hxxps://redscientist[.]com/rtc

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://redscientist.com/rtc
Sample260706-sgjfmsgy21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1768	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278239559410541"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{ABA6FF89-50BD-4940-BBF1-7B9B117BB4A4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2716	1936	msedge.exe	85
PID 1936 wrote to memory of 1768	1936	msedge.exe	86
PID 1936 wrote to memory of 1304	1936	msedge.exe	87
PID 1936 wrote to memory of 1304	1936	msedge.exe	87
PID 1936 wrote to memory of 1304	1936	msedge.exe	87
PID 1936 wrote to memory of 1432	1936	msedge.exe	88
PID 1936 wrote to memory of 1432	1936	msedge.exe	88
PID 1936 wrote to memory of 3760	1936	msedge.exe	89
PID 1936 wrote to memory of 3760	1936	msedge.exe	89
PID 1936 wrote to memory of 3760	1936	msedge.exe	89
PID 1936 wrote to memory of 1684	1936	msedge.exe	90
PID 1936 wrote to memory of 1684	1936	msedge.exe	90
PID 1936 wrote to memory of 1684	1936	msedge.exe	90
PID 1936 wrote to memory of 2040	1936	msedge.exe	92
PID 1936 wrote to memory of 1672	1936	msedge.exe	93
PID 1936 wrote to memory of 2040	1936	msedge.exe	92
PID 1936 wrote to memory of 2040	1936	msedge.exe	92
PID 1936 wrote to memory of 1672	1936	msedge.exe	93
PID 1936 wrote to memory of 1672	1936	msedge.exe	93
PID 1936 wrote to memory of 3560	1936	msedge.exe	99
PID 1936 wrote to memory of 4728	1936	msedge.exe	100
PID 1936 wrote to memory of 3560	1936	msedge.exe	99
PID 1936 wrote to memory of 4728	1936	msedge.exe	100
PID 1936 wrote to memory of 4920	1936	msedge.exe	102
PID 1936 wrote to memory of 1064	1936	msedge.exe	108
PID 1936 wrote to memory of 1064	1936	msedge.exe	108
PID 1936 wrote to memory of 1064	1936	msedge.exe	108
PID 1936 wrote to memory of 4952	1936	msedge.exe	109
PID 1936 wrote to memory of 4952	1936	msedge.exe	109
PID 1936 wrote to memory of 4952	1936	msedge.exe	109
PID 1936 wrote to memory of 4644	1936	msedge.exe	111
PID 1936 wrote to memory of 4644	1936	msedge.exe	111
PID 1936 wrote to memory of 4644	1936	msedge.exe	111
PID 1936 wrote to memory of 4148	1936	msedge.exe	112
PID 1936 wrote to memory of 4148	1936	msedge.exe	112
PID 1936 wrote to memory of 4604	1936	msedge.exe	113
PID 1936 wrote to memory of 4604	1936	msedge.exe	113
PID 1936 wrote to memory of 4604	1936	msedge.exe	113
PID 1936 wrote to memory of 5960	1936	msedge.exe	114
PID 1936 wrote to memory of 5960	1936	msedge.exe	114
PID 1936 wrote to memory of 5960	1936	msedge.exe	114
PID 1936 wrote to memory of 5624	1936	msedge.exe	116
PID 1936 wrote to memory of 5608	1936	msedge.exe	117
PID 1936 wrote to memory of 5636	1936	msedge.exe	118
PID 1936 wrote to memory of 5336	1936	msedge.exe	120
PID 1936 wrote to memory of 5336	1936	msedge.exe	120
PID 1936 wrote to memory of 5336	1936	msedge.exe	120
PID 1936 wrote to memory of 4120	1936	msedge.exe	121
PID 1936 wrote to memory of 4120	1936	msedge.exe	121
PID 1936 wrote to memory of 4120	1936	msedge.exe	121
PID 1936 wrote to memory of 5912	1936	msedge.exe	122
PID 1936 wrote to memory of 5912	1936	msedge.exe	122
PID 1936 wrote to memory of 5912	1936	msedge.exe	122
PID 1936 wrote to memory of 6004	1936	msedge.exe	123
PID 1936 wrote to memory of 6004	1936	msedge.exe	123
PID 1936 wrote to memory of 6004	1936	msedge.exe	123
PID 1936 wrote to memory of 2376	1936	msedge.exe	124
PID 1936 wrote to memory of 2376	1936	msedge.exe	124
PID 1936 wrote to memory of 3324	1936	msedge.exe	125
PID 1936 wrote to memory of 3324	1936	msedge.exe	125
PID 1936 wrote to memory of 3324	1936	msedge.exe	125
PID 1936 wrote to memory of 5128	1936	msedge.exe	126
PID 1936 wrote to memory of 5128	1936	msedge.exe	126
PID 1936 wrote to memory of 5128	1936	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://redscientist.com/rtc
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x28c,0x7ffb1433c188,0x7ffb1433c194,0x7ffb1433c1a0
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,18401154556206560630,9255221144378904768,524288 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,3378652097911611836,1419347240515932124,262144 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,12985775171534013210,8587641955626709769,524288 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,12597463117751325786,7257159076275320153,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,12035061058489022043,4880065632642874012,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,3292668691226356946,2591972315978883673,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,17530366816505510054,14615162507735641543,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,9473510706114319073,2521954150502561394,524288 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,10917937091840172375,17648903069587230740,524288 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,16865778483814816548,6669918373507661540,524288 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,16865778483814816548,6669918373507661540,524288 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6284,i,3986336280319076484,3087465473427267673,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5884,i,2127063920055996433,1752401160479474046,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4408,i,614354996342073086,3809537907451264193,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,3762175876081687476,5698066624869189728,524288 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6664,i,3460408488525628025,7498788308773866579,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6876,i,13536488362272503853,6933805697861955921,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,9830067458075799259,10506311394598771936,524288 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,12239057784447174748,3840699287893889264,524288 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,16058714485211681083,17432633168855643364,524288 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7056,i,16559733608605771676,9134784001893158280,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7120,i,16149543257869809619,2478426469739714841,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7096,i,4216564471126910979,16955962331502391125,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7088,i,1651384256049526893,13546536627830444124,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7516,i,12211586165620857708,2724376278014443115,524288 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5844,i,7153167578245072298,92549199326416107,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7012,i,3215140273019971691,4826910620124148616,2097152 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5232,i,7984820998660662415,13369743466756813898,262144 --field-trial-handle=2272,i,2677196562366310341,13283699719895813483,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5a1823ad-b095-4834-b6ef-f6bda2048ce4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\5a1823ad-b095-4834-b6ef-f6bda2048ce4.tmp
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000cc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cc
Size 70KB
SHA256 fb687d71a9090fd9b633c3653a29fd3ff5a0232219faf486fc7bef2442a2b0f8
MD5 457a06fdf8d4e3d90fe5d3f6666ad04c
SHA1 3f0907e5739b107188d38c2547a9bca8ba8c969f
SHA512 1333d720540ee69790ba13c32311775888e8018e5eb8c4af973133a68e10fb934465d98ff007bb79d40f31480bbb57dac100de1d427b6700b4379aeb69980197
SSDEEP 1536:Qdq4rH3xSG4yuk6NTmRH2Ma2mxKie56ckEcHhg8FimgmziZh6YoVLFPjlC/FQra:N4reyB6FmN8KqckEymWG/hFoLPjhra
TLSH
T1806312DC7216EB862B148A27F4E615C96B740947E2C9D9CA0D1D33EE1818E3F7FE2160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cd
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ce
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cf
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d0
Size 38KB
SHA256 4392ddde86f22a921269feaf788a13509946046047df6926017041ff33d0293e
MD5 04bd0131c5ce154413f71d20017679e6
SHA1 a83459180dca62eb56edee213409f83e12fa6172
SHA512 5818141afbbc45553e72fc106699d9357437f1c2751751dab4f51ad7127e92a6ff85fb67905073addfdec5dd581c8c22ffc8dd6b85919d6a1d72550ebda5376c
SSDEEP 768:hrGgBfBZrOcgLWz/irLn2nTXzHXP0JsdgCQL1/UAv73nWEjvvuUwp5:hrGA51OQ2naXzP0Jsdns73WEaz
TLSH
T1170302AD7D526331E7FB684CC972AA1340C424498063CB1FBEFF098E9D44A4FE056A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f1
Size 64KB
SHA256 49c44a97498af5cdc2abaa89ab61f43895326914e942068e4bcdd946627ea065
MD5 54c07aff64efbfa7cc409c2c39beee1f
SHA1 484508546a33fc90e6b97f6240601ecc135c362e
SHA512 39c0bbe4cddd7eb1b17c6690b580a650640a1aed61ab004092af6cc870286c13dbdd59df763b724b7b022d6d071a18f02cfa751710d38954eaa1eada5b9a1abb
SSDEEP 1536:xB3Y4uo7hjiARYSjFTG/EMsLZ+XvOqRTCQCQF:LAo7hjiGY2FTUEHZpqlCJY
TLSH
T16D530254E3EBCBC3CA9E0A554485D8309A87A8F287851EDFDA3CF4C74697E1C4E27509
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9c7e700cc3e33cf_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9c7e700cc3e33cf_0
Size 262B
SHA256 956251d33bc4328d9d818120b61d5c6f8d0da044bfacc7d3e164db178468bcb7
MD5 3d4574f956ebb70094c34506b1bd4ce1
SHA1 0b7d579dadef2791b6147c0dd1af07014dcf26af
SHA512 0ed6fd0c9705effe0fae817bf12f96cf850d56d3dc12a791feb06552250a21a087d329f9b1af69c4f330dc239f46bae7fef12631260c4d8cb924d5132cf33915
TLSH
T1E4D02EE760183442C83C84F1EEB66B0BCA32B2B80489D0A288152493A7249639AD30A6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7c3b67f503627158ef2b41fa966a3fac2be5f774d4b5ad3d564dc9f00fdd973c
MD5 74cc91c4d3644f5bae0d949f1d0eebd9
SHA1 8a9ea849c3432cd490bf53b4fd92dec2d792903b
SHA512 7cdc8c5ba74a0ec2fed6aea77625bae3e3d4c9e277e0e93b723839bccbfa42a028dea0134c63ac345fb882ea3d28d2f71580b9b45fe6c647428ca782781b8089
TLSH
T18F61F9380262C85CD3AC153CF1D15234743F858A9A1B6E662E14BFFDE5C9B71A1D6C0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 22b733a5744b15fabbc7979e393e88bd818790de847431c480d5091396c5fe7b
MD5 508bd3e7b0fe5dff142ba1c55edc583f
SHA1 feac220eaeedecad5fe23c9dd2fec1f0d5533d2f
SHA512 0c0345e80d1810dad99cef1e9b04da8ef29907fa9db93e8560c947ac3712386eed089de4040e9143565f1bcadd1b7eaeae9ff1ec7f16198a8606be1f4f5285d2
SSDEEP 96:+9RIp2CxnYA1dN8cHMyg78Th017DLxSnFuYwruZmX0kwE9pU6jS0do9nf/LCr:uc2J4Mcsyg78mbHti5iw6Zgnmr
TLSH
T19802621423E28887FB39583DE3D14D243D7B4199620B5E02E824BFBE9C837BB24D1D86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5868c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5868c7.TMP
Size 3KB
SHA256 e507117792dc4dc999ebf3374b66fde4b358d5221365cbc060c4fbdcaa43a03e
MD5 7abf035bd038ab077da6c673fd5fa819
SHA1 8cfa245e7d1682649d82eee457f750b63502484a
SHA512 148558ddceb87c6bbcce4c1e23f2703f512e1873fc0594f6a3c17dc6a785d0174dec7d167d7234b32c52e1eb5936300a62cb072d609875f9261fb3e081daddc4
TLSH
T1D3610B380262C84CD3AC153DF1D11234747F868A9A5B6E662E14BFFDE5C9B31A1D6C0B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 fef1d7f949f97a95a46503b4eb1cc0301e3528749cc6e492ed85f55c957037c3
MD5 e9eabdc56feabfce63d9183c63252091
SHA1 d20fa33fc251b634f8802d42fae7323d0449edcb
SHA512 e753a166a37a7fbc16d4caf82d54e2638c278cb551759941cf2e113ef2fab281df1f60228d3d62714031d30343084df5d808851c3d15b7b97c51c9a1eb2ab36e
SSDEEP 96:DPObD3B3LBZhHzBwBjcGOMtRCwGpU/rE6tvEIhx:DmbD3B3LBZN1kjc7MtgwGG/rE6tvlhx
TLSH
T1C2B19CF3C3EA825ED91152F0AA186F1BCE1C0946836C3D5A85D4EF4B93F2471E251B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 a93cc2ef4115e6ca9549d94c24091ced4e56e8b4936def5293d0abd094d24385
MD5 868d6d26ea7f01bcc10cb5676d678a71
SHA1 9418bbb07f84e855b9482e4a93f4744c4d43c809
SHA512 eff925627bcddd0178a0c9ab3369ac632cdefca08e54b1d0e1f087fdc974bd2953881fd15a98431cfd49d48ebc5960ee40a9aa27a4f2648eab11978e15370ccb
SSDEEP 96:DPObD3B3KzBwBjcGOMtRCwGDbzECXU/Q8u:DmbD3B3K1kjc7MtgwGDbz/k/Q8u
TLSH
T1B691C0F7C3EA426ED91192F0AA147F1BCE1C0946836C3C5A85D4AF0B93F2471E251B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 94dc65fb9eebdee07093ca1a1f2517ad930d053aa650401024766d19c196a65e
MD5 545c73b736836c3f625d232222e6a9eb
SHA1 581acc069b69b94291554138a6d71b1c5490d420
SHA512 ab41ee7582442f132af49f981d6d76c5482acb215adffec0b0879f18f327167b2322b4d78861a0997f8673dc1cd11f3b02f5f065e29fa1b1228ceea6fb57dd37
TLSH
T1EAD02263260970F4A69CBED9846EAC8ECB2A202009429ED930D09DAE16358BE0957A80
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 3f4351d87b27d1b049315eb2703063316ec0ff79a3b09cd642d9fbbda4e98f92
MD5 33da5d541a7242e9eefdeac23adccd86
SHA1 b5c157146062e21d8afc065db1f9ac00bdadeaa3
SHA512 c59787af38b5f9285bc9c327fd6b0b5557ef6db881221aa48e96c9ef64a812c6fb79cb3dfdb39acf794344d3e24a35af430e9e3209c978d89b1404deadd58374
TLSH
T150D022731244B4F8A59C7E8985AAAC8ECF26206009029DD5A0D49E9E15318BE192B980
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 b7d3efb9343121cd1e88efec6d789f0eb3c57e097c431738c7985e1a35d50de7
MD5 9571a0f646be696cb436d81d06dbd489
SHA1 45f4905a72b9b8309e786de5b123e136264ed07f
SHA512 ac405fee3576e134f4073d40273120c4d1cfea9510250d46a22656b0a073e35a8a450197d4a996096dbd05b490b03fa36d7f509087b3389c3e71348bbb979707
TLSH
T191D022732244B4F8A59C3E9EC56EAC8FCB27212008429DD975D09D9E06328BE0657180
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58bc27.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58bc27.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 14e3582c3e2ced31290af87470c7df7d3630905851ab1cb6e6f968585abdf4ba
MD5 67dbf36ce7b0460c1b95ae2445664e31
SHA1 582810e38b0a4a69d88593b429b42e74a1334f05
SHA512 b3ae2cb2f8b616170412b9660e9e712c33bcfce05adde6e1356ab60a8f9a0cf332a3ceb82c71a93fdcfa27f6f83ee08e11db1a913b2a9aa84345aa647c361e31
SSDEEP 192:sxZmRlyM/jK1Ml8MkV/fJsaC2rIdpJHW6+WNGYHlT9+WIgrJ:sxZmFMV/fJsar0JHbGWt9
TLSH
T19042E7166B349977CCCBD209FA55BF53D6F91472A2900E44A9FCCA0C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 74f4750f1ac6df9de7b065a2a401dc4851dd82897d113198be43e6edefb811e6
MD5 b247a609a3595dca5f34dff8426792c6
SHA1 79bcfb3ed8289b7429df2a06919b31b230923e70
SHA512 4a523a02eb7afee938a5aa87af5df00f751ed83df7b41c62816053d187e72b969310af793ce9da4142997163531709cb70cfb9b03148a9edbf3da96d6c45a12f
SSDEEP 384:sxZmXqTm1V/fJs1aAq0YHbwuCmpdMetR9j:s+6Tm1V/fYaAYHbw0tNj
TLSH
T1B982F75266248977CCDBC609F921BF53D6F814739A544E8CA9FCCA0C05EBAED2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 d975a5d44249f2118a0697002d06ee8d127a2251918a4ac2f8aa43abaad13640
MD5 ed7ee36a64ecd9db0446a0fc439964ea
SHA1 8c1d2c3e08543d1cc78b2f45aa1678e763cd2284
SHA512 c267e8ae0294150e0c234f4fd3778eb4a8da2285d0fbdaf47e76fa1cfc854e1b81007dfa90ed107436f8f07138482133b66dfcc58d7dc27e7a3666b080bcb551
SSDEEP 192:sxZmRlyM/jK1Ml8M0cB1V/fJs1CLPU5bgaRddpm5n14HW6+WNORtSpHQhI/YHvht:sxZmXsm1V/fJs1asq0lHbwur/ct5UK9j
TLSH
T11B82E95266248977CCDBC609F921BF53D6F81473DA554E8CA9FCCA0C04EAAED2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1a91cc66883585c60ede95e3ecfc3d4b9cd88886d984220d3267698199d61175
MD5 7733e72e147fb29b8a051b95cc2c2231
SHA1 650dedc000625cf9c938381139c5de7a6cded754
SHA512 63007bdf57f07637013c1f3b9ce00c803c28da18ac096e1782ae42ea2a4aa19ccafe77c82483173344876a47518ace293bb96fc7f0bd7efb56baa99c022cc643
SSDEEP 768:69UZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RCroV30P:69UZYTMWvg0Pou1ja7eLZmRZ+P
TLSH
T123D21A2B280CCB7E4F844E9DEC2A6F967ED801CB5A584D5447EA884C03CB7EF112759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 817168682c386c4640a8dbd065198083e53d1d595453183b353186cf36d6da4e
MD5 3ca52c475671b3868ef502852ebbb943
SHA1 0258c6d33df4e7f8aa93e5679fc4ffb87e5eb073
SHA512 f597fe885583cce088ed723bfe38fcee9df0c6f902f64e9b39198bfabe816866825f7cb943c30882e08aa4777a4a40e26e17615efc5af094c5bb894c2bdb7609
TLSH
T1E3A0021103904457C03A53B525DA43413740C8181140130B41A13149DC604414D4751D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 1d3e251c4d9c238d5f4598b8b83a4de66103c84ba2ecc65bb6d5aca96c259ee2
MD5 9a97804e61532f5576b234ca0c541f9c
SHA1 198170e7e188a871abb3aa9b4799814c8e60997e
SHA512 09f26ed0e64e7897e7297c13b1ab775d6a016dbb9eb138c7b43d8885eb94fc3149d2977e90b21587e871ff2cfbdfd338b54ccb24fdebb01578b2a1a4e095985f
TLSH
T1B2A0021552D03152C12727B326DA4173361CCAD01301277DC2A1406CCAE0756858542C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 9c7e5ac025224df468f44c3a6b6a8ca65a44cd8716453d6a983a11f37bddecba
MD5 079355cd562bd51d56e1075de99964ee
SHA1 a3adec83781df4a0f2ba56ae4138fd60bb49cec7
SHA512 ca6df1646e355828321fa605c7a098fe2a148fb286103bfe7e843ad953c1cd12c942fc2df972c51928437295359610ace9d4c4b2a678b152bef0c215db5f1707
TLSH
T12F210E8D4EA0898FF8A541B61176A6A4737198DC4B26B3239C3C32316E233593A5B5C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 3KB
SHA256 faf0446bec200fa25932435d654394ffc728ca0fa84789ee2639f71d50a08abb
MD5 1a019a53ac2aeca2abf5882ca139eddd
SHA1 599a8cad5444fac5f069be453f3830af8b04a34e
SHA512 38a0b4d072386be6f36cdeab537b4c41caacd64cb41f36ab61c40e80b41ef558b642ce06cd45a3f72a48ab3ecd3edb66e4ad1fbeb062b3b407f87309dde8fd54
TLSH
T1F151C78E4D4F2F5FCCAC227254B900C1373A68DD6A984F03286D69387D9763D289495D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586ea3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe586ea3.TMP
Size 1KB
SHA256 1a7c1b2da25ce2bd1fe802abb05fa1df08078b02d2bb487f02a7ef7b34c86735
MD5 f3adb8d0a81afa63a73d31f6834402d3
SHA1 695f5a6099c3fe49e1c82632afa195083c922723
SHA512 92110d84e2849a1c62e9f0133a7d6b79bde03a006424f696c9539a1cd0738efffa58f9b1650d174967324f3945bd5a0fffc833bb7d8c42c0f42caedc623f89aa
TLSH
T13121148A46D14A0FF884507B0963B8F8733189005711B393553C62795D21B8E1E4F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2bb738d755c3e9b990fb3f47b17f9e61e07466130ce28e0749c8354d8293fd66
MD5 3bbfefebeab62e38bdcc972d546eabcb
SHA1 0f03b25579fe89ff1e4c56dbb762a43de19fa3f2
SHA512 764cd61db2d571e293108b952112b0534b70c4c0bf5900051501e74bec397f438482a43ca3961a28f7dba3639d034eb01f3c207151fcc78bc3df13fd06837a71
TLSH
T1E3E0C0F33EFB1810AC7FC7D74471F4A405023CB8C64CAD8F00AAA2A310B2300280AC32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 853bf46939cf7138c2cd291eab3ff9c3ade7f6838f91ebcc98b1442e29a3de6e
MD5 8753c80b04393931820e5fe9a4f2af9b
SHA1 4acb265ed15da8b6ae1f7d62b1f86b0f990700b3
SHA512 28031ace14c86c36f0f16cd57d6e42894e8ff21ab3988cf3abc4fb5f42ad705e6db439327bcde628db3c2457f3aecda281f5377aaf55b60197e7b81f544ba64d
TLSH
T1F8A002B2C1D61953E4101270F1410984E291CD144A55671382B50168BC7E1415566104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c520.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c520.TMP
Size 48B
SHA256 75b9b5f5cc11eae38264cf7dde00b18adefce373f0117f9e11721fcab01b44a7
MD5 87c3610b6db9a75e0b524a2caff58993
SHA1 db49b6bb4fff809913904df0294a9dbe65b8b80d
SHA512 e28f4c16c10af6e4628a6f4b127e86952236920f2c234cb1f862859357fcae9686cc8b4b15e85e2cf997fe6320e27de0d23356b7463d92d31321633e1f7c6f53
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 537132558928affeb0cecdb2127c25f1d25690db9b474bf349cc77c2fe883d11
MD5 4da2852a0abd9f127f6526bbe49291b1
SHA1 45fb60d7c747def95b4d0ff006a377dd0f4a53c6
SHA512 1ffd04d5d42206a190f7cde9755e98620408a2110dd0903b6b0abc93bdbdfba94ead33b32d3203e5e45401cb215f8a1409ba1d14c568f36e37b67b430d50589b
SSDEEP 192:EU1HQHeGbg0GwQHU1gsK4Dm9+2Ns96/masM1:EUFQF8
TLSH
T1C8D1165272BA02462D3E6B1893D5871FCE4272533018E52F3BAD01B18E67E629CFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea8c32da-0bfe-4136-b664-8adf2714c567.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ea8c32da-0bfe-4136-b664-8adf2714c567.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5903af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5903af.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 dd6e234062fd463da78abaf1ed65d8da0c092a99de2b9df633c22bf6b5da1090
MD5 c10af1bc2d087b0cfe95c8ca0bfb0642
SHA1 86bdb0e3de6c9dbe77c36ee291c48c09b1bdb31c
SHA512 52ab28a58854156c96e02a3f9a4b5a6eacb43d60a0cc5bc834cab6a0403b0aef3c23584b03b221687d49ea5564eaf9cbcb701bfec03161d5fa8abbbe90ad18b0
SSDEEP 384:NiF1tNn/s3n9SOzsNC8TUNTUlIltTEUbSJSlhzX5od+hO/VuXd+2HMpOObjI9G6B:EF1j+9JDwgYUnpOgO9utlHMp29M4
TLSH
T15AC23BF258D78936D9AE9757B77E2D028EBCC167B5852A84B3D85A0CCD871BFC306801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b5bdba8f1095019b7bd6290abb6e4103c8e65115eb6726f29690fb4abc446db5
MD5 fb32cab34ecbc78c19455f869da83aaa
SHA1 d0721bf532ed56aa8dac3f1a10e1f1692ecb68a6
SHA512 dada4a22565943c825dd0649a3082d99a7c95a3694feea079bbdbcc3c19e7c35e544f9b9eadec3f60a35f8e7812a767fb7e2d6093cd26969fc92a94d9c9a690b
SSDEEP 192:yONw61VWQmiUyDWgGX5Obd+jFO/aob/aK36iU6:yONw6WjgGX5od+hO/V+3iU6
TLSH
T1E102D935A9286C778FF2BE49F48737135F992077EA952F84D6E81B1C00D769C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a044eb1ec3bf04e7c71eff5e9eca99b0f611017c166ad9467137937c63b5eddb
MD5 8ae7e39f1d91055a6711651f8982a8ae
SHA1 4fbd61f039fc938d77e4e75e8ca294cafc109c50
SHA512 8a5817334525ed70e196fbf5dbd494a64cb5ba201dbb84d385bd322d1d0f2492149dfb1c6cebda8dbd1773b660102c9a9c1b865bcd357765e1dd02acb6c2979b
SSDEEP 384:8tNn/s3n9SfsNBUtTEUbSJSGW2zX5od+hO/VuXd+2pMpOObjI9G6w74:8j+9UkUwWqOgO9utlpMp29M4
TLSH
T173928D32A8289D734DE2E598F44736539FF841BB93C92F84A1ECAF0C02DB5EC1316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a99dba0e4285fec53d1840613eadfff7ee4e7c0a2183a7b5942b13f06907b662
MD5 ba4c838aff11f6f1bb5677ffaed4c345
SHA1 948d9c51336057f33f8e504a0b56d17642d1db8c
SHA512 bb38e101b0fadfc33cb35cd57305fdc1752c2bf9b7e89183e05c8ebb401ea682b3fd6c591e7b70bf283e367b9a1b40ff705dba47b551672d05453f54f43b3909
SSDEEP 384:NtNn/s3n9SfsNBUc7UbSJaCtzX5od+hO/VuXd+2pMpOObjI9G6w74:Nj+9U+UKFOgO9utlpMp29M4
TLSH
T154928D3268289D734EE2E598F44736579FF851BB93892F8491ECAF0C02DB5EC1316D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d7f5bc50e8f91c871f7879bc34612eb2e58b3980e5121c34a0333b1498afcba0
MD5 4425b6f966deef2384ccfe3334bed63b
SHA1 ed189ad98acf0fdb0b646e7af72ccd78a75f07a1
SHA512 9972b138121249c3bfe933d4351fbb2b4f68f3bd3d8e9ab7f1182afe16f1e26ce424b8f9a2c52971788f0adddc8ca567399299126a75b194e4f9430627f6da8d
SSDEEP 192:UONL61JWQmiUyIWvGX5Obd+jFO/aouJFd+2wjJgqOpU6:UONL6KuvGX5od+hO/VuXd+2IMpU6
TLSH
T17F120932A828AC379EE2B595F48731538FA95167DA897FC0D1EC2B0C01DB5AC230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f7ce874c34af95dedec00e08fdb0cc52135dd743f3a9faa1ba038fe49376e764
MD5 a79a0c3fd4087cac05d957f92cb2b08a
SHA1 4077ac37529ef59bf302f6d1852031c05910891c
SHA512 ea4a4ca9d0abc9b3600e02ba38d48a79578bdd2e8fcf47e9f26206d055e6cccdfe3cc9dfaa8b34371ea00276ed2c3e03de630c65e6c33eef84ae27668bae4024
TLSH
T142E00103970104E9D63C073010532B340AD390B001B152454E21116C1D233006F24BC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 71ec7f97859992bf5b1c5db3b65e86957a2fe3266945454d9e5ae09ecfa8092a
MD5 6ce9d008d442865711747a37bde6b228
SHA1 d0499b4c4fdd1a5fcecd6e93a0479d221d416727
SHA512 49073fa675f7620fe64eaf9f6fcb9b0e74d23168158e3a47f36f7d95a8bac40cc3273dcc5756a2e2e7bb3a30651ae2d520fd22d767b2e93fdeee1dd56b1d00cc
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58c176.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58c176.TMP
Size 392B
SHA256 6dd2d5f115771b4737329cf32af3e6ccb40110bdda77813acbe6dea58317c0b7
MD5 26781f557a570787835fbce672f7ca73
SHA1 cae0c732ee14d51d46209cd3e7216fbd0890b9a4
SHA512 b01e04f02ee54a6ddf0027cb50f21dd0cadd1e797082aca7c937de5969e75ea1c1bf651f69c44188cde0d151d668eb04c771c30c70d49b410288be5469f0b925
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a5b8552d810fc5d2c8e338c32ff8521419a8399ab10e59eeb208afe276caeba
MD5 c4798cbbcf015ad1fc15be91deb4ce24
SHA1 4e559e25376c37fa282e2a3ec3aa3f37d4380b10
SHA512 fa33839f2e26637343f92fba998fb0f78bd225b2a7b358b212dc5778daa32537b3141ad884b0153c821b5cf0a65b9ccb5cce85e9e58147ad1bd7816ef8ed70ef
TLSH
T1AF412A58A6E91148B3B36E5AABF7A8AE483F79372F06D45E00010E4F0666F40CD71737
MD5 SHA1 SHA512 TLSH

Submit Download