47C00B5F7D17530B7E0CA03F5B505E8F907EEEE844088397B22394EA65604
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 42KB
SHA256 08bd6486257d26d3e3e3d9f2fea2a8dfc1e2839e1231d1b4a756b1a82b539057
MD5 2a96508ad7aee9e1a84b1e983cd5469c
SHA1 aa53726dc538d78799567ac7347e065244ded8f6
SHA512 3bab6562bbe81b93d4d0a8ecac6d2a6b822e6d14f2cfbcb75d6a449503b9ebfaae13c5f7be5e0ae9d1df0966eae014c6c8c59fd6582c89e65856adf8dd256940
SSDEEP 768:JuC8FAPnyaoao44CuGcx7tvkM/MA0imapzacDUBlMGXGsh07R0bb:aATudxR9pucYm0bb
TLSH
T1A7136652B5F9020AF2B75E7BE5B617668CBBBE461D04D81E5864620D0C62F40CD73B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 386B
SHA256 165a359a1f5fdfb6e52f17cf962d88dbc5f1302c5e12428fbcd61b9f7c23bdca
MD5 48316b56a826d6d47cb15aea84687d5f
SHA1 aebba4d7dc9993bd5351c961bcc25571d1a4d816
SHA512 a8da63ace16170749bfc1934b85ac17794ddc6ade42337d9fa510a24a5f612b41d4a87daa4176fd3da6f5899046b99b7b94898eeb55a1aaef355a1611b6fa2c4
TLSH
T1A9E0E56849DDC11FA35920A24125BB8CE2E3370BD78CBC415B1AD4D4B082150B6BE5A0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2d2131a3576e03c479ef750f92d5a51ed35f15138b38f5e3112dc559a91b7613
MD5 115cb5295657dc6ec18605438563098d
SHA1 f971af5570424648b4a36c4ec087736766d753a2
SHA512 633938b937c114efdd98511a25476f9ee3254af2f9a12492b1264d3dda130414f7334a0d3067ea5299c63f735b568f4c2c138e41f13fac96f8c390be0edb5af6
SSDEEP 96:D1mOnuIkwC9aaij6LzBwBjEBc5G5zHeg6cZdC8Gfx:D1FnuZwC9aaij6L1kjgc5Uz+g6cZdC8a
TLSH
T1EEA1C9F3CBE5822DD91191F0AE186F1BCE1D0452436C3D5A89E4AF4BA3F2471E152B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 f87221940b1c45295d7799d58ed9b412836f07b2f346d362f56f37d646ef04b4
MD5 2489631d083f59cc9f32893b433d2b98
SHA1 f81786e4916da919f94d844c325e581c90e4f197
SHA512 15a3b38468678ef02794fef5db6ed7ea0c0e61f5739184cb0bf239dff2ac51e9c3dcf2aacb3e05884da95538e1947d912db6edc7cc055062a58ff2571b35329f
TLSH
T172D02323170430F57A5C3DC15056BC4FC73B20500601DDD561D058DC36394BD451B180
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 9651684a1d53cef3cc7ac28819a09a4104264a179c8d01088630aa796effeed4
MD5 c42979683213bdd21934d0fd3e1bd592
SHA1 aac756fa36ffbdf9446b82b5ff37b31f8f32d981
SHA512 4406360192c3e326132a0c0c122ff82cbb1ab703fe4a2aaa559bd76530fceb0682d7f034028b304feba57054c217aada02a8b38e37f6ef9c33aac31087967f07
SSDEEP 384:sxZLYqkm12/fosN0QzmC4vE5MCyHbD4FeY//PkVX/UKKGsKe4:sz/km12/f5DzmtHbe/8Vik
TLSH
T1F5A2E64659248977CCDBC519F935BF52E6F81063DA914E4C6AFCCA0C04EBAFD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9bebe1a2a58af9bd4322c1f848503d1c6626d8815e0787ea6ecd20921309720e
MD5 642afdef6fe86a1e1b8085a0db207562
SHA1 ed9c272c020c00a5c5397c116815a778eb05ee1a
SHA512 6da24655e25b98236a81c5cb24b773bb9045fd828a4fde6020e827e14e7d09881b9d3b7aa04fb339a4152c39a138fa78e2538ca2c7f171c8f45d611e7ef8b16f
SSDEEP 192:sxZVyWRIOyMqZjK1Ml8MkY9/f4FssE04VaZdCzfzodpFXVoSHW6+WNDcVooX/Yv0:sxZLYM2/fossE0uazdFeSHbDn0/HaPjs
TLSH
T1F762E8166A3499778CDBD209F645BF53D6F81163E2905E44AAFC8B0C05E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86115c2f-aa3a-46d6-9815-b9652338a5fe\index-dir\the-real-index
Size 72B
SHA256 9ef1716bc48603e65a909443f6456a056c2708707badd80b8d1d8dc437c1d555
MD5 48828455e08a0335b961b314179563a1
SHA1 19ec7ed68b3414f7159264da34069ea6335c4fd6
SHA512 86bf362db5407cb81ee9406f4b062ea6bd54b01cf122061035ee2b85f267356cfd49850497e590fa4762c1ec67078949bc507dba4421d6100e563bce31d34562
TLSH
T1CFA0021931824305C80467F3115F75C4B7F44C19268A477150A80585FCD0BB04187449
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a6e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86115c2f-aa3a-46d6-9815-b9652338a5fe\index-dir\the-real-index~RFe58a6e9.TMP
Size 72B
SHA256 0657a6c5bb49f29fbcb284e960a9f7e484d33ef1557a5324ced2d37d5f145f8f
MD5 72127f54da05a3fa54a9de7df49db539
SHA1 e5ee1b6230e0f57fcf677b9f52990966c494a1d7
SHA512 e33aaf86b87ec00e3adc044e141805d2e1e338f51da61bc27f62487e29d626ed392dbc72721ede163bc53fbf6028b827b03c4c7b1ce8f244b9da1e2864504f35
TLSH
T133A0022077500128D18107F5622307601600E816206106168A908848DE9198947FA18D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index
Size 72B
SHA256 3b1f21ffa4c2cd430d46d9e860a492ffd1f320097438d0f59a505e1b16acd893
MD5 57bc57c2c2e5e4f5c977fd0182ff2945
SHA1 76a9905d5000bac58f97629296318ce59da58863
SHA512 575a414b2d6d8c6411cd413ad115249505354754f54e198e4ec4a02d1960dcfc249db25af7a04ac5fb0d46b86df00df5092633082a010996b2ca66f93d8565f5
TLSH
T197A0022131E40443C0610BB151C326B373289C19AE8A831550A40655AC515784947155
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a1c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index~RFe58a1c9.TMP
Size 72B
SHA256 5465ed6a3346ad3c98fef61f3800459d62036f72a548848aae7a5f45fa222b53
MD5 5c82086ece99f7c6df27e2db5cc46d42
SHA1 fbca211f03e08a7f60d47078e29fc185bcb77ee1
SHA512 cae79f3f32beed6582cef5736a6882ac69ffcace2462f0a2e310cba7de1773d2c53d73a80e54871660c0881ada0019ec9f9e818ab84b487129afae5d9fad494d
TLSH
T11FA002B562559440DD810670960102542706DE512802C78748900895DC774D85E42040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 360132e22b91a895afd9f039d49b053efc7de367e6c60ab436d91ac73e511583
MD5 b064902daf90b8d0ac86716f0fa96ddb
SHA1 19c2d50e99dfcf7234c85da4054476655a35777a
SHA512 d23f7600d93d9e712ca48e1fd619c554efe61ea00df6b518af304a4c5ba53bfd4f781d5f1cfe1f93537738dab7cb9f9ee76291e386ffbc84aa705d1cd3862bca
TLSH
T11051DC1E4C461607DDB8167364FB04C4377565CD66588A0F24FC2134FCC7B7D185D265
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 eb97f0dee18ee46a9a851e338d76e4d8ce09043805c49d8ba5509e2313dc660a
MD5 0f5a552951a705ebdd37d4a93a75cc18
SHA1 1d3cbbc6b410dbe1e1f65048884fef6c171b418b
SHA512 b18142dec76bc640410fe529562b6a9047f0c408b268fa66bba48380f1b1c2ee09394beadaa4e902a7ef0543553d20324f363ab5ff233e6482264800bec965f2
TLSH
T1C0F027B73FFB1850FDBBD3C62031496400057954D894DD5F6817B69795B2319205ECA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 06ba0d09660a6bbabfd9e09ee20378bd77a5629368a216c4abd6b1f901fa2dc3
MD5 25db426753ad4f552e2ccf03573a8159
SHA1 26dedfad7991f4ab5cdf1d0dbd55361f08b8bf38
SHA512 85ab8dab8f455dd55738989493f72f1d4cfe322eafa8d40b0ff7d3b23563e215ca62b4c18a3136e25624285ff433a9e0f8e99be3d4e5a375a56678a0e2d33213
TLSH
T1C3A002A1928B2802E4050A70314665807360CC15054A27036BA4D0ECBCAB5806149101
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 9f0b9564573374a79f06acec693078a884befacfc0634e658b8df4c6b595f6b9
MD5 75a9a43ca9c1dc4ed70a6bc5dc8d3d65
SHA1 61e5394fa970e3930c79bc1b7e30c1be08fb353f
SHA512 851c2c0bafeb6f6a6879640b88c6eda3a1021f8cd74a423132f1341a39509be6af3a479af51aa9ef9b10366acde897e1f67c15651ad4a0ddbc6154ee6b741e83
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9DTtH4Jco6GK3OT8QkFgyvAQjS49g:0LppY93PBZJPtN53D5R6
TLSH
T1D4B2695A703A0212397E298CB39596364F4235A37058F4AF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f4f1a199309611bc6e5b57e6bc78c1c85faaa283b391b4b90962c78507ee34cd
MD5 7539c0a5515743decad366a23c72f290
SHA1 71946816d525f483c0231b4c4b926d23534d4d1d
SHA512 4c86d9478eb5c986dc7bfc78f8d93b0125e8f9e810cd18d5bc6ff4c3c2c718d248435e712b9686ba7e40470ab95dd7cbfc0723c8ddd3ffac3522d370e9ff31f2
SSDEEP 768:OF1j+9S3qwg5kLRooGs7qpdbnJA78Kza5JR:F9S3gzySA7tza5JR
TLSH
T14FF2D4F698D38977D99E4B87A73D2E029AFCC153B5885A84B7D81E0CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ef5f61090fe22e2659631e2ab05797675e8be5b58a2e8d76623a109ac10dcbff
MD5 647abd664378b698ae769a7d23cadd22
SHA1 3e4395f3b68463cc5d35f2da4aba28c509ee258d
SHA512 8a1a5a0b96f15f0f3fd943f529da436d0fd69c3fab7b84af0f6aba6d5f562dd667e1e55f1487929072f2bf0b154585f091a0b91d034d1d6a14951211c2222c24
SSDEEP 768:pXF1j+9w3qwgjkImoGs7qpd0nJA78Kza5JR:A9w3OYySH7tza5JR
TLSH
T1E4D24A36D854CAABEDE64BD9B70A7B07DFE04263D68C5AD4D6DC1E0C00CB2AD530B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cad048abf9668b29a9c17ac52d1be6fe8ee9b49db701699659869585b9515b77
MD5 da0c61ad0d503ea050bb0e61ded01a2c
SHA1 dbbcc9add5c0fca1e7c35f67333a4fe5bd6db53f
SHA512 c442e991fa8127541923f9f09940a67d369087d2ea8935bf21e31597d5f6139611071047915d8a17537d7052c02afa468dcfc0b005ed82f51cf0d38a6cc8077a
SSDEEP 384:npHiF9CcmyWCs3sN78TUNTUlIm2QckCr9lKKphiftGUf7qEqvIvp2le4KV8p0r1u:pCFccps3ywgbkUwkoGs7qpwyI8p0rs
TLSH
T176B26C36EC58DABBEDE64FC8B74A7A07DEE0516785DC5ED8DAD81E0C008719D130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 98646f15389b9c8634b9282daafdd7c8ab8e4cbd7a29b7e3735daf6c8dedd6c3
MD5 2d71b45e85b0ac22dfaf4d93e4daff20
SHA1 faca647cc1ff0805599666520f10b27b3109095d
SHA512 5f4130d5bb4800a92aefa66dc97c8299d9f8cd13bd447eca2116c4dcd3fed50ad7dd991bfd00139aa88d79d60460e64a774db0c1d5f2188862cb759ccd3fbe01
SSDEEP 768:HF1j+9w3qwg5kMRooGs7qpd0nJA78Kza5JR:29w3gcySH7tza5JR
TLSH
T1F5D24A36D854CAABEDE64AD9B70A7B07DFE04263D68C5ED4D6DC1E0C00CB2AD530B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 26b95803870444188ef1a8e10a8e8f3fa1254ba38723fb6345971fe953f326ac
MD5 444a702efa1b89bc681f5e8b76170fbb
SHA1 e2b6b704b932c784ca9b00e2f507fd60ec7007b5
SHA512 26c78d0fdff631dbdd92916417f34f597e89f3513cb336683c8480db9970c52c1fa7a85d8aa0cac1ce62aadde412e9afcae35f3b9d6131dfc196a301fee939ec
SSDEEP 768:phFccps36wgbkUajoGs7qpd+nJAI8p0rs:Ls3sUySdI8p0rs
TLSH
T1B1C25C32EC54CABBEDD64BD8A74A7607DEE0526785CC9AD4DADC1E0C10DB1ED430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8f322f98a5843dda60af2a650d47a17511e811a38b2ef15571c57e48ea9be1d3
MD5 7c31a1caf9824a9b0dc6f66f9c17b8d0
SHA1 fef61718d4654f58ff749cc3928bdcd55c798728
SHA512 cfc666c0f5416c2ab5cb6a5653880acbc79a3b7a7e1578e3eaa9e3b641c6d455c8263401d99be6f95c932312d3607ea5881982fedb043c8ace9bb7032b020b4c
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 de3cdb0af9cb1d0ced10b13bd08345c4eeb03a0b240e49008cef20ec49f4ead4
MD5 7271f2ed9c83767f58ec6c54993a70d4
SHA1 9c61af60230a14e6e90646efe128866c74dae941
SHA512 a30493fe94b6f782cbd7dba2b319a824bec40364fe88abfe7e06e4dfd684c25c7d91039d7b883ba5f7b73110b59b60f8e37921b69adf61bc69486232150e8b6f
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe586136.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe586136.TMP
Size 392B
SHA256 3e416f2e4be29a9f99c35e079399d2d6ba9c9ddfb9660c1a3c6dd3ba1a92b710
MD5 224846e471e1892f822f78aa26b31ee0
SHA1 8de50bfeb6385d87942a551c8792cc806d221532
SHA512 9d424b224ec58ebd0d89bb21beeab13a60a9ae7e34ea8d21950ae5937c9e85743633d09398eefce24c5a358afc1f0105dd57c816624a8b1e43d3d4c3e01fce82
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2c383975f85efb8a50a15bc280b6acfee519990e8eee2302533db7e568129063
MD5 e701f9510a69ed7077c08f3843dd5071
SHA1 928f253ef3d1a1b98db531c202be27bc0075a5aa
SHA512 7e7ddb5a3652300cc6f3e93c16ba3f4488659ab2f4ef751b0cae1eccdd00a9a285454176ccdbdac58de941ad2894a9d38e10270d013ffa66847d23b4e24ec4c4
TLSH
T1E3414C5CBAE91158B3737E4A9BF6B86E447FB9732E06949D00110D4F0672B41C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5496-206-0x000001E3C5130000-0x000001E3C6130000-memory.dmp

Download