hxxps://c2-www-web-where[.]whale-tw[.]com/cmd

Analysis

user interaction
yes
max time kernel
449s
max time network
452s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://c2-www-web-where.whale-tw.com/cmd
Sample260705-2nhmcsf18x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3296	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277650248297449"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{601A3A6F-C120-437C-9823-CAA16FE7A45D}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{354D7FC6-2685-462A-9B4F-2D0C8C4BC8A5}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 2200	3156	msedge.exe	83
PID 3156 wrote to memory of 3296	3156	msedge.exe	84
PID 3156 wrote to memory of 2320	3156	msedge.exe	85
PID 3156 wrote to memory of 2320	3156	msedge.exe	85
PID 3156 wrote to memory of 2320	3156	msedge.exe	85
PID 3156 wrote to memory of 752	3156	msedge.exe	87
PID 3156 wrote to memory of 752	3156	msedge.exe	87
PID 3156 wrote to memory of 3524	3156	msedge.exe	88
PID 3156 wrote to memory of 3524	3156	msedge.exe	88
PID 3156 wrote to memory of 3524	3156	msedge.exe	88
PID 3156 wrote to memory of 4660	3156	msedge.exe	89
PID 3156 wrote to memory of 4660	3156	msedge.exe	89
PID 3156 wrote to memory of 4660	3156	msedge.exe	89
PID 3156 wrote to memory of 3828	3156	msedge.exe	90
PID 3156 wrote to memory of 3716	3156	msedge.exe	91
PID 3156 wrote to memory of 3828	3156	msedge.exe	90
PID 3156 wrote to memory of 3828	3156	msedge.exe	90
PID 3156 wrote to memory of 3716	3156	msedge.exe	91
PID 3156 wrote to memory of 3716	3156	msedge.exe	91
PID 3156 wrote to memory of 1576	3156	msedge.exe	97
PID 3156 wrote to memory of 1576	3156	msedge.exe	97
PID 3156 wrote to memory of 312	3156	msedge.exe	98
PID 3156 wrote to memory of 312	3156	msedge.exe	98
PID 3156 wrote to memory of 1808	3156	msedge.exe	101
PID 3156 wrote to memory of 2036	3156	msedge.exe	115
PID 3156 wrote to memory of 3112	3156	msedge.exe	116
PID 3156 wrote to memory of 1648	3156	msedge.exe	117
PID 3156 wrote to memory of 1516	3156	msedge.exe	120
PID 3156 wrote to memory of 1516	3156	msedge.exe	120
PID 3156 wrote to memory of 4028	3156	msedge.exe	123
PID 3156 wrote to memory of 2276	3156	msedge.exe	124
PID 3156 wrote to memory of 2276	3156	msedge.exe	124
PID 3156 wrote to memory of 2276	3156	msedge.exe	124
PID 3156 wrote to memory of 2976	3156	msedge.exe	125
PID 3156 wrote to memory of 2976	3156	msedge.exe	125
PID 3156 wrote to memory of 2976	3156	msedge.exe	125
PID 3156 wrote to memory of 5048	3156	msedge.exe	126
PID 3156 wrote to memory of 5048	3156	msedge.exe	126
PID 3156 wrote to memory of 5048	3156	msedge.exe	126
PID 3156 wrote to memory of 2272	3156	msedge.exe	127
PID 3156 wrote to memory of 2272	3156	msedge.exe	127
PID 3156 wrote to memory of 2272	3156	msedge.exe	127
PID 3156 wrote to memory of 1052	3156	msedge.exe	128
PID 3156 wrote to memory of 1052	3156	msedge.exe	128
PID 3156 wrote to memory of 1052	3156	msedge.exe	128
PID 3156 wrote to memory of 824	3156	msedge.exe	129
PID 3156 wrote to memory of 824	3156	msedge.exe	129
PID 3156 wrote to memory of 3028	3156	msedge.exe	130
PID 3156 wrote to memory of 640	3156	msedge.exe	131
PID 3156 wrote to memory of 640	3156	msedge.exe	131
PID 3156 wrote to memory of 928	3156	msedge.exe	138
PID 3156 wrote to memory of 928	3156	msedge.exe	138
PID 3156 wrote to memory of 2004	3156	msedge.exe	139
PID 3156 wrote to memory of 2004	3156	msedge.exe	139
PID 3156 wrote to memory of 4764	3156	msedge.exe	140
PID 3156 wrote to memory of 4764	3156	msedge.exe	140
PID 3156 wrote to memory of 2112	3156	msedge.exe	144
PID 3156 wrote to memory of 2112	3156	msedge.exe	144
PID 3156 wrote to memory of 3344	3156	msedge.exe	147
PID 3156 wrote to memory of 3344	3156	msedge.exe	147

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://c2-www-web-where.whale-tw.com/cmd
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffe71f3c188,0x7ffe71f3c194,0x7ffe71f3c1a0
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,3279185709433543676,13525303860941685302,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,41082396466614946,3826849021485560997,262144 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,14592389153740615387,15967804277390907327,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,16501609496379606358,3306319615429257071,2097152 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,13347381595377628414,2189879021357043352,2097152 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,1742409476059028759,6470970139112616369,2097152 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,14118270346300349248,8404527787388178740,2097152 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,2807062607507653323,17219999554630111274,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,3273136663595135514,10087194451615734195,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,3515678039828247180,6149532338742522292,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,3515678039828247180,6149532338742522292,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,10652216885326664458,4252164745345040203,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,16379039768828332313,8870998815534462646,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,6510104944226236788,5008944529166974290,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,13309205495197802098,1501500195787121720,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4492,i,2161060860712087622,4262589909063163170,262144 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=2464,i,10668228444684903407,10521241602891248236,2097152 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3264,i,570514483664090255,9615230179459482745,2097152 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3640,i,9806485749459816861,1428496750541626832,2097152 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5792,i,3356146280918420723,8218407092907276289,2097152 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5752,i,17757935055284659162,11585912168266544856,2097152 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,11831614460799651320,7832254377189031208,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,7563086986670642556,10697664719469807588,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,6707489628750243409,2382152015739972503,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,5004069828545727379,5377566256481955096,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,14426043872528613598,15106789759613159391,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,15328884433122686005,10586016165176911270,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,14586304706224322508,1425802687156789508,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,10323073839207927470,2882180086537186502,524288 --field-trial-handle=2268,i,16199557703592691980,16908417873623928392,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

38ec3714-3512-45a8-aaf0-42adb390ae2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38ec3714-3512-45a8-aaf0-42adb390ae2c.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 eb3d58ab278f43a3a3b405a9752bde16cca713a05349b6002437513c3e8d9999
MD5 ad4bb9f08b5d01fb00ae1108d972b24e
SHA1 ea7f235fc224dfa40b95e9fb838a896e89df5319
SHA512 031c59f7d7771f9fa84e93671a06a47ae5e4e5ad193e3ee460608415516ddb5d4723559a6fdf232b0561cb5f211989d403a7b9cb7f5fb510c77480466415392f
TLSH
T1E1E026881ADCC3AEF210758761AC932C86C03B5ADBC969CA17208698700588CA7E6AF0
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 67KB
SHA256 6111f72834ea242bfc28124a5f6263ce01a0217d6f23a506ce60fc54856a6135
MD5 8fc9e71ae75546ffe8fc9d9130a8b52c
SHA1 b514e431a45c17a723e7977fe9ee1a3a90dad723
SHA512 b3d647d945c457c2a4f69b733055426bdcc5799482fd3f961724695b57e2936d35aa29942b37e5fa7947cf1945be0536a135d53570ccc0d607cb93cac8d4480b
SSDEEP 1536:zEIkkLv2CzrJDBW5wp6KC5wRFtCsTtS9N165Ii30Hn0BFlDd:gaLv2CJewp/NtCsTwN1xulh
TLSH
T1BB63024BAE619B92CF0031D47D9F5DFF639BC58EB3951512C210263EC66B1B1F4A4670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 401KB
SHA256 7d1378a697660aeaf0b001dae7bcd956e60767c2d9b0698dd616c70004f866e8
MD5 209c4e6c82dab8c56d5887eb6078d94d
SHA1 448a39298cb9b3d2781a9d174487b41aaed31924
SHA512 0331545a0e307ba847a0eaa02f12648793aa59ba826d98f81d0e35afc5efaeb89cf2e2608cace5eb8b19c05bbe6bc6542b59be3f4555bad439b888c8b674f75c
SSDEEP 12288:LTCoHYQIhuIbPUCxQzAAm3AgsnwrN+gHU1wbDW+Mym/:LTlIAIbsCWcZhzNl016NMx/
TLSH
T195942319419795AAE14E7CDD0DE02B7426AD5173B20B332F31A104DBBAFAF444D31EAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 27KB
SHA256 4055c08923c81d63735c1691baa778c332bf680b8c4eb057d7b87e2c00c5578d
MD5 aa6a30350189be311d6f87b7d145d85b
SHA1 79d0105a90db8fe73876d31dc4f54bb9a194002a
SHA512 3563cdd2399d4ffe7f76a2b252800e2b767f7fc776fe1faf1bd385cc41ff9305c7a5367a2d28d6bcb46b9202461c23b86ad6f1f3cec2cf51ffbd181000651037
SSDEEP 768:Y+8X/NT0ZezFy6uLGsyvi7ssXAS39YGiE1TJnhC:Y/ZexL0o5X2k1Tds
TLSH
T1ACD2F104AD3D7AA06468E3D332713166FDA696A10B7702D2C615E625B3983F42BCBCE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 77KB
SHA256 a45a777a0f82b517510ff234571bad345a092c799622c3c10bf7f1c20cad03f5
MD5 b119e9517893ddc7dd629b9da33df5db
SHA1 460d4cf8e8c7d5cae8173049c62fc4198ff9103f
SHA512 000a1c2e06f4663f08da56cec2bc9cb4bec14c6f6b419174e55c6f8668c2b8b9ef30a165c0da8d88288371658c1532720119bbe783440308ef763cf766c6b5b7
SSDEEP 1536:vIjUEBEzyN+OU4d+ReFNsVUecM16UPpBsviBROlLrQ:wjUEBxPUYJNZMYgBsvirOZE
TLSH
T1517312498316E1860954D86405790EF4D0CA767DBDE65E7EFC313629F3C24A6F70BA90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 19KB
SHA256 b9e910102d058a696ccfcc1af565d3844c952c7e2127915ee2953f66839a9555
MD5 9f98b25682d26512e43c53b3ab379849
SHA1 241687b6aba85f978728113da6a9831378bd6320
SHA512 9cdd2d1b0d782879d8e089292d6b7e44efc176ae733e0cd223a1815636eb7776afdfef1d46a63121a1cddf261aa1af5741138e5026d8abaa1586f32507068e80
SSDEEP 384:720rn9jqnI9cpR2kDPi+Ck9Zl+jog912SHX6Xr6V3FFBH/nRLQ5wDhxCmH4I1:nrclta+Ck9DoogP36XmZXBZPDbBH4Y
TLSH
T16892C0A09992C88ECD36F4271E5EE9C3595CE4917E3A0BBB07D26D5B084164A7CB21CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 59KB
SHA256 2a43b4cfc47238c170257b2345f451828a25270327bba55db5db07398e1199e8
MD5 3df2a75a9ddc950ce672b11962b8d017
SHA1 aea2d21e8d4076f6abc88225e5182c0f5c6a83e2
SHA512 627c2c8d6a6709f714e16e9094e1e8b33ef228195f220b5be738ef09805897785ac1e02c3f48dbfaa66fea1524a1be3ce6a36f94172c82439e72cbc1c83866af
SSDEEP 1536:yG7MtNK2UY9XlJdEISDLz+9BxP8xTGxMYAWwd05TIbGTdNDVsFy:yGCNKjY9VJdWLzHxsMp4IbeVqy
TLSH
T1605312B8D9571FAE9722CE3C6B4A0168B7714A9A52DDF04D12D8080BFD816D25E2A4FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 00671f5c164eff0e23804d1c6552e491661341a7cf8c49a755bab104528569ba
MD5 fc0493972c89ef5a79e9c5e9f84016d1
SHA1 ac85ef3c00c181c287327dbcbcf0cff3604355ac
SHA512 282fdb53cad0e5a3a63f8697547872d88faaaf83e95e85d2f1d4b112f7c929673b92c9d4d7c530021bd2d6f5a29dde051bf4a26e64d9e2b302d4c3e4aa433a55
SSDEEP 96:GfXdQ6tR2ywenv8bEdPoWhkTxIWOGcyHi5AMWL/840rJw3:G/3Pnv80vOxIWZTcAx/sC3
TLSH
T19CD1B8BB6EE31A82DF11B371AAA10A422939C9D7FD17DE131C40D2BEAE473F41885171
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 404426d6ed429e387dddad8088df80c75b55ef8bb20d3a27bc956a4176c12436
MD5 0049ccef3ae220ef6c4526a3145374f0
SHA1 4fdfdc1c4b663d30917bd21a30ab7fcff7ddad0b
SHA512 9667fd597e93e87b10be96b14fa1a88f989deccefd9fbecd1e6c88119415e5bbdd30d05c172fa5d7b9e6daef17809d06aa33f0193069d2be8006ba1cc43fa66f
TLSH
T13B714EFE18E30FA5EB21F2705AC10242B13085EBF613ED674D80D7FB6D12731899A158
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586462.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586462.TMP
Size 3KB
SHA256 403b6d26508b239dbc3e730ef9772c785e797f07e2b3b1542c923803d9fbfc44
MD5 12215658e5134bfaca594d8598ab2daf
SHA1 f904d0f3b042aaf41cf9a87df24b168b61bc323f
SHA512 2b7db69d4760fea48fefaea0adf39a08ab39ee9cfafe5768d0879e198c5a9403fe45e46cceff178efa6fee26380e63419e14fee7fbefd134649479f02f0ee595
TLSH
T153716EFE18E30FA5EB22F2705AD10242B13081EBF513ED234D90C7FB6D12731499A158
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 198KB
SHA256 95dd7e685325ab30960df4572639712cdb4b66dfe3603721371ab2d08a3f95dd
MD5 706ebe416b742ed49af8a0f60c77cc61
SHA1 74bb47638319997705ead2debb71c79dcf0a43d6
SHA512 b6e384c08b0d9bdb05ba7860f5049e6940d33e33530fdf43d8825e37192ca34974709d65655f4d40b07e661be77453d188f0022e723fa5fce61e25e19addb715
SSDEEP 3072:7ytsPtPFkT6SqdwoL1TEWownPKq6TErlo2z+4WdrhKzgptcJDI:tEWfybErkwU7
TLSH
T133146D0D25FD72F2C70891B61C528A9993BCDD8426EC614FA4C1791CF3FBA8523B4E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 970d71dd40d707721a177a229ec470a750a3337e9707ac9cfea272a510b5ee93
MD5 f4e64949b39c3497813e2108a4dfac75
SHA1 17c30e7ed20df6b4895bb2b0c75619237c3a66ab
SHA512 4366359b9d539279647c619f996f47169f8dbc9785d606c9ac484118eff932938feb1e9e350070895c049a03ee642fbdcfec34f869d6f0ba8a6847f3367662cd
TLSH
T1EFE0D83CC5D9C3DF615464D79524BB0DA597691E97CCEDC51E04CC20B08A08C996D5F1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 7b836a06301cdc980390a93c23d5af237e1137543b8d98d36b2c29a7d9cbba5a
MD5 cc53ca5684fd87073966062df7a50125
SHA1 f69097531c988e10d7bade02357c27e5b048822c
SHA512 431a72cb91553c8663eef3c5216aae8c4f67dbe1220bd515f5628cff0b1090f46fb4792981f70f618c50f985b7c4aca3f7dcc5a2c5a484eaff34563f78b000ca
SSDEEP 192:DIQXaQbS8OF4CREp4UR1J4sBXv57VHi1H8dAftsaMX7tkj6KUx:DIQXaQbS8OF4CREp4UR1J4sBXv57VHiu
TLSH
T13E02EFF3C3D9822CD82196F4AA147E1BCE2D196483683C69C9E5FF4B63E1471E215B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a79d17764b1a83ca22e86952312af3dfc7e32de7e487b100decf00e6250770d2
MD5 4e7cda927e0b97e8f1dc81997df459a6
SHA1 831f65bfb403fe330719aab1c405154b9d2465b9
SHA512 f9d5e3d3755dccec2d6080618a4ee7e9775a86e62401b448208557afe6ca42641731ba9d6c315cac2a24d827edd09d4542e15a2727ddfbbcd9f309adbda16548
TLSH
T19C41C0B3C7E4865DDC2192F06A14BE2BCE1D091483583CAA89E4EF1BA3F2471E105D4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 ccfb13be34706a5fb8475eb0ae39fe5f00e8df91113cbc24884444d8bb3ff1fd
MD5 20b615dbf109a2e7b0dab02baa475ebe
SHA1 bd6037a3bc35aa03b051deaa0bcb2cd6114638c4
SHA512 0298eed9b11467bf8e27eb26ee22150c21d97ddfe59c24ca3ad0d5160f22a6395804f400924a831e315ed8d3e192668a6e42f68f0517c6ab25e46008d1d5da72
TLSH
T1D1D02353114030B5556DBED75095FC4FCF2720744401DDD410D0995E053145D450B245
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5972f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5972f4.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 8863536b8afcf27ceba7abedc9c1025c3cdf57f3159e2d219274df7a1e527d51
MD5 edc86f7d2156b49d59bbab7d9eb586c5
SHA1 2c8442b1c96e323cb818a341784017d2fb3bdaf5
SHA512 a370a11ce1b55c23021a0d471fa310c312ed88459b5fdc7fdabbc8770bfa52c4507c91780a8cf174edf83bea4802c14092534a2c5f53563eef1ff63945473c43
SSDEEP 192:sxZbQUnDRmyMqZjK1Ml8UQL+kq/f8sZKxkdHXPbzmZmdpiu9jalHW6+WNp442z5L:sxZvnDfqJq/f8sZUk5nDiHbVowc/kQ
TLSH
T1FC82E85269345977CCE7E229F941BB53D2F85462D6D05E94A9FCCA0C04E7BEE220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 96392cb6b544514fa46c239d4d129668aafc7baf97be33fe581a2756ff9c7294
MD5 2feb4e38132159220d2dd70ffa9f58dc
SHA1 21df808555852e422203f599d1e316e69244cf55
SHA512 6d6bd965f96004d016bd1b65653c74901b55a6b1312c3a50ce277b035b4affcff69c94e63f596be7844c74d8b7b20ed21f32a00e163f7b35a55930615eeaf995
SSDEEP 192:sxZhRmyM/jK1Ml8UQL+kq/f8sZKxk4IdpbJHW6+WNT291JYIugPdIg5nJ:sxZhIqJq/f8sZUkJlHbTwJpD
TLSH
T12C52D7126A385977CCDBE219F945BF53D6F4587292901E44AAFCCA0C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0e5b26fb4d74095aea3b13a4a9afe507372ac250f6da8cf1b4a2ddd8e4fac517
MD5 e341052ae096a5d1c189158d28d65454
SHA1 9ac03aeedd4860b42642a284b6ddb642f05843e0
SHA512 6a267b2182663fcbe229c944fee9bc5be41a71fb80bed7b5b1581e97ce46289791aeb2851eff1ddea9c4967d7abb64574ecc8197e1bfc340c769cbf2207f4fe9
SSDEEP 192:sxZbQUneRmyM/jK1Ml8UQL+kq/f8sZKxkdUsbzmZvdp4GjMlHW6+WNpk2DPEyeUq:sxZvneIqJq/f8sZUkdqyHb6WQc/MD
TLSH
T10672F95266385A77CCDBE219F941BB53D6F8547296D04E44AAFCCA0C04E7BEE220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 6c62d96af0657c45b51b4609c82c248965a1059452e73387bf6578e91f599947
MD5 032afd3f40e2dc7e4f692a9d6d068537
SHA1 95218f3e3d3051575fbe6e6a4bce2070234c825e
SHA512 5cfbd326ac504413fdd284450a1c4f54e11e1ca4b218e0abd3771e7164af3d5439719bb436ff0dc346168c598a7d92aa24317909508dc82b44afa9cb949c2f63
SSDEEP 192:sxZbQUnDRmyM/jK1Ml8UQL+kq/f8sZKxkdvXPbzmZmdpiu9jMlHW6+WNp442DPEq:sxZvnDIqJq/f8sZUkNnDQHbVWQc/MQ
TLSH
T1C482E85266345977CCE7E219F941BB53D2F8546296D04E94AAFCCA0C04E7BEE231381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ea26eb102db4c4bbb8d8ffdbf56a87a387b6cbcf7d5a4fd7d098434f6513eb37
MD5 77d45274015567e74456c00b8a6b6d33
SHA1 200cf5e482896ed1d9d450fc6698c15ab56120ff
SHA512 f7d063f0f2aadce1f74c9460d81bb42bb09295875315f3d8ffdc5319556c27a79290fb95865fff1468f93f4906461392b72af2344626a144d815a821ea43e52d
SSDEEP 192:sxZhRmyM/jK1Ml8Mkq/f8s+K2vIdpFRHW6+WNT2Uj/YIIJPdIgrJ:sxZhIMq/f8s+HATHbT1/49
TLSH
T19942D7126B38A977CCCBE219F945BF53D6F5057292900E44AAFCCA0C05E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 08d24e608eabb6b0513ebb3cbe2171f278e02366bc4625baa7bfddbb7f4619ef
MD5 dea6ee62d981e7c0495b20d53ed07b92
SHA1 951c6263d7ca7c4f55a7f8f132f4eb61e16accd0
SHA512 19dc78e5a5dc5054b666d4144a58bc1e53b16f2245d84d2dbd2039f63b3cfaa45950777d1d6a42ffae51b02f179aa4678849a3bc5489c95b89201fd3077f89e4
SSDEEP 768:acsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9lrojrk:acsqxXlWvJD6Tu1ja54LAs9ejw
TLSH
T1ABD20B3B694CC77E4F840E5DEC26AED76ED801CB56988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1587bc54-8d69-444f-a898-0d8d0f2b0f4b\index-dir\the-real-index
Size 2KB
SHA256 148ba110087f9dbe7e6a250f253db7e493c7ae6ac85a15ccff8c18202bc4bace
MD5 7d94f08481d5966b17bb9ff4e5b57295
SHA1 6492206b1cd0420bedc971e3acc4964201664a0c
SHA512 d63ccdb483fead3ae014f82687f2b41a297e955e58b5965dedf1f500cbd0fdfd621d82ea2cbdbf4ab8e9a2cfa8f4c889dc3b943402d3ba1cee520440d64cdcd9
TLSH
T11151854DC98063ADECB551FE29A028F297752C39FC5CC3518158B1B63053A681B5BAFC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a55b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1587bc54-8d69-444f-a898-0d8d0f2b0f4b\index-dir\the-real-index~RFe5a55b3.TMP
Size 48B
SHA256 3889f2d78db42525cf6fd147e1c8d029aae76ced8e9e78478151661fd3340904
MD5 48f52f249de890573dc16ca53171f116
SHA1 b9d2ec104d4fd69f7bdde9d0fb04f49b0dccdb70
SHA512 994b89178bd87d62161d2f784980d8f69f96f17d9a5aee8d42b66b30277077ddf545c7e031b718eb6de0ad6e69ceda2780183d92d8e05294b34442b5ddb2a265
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 7665872ea01eb92ced9f6287b2540b781912eaea422ef363853beb0b6b131081
MD5 50912cab7f48742002eb66433ebf106d
SHA1 a2ffff986cac9626d8ef61489e521d5fdb884017
SHA512 38c47f440025f75b53f0c91078419431cbc45c39354f170145e6cc4cdf4133533e5a4f54665b9623fa07efcf8b9d64da364591f67c118746dc4a0ffbd0a8e650
TLSH
T1E4C04CD6451056564A30EECC7028521DA50AC46C94D6DCE8A54574123529A13C406565
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 4c5b384e7db3c167b2f610f590e0730bbbd6334bd25fba517d272ecb09ed867f
MD5 5a2b9a2d4b81f964f54f8a33d96f09c6
SHA1 e1d976a49b438c2bac09d8f637c6d12b120aaa8d
SHA512 b6c4a7c4e50ed108b4b96f0ec1c69e6b6227e1a1b4f62be05ccbeb7013619271ac7d8d36f11561066b0611ee7117cfbf65515cdabf888a6eea3b4488978dfdbd
TLSH
T116D023D7423446564630EDC87138514D5037DC3DD8C5DCECA549F0573478603C8055F5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 947a222c7d9f9078d3fdb21170f09700608778e7866976d228b35b3bdc095349
MD5 76e0059ffc475adf57d65e2d9a50f447
SHA1 6a36cef7b1f8bf80a4e9540920b703acad30613f
SHA512 7421b7f071af46b86c90c3e9f35943cf7fa73a912769ebd657622ee35348155c253310938f15d5fb6734686dd283b715a9b4fbbcc228fb2d0f1f9e186052532d
TLSH
T11CC09BD75520975B4E30EECC703C521DA50BC55C84D2DCFCA14574133439913C402575
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a42e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a42e6.TMP
Size 137B
SHA256 1b54ef6ac93b483fe1866e667911b2103d4309e6699131cac68aefcedab3030d
MD5 7b604a887c18581d8b0859706c3c6c8d
SHA1 950642cce285bbf4156652958eb4e0448131f309
SHA512 2c2d5a82f47b504fcdd768f764e1373ed94c1d22057636582edcbeb77a312731056399134a85c473cb8be1debebc9928b2fcc674dae88989882c18615845835d
TLSH
T18AC04CD6451056564B20ADC87038524DA51A8C6D88C2DCE8A14675123039913C4065B5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 531101fca709a04284f98c5de2be30858bd8f739eb6135c2d4bf2fb7c06af2c9
MD5 61a86cf3be66dafc3ad9f3e64805870d
SHA1 78cafe68f39e1d1f10da42518636fb981e8af6d6
SHA512 7d7ce2fbe17b5678e2fe32ce9fb9ee9d4fc4cc600f7aeff471d63ab202e6e1fe61f957482bf0fb072b76893dcf21ee5df0902bd680ed3d06f251295669e190b1
TLSH
T17631FCCD8E51A98FE9A489F31076B1A073B0C9CC6B15A3134D7D62773C2239A2A4B1D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 3KB
SHA256 4f67000b8075c5bd7f9ce3971e26b305d1b218186978901cd6ce194c1bc23d7d
MD5 dda684626af8f9831ef2391503ee98cd
SHA1 89b073f4abd4aacff548c00ee606f1aaea65e338
SHA512 0a6a71e9474f4a48d8bcabc9f4ef033055398d1758395501f47b075ec9cb74585482447318a5fdc361688a3fb7ed132939ee686b8e2b8ad5bf4bb2a796011e6c
TLSH
T15951E98ECC496A8BCC7C11B3A8BA14C5337628DC5A848F035DEC6538BCC333D1426659
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3af7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe5a3af7.TMP
Size 1KB
SHA256 8ef7c3b79d303bcc84350f251bc8bd9d9bd443ede852d65d39efca95e7d20017
MD5 d4b4323cd8812bbfa215247cbd33b28d
SHA1 c2e0466f20866deafbfe71a5f975a865261ffe14
SHA512 b22eafc87726e151ce1a2f9181293e18c5a4e1a233454319fba2070e28e3c9c1634c4a410cd73be5dd8da141cea0854270dec102f5eff0b1d2abc8d6206ac01b
TLSH
T1D131218E8A925A0FE8D040B60557B4B83375C9406322B39394BD633A6C75B9D6A8F1C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0843b0f46bc28859d30e019afcc9520987e9c3ccadd3fcce7bc39926d83e57ae
MD5 e886216b8c2fbcb079e89947e6c38301
SHA1 fcebecf89a0ac26c7eee5114681743a8394c4cfe
SHA512 ea732bb4794e856cfcbb487b2f603267833b806cf88c77a8f5a5bb80ee55fe11d5f60b3c2d5778fb7709d18a764da41838ea52d3a302aa621ad69c51d7e6441e
TLSH
T1D0E06FBA2AE70800A8ABC7EA087344A60410F868C891FC4F1129928310622A02822C26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a1e24d263e8b94182d7dc58ed7cabdbe59912c62dbad3031e3a824fd5cbf30fa
MD5 b089a14d0199ba962e357577121376fb
SHA1 76a8f8a4e9fbb2ff4df5d13a5fcb4d8fa5a7a236
SHA512 06d6db310f0ee18190d83dc86772cb48d9e3d86435ec8aa83625568c4e3ae127a7d0cd8e123d7fcdac59498a6195b76b2f6befd4ef44420e93b14306ec4da562
TLSH
T129A002E1CA520D41E0948A7435E116C4A619DD201A19574343A60144FB769408185555
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aa78c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aa78c.TMP
Size 48B
SHA256 b3bccb95370f82a8832fac3b1c1b7a8133c3beba30641b36e6744e866903d80f
MD5 fc20a40c43d3dd428711a713d8ab6054
SHA1 2ad6089f918445f3af4eb04ba2f3e691872d7fe1
SHA512 5b61ec3996d4e8a99115ca877056fcc5cff81e174d4821f0df0c1ec0bb5a3ffa66d7285499f16c4eae1aebae3fa70d9b2387d1c2d68c304a69bea0fcc243006f
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5900a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5900a2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e8d6aae22be013a95f5f33ebe67e5bef9e214781fd82a08868c85268995690ef
MD5 77f251eec830afa7f00049550445de3d
SHA1 fc58e25d9e064c0cf49e463863531f3fd21a1562
SHA512 8d9904a8ae4cc6a550513b3dfc67e974346d9ca63e01ba005799f311d75689aa8946c457721ebfbf3bfb1947c3c96256738fe28ded5b4c15151be0e690610fc6
SSDEEP 192:uAFLsNv4QjOkRbzGPQmiU11tF4VRN3OmNOmSC9QjMUSR2qIfKsZL:RsNv40Bb0ZaVRN3OKZ9Q8cNF
TLSH
T1BA423B3668386C775DE6E545F54732039FB450ABDAC82F84D5ED5F0C06CB6AC230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 e1c3c1ba62d13527293908e59de6fd678ff4f9e6ba62af655d0b825d73b44630
MD5 4675a918653a523d3ee7f4296c4de054
SHA1 4c527d88037308cc4a32bb76a7485f3ccae351fd
SHA512 f62a23bc2d0f0553f351a21dc3c1fe692d1941d1d6e4e8b5caa383bfc8a1a5d07c6e8ff65cf15e1e7557eb895f15c80cc8deee9fa03d94de32f9f00b1320480f
SSDEEP 384:LiF1tNn/s3n9SdzsNR8TUNTUlIl20Bb0paVRN3OKZ9QZcNJ:mF1j+9mIwgQoH3Om9EcNJ
TLSH
T16CB217F258D74936DDAE9B87A77E2D038EBCC0A7B5852940B3985A0CCD871BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8d67a71e6baa01945cf4919878998a6780b7942b59dc8fa2bcb4f0a0f3391044
MD5 fe60ea219acf94f73ac54680bdea8c13
SHA1 a81f2bd303a3d496ce50ed98253b0608244fa3ca
SHA512 e3b13de3d39ff6adebf66f9445724214fed48385978af98904d00c2a32c1d9d88182641f50c8cfcb6cfdac7820c4c95d09eacc4db5476aa340599d022f44c0f9
SSDEEP 192:tONK6JkRtQmiUyrpW+RN3OmNOmFHh31ROFU6:tONK6UruW+RN3OKBpKU6
TLSH
T14602FB35BD386C778EF2AD49F98B27135FA4206BE9952F84DAD81B0C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 db34353957a17102b66445ee680095279eb5db0334c6be08221b6a6b9f774fb2
MD5 53e338e79d7ebff879787c40962aa6a6
SHA1 6511c8060aece182670f5bcdfe4b7fdeeb414d80
SHA512 86557bdd4ef1b7105415811f8294b5d27f2b3a7dd40229324c7152bb0df0188c12888e0fc1389378ad9820a8b7eeb537f0379fd6dbcae270b5be00143453816f
SSDEEP 384:MtNn/s3n9SfsNv20Bb0FaVRN3OKZ9Q8cNJ:Mj+9U1oH3Om9bcNJ
TLSH
T1D1727E3668382D674DE2E589F94736078FF450AB97C52F84D5ED6F0D02CB6AC130BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cd3a751970ac99d9d711284be7fc6f6b99bee9ccfc4a9dd66a63e423660c9a1e
MD5 0fcf7bb388001fe8670783c5277515d1
SHA1 73d00b9b61b95bd9b580d7b7e4e202758572a3d7
SHA512 a145f6475b8f882b8499ce76da09d669f519e55261d47b7d960aad2c7957755b420cbce7b438685ab9f66b799046e31eade424b9f11cd2778445214a5ea2f659
SSDEEP 192:5nONS6JkR89QmiUyrpG+RN3OmNOmSC9QjMMVc2qIfU6:dONS6UOcG+RN3OKZ9QccU6
TLSH
T105121B3678386C775EE2B845F58732134EA45167EAC96F84D5DC1F0C06DFA9C230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1c128596489d3f7f0e012db6ba8101dcfac366da86ffc1de3a557a6dea630f79
MD5 aacd48ee394a1acd735146573a9eb4da
SHA1 f51a0add12c74861c7a16b59296eafa3cd5b30c0
SHA512 7f0d90cc50647b7df52e960f6bedfcb1f07789554c480075976a17bc5adb3b46d87829f2c937f1d60dbc12ab0e56d9219085dae6d154904f15d3eff9bf6b3532
TLSH
T11FE00103E31510DAC028133481431F212FA385706662021A8F34065C3C31B103E29A99
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0791d5c727ec388fcc7e8017a13c7d203041fef6441a222fe081d135909c7dc3
MD5 89bfd760241fa7a879ce37f8f165490f
SHA1 12c546f09b520772cb62edc247dcfa3b0470a842
SHA512 fe1294d4929c329e4e41eebc79b548bd2ab37a8f7ec7b3f84fbb655fe478634fecf259012fe51256613ff1047813c2e954696411ae5f07872a8f7cf047fd7ad5
TLSH
T1F5E00203F31510D9C024033041031F211FD385706561031B8F34064C3C31B103E28B84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 987b7bfd7c3eff8e886b73f16160dadc0adee9e84b01344b0edf596b9ee8c51c
MD5 03fcac166516c7b93205f28fdd492e88
SHA1 141ab741c07cece0f1540b97c046cd6c767b3c18
SHA512 c9c3ee8a8b724eadf5346d70a4dd7438dae0b95716b86486dd1ab0da8fb745e9b82cf0f9bfcfec6541a74c96aa6c54c533f17fee84a2e29cc33b715f182dc81b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5eb9f1aa9f0eadf3ce766ddd729eefec2821e50d0af38ca2143b4a5b2883d34a
MD5 7119bfa56467ab34954e74fca6b3db06
SHA1 740099b34b924ae87229e79be506393de050137e
SHA512 9cbb47a6a4d1db5556bfce1ff9d5cb1c864925461e9f29b8bf644ec7db09c3a10668dad46ff93d946e1c1e9e7dc1222b613fe61de8fb94488377f1fb289d8c42
TLSH
T128E00403A31510EAC028033485531F252FE3813066A2525A8F24466C3C32B147F6AA9A
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1850da54dd51d1971e95544047d43af651f562821f1f9b3e4b5e46d19f26b30f
MD5 eb225355c69b2d94612a5bfc9b40e044
SHA1 f5aee950af22c13aa0f1a715d3385ac8448e0532
SHA512 583d591fbb477919c2b66d128ab2ab69b62ebd0ba1cfcfb23ff8fef475836bf53e1659779df97e13bd7d25cff5cdde5675a2605cb2eaa2c3ec229b4951cb5ffb
TLSH
T131E00203B31510D8C018033001031F111ED3847055A103198F34064C3C31B103D24B44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58a66c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58a66c.TMP
Size 392B
SHA256 37ae00596273d038cebc41b7c4eb087613fb32030874dffb71a21bfe88799948
MD5 7bec4203a5f75112079e7ac22c65bfe7
SHA1 83c8627e68482c2fd983ea9a4132c38a0e0579b6
SHA512 20a4ddca1cbfe27842effb3988bb6ceeb9f9cd3d73652b5e743bfa0f38e956d02d8805cb04d4712076a846046adc8c1879f9997abcb7cd4aee0e8c3dabb4f6a4
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1cdd28ce29db870fc9305ab639e92ef951b47301f29107ab798be78b74b90993
MD5 3eff38db2b0c31054651f6198eba7ed6
SHA1 d7d35d1d8d49378f1d3f01199e47ef6ec0dc6fe1
SHA512 48bbcb41f74f0142b59272c76af71bc1cef5be8d21e41fd41f0d0126efd7c7e95586db2ab826759ee3627c3e1cb3d784238046d967c791a216bb79df09005d6f
TLSH
T1ED41289CA6F91148B3B77E1AABF6646D487BB9772F0BC45E00110E4F0666B41C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download