hxxp://tlu[.]dl[.]delivery[.]mp[.]microsoft[.]com/filestreamingservice/files/b06635d9-07e0-4846-a382-e501423dab83?P1=1783573881&P2=404&P3=2&P4=aQhhCH5AdOfAbuWmNf8qFLU2ILcKj1%2B1GA4IzzVhcfWHBNywt0Y6PlFomW0cPfQGO7ihVY3WUzQiNmzFGWV7CQ%3D%3D

Analysis

user interaction
yes
max time kernel
231s
max time network
230s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/07/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/b06635d9-07e0-4846-a382-e501423dab83?P1=1783573881&P2=404&P3=2&P4=aQhhCH5AdOfAbuWmNf8qFLU2ILcKj1%2B1GA4IzzVhcfWHBNywt0Y6PlFomW0cPfQGO7ihVY3WUzQiNmzFGWV7CQ%3D%3D
Sample260709-e118xacw5n

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4588	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280447549309830"	msedge.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\MuiCache	AppInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\MuiCache	AppInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\MuiCache	AppInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{55C1C39F-CDFA-4BB7-BB01-013B8A590244}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{8D2216E8-C283-465E-A4ED-E124419B4D6A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\61878MobilityinLifeapplic.ScreenRecorder_2.2.4.0_neutral_~_zfxkqydss3nar.AppxBundle:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4456	powershell.exe
4456	powershell.exe
4456	powershell.exe
4896	msedge.exe
4896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4456	powershell.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5612	AppInstaller.exe
2868	AppInstaller.exe
2952	MiniSearchHost.exe
3304	AppInstaller.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 4560	4692	msedge.exe	80
PID 4692 wrote to memory of 4588	4692	msedge.exe	81
PID 4692 wrote to memory of 3220	4692	msedge.exe	84
PID 4692 wrote to memory of 3220	4692	msedge.exe	84
PID 4692 wrote to memory of 3752	4692	msedge.exe	85
PID 4692 wrote to memory of 3752	4692	msedge.exe	85
PID 4692 wrote to memory of 3752	4692	msedge.exe	85
PID 4692 wrote to memory of 2976	4692	msedge.exe	82
PID 4692 wrote to memory of 2976	4692	msedge.exe	82
PID 4692 wrote to memory of 2976	4692	msedge.exe	82
PID 4692 wrote to memory of 3640	4692	msedge.exe	86
PID 4692 wrote to memory of 3640	4692	msedge.exe	86
PID 4692 wrote to memory of 3640	4692	msedge.exe	86
PID 4692 wrote to memory of 1980	4692	msedge.exe	87
PID 4692 wrote to memory of 4296	4692	msedge.exe	88
PID 4692 wrote to memory of 5012	4692	msedge.exe	89
PID 4692 wrote to memory of 1980	4692	msedge.exe	87
PID 4692 wrote to memory of 1980	4692	msedge.exe	87
PID 4692 wrote to memory of 4296	4692	msedge.exe	88
PID 4692 wrote to memory of 4296	4692	msedge.exe	88
PID 4692 wrote to memory of 5012	4692	msedge.exe	89
PID 4692 wrote to memory of 5012	4692	msedge.exe	89
PID 4692 wrote to memory of 2304	4692	msedge.exe	90
PID 4692 wrote to memory of 2304	4692	msedge.exe	90
PID 4692 wrote to memory of 2304	4692	msedge.exe	90
PID 4692 wrote to memory of 5388	4692	msedge.exe	93
PID 4692 wrote to memory of 5388	4692	msedge.exe	93
PID 4692 wrote to memory of 5244	4692	msedge.exe	94
PID 4692 wrote to memory of 5244	4692	msedge.exe	94
PID 4692 wrote to memory of 5472	4692	msedge.exe	95
PID 4692 wrote to memory of 5472	4692	msedge.exe	95
PID 4692 wrote to memory of 5484	4692	msedge.exe	96
PID 4692 wrote to memory of 5484	4692	msedge.exe	96
PID 4692 wrote to memory of 5484	4692	msedge.exe	96
PID 4692 wrote to memory of 5852	4692	msedge.exe	98
PID 4692 wrote to memory of 5956	4692	msedge.exe	99
PID 5956 wrote to memory of 3068	5956	msedge.exe	100
PID 4692 wrote to memory of 5660	4692	msedge.exe	102
PID 4692 wrote to memory of 2148	4692	msedge.exe	115
PID 4692 wrote to memory of 2564	4692	msedge.exe	116
PID 4692 wrote to memory of 1224	4692	msedge.exe	117
PID 4692 wrote to memory of 2428	4692	msedge.exe	118
PID 4692 wrote to memory of 2428	4692	msedge.exe	118
PID 4692 wrote to memory of 2428	4692	msedge.exe	118
PID 4692 wrote to memory of 2228	4692	msedge.exe	119
PID 4692 wrote to memory of 2228	4692	msedge.exe	119
PID 4692 wrote to memory of 2664	4692	msedge.exe	121
PID 4692 wrote to memory of 2664	4692	msedge.exe	121
PID 4692 wrote to memory of 2664	4692	msedge.exe	121
PID 4692 wrote to memory of 1040	4692	msedge.exe	122
PID 4692 wrote to memory of 1040	4692	msedge.exe	122
PID 4692 wrote to memory of 1040	4692	msedge.exe	122
PID 4692 wrote to memory of 4896	4692	msedge.exe	132
PID 4692 wrote to memory of 5272	4692	msedge.exe	135
PID 4692 wrote to memory of 1092	4692	msedge.exe	136
PID 4692 wrote to memory of 5272	4692	msedge.exe	135
PID 4692 wrote to memory of 4076	4692	msedge.exe	138
PID 4692 wrote to memory of 4076	4692	msedge.exe	138
PID 4692 wrote to memory of 5360	4692	msedge.exe	139
PID 4692 wrote to memory of 5360	4692	msedge.exe	139
PID 4692 wrote to memory of 1084	4692	msedge.exe	140
PID 4692 wrote to memory of 1084	4692	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/b06635d9-07e0-4846-a382-e501423dab83?P1=1783573881&P2=404&P3=2&P4=aQhhCH5AdOfAbuWmNf8qFLU2ILcKj1%2B1GA4IzzVhcfWHBNywt0Y6PlFomW0cPfQGO7ihVY3WUzQiNmzFGWV7CQ%3D%3D
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffad0a8c188,0x7ffad0a8c194,0x7ffad0a8c1a0
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,1327778605467838960,6204432912295588291,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,6434828191494741150,16091047140868350069,262144 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,3902960949667086659,16852935113294295599,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3356,i,6540938980921788309,18069570609750208949,2097152 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3360,i,7052167908251821940,6605199324376253496,2097152 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4108,i,6740800999100796165,10519743582657232001,2097152 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4120,i,902036140208214918,7666053958458695315,2097152 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:9
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4184,i,4628493784895946345,3272482022957375249,2097152 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4240,i,8195921646534196817,3896990116354853009,2097152 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:9
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,6153663884319952706,4034367506194167637,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,9740603741784954441,6910768321547873597,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,4551074418194204675,3907656042726411380,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5812,i,3004189304776591698,1164844926084801563,2097152 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,1328557647831463688,11164269764600325010,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,1328557647831463688,11164269764600325010,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,1138569643143673221,3876103226692041209,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7580,i,240845088843250503,4746960829988330800,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,12891733044672878374,8474596190408292345,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,17339024148436609006,7549611225818236388,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,5580052400060813027,12591803883797026688,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5468,i,8532504648196480920,16584391924693186638,2097152 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,9536936533718754231,11474558876499406245,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7652,i,2626190314187490636,4505047609778111604,2097152 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7800,i,1483962430614900747,10404743991184578701,2097152 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6724,i,14151290347940459007,5113719349126553939,262144 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7388,i,17011692030419156419,11755689293188954774,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:12
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,1652590093971200046,3494128319319353979,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:14
  2⤵
  - Modifies registry class
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,16771736483764081187,10495429881481575233,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7824,i,10341379241433290558,5535498822746318768,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,823408071290463493,1245325329454086907,524288 --field-trial-handle=2176,i,4076840732228938444,2594155858392856630,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
  2⤵
  PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2492

C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe
"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe" -ServerName:App.AppX9rwyqtrq9gw3wnmrap9a412nsc7145qh.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6000

C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe
"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe" -ServerName:App.AppX9rwyqtrq9gw3wnmrap9a412nsc7145qh.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2868

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:780

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:3224

C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe
"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe" -ServerName:App.AppX9rwyqtrq9gw3wnmrap9a412nsc7145qh.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 19KB
SHA256 b9e910102d058a696ccfcc1af565d3844c952c7e2127915ee2953f66839a9555
MD5 9f98b25682d26512e43c53b3ab379849
SHA1 241687b6aba85f978728113da6a9831378bd6320
SHA512 9cdd2d1b0d782879d8e089292d6b7e44efc176ae733e0cd223a1815636eb7776afdfef1d46a63121a1cddf261aa1af5741138e5026d8abaa1586f32507068e80
SSDEEP 384:720rn9jqnI9cpR2kDPi+Ck9Zl+jog912SHX6Xr6V3FFBH/nRLQ5wDhxCmH4I1:nrclta+Ck9DoogP36XmZXBZPDbBH4Y
TLSH
T16892C0A09992C88ECD36F4271E5EE9C3595CE4917E3A0BBB07D26D5B084164A7CB21CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 59KB
SHA256 2a43b4cfc47238c170257b2345f451828a25270327bba55db5db07398e1199e8
MD5 3df2a75a9ddc950ce672b11962b8d017
SHA1 aea2d21e8d4076f6abc88225e5182c0f5c6a83e2
SHA512 627c2c8d6a6709f714e16e9094e1e8b33ef228195f220b5be738ef09805897785ac1e02c3f48dbfaa66fea1524a1be3ce6a36f94172c82439e72cbc1c83866af
SSDEEP 1536:yG7MtNK2UY9XlJdEISDLz+9BxP8xTGxMYAWwd05TIbGTdNDVsFy:yGCNKjY9VJdWLzHxsMp4IbeVqy
TLSH
T1605312B8D9571FAE9722CE3C6B4A0168B7714A9A52DDF04D12D8080BFD816D25E2A4FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3a1edda08c5f7b6cb8e107fcbafe74bcff4d57685b7c6a08ab2129467175619e
MD5 e176fa2407b0b5af5e30acadd734577b
SHA1 748c4414c3bbcc4a5b8335632f6241d0fda73c85
SHA512 6062106fe4e6057bae7fadc5a5605895b4c32353226845c0e4e1a74a23d1e59834a74198f7f63ea98f180592ac41f8291d13f1e84233bc843c1d19d4da829a59
TLSH
T15461C3B52546EC73E3792FF3ADD11E0E34F2449A89230E4511B4A9FA2912FE1C2B1F08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 072728b215e42ddb38616c3325217734df5e263ab2dd46d6d439eb8f4a6dc63e
MD5 3b5b5e7a7e3518200c7be1df44d3150a
SHA1 d06f7a14578bf7a9773db6223f9e8ea6a9f740af
SHA512 31d2ec1df0267c73920a70893c563f3cd3078f7485b3c52076eb3d84baf953b1ce56b5a8d101212083f381ce4ba092402dbbc502c33ec847943c6154bfff7137
SSDEEP 192:6n1NYdVzE0BtdCL9CIYyJ/ad9tZ5cbeHAi0makQIoi3MSvIT5580v4o91TeW5mhr:6n16fI0BtdCL9CIYy9adjZ5c6HAi0maw
TLSH
T1B70287139283E9A3DF648AF39FE20C9975B8C56409033EA5242DF8B9174ABD0C371F24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58726c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58726c.TMP
Size 3KB
SHA256 13f4bf9de15070204cfa21f512fd25e0550559c02b8b778b5e59c85445d0162b
MD5 870151043c5094360af2c00f30b046c9
SHA1 7d7a2e7b4cba66ee5ad2a98d8de8dd74d6d826de
SHA512 c6895d432ed62cac772b89370f9033fc941f45995f4111cfd9be35440dc7c7fbb3b798bdf2d10b572c600c64582702e5899ea87ad42f6650536563a39472c427
TLSH
T11061B3B51546FC73E7752FF3ADD11A0E34F2449A89130E4511B4A9FA2912FE1C2B1F18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.bing.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 40bce06ff83d87ecf473b878d1188f2bb050958d698d4edcbf87579948abda29
MD5 0b16754c2bac758a054f6a7b2d2a355e
SHA1 39baa8a5604a608f84885b549d0129c982ab3282
SHA512 2de3846c2c5ebb9e70c9ea7c0de21723fa27daa7e59350c887a3eceff9e720023c2b188d2b720e39483de6672317d8551a0a3343dc1d36e151bd692797edac8b
TLSH
T11F81B8F383E6822DD91192F0AA187F1BCE1C0456436C3C4A89D4AF0BA3F2461F052B9E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 817afa413563659ebf71c49aa8a37e69bb808645845f0185e18283b1c8b4e50f
MD5 f851e294145c139138b89f845175c30f
SHA1 efaa0450da82e6d01e4c3e5e5cbd67d245a039e2
SHA512 33ebd84f001850f23ea21cfabbdcceb8c79357e031a9ac6de6fbb2da3f1b5b501e6f9e5a6af595ba2d12ceb150d2069e2d76feac2575bd7476239e0a797a6922
TLSH
T1576199F2C3E6866DD91196F0AA147F1FCE1D0552436C3D5A89E4AF4BA3B2461F012B8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 8aa7c4e95aef1f64950d42efa40b7a198dd333d55dcf3d040ca7949a61db3f56
MD5 7f3149f798b0550c308bb7bcb88fd04c
SHA1 218a23bcb4103a6df01cbebae8a13809a0885e43
SHA512 044647f1e4c6f35db65f7fac395c9fa76831533a3c03c7a89c714a601642fb314e7336ebce5c281944b0edff4d45ecfd5faa0721119a4ba76ea5cba45da49753
TLSH
T18BD02263130030B5A9BC7EFA806AFDCFCB2620600903EEE420E0A99C453286C250B284
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5967e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5967e8.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 7a13ec3deb75ba6650055e91469633c0ab79d7bfb173804b4947908984c63b1a
MD5 22ac9d611ca8d5b8748ad34f873241bc
SHA1 afe67ab3926b20b03cb0041154671af16ae5d1fc
SHA512 0302c16cbb13c24038293ab11831d55cc54aea5f0a5cbee12868dd00de2b4f8232a69f3fba64db8d9044c2e0230d6d79bc6cfd6c6e251d26a8f1e184cee8cce0
SSDEEP 384:sxZBnqBqEm4V/f9smglAdww1/UHAZ5wZqW/p:s5qIEm4V/fXAAV/U45wpx
TLSH
T16B92EA1269348977DCD7D519B922BFA3D6F41463DA911E4CAAFCCA0C04EA6FD221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 64a3e6545fb5cb2ce5c4487a8091c92b7a9baea2a2bf9f3217bec00d541931ef
MD5 8d63ebdcd35bb01eb835c0a8b1f58046
SHA1 65c856a0e5a4d22e719f0783cf82fdff354cbd58
SHA512 2aef78620d33da52a6b718cd5ff7132c45115c882cdab34b2e76c300bd237be5edaaf059325234b6fac4d0ffa53a86758a166344b1cb81a54802650f9bb3105d
SSDEEP 192:zZ9R3yM/jK1Ml8MoV/f9sxLzoSoEdpM/DT6+WNGY01F6y+CIgrJ:zZ9XQV/f9sxfl/M/UG5PZ9
TLSH
T1A842E812AA345937CCDBD209FA55BF93D6F95473E2900D44AAFCCA0C05E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f9d4b09d432e39a82e38fc83d33e81f717ac71530bd087fc2d7ae8111352ed2a
MD5 ddd019355357ed6fa2cd8c7c3ff0fdc6
SHA1 da3d2136de89a61b9204002a2a9d5bf016e761f7
SHA512 78e4ecf042debbfdc6170c4c5cc8c3c208d2bdda40842ab3ad264df85bca95efa047788eaf925a53ca633df150163e6d264190167d50aa8d6eeadd5afffcc8af
SSDEEP 192:sxZJQUnRR3yM/jK1Ml8M8PV/f9smL8oSC1qbsDvdp9d/DT6+WNBFj/Y01eEL+CIV:sxZBnRBEPV/f9smglCEwL7/U3/57Zg
TLSH
T10172D816B9345937DCEBD219F906BBA3E6F85463D6901E44A6FCCA0C04F6BDD221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 eb1b50af46252f3e0aab1d6265eff76a6a2baa8d09586c9ac62125d63caf3a40
MD5 55f27391b052ad7bc9124e46078ee6ca
SHA1 3e95ccfa1a19913ca96262ae9b2f288391ca0dc0
SHA512 35b1a912d02015b4a5e4c683d19e6956180d13da493a4f59c1336c0ed55048f0a96c4811e5ac8b36d8ccf3a9b191311730387af305218cf6b33de62037657552
SSDEEP 384:sxZBnqBBm4V/f9smglAdww1/UHw/5LZqW/p:s5q/m4V/fXAAV/US5Lpx
TLSH
T1BC92EA1265348977DCD7D119B922BFA3D6F81463DE911D4CAAFCCA0C04EA6FD221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c7f0fc2e2d5bf2c83fb786548b96a26007931654c271dc29e929f3223f96dcfc
MD5 ead8e7ec2df9111c5412a0b153111195
SHA1 66997ca6d862113fb1a95a081d71147f63b4ad86
SHA512 fb5ccc7d261d903378524da5a3e82e7088f0a2bb25d973eecee74c1583f6274de74c162920468d3f154cd0e8b2b7c487e1b1da51cffddf0588841c7585829fcf
SSDEEP 192:sxZBR3yM/jK1Ml8MoV/f9smLzoSoIdpM/DT6+WNGY01F6L+CIg5kJ:sxZBXQV/f9smflZM/UG54Zi
TLSH
T17552F812AA385977CCDBD209FA45BF93D6F91473D2901D44AAFCCA0C05E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 6c7561ce060824c097d8d1d6c233c955d3c767713df1cfe57bf634226d7bf101
MD5 c5ef212ccfaf15315ada2816cf0fc5a9
SHA1 57b5ba14ff8a1dbf76be5546175e9ee3c8af91c6
SHA512 a315843e7b368b84819816ca3294061e56c1ea5e76847826b42f5c6853713d0e34073fb08f77b564224f75703c772fac9ec09b8f411e766db46b98c290bbb41d
SSDEEP 768:UZ4bSV4b+8b4bm254bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4l:USu+68si2y1WRmlzQqju1jaKDILpZ8UY
TLSH
T1FDE23A3B280CCB7E4F840E5CEC26AF966ED801CBA6684D5447FE494C03C77EB512A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6a219570-5c97-44b4-abbe-82c4d42a4a5c\index-dir\the-real-index
Size 1KB
SHA256 7d9c94bdb3ff3b8ced0268f1d2a8a28dced665e4a160ab87e621304bdd6afd9b
MD5 db5c551959a46de53814fb002274451c
SHA1 8f51c5c2696b8ddafcaed60568b460a1c322fa65
SHA512 b58fd93ce62fc4beb957a62ecd176138efea73d9dfd412be3102c70ab1231ebb7a57073e124769818cb3ed90c8d20df255a72a6011bd921cf6b34d61abef4613
TLSH
T17531204D5EA09DAFF4A480F22576E5A8B27089DC4615A2338C3C23716E5334A2A876DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6a219570-5c97-44b4-abbe-82c4d42a4a5c\index-dir\the-real-index
Size 2KB
SHA256 b828a5fde395a44e73583d0f9bf375845c785f3857d24ffe905ef3c05da1f2d3
MD5 3daac95c33b1b36a89413ef4ba4b7cc4
SHA1 bd62fe084cce2730b473ac4a6c20f47d1b2aeb5f
SHA512 accf81488d9761ff56a69914e300fe8c69b3418671c745b6bf72a91c2bcc65545517a77ef2cca2afe7cc4fe03b29131e381805403c6941818c6a70fc16e85ff6
TLSH
T16751D88ECC8A5BCBDC7C61B378BA14C6373A18ED16848E0B5DEC6434BCD323D1926654
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f865.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6a219570-5c97-44b4-abbe-82c4d42a4a5c\index-dir\the-real-index~RFe58f865.TMP
Size 1KB
SHA256 3fd8431b09e35d70fbdda4021f64055b744969b1f9476117b6cc5f014c555721
MD5 e996ba19c73afd168cad97fcf2a6cade
SHA1 556b965372cd33e9ed74ddc037332d8071eaf0f7
SHA512 7899e35f1fab59e556b3df93635bc75d6fbb2c30038f57ecdd3448974a56fc0e00edb295d87a94438658d89cc399814f9815754b8436d653bd95f2eb162fa0e5
TLSH
T14831028A8A918E0BF884907B1963B4B8733589408311B393A97C62399D61B9D1A4F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c141c4a8-18a0-4627-af8f-aa6de8b6555a\index-dir\the-real-index
Size 72B
SHA256 e98b6e9bddacead42166bcaa44c7d13ba8e6560c492f9861db144b110634f824
MD5 187715eb9b2aa078c35dffcbc9bd7043
SHA1 6b4e1d86af82f9527c7cf563d296de45a609fb60
SHA512 eb87090901bcbd10890b98ab39eaa36de78b5c60dc57eb4323b70bad7f9ea33b987da4febd18673e36c5b2ac03218568b08dbe4d12bb76e3426b1cd22c3bcfee
TLSH
T118A0041013C50007DC1317F117F353411710CF301141D30740D1044CCD53CC04D4145F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c141c4a8-18a0-4627-af8f-aa6de8b6555a\index-dir\the-real-index
Size 72B
SHA256 73ed380d214f21a24a043146877ed00f6d4fb4b31c13e62f54edf7425a9a2e0f
MD5 8dc211cddea63e5ec8cf62e7719c6c9f
SHA1 12113421d091b679442daf5dc24b4653febba611
SHA512 8a72cb29eefaf9b7ea205a400ed07acd7e56494c03107115e732180051f40f6407b51d0330063179e36c5245624b967ab4a29aee44b27f0522b194ffc013ebdd
TLSH
T1AEA0021602C20807D04B53F069DA126262604D24A212231785E05288C961566464300C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2279f6e965fd39e4dd4c4b87fa0f065398b294272b777c518a59f25382a4db0d
MD5 74148aa9ee6abda0095b21675876569d
SHA1 ee7e810dbc0f8d6a9906262a7693edab317adfea
SHA512 e97abd2d09532eacefaabb42b7aab531e733f89f00927e24273c3ec39d10de601e9d4db2c8604deeabe43e99ea02a382f292a30fb3023d21497c4ecfd1dbed19
TLSH
T193E0D8B72DE72C28EA6FD7E61435A59104017454DA26AD4F142AA3D790717252846C73
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 46a626217854548470388122e9bd765cf59b8814c1fa7fa260c26b81ed175a40
MD5 e7da8f9b42b3a314745892affa5427b1
SHA1 9bed31d0cc1d83fb20d17da1455f0f84b108192f
SHA512 9b9a5c8ec7acdc68170ecc3e25b31ed19870361789ecbf7a303c7efff7a77ccff844005764bca44acf673d10202a90224942f5307c34d7516002bdfa313bf49c
TLSH
T1F7A00255DDCEA2A7C5401BF028A9A1C033D048DA430526017598B0DC9D912805AC13A2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 c01dd4cc8ed87c2d4abbab58ba59bfded58dd5ec4af98034ddf7f7b00c9e20fd
MD5 37d3bcf5672d6dd82ec5254b4c06879b
SHA1 379829053a07bf2621669322ce4670cf710d7c72
SHA512 99bcbd55b14cff034f8916f580b9db77c87aa39ea45a443ae94e78c0fb84fe71205164006fc452f577e9d7777a924b688af60eed46bbe483cb5ecd1ce2473eaa
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3a6009f1a0be55e111ff523efff8267dea95ae36533c59a79bebee0cf46b54f5
MD5 503120e78d7c238138f624db9dc1f85e
SHA1 c8af7065247634e3bfa320d26b488374166569cf
SHA512 074391e0302fdd559f5c265fd39dacf982b3789c0f2563ab22213ceb1c3e740985608463d88634f0bd46c8029140757df7fdee7047b8f3cf872553863ccc1484
SSDEEP 96:K8K0KLS/+cKnKCS8wK5eHklQUuSW0Wyf/gc0K4xgW0cUUfO0pg:Stv7KklQUuSWLyfocIxgWbUUfO0pg
TLSH
T1AFA19562307B13213C3D251C9354A72A5682B2A33099E87B7BB808B61F77E615DFE5DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590e6d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590e6d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 072636dbf403870bc3a984d34f94d67b4b741cffccb26e4f9571436728bb4e6d
MD5 9b6fc08295858284c6f51723fa3536b6
SHA1 8493d8392b87ef8df88e3264d95ec533b8d76d0d
SHA512 fd456f0d7e06c3dda8d4eaa98aaddb147782c704e6b5af5fd2a7f7d591ef5cd483d5bde50976698fc96c9af2ea6d76f4f791c996f6e798e4af77b0f0ed7d2d06
SSDEEP 384:PiFjtNn/s3n9S18Nd8TUNTUlIRsTU5BNrk2r3b+AH8EyXQMzOObjI9G6w7hk:aFjj+9owwgRfkarpnKQMz29My
TLSH
T166D23AF258E78D36D99E4B47B73E2D168EBCC167B5852A80B3D85A0CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2fcd2a33a23b3daf01620800ffd2f51881413d4eb0cbf54fa531411cc0ea111e
MD5 2817f56dbfd085363282e68af2bf7fc7
SHA1 5a97fb439211f709421024969d1e13d0add3154f
SHA512 e2db0a4ab45370ff987e8319a957eeed0a636fc28435acd0efc229cf5680ca13ae028620bd0971f11226a4e53d45df3f057abc7b677565e36d099751812a8954
SSDEEP 384:EtNn/s3n9Sf8NyUmU5B9cDr3b+AH8EyXQrzOObjI9G6w7hk:Ej+9MYE/rpnKQrz29My
TLSH
T105928C32AC799D734DE29594B40B362B8FF8417B97852F84D6FCAF0C05DB2AC530691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 77c3c03ba2d031be28acff32eb9d929214f173acea47ae3e13b3cd9a90aeba39
MD5 6dc5aecb4faf1d5388bbe24066721a11
SHA1 e96b65ca4ef56ec68d13029ef4a99836f629383b
SHA512 2515764bf870b3904e4f7b1e81a21c9d2d615f93888c6d74be1ea70e8ab49024d82278d3a0ec4529f58d86120b130faa5c5e9aaddaf4fedee2da0740a8082cfa
SSDEEP 384:PiFwtNn/s3n9SI8NI8TUNTUlIlsT15BGpk2r3b+AH8EyXQyzOObjI9G6w7hk:aFwj+9dvwgMSkarpnKQyz29My
TLSH
T1BFD22AF258E78D36D99E4B47B73E2D168EBCC067B6852A80B3D85A0CCD8617FD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 24f467e80de99c7e0e2fc55ce7fbe89856840212c7688a071a68b112461fd64e
MD5 afa603aca07a16e44d8f6eabfd7022eb
SHA1 54a7329ffe4a2301c6d15d3f84159b668a03cbf1
SHA512 b287cca27cd404583310e67bbec3865e1c86f87ebe0f8723666653c84921f04acf65a84d0d4832855eb5a06451b2a2c2fbcf2b29600755bd40c53b8a7d59ce57
SSDEEP 384:PiFYtNn/s3n9Si8Nd8TUNTUlIRsTU5Btnk2r3b+AH8EyXQgzOObjI9G6w7hk:aFYj+9TwwgRPkarpnKQgz29My
TLSH
T190D23AF258E78D36D99E4B47B73E2D168EBCC167B5852A80B3D85A0CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8dd61b4ddec11518e194b9811f83485617ed34be12b5fc8ce3ddeee278497191
MD5 45d4a384763546c8d8375e656c6eef6e
SHA1 be129ae4e4937df6f3add86ec879b9d534dd3de1
SHA512 556db324b2b2f71e484c5e144131c69b392f746f04f5fcdb20033083eaa9680615b35ae1bbce19878082746ecd34eb6e09785062629b38441d9d93b5eba0272a
SSDEEP 192:u6V8NyUKQjTFZrBlQmiU1yTvTM4r3b+jcfjzorrHoAvXQrn3hGrqH3Av:x8NyUKU5BZkDr3b+AH8EyXQFz3C
TLSH
T1C2420832AC799C775EE29585B80732539FB84067DA853FC4D6EC6B1C05DB39C230B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 3ef6e63e032d710592c862419bf34ca7495608df2c2d3a837d8b690cc741dca4
MD5 96c4d19db55efd3feb396b7888c1caf9
SHA1 cb0573164b2ff972c743da16e5be10c732ac1a53
SHA512 755c68a0ff2786b697407433bcafb5ba144be95add6aaa634f67bf2a4255d5b5d2dee0d92ead23a863fd500317acecea16ae40b8be0328e407183fc54796f101
SSDEEP 384:PiFKtNn/s3n9S28NX8TUNTUlIlsT15BaMk2r3b+AH8EyXQBzOObjI9G6w7hk:aFKj+9jCwgMLkarpnKQBz29My
TLSH
T157A25C339CA88D7BADE28A94F54B321BCFF441A7C6857E94E6ECAB0C01D729C5306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5e4ef5e0372d5b9f1d6ef8d083cba6aadfc24070ee1475322f6d187e34a7e71b
MD5 52bc63fbc67ecab25c39a24075925b9d
SHA1 4837d06de4ddfcc8ea2c90a0227b9de3bf5369b7
SHA512 6920fa9abd9ac4d24c93e1d78b6f1a642dd0db74a5c7558371cfd670405cadc9f6acb107eeb9354bcf7827b44a8dace680c896e349d244defbc37c8bc3cee3d2
SSDEEP 384:PiFYtNn/s3n9SN8NI8TUNTUlIlsT15Bapk2r3b+AH8EyXQ7zOObjI9G6w7hk:aFYj+9svwgM6karpnKQ7z29My
TLSH
T1ECD22BF258E78D36D99E4B47B73E2D168EBCC067B6852A80B3D85A0CCC8617FD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b00c2227259c481ab5b9d29b862c69100560f1156f7095691316015815c54000
MD5 b4da3e47a00853e8fdc18a7d0abca491
SHA1 f3cd4f1a25f22d60b452941cc098c013b8c65c76
SHA512 8608b622c9bf7c5c4d9fda5dcdc9551c6ad226cbf63609f5ce50750786d9e68e24f97f23c378dfb27c0405f01ae48c8c9716e35b95a52f33b05727f2f0397263
SSDEEP 192:nRGNU6yMQmiUybJmM1Y3b+jcfjzorrHoAgMnXCU6:RGNU6xMv1Y3b+AH8EkyU6
TLSH
T17502D731AD786CB79EF26E45B88737138FE4117BEA952F80D6E82B1C009765C2347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f72d3d1203c18d020c5742c85bc8feff1224b237cfb432a0dafc3fe742602cbe
MD5 1c316c95958085c94ffb3bdaec21e2dd
SHA1 840395863b3558ca139ec8c0550fffce3241f22c
SHA512 344cde59020ea452d2ac62a8209c474c2359e8ba45325345f0219a8e7e15465d4ebe180c1826abc7aa54d9fb1025c8ff732a53be8a82925a5ba6c1e4c7615a99
SSDEEP 384:rtNn/s3n9S68NyU7U5BvcDr3b+AH8EyXQrzOObjI9G6w7hk:rj+95LK/rpnKQrz29My
TLSH
T1ED928C32AC799D334DE29594B40B362B9FF8417B97892F84D6FCAF0C05DB26C5306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 80deec7036d4fac9750901267ca74bd78e4af7d12e9a15b21bd78944877b0871
MD5 e0f8515bbb47e148f845630c1d43e0db
SHA1 f15835c3784c239df49d2e57e997d3f9b0e8213a
SHA512 7997bd58e090037e4458ad0bb946b066aa7183f0f85f190e22a447d63bd0cebbd9a743315e963b02ac5a204779d17efb5adabf87efbd9b53e3e525e3f8faa0d0
SSDEEP 192:tGNQ6yrQmiUyt0MRY3b+jcfjzorrHoAvXQrG4MGrqHU6:tGNQ6E4RY3b+AH8EyXQizU6
TLSH
T19512E832ADB8AC775ED2A984B44732139FE50127EA897F80D6FC2B1C05DB65C230B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

AILog.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt
Size 917B
SHA256 a4e5ec197a34022597d127dcf830c205401090762312fd0650bee4fdae176acc
MD5 3bc8af12108f7ad8a8825f8f72fa1f8b
SHA1 c96b056c0bc2601d89e8ae24723d5954e6b84aa1
SHA512 32ea70b8ffee4017cbb6d9666462c30c54b7e52c0899d773346a8f10e7bf556dbb54b4331f28aa9565765b345fdc20ef44585ae085afc22ea5c30d44dcad7b26
TLSH
T13911C48E656F3B3C41324362B411B0D907E4039E45A075DC2169B0A9AB725D9EB84FF4
MD5 SHA1 SHA512 TLSH

Submit Download

AILog.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt
Size 917B
SHA256 532f94b6500a2587f3c38e0c9545cdc7d3441c82033be0845a4adba4eef9510a
MD5 0f0b76f7312e18a2dd7e1d988dcce12c
SHA1 ea2141a83fbe1a07942714febf5f6152c845041b
SHA512 17681e694d9f0445e012d9681d499371c67f436c8e0ea26f2a557ee351dc21b306e85e7ec5f50a140c0f61cf397e6c7adce0432e7d2b187eaebd0470d1d6d1e1
TLSH
T19611A75E256E3B680433039BA81971D907E413DE856076EC31B9A4A8A7330FFC784FE8
MD5 SHA1 SHA512 TLSH

Submit Download

AILog.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\AILog.txt
Size 917B
SHA256 43ff17fd19cb8d53b2d0633918a4beba099112c36eaa448f532e1cb5d4cac48b
MD5 352c8ea1d2a5cefe4d31cd8cd872b594
SHA1 6debf7e9656b1e4925528c7f1546058846b46f14
SHA512 061ee9fcc77704cd8006026e03599e18fc8a6b1d5d2a777c397e50e8bea7b88cf4ae075732c29313f1bc109938ae2f94344952c12a0c7580c51f7e8fb301442d
TLSH
T19511C45E657E3B2818330396F85D61D907E81A8E45A075DC2065EAB867324FAC3C4FE9
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xwjp2tdf.43g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xwjp2tdf.43g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

61878MobilityinLifeapplic.ScreenRecorder_2.2.4.0_neutral_~_zfxkqydss3nar.AppxBundle:Zone.Identifier

Path C:\Users\Admin\Downloads\61878MobilityinLifeapplic.ScreenRecorder_2.2.4.0_neutral_~_zfxkqydss3nar.AppxBundle:Zone.Identifier
Size 263B
SHA256 a2340d82c2649c6466b45dbe4a56d9ff5e396d6e5add18ea0bee8be3c2991699
MD5 d89135f0724559a77aad6f934cc9c34c
SHA1 fde5ed747c5ffa2b16f0079ada5f790b80796528
SHA512 770a7b8551a7c144754991e5ac3486909927554557a16e1ebc274ed47021f215827be34bf506be1d5113edb4b89a058bb6856742142e4390de23522340e5a2f7
TLSH
T1E2D0958F419052025D0939A41EF8E31C245DB2B52145F2D0CCD49DF184C13ED14F64B7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4456-1472-0x000002962AD80000-0x000002962AD9C000-memory.dmp

Download

memory/4456-1473-0x000002962ADA0000-0x000002962AE53000-memory.dmp

Download

memory/4456-1474-0x000002962AE60000-0x000002962AE7C000-memory.dmp

Download

memory/4456-1475-0x000002962A780000-0x000002962A78A000-memory.dmp

Download

memory/4456-1352-0x000002962AD30000-0x000002962AD76000-memory.dmp

Download

memory/4456-1351-0x000002962A6C0000-0x000002962A6E2000-memory.dmp

Download