hxxps://nexusgames[.]to/game/1-for-the-king-free-download-vpc/

Analysis

user interaction
yes
max time kernel
1799s
max time network
1643s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nexusgames.to/game/1-for-the-king-free-download-vpc/
Sample260711-vqlcpshx21

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
105	discord.com
93	discord.com
94	discord.com
96	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
900	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282635172761053"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{370196BF-23DE-40C7-8399-F6524D8424D1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5124	msedge.exe
5124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2984	1524	msedge.exe	87
PID 1524 wrote to memory of 900	1524	msedge.exe	88
PID 1524 wrote to memory of 4860	1524	msedge.exe	89
PID 1524 wrote to memory of 4860	1524	msedge.exe	89
PID 1524 wrote to memory of 4860	1524	msedge.exe	89
PID 1524 wrote to memory of 1580	1524	msedge.exe	90
PID 1524 wrote to memory of 1580	1524	msedge.exe	90
PID 1524 wrote to memory of 1196	1524	msedge.exe	92
PID 1524 wrote to memory of 4708	1524	msedge.exe	93
PID 1524 wrote to memory of 1196	1524	msedge.exe	92
PID 1524 wrote to memory of 1196	1524	msedge.exe	92
PID 1524 wrote to memory of 4708	1524	msedge.exe	93
PID 1524 wrote to memory of 4708	1524	msedge.exe	93
PID 1524 wrote to memory of 2680	1524	msedge.exe	95
PID 1524 wrote to memory of 4748	1524	msedge.exe	94
PID 1524 wrote to memory of 2680	1524	msedge.exe	95
PID 1524 wrote to memory of 2680	1524	msedge.exe	95
PID 1524 wrote to memory of 4748	1524	msedge.exe	94
PID 1524 wrote to memory of 4748	1524	msedge.exe	94
PID 1524 wrote to memory of 3528	1524	msedge.exe	98
PID 1524 wrote to memory of 3528	1524	msedge.exe	98
PID 1524 wrote to memory of 3528	1524	msedge.exe	98
PID 1524 wrote to memory of 3452	1524	msedge.exe	99
PID 1524 wrote to memory of 3452	1524	msedge.exe	99
PID 1524 wrote to memory of 3452	1524	msedge.exe	99
PID 1524 wrote to memory of 3844	1524	msedge.exe	100
PID 1524 wrote to memory of 3844	1524	msedge.exe	100
PID 1524 wrote to memory of 3844	1524	msedge.exe	100
PID 1524 wrote to memory of 828	1524	msedge.exe	101
PID 1524 wrote to memory of 828	1524	msedge.exe	101
PID 1524 wrote to memory of 4324	1524	msedge.exe	102
PID 1524 wrote to memory of 4324	1524	msedge.exe	102
PID 1524 wrote to memory of 1128	1524	msedge.exe	104
PID 1524 wrote to memory of 1128	1524	msedge.exe	104
PID 1524 wrote to memory of 1128	1524	msedge.exe	104
PID 1524 wrote to memory of 3900	1524	msedge.exe	106
PID 1524 wrote to memory of 60	1524	msedge.exe	107
PID 1524 wrote to memory of 60	1524	msedge.exe	107
PID 1524 wrote to memory of 2784	1524	msedge.exe	108
PID 1524 wrote to memory of 2784	1524	msedge.exe	108
PID 1524 wrote to memory of 2784	1524	msedge.exe	108
PID 1524 wrote to memory of 3840	1524	msedge.exe	110
PID 1524 wrote to memory of 3840	1524	msedge.exe	110
PID 1524 wrote to memory of 3840	1524	msedge.exe	110
PID 1524 wrote to memory of 2816	1524	msedge.exe	117
PID 1524 wrote to memory of 2816	1524	msedge.exe	117
PID 1524 wrote to memory of 2816	1524	msedge.exe	117
PID 1524 wrote to memory of 5404	1524	msedge.exe	120
PID 1524 wrote to memory of 5404	1524	msedge.exe	120
PID 1524 wrote to memory of 5404	1524	msedge.exe	120
PID 1524 wrote to memory of 5856	1524	msedge.exe	124
PID 1524 wrote to memory of 5864	1524	msedge.exe	125
PID 1524 wrote to memory of 5872	1524	msedge.exe	126
PID 1524 wrote to memory of 6132	1524	msedge.exe	127
PID 1524 wrote to memory of 6132	1524	msedge.exe	127
PID 1524 wrote to memory of 6132	1524	msedge.exe	127
PID 1524 wrote to memory of 5212	1524	msedge.exe	129
PID 1524 wrote to memory of 5212	1524	msedge.exe	129
PID 1524 wrote to memory of 5212	1524	msedge.exe	129
PID 1524 wrote to memory of 5720	1524	msedge.exe	130
PID 1524 wrote to memory of 5720	1524	msedge.exe	130
PID 1524 wrote to memory of 5956	1524	msedge.exe	131
PID 1524 wrote to memory of 5956	1524	msedge.exe	131
PID 1524 wrote to memory of 5912	1524	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nexusgames.to/game/1-for-the-king-free-download-vpc/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2bc,0x7fff2847c188,0x7fff2847c194,0x7fff2847c1a0
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,10973109117232583111,18059286596343259743,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - System Time Discovery
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,7016637626599906179,12650472459257089582,262144 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,11809792265324564867,7060099810373848811,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,13263695080963513018,1681334484427592614,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,10208949499710762202,13366518555767055664,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,12326857765301607682,6775411972688360594,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,4507065613483774637,3205994396906675016,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3612,i,9789311477511149670,736659764502042424,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5252,i,14413586517382104212,13773471894128739198,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5468,i,9920395299608906677,3707266743845193873,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,3120477819944431694,9603734707834408361,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,405939958130862810,3001573956495403725,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6564,i,13908261813384283484,13617647375993017538,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,11095804334679167690,13731233457829107433,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,11095804334679167690,13731233457829107433,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,9060340824224530491,15291123774548716415,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7020,i,16303722056180037744,9425871822610999513,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7500,i,11626281032318625860,4978251659301021798,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5148,i,14483056085012791969,11982434044419742691,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7356,i,17626369232621507654,12651023188957684836,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7424,i,15164684314379677974,3704100355610568129,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,11809309648290436235,10800221954070074303,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,14731873298422506977,12059126292949963108,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5568,i,6846130197631722761,18419828857491031054,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4724,i,6793670125235421958,2286377079021625676,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,887697000550700119,15808509392703438535,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,5058587896902478936,13145578839047844302,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7240,i,3803113584872139204,5317423879751672666,2097152 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5152,i,1474663334322152642,8800642624546844564,262144 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,5290428185870910324,5208398485223585377,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=1060 /prefetch:8
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7236,i,9879149374582884693,15539827354670157420,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:8
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,3636543150350057131,5942668177740072736,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,4692737113225277736,9897817662075851247,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,4977900825886918107,14804862540168905814,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:8
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,6016222002237367206,17705817069442998263,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,14131841957258225725,4233787795291837557,524288 --field-trial-handle=2260,i,13018510119449510121,6280025876442175543,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 cf62aea37d932c14a73e18bab642d9709d930235a853be045990dbf2afd65dfe
MD5 168d3de5dfd46ac9cc08f1b7193485c9
SHA1 3a0da82320200c1f7033a9d9bf7d478ae9f4f396
SHA512 e4b8a981365049d11fd90159fd48ae10cc5a7cc7f2b214a02f1ea2037f08f5f6f248918157ba82bd89de680f53a13008f48195a919060c67089c5b373ca30123
TLSH
T17DE07D8419CACA2E96D0E6C743F4A30CC2A0378FD2C8FE7A5730C8DDB881044A3C25B8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 c363a19f12d61a6d1a6d641a97fb337dfcbf2915a044a4894835a3059499a1c5
MD5 9fbf5c418924df48cee5ae9339d649a2
SHA1 ef93ad45f5fe4885accd6611f87bffb9c438a947
SHA512 5cfbe4ccda0b39227278dc2c1c4e3ee84a37fae0e97edd134773ab84b941c05ac16e8dbab783be654705317794aa8425eb14fae9e2ff0bf06ba0a31a89952c2d
TLSH
T129E020771AC8CDA409C096C78046737CD516B14D994D977F3375F8BD6C4D00163D08C8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000e9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e9
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ea

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ea
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000eb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000eb
Size 401KB
SHA256 98f245dd4ea1657ec5caee3b61220fe47bdf506065cc6cb3157571c88c360407
MD5 1c4c724076400ec414becc254150cb71
SHA1 b7b863185d901d1d66dee8013eeab87dfbbb7584
SHA512 78d9fc2bed91ac369b7574f103da89bd820a7db176c43adf9c083f9e74f3cf7d93fe25998af31d44f55378d352ac855c04f15d572d9c8d8c2b81453ed32402da
SSDEEP 12288:PtfgtaUcQd6jMZlyexMi26SLYUmYEw+Qc8n4KhUSQOgnC8Hz7:Fgt9CwZ4exXwkUqqB48NgnFHv
TLSH
T11394234FDEB0F07B772C88531FE4A80F66D676A209BDFEEA15F15726E31D0A109A0548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ec

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ec
Size 67KB
SHA256 2b5ed041424f24d8f0473eb3defed6fe82ab0c9c21d51f959935e8c7f569292a
MD5 068702a04ed266e5f85a1bd7b7beb3d6
SHA1 9c9e100c94193fe904ca224d8ae3fd766cb54db5
SHA512 50e31424bbe13a5080c5634d89eb6d100284ef15cea34ac21dcc5548668577c01c3cee500705b9f2edc51aa76f0d13c6b062d58e4e80d5ab0a9142c40a0a80d9
SSDEEP 1536:E3B7N5R5hwirOGHn+ofuxzIJG6vAzDqWKGWM03PL8jAN+Zh5aSUgK3Gkb:EVN5zYzoiUI6vAzBKl0jA0Zo
TLSH
T14E630285CE4DAEF296352B7AE31AAF51550CD2B5CFAE62BF3EF1C11342C4C55886402A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f0
Size 78KB
SHA256 690acfe5876b763e7afd4d1535dbfe8187a995a98ba1f0679d914e3468d9cacf
MD5 5057156cca6e15500a94c459729f93fc
SHA1 f5ea5a01df3c423c3ba37211b3a996ee31f1c22f
SHA512 d42f652029ccad9f62cedb1af86b28cb34af79a80cca08925212d4681c05b210b1b0022e2d3649cec0339338d30495dfd9f231c0ac766606f5cd2075ee7c3df6
SSDEEP 1536:/F/SeszsxXrgLllk72duVKv+4lZgjfjsGPr6d1k202Q9bJEz9DskRRB0zjZGBN:/rAsxXrgLnk6dd+4lQT+d1kP2Wb89Qkp
TLSH
T132730207C0C1313ED7EEF28A8FD49103AF8A7B74A7AC125D77998D234AA746B008D765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f1
Size 27KB
SHA256 4055c08923c81d63735c1691baa778c332bf680b8c4eb057d7b87e2c00c5578d
MD5 aa6a30350189be311d6f87b7d145d85b
SHA1 79d0105a90db8fe73876d31dc4f54bb9a194002a
SHA512 3563cdd2399d4ffe7f76a2b252800e2b767f7fc776fe1faf1bd385cc41ff9305c7a5367a2d28d6bcb46b9202461c23b86ad6f1f3cec2cf51ffbd181000651037
SSDEEP 768:Y+8X/NT0ZezFy6uLGsyvi7ssXAS39YGiE1TJnhC:Y/ZexL0o5X2k1Tds
TLSH
T1ACD2F104AD3D7AA06468E3D332713166FDA696A10B7702D2C615E625B3983F42BCBCE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ff

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ff
Size 17KB
SHA256 fe672d5c4e9570c5c4c30f7ffa25027237ec3a8766ec89d377a0f8964ee75937
MD5 7b25ade41ba17550d716530d18040b36
SHA1 d4d120778bc8ec1848baad09c6cfda312e02b155
SHA512 0785d61dc17879db03511c9977ebfed986072398665166edcda0ece0ffd0bdae44592d4a91064be3da462c571e13fab722aa5d9516c41d215b9a381faaef0e5f
SSDEEP 384:/nmVvU04jy2mdP6WxXByiQy1lm3W0KlGou/W2B9wv5iMOtLbnO2b:fAvX4jy2SP6WxxjhmuGoeW2B9wv6bnOG
TLSH
T1E882D1539CB2628EEFD09404FCB02B6E6B45CDAB700177ABB7D1426811C6187F2796B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00010a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010a
Size 16KB
SHA256 b17b23990851346a40d733da642788136fcc9913a5e690865be124637f16bf66
MD5 e97f51ffddb5102e601f568bebbe6656
SHA1 80b1ed86320c70b9a17f9d5981a132b9a4a6afeb
SHA512 0561e3a1f680d2cf8fa0d19282359588fbdb3a508831810aa5059d6b7b072c840b06323d4ce4c66464ab016fdca47bea6eedbd765acf8c6a503ff2edf91d5fb8
SSDEEP 384:PUsJMhkvuJpDKSNflVDtakrzt2ro/zvllLMZ3u:8bz7Y0ztmez3LWe
TLSH
T12872D0A96EF500237B2B8CEE15D083948E847AF36D6B7DF642883067849C6A17D1858F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00010f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010f
Size 36KB
SHA256 86db6cd44df49977d457fff75bda1a63a31377dbb352e1c844fff5a062333840
MD5 761800cc7b13806703719d9761d3a64d
SHA1 cb6a0b530323ea43db8ac9ea9c6f14aa5209801b
SHA512 5ecd0dca6bb8fbc76245b6c606e8c9c3ff3cbea1e2cebd6e179f88eafeb084219657be14737425f40f0a691df55e46c0e771617ed5886a1352e1f49e8515c4eb
SSDEEP 768:fOQt/KvYIIAZ3kg6FXtDT9SSO7q4KpCLXk73ON/iN9xquWqhx+/w/:fv/KAfAZUg6HTkS6o3OK9xquVhxCS
TLSH
T148F201D9F348F6B92801E43BC5CE0B65F222CD8C51D9990E23774CB48896EC9E4E6277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011a
Size 16KB
SHA256 abf44e4e9928c3c6141c00842746c42192078d699b8e8e65c4f7e630aaab0210
MD5 e6e59b39017f4009a0a3327967431678
SHA1 7c69616071dd68e02e4dd2b6e07281a1b627f706
SHA512 4fd7cdaa93d86fa40ebce2c45f9fca7cfe2293c60c0b2d84ce0cca3cbeebf5fe60aeabaf3568f7d73e1285a088f9e1c0bcd77c2731ee24981e393347e7cffcad
SSDEEP 384:pOibbuO6oghUlywYvxZyNCQvLm0HP5a17dO+:sYbIXJYfvLlHRafO+
TLSH
T1DF72D09752C0858B1C3003AF10ED05C18DAE32265B5B4FC1D08FD6EA96E2EABD52B727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00014d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00014d
Size 373KB
SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
MD5 7eb1501498252ec1a30118a2d3917c94
SHA1 b275a098ab3e050e2b4ac71eac10c238c2365c45
SHA512 8f5831b6bfeaea74aba0d23b684687e0a308f51f1528859535c9df335367b946b6be42500ce637e77baff40795bbf152e24abcfcee227c6d9d0e490412e09d26
SSDEEP 6144:bBJYkBiu4su2hIklCVm8ZiLHBd0R+2jBLX47rD+CNOgtU28xNAoWclJ/lo31jjuQ:bfWV22kvnBSw2FLIPDVNfN8nWclJ/Md9
TLSH
T100842306FA0DD6F4A7A40DDD2990A3E04D1372444CFC4A347B8523B9DDE3AEF4A159AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 3bcd7ab36fd628967b9bd12483d3e05360c3b10dde76df4ae0adb2574c698594
MD5 c73d2e5af6eaef68519b8fbc4df338a5
SHA1 bff5b303716c946c4941ba2b065a109288a5b012
SHA512 19ff734f5a36f44c6937db5a5476a9b9e484ced8fc9d333214e72c55cd48fa4be1d803f1388f521e0db32ead462a8cea23f3b17d59534945fe55441bcf08588b
SSDEEP 96:SdpGDJU9AFsIRNGqQxQ07kBe2TOYwIBv4w5ntdVv7jT8nL13Q:SdpGdGAbXQCaQl5XFPTIW
TLSH
T15CF1DAF6E180115EDF618A3030E2E9F939EC65D8F5836FB2086DA5FA244F38049A851F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59406a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59406a.TMP
Size 3KB
SHA256 0c9160fdbf117768460f95a9a820c2ca1346d6e836600e9ed603c2162e48a64b
MD5 3d590e02fc98a7103cc3dd1f0e7f3357
SHA1 82cade5990dbe28da2afb493b0f427162a07baec
SHA512 32ae4a3e0d11b85ff8c803847996b60d4b9858db768cb6938aee8f346beb4a9e11c9682f12d89107f997b1ba1e5fb4f11a98f1558228c25101ea10a0c1f39ba3
TLSH
T139712BB620014153EF210F70909372F27DFCB6E9F2575EF92D7099B7650636086AD90C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 71f1306d9d5fdff6eafd8062e37beadd462680d574c63392dd9eb3c7f317d4be
MD5 4e5e1a6c422f758368afdc3468dd2906
SHA1 1e956c990a08459aa3055185fac3c8f439ec61f6
SHA512 6660cd9bd95ad859d161417eccf7f6e885aa556ac5e8bb684f394326a7efcc48d38ed1060848be0267c08b74da8e383f9d859b7293faa450598b8ff7af297ba2
SSDEEP 384:DwlgpGjdiHMirmIQq6+tHv8RxQqhbS6neaiWrHZ9sqtGAb7qHu7xyuk5ZvuBVHBB:Vwt
TLSH
T11D929FB7C7E8862DDC1116F46A147E1BCE2D096583283D26C9D9AF4FA3F2071E21574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 9ff5ddf7262e86c46ecbf4d410aaf56b1e5e3cc801e252a6586d5f3d5e074b5e
MD5 dc815880ca26873191de135613e56f44
SHA1 91d05c8add6eefdbc990e1201218b01366c0a11d
SHA512 2b7e17ea7e87b78b56298db917ef41a2720aa65316e3fafa3a82243498ad57f2434bf7e300313ddc135265e5cd578a848ce1dade9cc6dad5ba7a3151a79260c6
SSDEEP 384:DWPFMrixaXcoIL43lNX9HwNtxJSTQA5L96xbXm9sKwtb7q5K79yugzvjZIBc5vJd:Ft6Av
TLSH
T1DF528AF797F4866DDC1156F0AA14AE2BCE2C0925436C3D3589D8AE5BA3F2072E111B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 2595aed01bab837b10911b415500007a99fbeb278db0c595aa1fe4f5409d6467
MD5 9d62ebe9883b195328432f4fd260d29d
SHA1 f196e8e15a7348e208c9daa42e35e3ae3d50e225
SHA512 21e94dc44156997e19a9fb5fc951b25e8f5a01cd8ea2017c65a5548289ee95e563dbb2f169b0c93a3819ec94359e771b93e64a4d7c134fdf454d2295f714e60f
TLSH
T158D022232328B0B9A5AD3FCA52FAAC8FCB3720300803FDE410D09A9C05364AC1627248
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58ccf0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58ccf0.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ab885e9c360dea7777b905c2b81bc723e640080335cc50a7f92eca7a0046bfc2
MD5 0eaf7607608c066a19a06e1e7c3c514b
SHA1 0bf6a69e232ae48e1604dcb1e8a37438c41aa167
SHA512 cde0adaabdd1ae76f69425b9d44b463759ed9b49b00db114679a84903a9ad4561babb3c6670f4251eabfa0e0d7583cf4460a4911967ac186ca4e12216019749f
SSDEEP 192:sxZyQUnbRUyM/jK1Ml8Mkv/fIsrT0XVdasFGddpmB6AlLHW6+WNciaYqiAH4X/YJ:sxZUnbqMv/fIsrT0PF4+HbfoU/mJ9
TLSH
T17B7209026534597BDCD7D219FA06BB93D6F9147396904E48EAFCCA1C04E6BED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 e2c09d7b9799437ea9ef4b589a4203c87d5071446ff226a0db014fc5257c5496
MD5 9eca948043c543b63426312316cf3c43
SHA1 dc7e139caafdfd2a76ef5b35eac6f95f60a30053
SHA512 93eef30d0279224638b035a8e9220e776f57d3245760e4e6400bf96ff91c389b992717266b8d0462bf090bc521a3d9a28e3272d4653eba63badd8a348955eb6a
SSDEEP 384:sxZUnMCqAm4v/fIsgTZVxTvE+HbJUUoU/ZJ6nm:sWMNAm4v/fMTZHI+HbJBZwm
TLSH
T161A2E85351304D77C8E7D219F925BFA6D6F554A38A904E48AAFCCE1C00EA7FD2212C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 1a03887337d86ec46ad7d6e8028260d13c4a9e46de68fd89738f7f14b7e22d40
MD5 fa4bf3bef5b65977e580ac8b539a5536
SHA1 bd83de21d5f8372221c2f7c758770ded5743cc03
SHA512 27f2fa5291c24ae78b42cd0251d7fd794b3264e4ba0f665c3f5f3ffbbce7b9c82f9c40c5a8341016177daa8c0a98300228ce7f9623a7c9276eeb9256c779589f
SSDEEP 384:sxZUnMCsm1v/fIsgT0RxTvHHbqoU/mJInm:sWMzm1v/fMT0rTHbCmem
TLSH
T1C092E81365205977CCD7D219FE25BFA2D6F514638A904E4CAAFCCA1C04EA7FD2212C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 36KB
SHA256 346df542688abb2ef293a80bc0626744206d64a11de90060160cdacb26600483
MD5 d5ccae5e34efe9989e971e687bfb3925
SHA1 f8ea701725c60572c4be9ab938b04be3aca17402
SHA512 ba53a8bdabc17e6d7e44b2a9dde0ccada44a67980e79e4390a3a24608143e67fd392dccf0438c6eb7f582e9e681750b5ff6124cae1b6fca3b6dcc8e4b4974eda
SSDEEP 768:sWMcAm4v/fMTI4nnc7WeT+THI+HbJBZ0m:icAm485nmWNHIaJBGm
TLSH
T149F218025420C877DAD39D19B83DBE72D6AC50939AC0CEDA5AECCE1C009D6FD6B07867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 32f6215455a6d6b388c606e48244f3704b45b328f83cdbb02ae0cbab91404316
MD5 4d3a1c3b5d6276bde5e2b3963aee4192
SHA1 d0cab4417fe2629620a1b32cc96aedf309f8bfb3
SHA512 525cc5265709589f3a47299d667bdb416d9d9993770150151d0017351b69306b6a10236dbab60233cdd9a855b0a0be74088760496d7f5e827f0152176c0cf04f
SSDEEP 768:zfseJ3xWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp4roUpB:zfseJ3xWvhfwnu1jaVcL88pD6B
TLSH
T18FE2FB2B280CCB7E4F844E6DEC266F966EE801CB5B984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 500c6cff69a0443e3eafe0a7a39cf6cae8503293e6a56d9cf0d6089bedd1a45a
MD5 bf6a54fc502ca7b3781846b2e474eec9
SHA1 0f6b1d2c0cc69dc939b0a6552995c773dc7936fe
SHA512 69b18391dc0f050c115e2de8077a9b9f110c4b3156417ff5430a8faa99e0ae711715d9e574d16f1478fac304b38bb6397bd105540b0a7496b5a2afed4a7e5999
TLSH
T1B1A0021682C5080AC50613B0359749456213CA2C5301A38942A084C8C864A494E6200F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cfed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index~RFe58cfed.TMP
Size 72B
SHA256 fd4603275f7e87db8fb5ec96fc4283bcb940e162a68ae9966f8d85e3872a4971
MD5 52946637cc4c0481d7ac2198de0182ec
SHA1 d96be9e85d9eb6e4049b317379bf17fe5d862dbf
SHA512 5b81697858c5eb1d9f94f76fcbd5288a6f0b97cb7a4535c2c28048aa3737dd6952760c88318324eb8782938d4fca0341c19fae6bd0b37669ce05b1e912592ebe
TLSH
T12EA00250DB80101DC11352B2255307915300E89422005B0784914044CC908C44D4158C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 2KB
SHA256 5ed2fc71b6720074a3d6833912f5c06b7a1e5f01f36eb3d76bc756d26a32ec5d
MD5 8d968e13048892e69b40108f45ed34e7
SHA1 30769af75d095b05efa0f72e7c1b877a9afe817c
SHA512 0638946238830b9c9a3a9dacaf330fcd40ae1c88a5a5a4fd4ed8ac6d158c2f3d16066b2279d6103134cf980d5a51def1307e7fc2f121c16696aa5b7a1cb9781b
TLSH
T17951D88D8CC529C7ED3C21B274FB24C53B7914ED0A848B1B99EC6634BCC723D286A754
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590b31.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe590b31.TMP
Size 1KB
SHA256 8fa9b7cf751d4d6179d101460bbce8966c0308d5e358bc158d8d1f59182d80f3
MD5 40b3214d15c5e309a6a6ef1a4d58f2fb
SHA1 93f6ae4ca675c326bf093c5f46af5ed2e1530b3f
SHA512 aada53e1883eed9c973e016729aab946bba12fd24838c008f24ce4caee698d4b6bca545aa2c96aefa15977e940da2346437e19c9094a006f5535e689eef4029a
TLSH
T1A131868B4A418A0FE8D440B20592A0B83376C94053127783987C633DBC757AD1E5F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 20457e3f9f92c8d6e96a37c9ef3b6234b30967588d0d91a379ded5a01301b1b4
MD5 642372630310088d7f3ed77c51489900
SHA1 94682c0a491d6c6b01a7b9457d688d2cda401f04
SHA512 f9841d70741a14828cab359d49c93ae357866eb16c91abed7f7b58ec9772edafdb91c3dafd1eaee9b221f2d0866154f0f5784288cb4a8cff39c64e40f3b0281a
TLSH
T183E068B62EE32414BEAFC3D124318090060A78A8E902FC0E951AF6831072355309AC35
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 be451dc27142814811cd16c495b87e79aa589726d0e65f9bc41216aded8f68d3
MD5 6b420910a780fc03bce344559357b3cc
SHA1 158bf05b5952b6be238a77e8563b99beafc17e70
SHA512 28ee7a4d768e4b8878c08b22b313de842845c30f036c386c284e9204096955c2906973ee539864128a2629ee0a6f8eee8d7df8dae0902c98c910ba57613d9d25
TLSH
T100A002A5CB559847C3140370B1B341D96690C8EC4735275180EC849D986729141E3016
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d03c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d03c.TMP
Size 48B
SHA256 c2e493bcb3f15d0ddc3c7099f9028bc91f07251d6437ebd4953006556ab6e0f1
MD5 cd40445db21cc31950cc9dd5ec5a92b2
SHA1 efa1107ca49d1f9d562706216c1d739cb41e542e
SHA512 eb90311e9ddbdd26d66efa092f71288ebdd5d0f3d37bdecb32be005d877f717b8027055b76019a4d54353e39d9e3e8c43f5ccd2189a0ff713297d4007665fcee
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a0d5ca9e752797dc803a6402f94f796395a4644ea483eb609e9d55c000b38552
MD5 09de7629a1738b4d87a4f823658ef47b
SHA1 f9e013fb2354f2882fb424c98f907fe994f70e0a
SHA512 d351438c9d47128b1afdde63c0a6b7ffd6b23cbb81e629d0a2e2d8058ceb910a9e83e58b11d6fe18d3957c3372a42bc14535518b79ca1cf7c66cceb4e49e185d
SSDEEP 48:KYHIhKggkXy8+FCuEA8kMADPIDmkKqBickWO0VjEO5y083ocGO+2kOh9ILc2KWT4:KYH+Kggmu32KYAe+ReKSoFz
TLSH
T152918A17317B020238BD664DA2A7A6378E4172A77414B4AF7FB904924E27E212DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594af9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594af9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 bc727bc7de1e4fd663d3087804bcc63311169393e6ebd27023a5da8fb4ca9fb5
MD5 dad1cf7e38ab37fd40a9b34ed7ca5ac0
SHA1 b3550a4708e22eb4a892d46b56a8c73dc6e2faa5
SHA512 926a205632670d08b6af3188b780d2cc000d6f17326c2563a88bb07a8ebdc76139170f53f8ccd477a97f89f301c92173fa0cfcbe6c3f3090b7fd647ee49df6de
SSDEEP 384:piF1tNn/s3n9SPzsN78TUNTUlIlTTxQU76A6MI9dcwdvZ:AF1j+9QiwgTlKdPdvZ
TLSH
T1C7B2F7F348D7893BE99E9747E77E2E064EBCC167B5806A50B7885A0CCC861BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 f1aaf270208480875610b3a89262f8625ad14383bd26eb97255d1d003be6d7ff
MD5 64bbd85bbfc28e5c98cd80bfe6ffd912
SHA1 96056745bf4529a6eba1167cc6206e1f6e150fc9
SHA512 6a269e8dfa4fc404a7beb39cccc8a9fc9af4f566091a5f174afc77e00b323f6a14df2b6b944630ff8dbb89d4facb00e3873b7be18c80d3ddce6a8dc7f7cdb075
SSDEEP 384:WFtNn/s3n9SfsNZTTxQU76A6sI9dcBdvZ:WFj+9UGdKdUdvZ
TLSH
T1E4627C73A834AD2BACD7A184F18B33474EF4916B96C02F44E6DD6F1C00CB26C1307A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bfc0c2d0b583b302e096d5e8759a7efb46fc99e42a9ab391fd4d36e064081284
MD5 1ee794c96b68ae1ab2caac84eed2df6c
SHA1 41f0af51c6c859dcb396f71d70c6f84aeffc1ebd
SHA512 6740560e124bcc34289049a582a8d61e8dd62fea8f6042cf20c713ffb015420242e8cbbafcf9fd30a0e1fd8f681b5a8f5284376b8614d7a620b1cba5b1220cdc
SSDEEP 192:lONV6vMtPQmiUyKPThT/hCi0bC847u1U/u:lONV6UtRJTSdM2U/u
TLSH
T13C021A36BC686C6BEEA7AE45F48A23175FE4116FA5905F50EAE82F1C00D765C1303937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 fe07ce12bf1932cebc19b1e1ea76b9d097952132ab46d9ba50def0c39f456941
MD5 7be978172b2f56420583ba902a1ec6c0
SHA1 4c8fef523bdd989d91c44696b35c530d2887c9b8
SHA512 cb29ea37a3842c9ce7c60ec5c8a3cf8d946597f9ed8243751706190f28018cbcac9851218be03e1e214ee0e97c4e69da8eb67de5068354a9a5879d6ccb00f52e
SSDEEP 384:stNn/s3n9SfsNZoTxQU76A6Gd29dctdvZ:sj+9UxPdAdqdvZ
TLSH
T101627D73A874AD6BADD7A184F08B37474EF4916B56C02F44E6DD6F0C00CB2AC1307A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b85118f742802fd6224b4c361d87a3f9069658585a3e4b7870adf1510a90311b
MD5 e84d1070d2fc9a518348013d3cca4e21
SHA1 fd893935a0c459ca753d2e843280ac9b82b8e958
SHA512 5a51fc88c75b8383c380f9fa2db52dfd33e6202bcfa458f1a5da371bad57a51a02ef59fecb31514dc259eab75d1cc296bdfd21373f0fd3eb165653bdac66ead1
SSDEEP 384:9tNn/s3n9SfsNZTTxQU76A6Nd29dctdvZ:9j+9UGIdAdqdvZ
TLSH
T13F626C73A874AD2BADD7A184F18A37475EF4916B56C02F44E6DD6F1D00CB2AC1307A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 023a0eb47e52dc353b5f9b0c18eecec1f53f247e86a8e9baf50749f4ac207758
MD5 0628100b33e549d2f7964b3de2714c11
SHA1 48a3150e0b54e202c8533c48332434a9d3a7b5f5
SHA512 8f7ff227dc19ef8f72f36ef16a4b276264816e27748a270cedb7b0224c8d172a601499676399972cdc3c18426aefa68c5eb872a2392bb1883920ff07671cf5c4
SSDEEP 192:wON86vMtPQmiUyzPchT/hCi0bcvNR80IcqcsU/u:wON86UtRqcSdcmdU/u
TLSH
T19E122B73A8689C6BAD93A551F0CA33475EB4826BDA849F50EADC2F1C01DF25C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8b66f78b999d5e5834e7e03e6a0694ecf2b4ec485ed8477fad10bd37d36959cf
MD5 82d920b52f26a1c60c620bffdcdd6159
SHA1 970b60fab0c57839c0045ce387de4b9058d87620
SHA512 5d3fcd6e752cf7536c2db6e7053c2d244104ebb0403f222b426006e3ff28e31e99a7e69af66d2e3b77d8a18a2e5767474e16ba0258295ecedec1fb2814619db5
TLSH
T166E00112D30051B3D00C07324087260477F2A03143F72616991401782C536181D70F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 54c388591a512cd4a273aaadb38821dc4d656f28cf4ddf9ae5b4d3a576a12e41
MD5 c600b1a598515de2eb43b7157be0916b
SHA1 d212b685fd97efce1f2d5db50771738aec2f2549
SHA512 84c94edada4a8ffdcd2b351023e12613b19e76707b3d6ccc565095d99b715c43d91feb2297c6387197d7bf7d2535c943488a10648792da3c69e4f2509b700355
TLSH
T135E00916D70091B2D40C073241872B04BBB2E03187A627179D24417A3C926282D70F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 21ac869c2d74151f23d50c487b69a2db1261af315e82b7b2afe78396bfc3a30c
MD5 c127227bf27dd6a7c218fef213b4dd4c
SHA1 75b5486e40e65126465931bbe38c0e4b58a1d04c
SHA512 d0a714a4b8d78d64be8946d36fcf946581998f340be99a3848d3253f20d64f707fc006a38fbf47d8ff4605e6da737d0e96734499a558aa91c97aeceee2445bbc
TLSH
T124E00416D700A1B3D40C073241872B04BBB2E07187E727169A24457A3CA27282D70E40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58c908.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58c908.TMP
Size 392B
SHA256 9e90010af06b158dbcfbb913b3add45e7ee8163b6a1506877a14d42c0984ccd1
MD5 8061388d82f07b09abfa3020abb9a9cb
SHA1 58c6e38c62a749debe01aaf6792f5f1eeb32d360
SHA512 6fe843dce9bc2b25d8278ecf5bf0622cb649cdcdc4bf2dbb2d70e5a56ba72d746554c63634409cc241f57ff37d55377c3a38501ccf0ce6863f8bd46cc236de98
MD5 SHA1 SHA512

Submit Download

215be5d9-4206-4d3d-957d-b8799c58aa2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\215be5d9-4206-4d3d-957d-b8799c58aa2a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b159cb3977238a442bc969168b734b3f4ded48ec07bd32648291aa77a16971c7
MD5 675dd5e9827326f5d6b21fdcbe5b0ac7
SHA1 385b51f194d7574052bd0bc187f5b23fb938d496
SHA512 1cbeb5739f3634104ca195c267586bf62af7181f2f56c3bb9924efdb809983b5f45045c20fb030b735f5b9482ba343174d7c3dbca0a0f69da7d02394e336fd8b
TLSH
T14141E758B6F90108B3B76E16AFF7A86E447FBC772E06949E10010E4F0632A40C972737
MD5 SHA1 SHA512 TLSH

Submit Download