hxxps://penisland[.]net/

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://penisland.net/
Sample260703-p6gfsshx6y

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
218	discord.com
219	discord.com
221	discord.com
313	discord.com
314	discord.com
316	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2168	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275570284362501"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{21035761-978B-42EF-9957-37A5A7A79444}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{44BDA505-5897-4420-A0C5-F4FB6E78ADD8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1236	CredentialUIBroker.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 4612	6080	msedge.exe	84
PID 6080 wrote to memory of 2168	6080	msedge.exe	85
PID 6080 wrote to memory of 1756	6080	msedge.exe	86
PID 6080 wrote to memory of 1756	6080	msedge.exe	86
PID 6080 wrote to memory of 1756	6080	msedge.exe	86
PID 6080 wrote to memory of 4384	6080	msedge.exe	87
PID 6080 wrote to memory of 4384	6080	msedge.exe	87
PID 6080 wrote to memory of 2256	6080	msedge.exe	89
PID 6080 wrote to memory of 3408	6080	msedge.exe	90
PID 6080 wrote to memory of 2256	6080	msedge.exe	89
PID 6080 wrote to memory of 2256	6080	msedge.exe	89
PID 6080 wrote to memory of 3408	6080	msedge.exe	90
PID 6080 wrote to memory of 3408	6080	msedge.exe	90
PID 6080 wrote to memory of 456	6080	msedge.exe	102
PID 6080 wrote to memory of 456	6080	msedge.exe	102
PID 6080 wrote to memory of 456	6080	msedge.exe	102
PID 6080 wrote to memory of 3788	6080	msedge.exe	105
PID 6080 wrote to memory of 4752	6080	msedge.exe	106
PID 6080 wrote to memory of 4148	6080	msedge.exe	107
PID 6080 wrote to memory of 4568	6080	msedge.exe	108
PID 6080 wrote to memory of 4568	6080	msedge.exe	108
PID 6080 wrote to memory of 4568	6080	msedge.exe	108
PID 6080 wrote to memory of 5100	6080	msedge.exe	109
PID 6080 wrote to memory of 1144	6080	msedge.exe	110
PID 6080 wrote to memory of 5100	6080	msedge.exe	109
PID 6080 wrote to memory of 1144	6080	msedge.exe	110
PID 6080 wrote to memory of 5168	6080	msedge.exe	112
PID 6080 wrote to memory of 3804	6080	msedge.exe	117
PID 6080 wrote to memory of 3804	6080	msedge.exe	117
PID 6080 wrote to memory of 3804	6080	msedge.exe	117
PID 6080 wrote to memory of 5252	6080	msedge.exe	118
PID 6080 wrote to memory of 5252	6080	msedge.exe	118
PID 6080 wrote to memory of 5252	6080	msedge.exe	118
PID 6080 wrote to memory of 5556	6080	msedge.exe	120
PID 6080 wrote to memory of 5556	6080	msedge.exe	120
PID 6080 wrote to memory of 1952	6080	msedge.exe	121
PID 6080 wrote to memory of 1952	6080	msedge.exe	121
PID 6080 wrote to memory of 1952	6080	msedge.exe	121
PID 6080 wrote to memory of 3684	6080	msedge.exe	122
PID 6080 wrote to memory of 3684	6080	msedge.exe	122
PID 6080 wrote to memory of 3684	6080	msedge.exe	122
PID 6080 wrote to memory of 2552	6080	msedge.exe	124
PID 6080 wrote to memory of 3284	6080	msedge.exe	123
PID 6080 wrote to memory of 3284	6080	msedge.exe	123
PID 6080 wrote to memory of 5144	6080	msedge.exe	125
PID 6080 wrote to memory of 5144	6080	msedge.exe	125
PID 6080 wrote to memory of 5144	6080	msedge.exe	125
PID 6080 wrote to memory of 3516	6080	msedge.exe	126
PID 6080 wrote to memory of 4808	6080	msedge.exe	127
PID 6080 wrote to memory of 4808	6080	msedge.exe	127
PID 6080 wrote to memory of 4808	6080	msedge.exe	127
PID 6080 wrote to memory of 1748	6080	msedge.exe	128
PID 6080 wrote to memory of 1748	6080	msedge.exe	128
PID 6080 wrote to memory of 1748	6080	msedge.exe	128
PID 6080 wrote to memory of 5152	6080	msedge.exe	131
PID 6080 wrote to memory of 4376	6080	msedge.exe	132
PID 6080 wrote to memory of 5152	6080	msedge.exe	131
PID 6080 wrote to memory of 4376	6080	msedge.exe	132
PID 6080 wrote to memory of 4376	6080	msedge.exe	132
PID 6080 wrote to memory of 2148	6080	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://penisland.net/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdd7c2c188,0x7ffdd7c2c194,0x7ffdd7c2c1a0
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,15147264497469379983,5948616102302065505,524288 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,18233034420483774238,1398095669129073659,262144 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,1671671856389859153,9202606442877360019,524288 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,165550759995939670,10290906454255106138,2097152 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,12299095476117294534,16317951666932290323,2097152 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5196,i,11857828509546452865,2646220688182554638,2097152 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,15382072689448619903,1579167021009775580,524288 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,16283988528213916450,13661842519004879370,524288 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,8575844227076672985,11477715384200954571,524288 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5480,i,4707621743667062200,12710237774704395689,2097152 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,1834646260710148611,13155835851643909534,524288 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3396,i,18260162508936777399,16210605383297870718,524288 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,14808200323011513654,3424135428563597433,524288 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,14808200323011513654,3424135428563597433,524288 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6480,i,16876054720362179402,1560471057040830810,2097152 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5136,i,160507195749635012,10914026268922575666,2097152 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,15868486183536110001,5574686764796019464,524288 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7052,i,16946164966477403071,17595174390288107123,2097152 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4864,i,1403634465925717761,11390291249972879584,2097152 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,11925801013324546536,15526260247929140360,524288 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,2023150842357692424,7407695025746899513,524288 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5052,i,3128125838275187532,7124365781859868517,2097152 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3532,i,9759836005522815496,5454151465457982013,262144 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7376,i,11031466659959028950,4122635048228113915,2097152 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7672,i,15052004635325784187,13918556703582847093,2097152 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,16601386161381595616,4223484394670069533,524288 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3576,i,379987350525566205,9611856725879214033,2097152 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8452,i,6602409089878906876,6492041651213624034,524288 --field-trial-handle=2336,i,3841006415212782251,17371876057306520013,262144 --variations-seed-version --mojo-platform-channel-handle=8460 /prefetch:8
  2⤵
  PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4616

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x298 0x2f4
1⤵
PID:3304

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

6a476e76-b5f8-42d2-a616-92a227428817.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6a476e76-b5f8-42d2-a616-92a227428817.tmp
Size 18KB
SHA256 18efa646367c810569b83b48468e04706f36a4e6a3451966d2e6642896f2e8e1
MD5 e559ca7e6ecd30947c894f4bacfe3b86
SHA1 5a81bd3fe198a6f261870db43e03d240b86cca19
SHA512 ab306d82565d87fa699061632f6c3e45ab095bd27fe361661f38451e88c382864b1ab247c85113132eb1b82764c034d4de2b25b98b7d9f214a8dc29adbc7c214
SSDEEP 384:sxZQnocM+/fRs16z96twq7PHbKt/B/SNZs:sCo5+/fE6z9S9HbKjSY
TLSH
T17382E7066534497BDDE7D219F905BB67D6F81163D6904E88AAFC8E0C04E7BEE2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ecd801618d8f524dbd85ada04586923a00cc9293132907cb9689bf8ba6c6e23f
MD5 0cf3bca5885bdcb724a13ad235e11c8c
SHA1 938eee479016990bc4eef23f856fe20d1c132395
SHA512 e985be8fd17d9463dc5461f26d71175fdeb3c8666a4469b8b4192d1ba45dac41de754584f012dfd140baa2dbb9c7f73660aa07b45bcbd0dc6aa9b5030585177c
TLSH
T183E02B66D821EC2B49FD0759A00D4B5AEB5413572A414D4F3B3C820C8FB172645C6C9C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000fe

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fe
Size 38KB
SHA256 13da02ce62b1a388a7c8d6f3bd286fe774ee2b91ac63d281523e80b2a8a063bc
MD5 ff5eccde83f118cea0224ebbb9dc3179
SHA1 0ad305614c46bdb6b7bb3445c2430e12aecee879
SHA512 03dc88f429dd72d9433605c7c0f5659ad8d72f222da0bb6bf03b46f4a509b17ec2181af5db180c2f6d11c02f39a871c651be82e28fb5859037e1bbf6a7a20f6b
SSDEEP 768:w35mZVsqT7RAo+6tbgLdolT9YSswcTWa+O/dm8ae41u37qt+:1xTO3kb0dolT998WhO/Hae4jt+
TLSH
T11B030292A14018CA6EAE219576CCC7A7F4745D89DA081DD619CD01F0FCB326BBB51A3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000100

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000100
Size 42KB
SHA256 b78fb569265b01789e7edd88cfe02ecb2c3fee5e1999678255f9b78a3b2cc4e8
MD5 281bba49537cf936d1a0df10fb719f63
SHA1 4085ad185c5902afd273e3e92296a4de3dc19edd
SHA512 af988371db77831f76edf95a50b9ddf1e957f0230404c8307914f11211e01cc95c61e0768d55aa4347f24e856d226f7e07ac21c09880e49dbd6346d1760b8bff
SSDEEP 768:fQelRMAMlg6keZjHGyL9BFjYBuukYbpX4Qb0NJ4rLU7KoYVZ:fQeTWlg6kON8cubbpIb+ggf
TLSH
T18913F16222FD3543C412E42B5BF6B23BD3C516CB231285A3A77B9BCB25B5400A8DF953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000129

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000129
Size 1.6MB
SHA256 c143b01ab50859ac32f8c35525badb15b070f0e58c790c8a791e4624b4262f94
MD5 b101bfb9ec32764d14866a80ed3d5501
SHA1 81e4eec6e4573bcacfbf05620695f1e8665f3e5e
SHA512 5699454a5c846af5aa7c733cd7c7a80a7eaa8743d27ca8d299c92303644f039d0a159e37d86769397dd57c994cd0fec3f0195e0379650f1af865d72d2b1ab928
SSDEEP 24576:DEzyPf0tFM44fgorz+AJukE1M+vJJhcZO/7m+ua1WnA2JHM7iKM9jyZnLcBJiGzo:I2ctqrfgoHJuLvKwWhn9c4BJzZS
TLSH
T1DE7533C0DEF1ABF5809F7A4388AA8F8148196125C797C7F262B9DB5D23537713628F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 bb9e50b655696aa5240f566d1278faddb412bb1109fb565fc181dbf87e85d5a5
MD5 c11478a7c487bfecde00417e9cdf85f7
SHA1 38bb87c22ce034f21b5550b9a5aeefa7f0d977e4
SHA512 7e2200fa8ef183815662f81b49f9bfbe7ef4f75b5b5dd8c41172a2d22ce41ab1d5f85ab0e198d1094f4ed9d560acd49e5c61bcfe812e4fd5ce4ca794b9a7baea
SSDEEP 192:EQYIIp8pQNwY3296Rb8kwP+dQbW7SREWb:MIIp8pA32YG2dQbYSx
TLSH
T1DC02816987B714D0DBC4A67071E49D34BA7CE4D0F4171E2A1384A47EB3BE3C29A6D90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 65a801a487beb2011fc20ffc206898a40da9b24120721bce89e18490f63d9aff
MD5 01125f3e1f4984fd6c41819c4fd0fb31
SHA1 b698f434912df8f07edc52a770f44c12a1d071d3
SHA512 41d4343b74a95e2aadf442621a26c20c1e541866ed69f6b27ff211e75cc77055f1c1cfdc3c91aa287313fedb5cf94215e4bbfde89ed37a46c023ad9b6264ea8a
TLSH
T1025172B8E57C10A5E7E0B53076E0CA33F1B684E8F907AE9D46448835B732344EABD544
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58463b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58463b.TMP
Size 2KB
SHA256 625a70c4a241171c9c1c62d05c0779ea05aa170c62c7b98d76ae4d1bfd5d0ae6
MD5 ab02e7a6148d7123b1bc78e4cf8f4c54
SHA1 94784302482ab283f942ec6dd69379ef08d2f2c2
SHA512 d35fd833a951c2b3e3f0b4c9b84e92fcd2f443a7e7d9f448e5c3583751816a6134389186ffa8881f769b2856b136ce29c340ce609241879b78a0f8600ff4fa2d
TLSH
T17B519478E47C00A5F7D57530B7E0CA03F5B505E8F907EEEE844088397B22398EA65604
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 31KB
SHA256 cc39c118ced8221d8ffa605f2539cad1e1ac96dc8f51a7c3c09932d8a291f816
MD5 60ca14897eb3139c9b3f3f173c84d95e
SHA1 cdd2d124b6ccfc359cce34d6a855ddfd23f5f981
SHA512 e8cd58c9da71efb7295684092a80941d1453b6670760f4a61d6a652d1d455aea5b37768939b32669cb5404d2fcaef7b7d6f8825f2533418e9c74fce8ae5fa2e5
SSDEEP 768:JuC8FAPnyaoao44Cu7zx7tSkMUMA0i98/oMktxR7ClMGkGAC0Ne:aATunxRI/oMGxps
TLSH
T1DAE27651B5F9020AF2BB5FBBE8B617A15CBABE462D04D81E5860620D4C71F40CD73B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 386B
SHA256 0e01032e4447d7ec4dc5acacc0608c7c9f8993eda101270b90b1fb3487857e20
MD5 4f6646048e4c096d9e06233cd82a4d88
SHA1 9f7cfe24280c410f60cf9d1968aa195617342dc3
SHA512 4622914470829a7fbb16b538abb2d887eb4e538a949e9b9f79799fdc0713e026a5c3e96924360c3c06fe6443bb731a7179314c017c2abcd19f7b1064274dca04
TLSH
T18FE06DAC5ACD822FA21424965234FB0DE3F3761A9B886D895F4CC864B041254FBAD1A0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 1d345174421efc38c9de7882c4e8167fc49f092f1b83c18f7531572a706b6280
MD5 3983a29f7ccc062b8cae3b7d11154c4f
SHA1 812e3778b81f57a8905d2f9b1764bd0bcb132caf
SHA512 5a9a5419a4ef9c65b20668e07bdfdd5fd1b36168cfc0b5b47e08cfde4e1215dda5cf5cc7d778b25165d23c5556d6eb06d5b7398bf96b672046fda398d1d3bed0
SSDEEP 192:D1LjJkHZUJzvebOVrEvaaij6j/1UNa5r/1vCL105/2ZqfiGTp/Z7emcZ1CGk:D1L1kHZwzvebOVrEvaaiGj/1UNA/1v88
TLSH
T15D02DFF3C3E4856EDD1155F06A147E1BDE2D0955822C3D5A89E4EF4BA3F2432E211B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 0eb1aea41e049b8217cbbb834c419222cfe0b999864a4155a105d2da7ba39ceb
MD5 58df88ccdd650623a948e257e2712ed7
SHA1 13d1acd183aed95cd1b2face729ae6754e19a08e
SHA512 7745255f8417fa5fa48265032cb0434e208d0d3c9e2afa45bd3f8a9b86fbfa7fcd20b1d6cff188f2d697866a181991f59bc8d8e225f68b29732b292b32cdcb49
SSDEEP 192:D1LjJkHZUJzvebOVrEL6nBR3nFChaaij6j/1UNa5r/1vCL105/2ZqfkTp/Z7emcq:D1L1kHZwzvebOVrEL6nBR3nFChaaiGjS
TLSH
T12A42BDF3C3E4862DDD2156F06A147E1BCE2D0D6543283C2EC9E5AF4BA3E2472E141A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1f1cffe4373b467c945a2f916369e2737015529cd50fad25fe822cdc10986b83
MD5 26ee97c3ace92907b403053d73959c31
SHA1 542d63cda6f0cf010ea0ec2f0a254f84c622399f
SHA512 299bf4be7d301608bfb155ccdae2669f75d7826086ece2584240476b7e973e3a908dd56042410f4aef311a4636f0f2bd74801d147eb4fb46da75c0124ff84dc3
SSDEEP 192:sxZcgyR/PyMqZjK1Ml8MWOPG/fvpsPdGumZd5Ky8bbtdxodp4cMcCQHW6+WN5ucm:sxZm8uO+/fRs16z98o2QHb5t/XWeNZs
TLSH
T12A72D7066A34497B9CD7D219F945BF53D6F81563D2905E48AAFC8E0C04E7BED221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7202c869f7e4c9bb2c3d5469e492145f58978f36541628dbbd858a8c3f739b4c
MD5 05236d14305f924108192a06df529aff
SHA1 9777179a80e1260859cda1a0f844545bb317d173
SHA512 bfe20fe2119925940242c46a4e766c544cadedb5369b86d7936d04cdb35b894f23538d80249e023d4429b0c7fb744b2bbf856bc47db487b7cdc2ef2b00caf302
SSDEEP 192:sxZcgyR/PyMqZjK1Ml8MkPG/fvpsseGBaZd5PszodpacCQHW6+WNHcCPhO4/YvKr:sxZm8M+/fRsseYazpkQHbdZO4/ulNjs
TLSH
T1FF62D7066A34997B8DDBD219F645BF53D6F91163A2905E449AFC8B0C05E7BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 0fa7715380ba71506637b834f92a14b728eb0a5b5ee601a918babad762b697fb
MD5 ae9f38f3cb455b14f38eeeec3d5fab4a
SHA1 2fbcb530aee831dec4908cdd6c4057e4d30850e1
SHA512 638ed9942f0f0a4a656ed8a5a43103c40325fc84a219dc5b05c907b666504c291b5fd5bb50febec57a1c1aecfe2922ecaf9a8887fbc057da8d84118cb99ef410
SSDEEP 384:sxZQnoXM+/fRs16z9Ntw6TPHbKt/RXxNZs:sCo8+/fE6z9HlHbKzxY
TLSH
T19F82D7076574497B9DE7D219F905BB67D6F81163D6904E88AAFC8E0C04E7BEE2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86115c2f-aa3a-46d6-9815-b9652338a5fe\index-dir\the-real-index
Size 72B
SHA256 8cef4a674df451abf8dc47a15ff7d3c88c212684ac044380cd93ed4dd78919ab
MD5 e5ff9208c4340fc378d3a9279c3c7f5b
SHA1 00d890a8df0453deb222cdad5fb593a00cdddaf5
SHA512 c5c91f2b34bdb1472d9d6696fe9546768202510f3b88c0244873e70d62de84af1990273115210d5f0618579ad645c4ff043450b9b0dd34364202614b01783412
TLSH
T175A002181641460AE86083F1D4517FD47A11DD96A341860943A050B69CB0150D203848
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f690.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86115c2f-aa3a-46d6-9815-b9652338a5fe\index-dir\the-real-index~RFe58f690.TMP
Size 72B
SHA256 0657a6c5bb49f29fbcb284e960a9f7e484d33ef1557a5324ced2d37d5f145f8f
MD5 72127f54da05a3fa54a9de7df49db539
SHA1 e5ee1b6230e0f57fcf677b9f52990966c494a1d7
SHA512 e33aaf86b87ec00e3adc044e141805d2e1e338f51da61bc27f62487e29d626ed392dbc72721ede163bc53fbf6028b827b03c4c7b1ce8f244b9da1e2864504f35
TLSH
T133A0022077500128D18107F5622307601600E816206106168A908848DE9198947FA18D
MD5 SHA1 SHA512 TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\4f2277ea2139c475_0
Size 61KB
SHA256 eee5f893f94db1d3253cf6af3804540b6d74d2fb7439a638159b3d3d0426bdf1
MD5 bbee2a9b1b98cc08d5aaa2fa1d29d4da
SHA1 74f88277bf477be43bca7ee3be66b090b049d9a8
SHA512 1ab16e032383c658220d2817d87ddab4003741fd2969af86f3ddcc114af946ef24954f2543eb487569ce118a959892ebb6aed768f0267c76128ae229c35f665f
SSDEEP 1536:cV+jvXddNw+BHKut3JHjvGEs7RONVIqtNqaVUu7tBHHPwqpzGe/y:cEvXdA+0ghGEEROfFbP/y
TLSH
T168532AA7A2626036C7AD21D1A49A7F00F11B13561845C9ECF0BD69953F18E8B53B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index
Size 72B
SHA256 27c9a33b47a7a27eb7d4d3a6ba0e918b4506cb6bec7dfa1fff10d5a33b39af4a
MD5 61e7cfa758bc5565868a64c5d66b8329
SHA1 4d0c846e8ffa5cb10f6d28b9e5a2bc69e483d78f
SHA512 63683ae805140125382d5a36d12db0bdb07f198c2e8f33efec6a98254f435e69b24382af38f6fd17f66b1ba0dd674bea7598a4e98662b363a96efdf7d57737b1
TLSH
T1B8A0022102A6B256C40906F251C2457423645E9591054B39C294049ED8F73588643644
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f325.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index~RFe58f325.TMP
Size 72B
SHA256 5465ed6a3346ad3c98fef61f3800459d62036f72a548848aae7a5f45fa222b53
MD5 5c82086ece99f7c6df27e2db5cc46d42
SHA1 fbca211f03e08a7f60d47078e29fc185bcb77ee1
SHA512 cae79f3f32beed6582cef5736a6882ac69ffcace2462f0a2e310cba7de1773d2c53d73a80e54871660c0881ada0019ec9f9e818ab84b487129afae5d9fad494d
TLSH
T11FA002B562559440DD810670960102542706DE512802C78748900895DC774D85E42040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 3af46012a70adbbf67006ace1484dc1b0023b4c696ddf1dc1ae50937ea0e211f
MD5 3db10acd6352c8d5ecbc9cddc11b028e
SHA1 ad949f6e8b005955fd53458f0391c786d20d4279
SHA512 76d64004c60ce9951ddd8988ff27807cadf39fe6aab84da3f144fa40ac2f13dded638fc697248317a145dbcd8425f3bfbdc5391b90ec083b05fef67d15f989a5
TLSH
T1B951B51E8D463A5BCCBC127264F604C527B5A5DC6B449E1768AC9139FCC7B2C246922A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 8fe83ad9c3df6ada0f5fdd9d843296a38316dc28acd02da61e7e4c9236d04b66
MD5 07e295fa69a106dad8ac20aec869e134
SHA1 9d0e546a63edcb29ee3eecde21d09e3da1356251
SHA512 6cf29c1f93581e0c29122eb283f2dd40ab3d4c083945f1f227c45e82338d69c30ed25634d3ac35a00c7d0548928a4f0a2c0458644194db43e3cc340862c62833
TLSH
T11FA0026802A02046C80393F027A24141A36049141713231DC2A292CACC64554924924D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cc63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index~RFe58cc63.TMP
Size 72B
SHA256 171fb5e94ba9db3f9dccd7fba98aebe7a02c26d5fcaa7ce884e07dc3eff57882
MD5 09b70ed6415cc8428eb5427911d0c544
SHA1 3d39a57276f674579cd8be14da46a8264a18476d
SHA512 811396a607909bdd1d9934649db35c9e580d0a62ef58cbf935498be43153e9d515d454f80be38f80d8834a85770b3e9ae399049ef6e7ab4a7b556a1c7e249ad4
TLSH
T1D9A002109B912405C49612B11A7707565B40C89561207347C0914044DC648404D4300D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 eb846af049b4a6119d6cf8a8e073372a77c3ab44022983c8ddc610140c7ef086
MD5 b2b1b236fe1e152a31ed612fd2d33d7e
SHA1 85502c221705f858c51c68b868eb55c929f0d748
SHA512 9493bb357aa10463edf68c401f8aed19883df503c69a9c5f5fecc31efed79fe0f6015c709e0b790ac0dd395523e4a4c357c8ed31367d60f071ab7d792000110d
TLSH
T172F027B77FFB1814FDABD3D6213158A400057950D894ED5F2827B29395B2319245DCA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\8c3b85ff-3e95-4477-96fe-cee7b024c019\index-dir\the-real-index
Size 48B
SHA256 233ae2c794000e00894737f1e8f94b49b73ffdf2c72d1c9d5825ab5d6ef6cf7d
MD5 454ce0118bbdb9f64b7388751f6f0220
SHA1 c73e721ea3a6b87a8c998589d249993444a70d9e
SHA512 f803f30e0d66ee02e4fd0b8222764b8f7ac204cbd9f5d9fc1c1e4148a53a5424e58df12827cc2414b28a703ea389f0efebdca56f3c588cf31564ac5a88d867c9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\8c3b85ff-3e95-4477-96fe-cee7b024c019\index-dir\the-real-index
Size 72B
SHA256 a567753569eeb0272e6a7bbd70a6368077f641cd33c827ca554868dfcd088264
MD5 71722ab8217d3cdb1d5b4ae73a0969f0
SHA1 c96fcce6171a54ed977cab5fff28d98c8b8cb68c
SHA512 f2a590c52b3e5dee992cb31b28e5726fb23868757bc994b3421cbd8fafb87c6196cc6e437c3b86c5d7387eeda17607a2975edf2161b87404d1bea63fdd791294
TLSH
T135A002258540454BC5186A72147341A176204C158101869392AC0159BC707C45502101
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 409845a60432e8898c83ec9166e9838aaaa34c35ee26869d6e0615308b889978
MD5 e19cd5d5122c7a9f3a67584a3b289173
SHA1 8c8e4ab31a54a32a5012ff31d19c13db87c75775
SHA512 5c5ccc4e3a07cf2dfeae45241b1b6fa11ad822a1a35ab47da8132ba4ce26c2bfdaa36ec6aa3c70fab9c39fcc96d8e19006c18aa6f6181e00befae2773b7c9b69
TLSH
T1B7D0A77BA04418C1D6AB8F826A12106E431938CC249AD08CB4060D266C4AA57E113E96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 421b954fa8e507181805c28cdf28ad1474fafdc36f9d57c16c866d5c7c3716b2
MD5 d24ecff1e70f7f6aa3c537f021c27aee
SHA1 18e61b422502c1f7502bafbc4518096c331fe5a2
SHA512 928aa5087c02352b5ceca6c2f1312c25bea6f1bbbde90fdd32eaefec0206633ef792d6e74e9159135075a0ca3843bcaa7d344638e87882410201fdeb9f6d28e0
TLSH
T1F4D0A77B905518C1D7A78E826A22109A436D3CC8288AD08CF4072D2A7C76A47E222E96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58e615.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58e615.TMP
Size 138B
SHA256 79faa7226437ad51c10c81400019d5eb5bc7b908181a0ad345598be671d3feb3
MD5 b525134fea9c77707af1923c20f093e3
SHA1 7bb2e350cfbe8a6a2fcb7185ac6c7b99af9ce674
SHA512 7dc44bb7b34a761d94a831296a7d933148047972e8bf502704bea1a9178876115ef9c5996060f63daae4c8781af408333ff4fdd7e3961ddd1de25acce0ccdad1
TLSH
T145C02BB3A0400800CB120F811332105D43153CCC0C8BC08CB42339152430E27F101ED2
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e2f55c940b745a6f4d83fbd753235053ce2a1a9e\3feaac7f-0e8c-41dc-88d2-7180522230a3\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e2f55c940b745a6f4d83fbd753235053ce2a1a9e\index.txt
Size 208B
SHA256 be07b942ed6d4fd411b3d6ee021cc342d856b28185934cde4da881e54731670c
MD5 cbc57fff347530805cff29629c2fee90
SHA1 499188fc77f3b7b55d93f497f0798b8f210cadde
SHA512 4c33fbd3387fc64df4225a97ead2ed505512f46107bd7a002e806d37395573c78e8d794ca554a82ec90b13586e26ed11ea8c8dd6c5d09d22eb96cdff7395d8e9
TLSH
T1D8D023CF40B7341C3012624400235154970B5D13DC90A046C90174351CB54218E05D7C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a0cf2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e2f55c940b745a6f4d83fbd753235053ce2a1a9e\index.txt~RFe5a0cf2.TMP
Size 140B
SHA256 4b2c0c8d00f39c7bf83d6cab7f13dcd957213f453c36487c562588f6e54365e9
MD5 d957fb3c0e31b7f343ace9141c6bf98b
SHA1 a70d409680acabda182fd222dac51639081417f3
SHA512 032f7af618d7edb20626e9bfaf65dd045db657eb884b216d617e1d63d7c03559c1973fb8ad1994e9de5cd2c839c19299b06f789ecb47ddf2d51daabf16b959f4
TLSH
T1F3C02BCF403338183120029404376204D72BDC479C9081C7C609303218B0423CF00E3C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 645d6e815ba8d893883d39566746f232624e7d94355463c04578ea2e1d477390
MD5 7e67a59c44c67f3f36fcacdb591fbbe9
SHA1 d989b3ed1fee45b258b3c02bc9d6c0535cce9052
SHA512 13c0fc1993c9890fbaaaf1a0b0fdb601256543f3a996cdb3ce6996465928388240c9949a905ca37875cf67665cf70f3186dc6595f02633ed9a672b0cf75ca24c
TLSH
T150A002B0C25B6801F490077831859140B3D0CC25171617A35BA19199ECB3144E649161
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 26b5b3b6f84aaa919d2068ce4c36a9ec95425ce87c910b0d572b29dddb70a16c
MD5 6bdbcac2f1f79761f5581a8135d25901
SHA1 96e2cf0e35dcf39a98311e0901dad6f255f92cab
SHA512 1cdedca7c65fe67521060a1834ad1e48910f4fa424fdc038b57de8c812016901bd6457897305dcabc05fe8c8faaaecab134cd912d073823087beefb23677c7c4
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9DTtHnwVRnlV0m:0LppY93PBZJPtN53D5c
TLSH
T18BB26C5A703E0212397E298CB39596364F4235A37058E4AF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3c597fbedcf4ba47bf1b991b31a3a375d0edde6739fed41a8ef1ba29f896e1b3
MD5 7719b06484c580ae008eecbfa2d00098
SHA1 685377496818aab501bb98075e3e5adb4a699fc4
SHA512 4fe543a7aad7b4a16baeee815b447e7319c59355eefc4b2e21a2cc9a84ccca7909a54f60148369f2e94556fb2a94229d96cf71f5a1d8db8004d7f8a66db37889
SSDEEP 768:SF1j+9VhwgBky/BLooGs7qpdkq1A29MHp:h9Vhd/eySG32+Hp
TLSH
T15ED24A36EC54CABBADE74BD9B74A3A07DFE44167868C1AD8E6D85E0C00DB1AD4307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5677800efbcda0b4a224a10c4945f1514e244c6e7f730d9287f9ae23c16dce98
MD5 83d29b15d833673c8b9d2d30a0ff539e
SHA1 0bbafd213c2f25735c4b648c70692ca57024b953
SHA512 abcdf2bac2bcc7e6e03fa0285c9147e8d6a10b7e9df215ff406ea085c08517a892c4ef2f6623219a9e23c94259834b389c37a4ddfd2dc28bcbfc39afc92302d5
SSDEEP 384:npOiF9CcmyWCs3sN08TUNTUlI4OQckCreVKphiftGUf7qEqvBLLkN1AoPty/7Ig2:plFccps3hwgPkXkoGs7qpdkN1AoAm
TLSH
T1A9B23936DC94CAABEDE74BD9E75A3A03DEE45167858C5AD8DADC1E0C00DB1ED030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 02e4e7ce843dce5e0d816cc6b04e3ce41d6d16c50d9e668da56baa36743bd8eb
MD5 c4467b3e35358df574551d421e660ef7
SHA1 70b046c5d46acfb9378e91ff2b0d8d5c06043d67
SHA512 dbba2c485941e7d198b9312e96eb5ebbc6206de11b58a3d33e5c035838e6c36c9912f61145f53e8d6727f54085bfd3f3c4763893a58f2a5cb11ef5ac3ef97349
SSDEEP 768:CF1j+9qhwgBky/mLooGs7qpdkM1A29MHp:R9qhd/LySGt2+Hp
TLSH
T1FED25A36EC54CABBEDE74BD9B74A3A06DFE44167868C1AD8E6D85E0C00D71AD4307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 54affc49c4b2827595314bc00a9186cdb341f8c6150229a4afb991596f10bd6a
MD5 2951297ad21f2e24b6024254bed833f3
SHA1 159adc7fcf2f0a4140bb6aa5b1588a40b257c784
SHA512 bd4ee051923627c61b8335f94be7acd503c0828ef6c056cdcaa62299ec438cd770808eca9837e6d988482eead7aff083b8dd148a0b8e7af9d4980aa080ecc87f
SSDEEP 768:pAFccps3xwgbkUPloGs7qpdkY1AI8p0rs:Ks3rzySGRI8p0rs
TLSH
T14CC25C36EC54CABBEDD24BD8A74A3607DEE0916785CC9AE4DADC1E0C00DB1ED530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 bd07f361412c395c3abb12780573045975e048de7d143e7054c32fd016465c48
MD5 0ae5055c9bb57d915aaf8a5e9584eda5
SHA1 6a6b8160457f9577bef0098a36c9afd5969641d6
SHA512 77ff107736ae25054a4550945bd434468dff05200b66e4df2afb01f981d8fb8e1a7356be1ba2537e38a41048ed6ded21a00ea41a81e1f6657ae4ca0a9cf756f0
SSDEEP 384:nXiF9CcmyWCs3sN08TUNTUlI4zQckCreVKphiftGUf7qEqvBLLkN1AoPty/7Igkm:SFccps3hwgGkXkoGs7qpdkN1AoDm
TLSH
T15FB23936D894CABBEDE74BD9E75A3603DEE49167858C5AD8DADC1E0C00DB1ED030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a329ce38c78404109998715fe217c4e2eebe5d017c5e41563f2744deb8df1e0c
MD5 99d46d30212e1c45806ba00012940e72
SHA1 218a5141f60755daadfa22ebe19e660312c73537
SHA512 2c9afb4584370c6370145d6efb955c4e3e44a2cf4fde8226f3d56835330f8fdedf5892fd447e7863122eaa3e3d3796f437fca88bc3c3b702d73bba3014604cd1
SSDEEP 384:npHiF9CcmyWCs3sN78TUNTUlIm2QckCr9lmKphiftGUf7qEqvIZp2le4KV8p0r1u:pCFccps3ywgbkU8koGs7qpwAI8p0rs
TLSH
T1C8B26C36EC58DABBEDE64FC8B74A3A07DFE0512785DC5AD8DAD81E0C008719D130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9c3a47faa2143e672068bfa459d6e7ce922aa7f25bc036e0b9997be336df0961
MD5 7bbf9a86c503247d41b94388e9508d56
SHA1 03350eeac768134f9ab0a03f64e2352fb4268ca9
SHA512 c98c3328aa69b49b2928e686f1f4ffe450016e51a4808a36c22607b294627dc8b3d24888d4a21b2e6331dc0c4f48e73f6e07ddcfd86939f0afe67c061bacd73e
TLSH
T1F9E00201D300507BC17C133000C3153035F2412407F301084570417568233515730F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 924abe7ecc73ce3bf722c7e61040f8faf6b2a65d043b7981a08a8b6fdfed1c18
MD5 063a519f55ead1592d46d2fb67538287
SHA1 8e2deed10e67314bbe2cb361c2eae3dd46096cd4
SHA512 90559506a2f400a1fb7520a52491b3a9210cddb053c192ec73896e99ae5ae0e43b037625945eec60ef871d93bf50795712b5faa74454283932746821edba5541
TLSH
T12BE00202D34090B7C1AC577000D3163034F3413407F31949457441B464273D15F30F41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 565a4ff08f7965d5b3c73364f1de843b58312b802b995aa7e96cf7167cc50f40
MD5 77db6b6bdd86ffcce62de628ee2efb2a
SHA1 40fc6b747b869ab0b13363e8f735c53d8c8169e5
SHA512 0f0ff58f915e77f554443c22d3c2390b62df3b92b874f1a37b5af42aa27a6c110961c775b6d4dfd8bf622e93b36bc3ee4a232d6c37a8fb4d5e8640ba3b962d23
TLSH
T1FDE00143D34080FBC1A8577401D31A2038F3423407F309494B7481B868673A16E30F81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e622a1b5de2c90228331c04695c49c8db2b3e6e7ee790508e680c9085dee5dce
MD5 6b1d9deb80f9a604607586fe46d47960
SHA1 bd9a3d473b8e40149b767926cd685ff797021161
SHA512 8ff521b0ad0c9874f8c339099ad6de3ab21061b209e2138215e645b23f228bb437e4eb18ec64a695942b976cec4d036b4fde871d7b2a466a115903bb05bbe195
TLSH
T1EEE00242D34040FAC16C577401D32B2435F2411427F34505477145B478673515E30F41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58f21b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58f21b.TMP
Size 392B
SHA256 2ef7907395aa77125a0821c841c5a902655c28142719c6e71cc42985147cf955
MD5 2b8756dcb6873728747828c2f0e917a9
SHA1 54766a9a52df0d3aceb2c2cd4e9280e2d882e33c
SHA512 4bedb47f7e2d1200a09d0111d6617157bb43b499bd59274cab4c05d9751daa9a55b5177f3b1b21087ea88b79fc7d2d519bafc92be2badac09bccd8daf7c05171
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c0dfd60d7c790a3bc52eae2502859b199b90387cf74ed67fe7f858dd46920ae2
MD5 3f22d06894c815406d08d056d6dfe01a
SHA1 0fd5fcb6ab230e0d99f0b7e54743d11c4106c9b2
SHA512 49fd4fa277f123b499186c8a65ad88c3750137045cda75d8f4bc7096ba1a03480fcaf3959c92770a03706140c070f1fa9ab1350ee1f34161d7e8d4ce7ac1c06b
TLSH
T1D641F948BAEA1148B3B76E5A9BF6B86D487EB9372F07945D10110E4E0662A40C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/5168-1239-0x000002A39B7E0000-0x000002A39C7E0000-memory.dmp

Download