hxxps://test[.]com

user interaction
yes
max time kernel
89s
max time network
91s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://test.com
Sample260714-wdevtscw7w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4732	msedge.exe
4892	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285248973863714"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{A2061F48-4BFA-41FC-8288-BA5EEAC76B86}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{8F15B709-BBE9-462C-9E97-385989A4017B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1616	taskmgr.exe
Token: SeSystemProfilePrivilege	1616	taskmgr.exe
Token: SeCreateGlobalPrivilege	1616	taskmgr.exe
Token: 33	1616	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1616	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe

Suspicious use of SendNotifyMessage 54 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1616	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 4752	1208	msedge.exe	87
PID 1208 wrote to memory of 4732	1208	msedge.exe	88
PID 1208 wrote to memory of 4540	1208	msedge.exe	89
PID 1208 wrote to memory of 4540	1208	msedge.exe	89
PID 1208 wrote to memory of 3544	1208	msedge.exe	90
PID 1208 wrote to memory of 3544	1208	msedge.exe	90
PID 1208 wrote to memory of 3544	1208	msedge.exe	90
PID 1208 wrote to memory of 3056	1208	msedge.exe	92
PID 1208 wrote to memory of 2112	1208	msedge.exe	93
PID 1208 wrote to memory of 3056	1208	msedge.exe	92
PID 1208 wrote to memory of 3056	1208	msedge.exe	92
PID 1208 wrote to memory of 2112	1208	msedge.exe	93
PID 1208 wrote to memory of 2112	1208	msedge.exe	93
PID 1208 wrote to memory of 4712	1208	msedge.exe	94
PID 1208 wrote to memory of 5900	1208	msedge.exe	95
PID 1208 wrote to memory of 4712	1208	msedge.exe	94
PID 1208 wrote to memory of 4712	1208	msedge.exe	94
PID 1208 wrote to memory of 5900	1208	msedge.exe	95
PID 1208 wrote to memory of 5900	1208	msedge.exe	95
PID 1208 wrote to memory of 5944	1208	msedge.exe	96
PID 1208 wrote to memory of 5944	1208	msedge.exe	96
PID 1208 wrote to memory of 5944	1208	msedge.exe	96
PID 1208 wrote to memory of 6040	1208	msedge.exe	98
PID 1208 wrote to memory of 6040	1208	msedge.exe	98
PID 1208 wrote to memory of 6040	1208	msedge.exe	98
PID 1208 wrote to memory of 6060	1208	msedge.exe	100
PID 1208 wrote to memory of 5488	1208	msedge.exe	103
PID 1208 wrote to memory of 5488	1208	msedge.exe	103
PID 1208 wrote to memory of 3548	1208	msedge.exe	104
PID 1208 wrote to memory of 3548	1208	msedge.exe	104
PID 1208 wrote to memory of 4872	1208	msedge.exe	105
PID 1208 wrote to memory of 4872	1208	msedge.exe	105
PID 1208 wrote to memory of 4872	1208	msedge.exe	105
PID 1208 wrote to memory of 4340	1208	msedge.exe	107
PID 1208 wrote to memory of 4744	1208	msedge.exe	108
PID 1208 wrote to memory of 1452	1208	msedge.exe	109
PID 1208 wrote to memory of 5524	1208	msedge.exe	110
PID 1208 wrote to memory of 5524	1208	msedge.exe	110
PID 1208 wrote to memory of 5524	1208	msedge.exe	110
PID 1208 wrote to memory of 2420	1208	msedge.exe	111
PID 1208 wrote to memory of 2420	1208	msedge.exe	111
PID 1208 wrote to memory of 2640	1208	msedge.exe	113
PID 2640 wrote to memory of 5276	2640	msedge.exe	114
PID 2640 wrote to memory of 4844	2640	msedge.exe	115
PID 2640 wrote to memory of 4892	2640	msedge.exe	116
PID 2640 wrote to memory of 4844	2640	msedge.exe	115
PID 2640 wrote to memory of 4844	2640	msedge.exe	115
PID 2640 wrote to memory of 5048	2640	msedge.exe	117
PID 2640 wrote to memory of 5048	2640	msedge.exe	117
PID 2640 wrote to memory of 3068	2640	msedge.exe	120
PID 2640 wrote to memory of 4576	2640	msedge.exe	121
PID 2640 wrote to memory of 4576	2640	msedge.exe	121
PID 2640 wrote to memory of 3580	2640	msedge.exe	122
PID 2640 wrote to memory of 3580	2640	msedge.exe	122
PID 2640 wrote to memory of 5076	2640	msedge.exe	123
PID 2640 wrote to memory of 5076	2640	msedge.exe	123
PID 2640 wrote to memory of 4532	2640	msedge.exe	124
PID 2640 wrote to memory of 4532	2640	msedge.exe	124
PID 2640 wrote to memory of 2032	2640	msedge.exe	127
PID 2640 wrote to memory of 2032	2640	msedge.exe	127
PID 2640 wrote to memory of 3464	2640	msedge.exe	128
PID 2640 wrote to memory of 3464	2640	msedge.exe	128
PID 2640 wrote to memory of 4888	2640	msedge.exe	129
PID 2640 wrote to memory of 4888	2640	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://test.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ff897e4c188,0x7ff897e4c194,0x7ff897e4c1a0
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,14883036557476601086,3394563853805200004,524288 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,6831328056620046537,15620855520050998951,524288 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:13
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,17106282901284454988,8114177878682936286,262144 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3684,i,13861229831479877170,10129504906251249477,2097152 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3708,i,16472870779411529677,4357347154818654641,2097152 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,319043897346426212,11090216946288234610,2097152 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,3626298226053102434,10489163295222622907,2097152 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:9
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3828,i,7598984014607215143,5525365573302205787,2097152 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3956,i,10891020453194821213,1612940293695884257,2097152 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,4045864329703242454,15245825102255416236,524288 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,4045864329703242454,15245825102255416236,524288 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,12783345085861405920,18394537231645714506,524288 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,10541031803332811256,9825514266007950722,524288 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5432,i,7889534294627690101,2448335040142008467,2097152 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,13900322690133852808,8807021998956735079,524288 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,12733581385925050843,62216764868195144,524288 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,2491916684000522899,9971760574705799450,524288 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5416,i,17578210721633380385,13158362729775208750,2097152 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,5775781630728705651,14791435698541133753,524288 --field-trial-handle=2644,i,5648371751010289531,16080321110910414735,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ff897e4c188,0x7ff897e4c194,0x7ff897e4c1a0
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,18055568794708348552,9602956803387400421,262144 --field-trial-handle=2768,i,2924619614719618801,2709606963870378387,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:2
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,15471356608767504152,5224248395757849143,524288 --field-trial-handle=2768,i,2924619614719618801,2709606963870378387,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,3864730824036510782,17140606255158816167,524288 --field-trial-handle=2768,i,2924619614719618801,2709606963870378387,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:13
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,18021391618564808823,11555631837557493767,524288 --field-trial-handle=2768,i,2924619614719618801,2709606963870378387,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,18021391618564808823,11555631837557493767,524288 --field-trial-handle=2768,i,2924619614719618801,2709606963870378387,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,7233731288147130453,2543323455912246198,524288 --field-trial-handle=2768,i,2924619614719618801,2709606963870378387,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,14912797163080362171,10518315209680894776,524288 --field-trial-handle=2768,i,2924619614719618801,2709606963870378387,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:14
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,11880283079985392253,9502782504221528945,524288 --field-trial-handle=2768,i,2924619614719618801,2709606963870378387,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,11439611507446043145,988145307231609988,524288 --field-trial-handle=2768,i,2924619614719618801,2709606963870378387,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,4917022430808215432,6787783362013748273,524288 --field-trial-handle=2768,i,2924619614719618801,2709606963870378387,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,198194554580229970,9748434180860082814,524288 --field-trial-handle=2768,i,2924619614719618801,2709606963870378387,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,11428696891802511657,17171813360305282462,524288 --field-trial-handle=2768,i,2924619614719618801,2709606963870378387,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
    3⤵
    PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3360

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

221f5242-674c-48fd-b3b6-94e789ad23e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\221f5242-674c-48fd-b3b6-94e789ad23e6.tmp
Size 37KB
SHA256 3ef0ef5cd3c35785ca227024b0d96a3371bb521144067df3e2e4a94e65a564aa
MD5 2150d93e40d1940ab3c06caacb02e162
SHA1 0458fe88515980efd11137dac38f0feb86ee1a5e
SHA512 a4fc177ff3a5dd452eb4023743549c3899d24aaafbddfd9f56ce42e559293fcae95bf46b5daabda47e21bebdc9f0f298350cd833ce301e1145bf68d040a4260d
SSDEEP 768:TFsj+9x3UwgPZ9FCtQjfp8+p3bd66j+4BRv86aLIFQb9MN:19x3kDx8+p3Z6n4yXb+N
TLSH
T116039E73DD99CE379DE6CB44B29A3793AFF011B785C01E98EAD89F0E044729D070A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3b6d5fdf77d33b04d11d471d35a178c210e6b8755bcb281285ec2067dcf35c0d
MD5 2e80649acd1a1a098ebc4389a5deecc4
SHA1 c73f0770e9bd2c6cdf2bbc9c5b81e8df4779f62a
SHA512 febfcfa2569b2ffe0ccb9881427b2fca9b253dc33340f9d8ae4a29e5bb8a8691aeb37f5d057d4de85b67c34fa0c9c5522ac4be4683128bb74b1055aaa392354b
TLSH
T132D023247339BDC3F039617244B02700B5360023325ED6833250C00C4C7908157E2ED5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67df9e1a6f6e5ffb8d2e0ae0f52afe57f895ea86f8ac3a414021c7a56acdea0c
MD5 295ddc33e8ab03985a602dd3ae059525
SHA1 feb881e337bb21de280ebde19ccbb47977410674
SHA512 aa6c4f8a7436d42dbace6c49a104f6112178690eaeb9dbbd5bc757aad094e4abb7082c89a6fc2fb8c310454021eb4962ef22e7b86ec2cb46fff515650d95fb6c
TLSH
T1ADD0233473387C03C307B1311480E31077631213750DF8532170800C0C7558047DA0C5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3da6de08278180dbb025ae28539727f86303e7ff8cb60a543b32b7a60f77d27a
MD5 3c0ff8afbd974e0ec8c6fe1daf6ea2d9
SHA1 b76623d18bc560153ac73b178b2314f917cc0ab8
SHA512 fccf66b8f5aef550ec5b3eb1dec2fbcda03bb1936d905f853d1ee1837b1a30552e303f6fb2a7cfc5f4ccd1df2395cca24c653f5e1fd42ebb63febd0797e25c8e
TLSH
T1EBE02BABD926DC2728FD1B1AA2404BC5EB5113565B408B4B3B3C82088FB8626068582C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 25d7624230769c98178c5418403b90dc3344b8093d56b965a8496abb4aa0c569
MD5 4c825d13f560932d6df0c4239ac37292
SHA1 732619a520dbc82883c527dfc5ae4f5c5485e425
SHA512 604a9353943a82e57dc70911e3ccc7bc82b75e10266f663edc36d87eac08ac5afdd92a57d838795faf5e582c492912262a7571968cfb76f337452c80f1175887
SSDEEP 192:GlRYtsEalvaTpXhP6+ZVHKSPWe9UUAjMwVuk+ZuiJU76iDjI5fkrOrybhPdm3sYb:G52i/je9jrwVcuTvMkbhYdzif2
TLSH
T158135C3EBB090D60D3E7453DB19B9B36637DE818E4E9A8174636B2228D40F168DDF217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 15ad031687ae613724dd79f5edb8aaee55f86c0c135e5ecde092f3187a1bed17
MD5 c6fa1e3c58b11fb668dc6d6a7112b0be
SHA1 fe324a8cbae75842dff654bd3c66c372d6a3b298
SHA512 74627986b66e80677df9db981236550a08f4c65eae4e123e27633b5bd61a136f857b5fd2fd3b1eed19058fb71576ee92f248ec6c794f5e368c604563253e095a
SSDEEP 768:RHL+HQzvT1amAHL7NpIWL/gW5LL/OvnnlOhZGNa/tKxKDJGbEDTlIHL+QSuxO9ik:RHH1gHdL/lxL/AS/JnDTmHSl9iPp
TLSH
T19B445DF70951A01BCBA852F5E2033A3DD27B451E6CD2E8A9E57C4C812C25F31B6FDA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 dff39ae5a0bd22abb71d8c811818c83e8f503f3312d10792b7d593b2025469f5
MD5 8cb3100589c13c2a0a012097aaa8e1cc
SHA1 0a1ba1ac3bfd8769681c071dd987010aacf9bd3b
SHA512 af4762bf57317ea321f2b198e9dc2257d5745703e86c294ff86b769187cbf6bd23a1ad3d80d8a00204531adbb362f9184e48cb8469bc4ab363f43ac07fec2e4f
SSDEEP 1536:ri49G+PFuAuXeMkEvA+mrHFUZb+1l4rGEPDz+UnReBlLVrOsLsrsrKrTcuJN0akh:rv9G+9/mqHIG8vWsd0LUNwCQDkNn
TLSH
T1FB2539EECB682C42CE6B877470E0E9077E712182B64CD0D39944C5E997D6B8176F82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 9acbc0e8d58eef0a020e58ef6098b5c4c6f51744e18c377309d31b871a187257
MD5 92ec33a0b32668b92ddfa446f78a85f3
SHA1 86e668ab2cbe0392f3878228d51e14df29550fd5
SHA512 d1e21a3eae637cf2361594f7cbd05c4617ddc0f67969f94f73ed1297da5b4f0f206b4200cb0b93c3f4e0bb7ac8bcf3961c3686d29dd813923669e662a1377595
SSDEEP 24576:GHg6lZDQMTrEMpvLipXpul+cOaUZSfCSxdO:GAeau4Mpv2pXpwOaBO
TLSH
T1EC166CEDC96858C3CD63AA30B5F0E9477C7413C3F994C1D6889CC584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6f30d9aa3c9fb1b4cf2e5b69cdb7813d53155604f6362121b2568ce77d0d335f
MD5 4f27b78f55d483cf21ad3bd78f99489d
SHA1 c22dbb6a4a4282a759f6740f69a2a28123976733
SHA512 87ad807fa4f6bab3f216f00df13afdf3f326f7ea59ced7458295625f551398015fdb66dfd0e2145015230337a696a71f575a81b7c8d2854fe625259ce3304f20
TLSH
T1A85195B133663EF2DBFA497132E1625832FDC44902BB1E25B0906D345C6AF99E9D5063
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5964fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5964fa.TMP
Size 2KB
SHA256 c90c099c55e8cb44465477220c54388c816ff8757e077ec1b42ab27cfb5d9f15
MD5 633c91d3ac3c6ec9dfa12ca1919b1907
SHA1 c29bbf1d3412f047cfafbf0ff6b8f2a7da5e9396
SHA512 5ecb067725a6a56d79a0db8765a03b8fdf6e398fbe9e2dff99f9d56ff008397bdd4a9833204e050055e9c5eb0e5c0ff5ce9176274f1c35e21f3f03539ae63dc5
TLSH
T1CC51847133263FE2DBFA497132E1625832FDC44A01BB1E25B0906D745C6AF99E9D5063
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 78a8e2e41172e8acf04bc4ab3a28da11606ecd70e6bb615b957ad696fb596f55
MD5 ae51516e65b83b1268503fa87f3e0d0e
SHA1 e8e2fcb1433a8f7aea0cd064cc4522dc199f2cb3
SHA512 2e69280befe822992e3aaaadadf4eba815fbb2b8aec1c11adaa2aa39d89e6569e7f72499e0bb12541ff5f32e72fb398d07bb6e10c3373c546737df1b59833ea6
SSDEEP 3:MsEllllkEthXllkl2zE/ly8Ptl:/M/xT02zhol
TLSH
T1454402456B851406D5012139409583902370D41007226B4328A114235C856400C41010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 861fcdc782e3c2c8ebe00ca1d167c327cb91eac680d7c16c302380689551ff9d
MD5 73388f529668ad4c5b243f995483cf3b
SHA1 384644b09d3a90981295ad86e6569af4facf8bef
SHA512 db43df49fd56e2f1f05cf267c059c043c7e6db11c55c26c6a0a5fc962c4a7fc9637937efcce650c67d2d202ce81a66376974418b6c54487001b2be597c67b128
TLSH
T1C3E06891E9C6E52D196434D21128672CE1C0385BC7C43E43170488D03A83005FB56142
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 ab5ad02e0342c60c83ebffd2816e30bcc784ae8e4065131f5c59e88e27f997db
MD5 4da5ab1184a722cbceb43664d622a467
SHA1 407f9e6d1a5bd41db7f220fe51ab95c1447b8ff6
SHA512 9813e8fa347d192f4028a1b2e3cc07c831961b8b95e46ee339bd909c47d6c822793e0c2e4573253f518759ba88971bb502cc242dd9c4685d9c8a5a5499b05452
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfjGPW5LglFtIKDdrNVqYpL:TtD4jJ/0UC+lf5WWxIFOIdZVTpL
TLSH
T1B9E2E28C3B11F911C4EE733DA1D2C5E09EBC692C4A4DB1B0523C5C769C23AA2F49E15E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 53c259d2e9c40dd8b5b3d1ef25c2a3261679bc660319e728875930071bc8dddf
MD5 54e8358c2fa1c67366ad4313baf709b4
SHA1 9d9e2fc0f1884151f97e9187a2849ff5088ac505
SHA512 f4c72e2cd7c838e8e71ff1ed39c1b7293e1986fb4a055ce10e706412df8de8830c769056f2c499dedc19e10d0166bafa4a23265182edbda522e377516bc8eecc
TLSH
T111E07D0444CCC97AB99468B383E8B32CD7E2344FF6C83E07174CA8A47101241B3BB280
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 f0c06bc8a5989c079bf20b956e6234e8f58f29cf443f95e5e1f0340a992a9e47
MD5 c894a6e0ac049cd42e7e0e620f110a81
SHA1 75007a9436384a253b2a1a9d8796246b3d5c19d7
SHA512 896000ecb27ab8e559c0016745f4ec5a2aff1e7a043b347109574525c49d456453126531b22e922a8bc328a288e59ad6247d10da21b5d79a27306c77726e3be3
SSDEEP 96:AsMGFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqD:AJFH+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T19624EE4E5F342722CDBD913669E645A35C7CF03FCB5366DA686114B4CEE2642A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 19B
SHA256 ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7
MD5 0407b455f23e3655661ba46a574cfca4
SHA1 855cb7cc8eac30458b4207614d046cb09ee3a591
SHA512 3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 4f39d874aa2ded96dae2598d580dff1dfac333f10e3ce09654120cee455b1709
MD5 a2fddde2ed1ed7043a2360d928a91ee7
SHA1 25f27f378c22d7eae224d393e8d437cf0b532a86
SHA512 2eab12087b2789f86790ada2a1e6b651341d492568bd010bde2dbac769d9a9c299034491ec5654eb5b3bb8a67073bb126c5b1a6005c4f244092abdbeb253b96b
TLSH
T1EAE026A888CDD93EA65825AB8238770DC3F1340FEACC3F121B14A950B881004E7A72C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 56c9d0d5c23c696be0e2a4de72e614e5f454500b7364e530feb1500adf16982b
MD5 8ee7a002320b2acf2b501a7a4d2f840a
SHA1 dfcabc22284057741c4bf8da724a323e5ce1d40b
SHA512 c744efb9b83dbb7523e3fd1cd534d3dab493d89ff3f709ab4f993c6e645d7c9cab8f0bd1dfb97706432fba443f066be18a5e924e6db9716029666edebb7fbf71
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7oFywHBfdQzrftl:qDeMatha9RAECBfdQvftl
TLSH
T12CB2200E6F306221D0F48B76EDC485662F7C110DC7732659AD0420F2CE93A9BF5065AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6f50d25499353133d379123ee3527ef5deefc989debcf5cd827f8e27caa55806
MD5 3a9aa60ffa39f58c6957bb307ceaaac6
SHA1 e12fed778fc66a10457756a5a2898b946053367f
SHA512 bb8adb6977afb7f56ece41e0f14d09cb61e2732dcd7acdc83b31b33ad6ba742679344d1559db2f8f893ef17772d449f2ac585e7941e8d062b77d26042824e97c
TLSH
T19A51CDF3C3E4897EC90156F4AB147E2BCE1D0915432C3D6A89E4AF2BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 963f81cb714cb06e6f4c4a5fcb131694e3b6763435e5c7037dcada855f982fa6
MD5 38ef7c0804c5ec6ed46587e4a96095de
SHA1 1c4835795b8479a277ea2f5af205b8b0b0126c6d
SHA512 ca22a5809421a81cd0ca47073c64279245d0aacfbe65f3e490070b29e0d4a26ba7e8096d5db2be6efdfcafc81d9c89bf56c3ffc220893aba27fdd549b9021c0c
TLSH
T1C9C0222682B8E83610354CBF1980B880A7BAE4300040B4A0D9A5D33CA0810B75F36029
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 19a65642de1d210a2f53e0adc3c63804b749291980150ca01f3c34d8152b5c1d
MD5 616a0d0eb1f117e5cae3da0c1753554d
SHA1 7ff5e9eb3349ecf090a90ada3ed13ef9bbefca30
SHA512 fd87748363359fb5ef940283b97c1364cde711bb9e75014ba91fe57558201fd715102d801160688003557c6cf9ebbf584b7234045d33b901b30596dfb0080ae2
SSDEEP 192:sxRcRZyM/jK1Ml8wb0/f+siqKDde5lSTzoD8pbX/g6+WNIYCyuOQG/IgIJ:sxRcpl0/f+sBKc5lir/5IQTs
TLSH
T14552DA1666285D7BCCD7D209FA517F93D6F41533A2901E44AAFC860C04E6ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d883442a096eba82584cc2af2f00403ae2ba6cfa7b10085b82832623f1363796
MD5 8e88474d93b29ab2d44d81cbb8e71270
SHA1 dc8b9063264b407ba78abc0abe35c677251b515c
SHA512 d790a8b0591e722d0cb881d97a22bf0a15149790c2a041b4752c149dce8da6681c77c0ea920a1cdc5716111333d77e1d3598f1842bb414a3ef8772382d974cbf
SSDEEP 192:sxRjRZyM/jK1Ml8wb0/f+s5qKDde5lSTzoD8pbX/g6+WNIYCyuOQG/IgD+J:sxRjpl0/f+sMKc5lir/5IQTG
TLSH
T18E52CA166A285D7BCCDBD20DFA517F93D6F41573A2901E44AAFC8A0C04EABDD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0061db95cdcd485e8639453f1afba4b3ce4a41896310edfc4ee78e99fdbddb81
MD5 75f0105c8a417aa98cdf6d4792954cf3
SHA1 f5edc88bdd8ef9cf6e7ff74aac658ddf7f1b44f3
SHA512 dc891b213d790e8a452b7428f7bb0a3aedb9de479a00ba0ff00fd560cfaf023972c01e39d3f4d40d0855dd6926de91ee489bdc32ddc1a90625e956858bda1321
SSDEEP 192:sxRjRZyM/jK1Ml8Wb0/f+snWpVqqJDde5lSTzoD8ppX/g6+WNIYGzuOLg/IgDEJ:sxRjpd0/f+snWvJJc5liN/5IvQU
TLSH
T10662D916A6285D7BDCD7D20CFA517F93D6F81533A2901E44ABFCCA0C04EAADD221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 926274273f884d70bc777c236b79c1f41721e8c169d5a8bd9978d8fd728f7789
MD5 70b8a9d14118867859ad0de33a61c1d6
SHA1 bb61155c889c3d4b30e271e0bf4888abe02dda5f
SHA512 2507226a8ba5acfedb9c4eead68f7d3b60a020c85fee7ac260fc7c18062c2e7245a6bd84408b380609e406eee72450dd3ba19ef168a8fd88c62b002a310b0959
SSDEEP 768:j/8vrQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCQqqIrovS:j/8vrQWgQ+fB+u1ja3Vqz6
TLSH
T164C2EC3B640CCB7E4F844EADEC29BED66DD801CF57588D5447EA890C03C67EB521A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 36824f16fc4f9dcba9cb2a2736c2f27a5a37f750302bd8d5d7d9e9ea9689e15f
MD5 67a1b152db39bd06dab21f134f5420ee
SHA1 f30d7d0f2aba9e78a791ad457821be503e3c90b1
SHA512 790c37588868bcd27b5de051703d419c6f947be41c6336a8e1123c30cebdb23f83fcd65b7ee8455b0daa604231b22c2cc9d2a0ca5f6c7b59c3e5d8bc86a0f369
TLSH
T168E0262046CADABD619526570228930CC2E4742FD2CC7E03AF88E8606A86588B2AF280
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 39415753bdcfda01c1a3148616263cee719c39ca30e75cf2ee050d310ea5196c
MD5 d4772568e10da78b793104e2628ccee6
SHA1 70f87e66254fde9d649607be0dc4b30f897c42ec
SHA512 2ffa1b64cc44c4c0348fe1371071bba132a1271eb1a04a6b45f4504fde8563d255b789151e3080240ea70f71b30e7bd70b7399a3664448f3aa51e940aaaffbc4
TLSH
T12EB012407F0D9B81C5CF89700A80C7C5B360E40200028807CCE4AF214C447BD3F4A8C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 3663a2367d5da79a08b8ab74a2aee0b880ab9d3da2f61ca84052f5b03b43a23a
MD5 067d1743971921a2d7b2c1fc3ecdea14
SHA1 a34cd2b83ad2b19e619e09a191cbe62bf2f18ffa
SHA512 75ff0ec38dbd79d8973dbc3fffe73fcb169be83fadf921c1b6a1b7e7eb80d4b3220510bd53d421729a3a16b99a8bc0842719baa156beb3df491b49139de20a5c
TLSH
T12DE0D82057CECABA619560DB4224F30DC1A2B41FDBC87B316B0CA5B0634A5807357281
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 3d1e98e80ec1bd72dadab91c7939e61965f6d7c728f039a7905c5a68849ffc89
MD5 9c21844371639a910e8a51c9667127f7
SHA1 100ba93adf28c5092644b5cbe476d84374850ea3
SHA512 070b57db0643321389ef3fdbfc3073b3001d36734065707496814bd699d8f9a216a858d6aefc3d963373296c771e5e9e560cc7072b7c3a58b78fbab638341b9c
TLSH
T155E0867499CADAB998D5609B4264AB1D83F0781F97C83BD65F0C5860A745184F3BF680
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 900051c9f3941c353cbad7207a64580ac5550431f43daabdef1902aa8f2556f7
MD5 198cf4717b7f92a0667401e37c9ac82c
SHA1 30a7b16de7d5a78e6d3f6fdd8c48f5710242cc22
SHA512 471eb2b7388d3786853561204152316a151819824a97d1357b7c737f27059c75b607c652f93a5727aacc0b42aabdbc2bcdb8b188651a70445308fa3d3c305c5a
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOGJ+KKA6GvmKAwDL0vrVdN2TdG9Nr2KlTNS:CbEBVj5JAdSp9/EgTK7j6dJOdhNqL0vK
TLSH
T1DBB14400367A5281397D253D81A5962793C2F077301AF53B3BE8B4661F6FE426DBE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 5627ebb9ac942a905ac48511ec7e47a93e1e0af2e0ea41c5ca1cfee33a174234
MD5 acfe4af9429c8b9bd2feb738df8b2e25
SHA1 c96e3d59b485d67b7b3c770f15855dffdaa7322f
SHA512 d4db5aaad7d25084e6df6ec2eca603ee89b31a8d2b7dec4a6434b39d83183314447045170db2d21a044306ac438a065df2fe9f26e00669a95544b37354eeb24a
SSDEEP 384:DNrRZyCSDnxTICzhMEhIKyll7svbFKfk7:xFZJSDniuWyI1l7svbF9
TLSH
T16944850A7B747001EDE7D9721CB080771E3C716E8F62A6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 8c6cfadc3968bd9c6109d997992bc7cda6a91869db8b22b03dd676e7f73b4da4
MD5 2d7675f7607cb406203a0732db3e95b2
SHA1 d73c231e1ae2778ccee6c1255cd3b25e3c156cce
SHA512 03f5567417432722de3b0eaa2f48f8d9bc9d3b9eb3ad3f3fa34387d383e2bead1d420583bb77683f17c9bc32f6a65c3b46e16aeb0c55c02ce6493e5a34052a59
SSDEEP 192:/UQtVIIIObOMIMoJYcYJeOI8As2lu1PrsLO:cQtVIIIObOMIMSB0Ils0ss
TLSH
T11942A65E16096F7FC05F5B7627628644ABD468838032212D315A2CAF9EF3F9786C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 3ebfcebeddb7b0f141a86d653ed9146ac8555ed57ded24fe6c48981fbe77e012
MD5 753cdda82822a14245fef5d72e6f8148
SHA1 065d225710cac193dddcc4d4921854e544e5dc87
SHA512 18c2a1beb96710408b0f8b7fd987aeddf6168a0a14c12a9415551a5a56c8332f8f8be72f431c36b0354e5021c5c8404592e003f7bff6324a9921234c334bdefc
TLSH
T149E02610EACCCA7EF4D964DB81285B0C92A0380FEBCC3A861F00CC84A441181B3AB182
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 b6a4c10bc1b1ae0c040d920089979b9476beb370987d081a94e56c410cc4a459
MD5 d3eb105f2f2adca87079c1d1c76c401f
SHA1 a3668a0c8441b98e3d6ebcb2a543ec758bcae4d3
SHA512 bc86c1efa3b7021c6ea6a2fc9b18f50e6b2649192f6e28c5b72f10e5ebe6255c662c10d23928667f9d227994c43f6eb665309ee8c8ba7c2da534f50900abc8f3
TLSH
T11C21C495F330C049E15DC67E507E9B391738E8128FBCED0F857A20386EB2A140E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 b3a1d11f2675c67788089db210f67cc9bb14cd584795f18b82b3fa2da1e4c40c
MD5 c3505bb3d21711e65752a17a3501cf6f
SHA1 a0735a77502727c985d01dae27ecd538eba0adc5
SHA512 679ecf61c3980b912a918f5a85eef032632d3df10c3a72f91b744cac002668b13e545a8a45e2691a7fe0a50fee50f3655e9be253f3a472d2c615f564ff71d984
TLSH
T1B6E04F50E8C9D9AF959435A34168A39C92A1384BFBC83F1A1F54A8A4A981185B3AB281
MD5 SHA1 SHA512 TLSH

Submit Download

cc32483a-ca81-47d6-b2e1-a9a8cb2d2f09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cc32483a-ca81-47d6-b2e1-a9a8cb2d2f09.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 4400ae7ac10425852d1157a3898f86782f4f255b63ab0e74259d392127c54f96
MD5 ab4ddbda680748502c261f536ec836dc
SHA1 48f031fa5ec1c584a9514b22dfaefc3e6fce2563
SHA512 04a9f853745af0a765087d59d2acc4c929684cd7f46b6df8fc55cb0a7926a0cd7305c707ebc40e18299e36980753d2e696f8cceb6519aaa5e9bf37a48ec0e6e2
SSDEEP 3:MsEllllkEthXllkl2zEmQvhs/ll:/M/xT02zJQyt
TLSH
T1E74404447FD0054DC70010744051C3500371D4130531574F345104137CC55750C000C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 75030498324e39029b8c83681b271894df84759baaced48ab70be5f64ac29507
MD5 b208f5e9b2fcbd51291211697038dbbb
SHA1 dfad423e05cdd0340de001ebd490c194500822fd
SHA512 6af407ceaaec21a1af40e83e9ab703ea5becddeaff52184efa67c9521432dab9ec3311d587d3f5b6b631be9d9bff15d98b5a652e927d6b15536992f1343f9525
SSDEEP 3:MsEllllkEthXllkl2zEFR+/l:/M/xT02zcR+/
TLSH
T116440404FFD00D0DC50030704151C7500371F45145315757355304137CC55710C10400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3e37cfd73aa673d27cc09bacf4b8f782ea8924a6b65f9ae8bd091fd2b4a3dd13
MD5 7e8d8c0d96b3b52e2208e7b4b73aa8a7
SHA1 ca2828f507f65c8edfdbd7978675afce01d6c438
SHA512 b64c27e206b1881d76f93657f00de09f86ca32fa0673f0ff55d5a832dbd5cd329f2716899c6ac8a0486ad205a20e79bf4e28fdd008db08ec73af577c11434387
SSDEEP 768:urv+4UNbdH39y9FCtQzjp8+p3bd66j+4BRv86aLIW1b9MN:ubsbN39a18+p3Z6n4y3b+N
TLSH
T17B13BF73F86CCE338CF2C654B18A36537FF4516792C40ED8E9D96B4E069A0AD570B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 41beb692db3c46390d8eb9d49adb93d336a3b9be6ae07f58c7a1b1b5052f9f6f
MD5 1975c0763aa85531f8c06754a8030531
SHA1 0262a1021ebb7b90eb484d38a4016b8886c6ffd8
SHA512 8feabbfe9dfa15237b1ff7477d02b65e597f621af5695634dadece327048bdf5c0cd893a62a104d107c6adda4bccbd3f24040746fe0b40c9860f22c8e4766f19
SSDEEP 768:Yj+9B3PY9FCtQz8p8+p3bd66j+4BRv86aLIW1b9Mv:H9B3P0a8+p3Z6n4y3b+v
TLSH
T180F2AF73ED698E278CE1C794B2863783BFF0516792C41E98D9DD6F0E05872AD470682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f6dc0dfd450cd56b495cb210397313df73a573c11a8d0de21a1b78ae6de634c0
MD5 28464bdc6ba983f2616f64a46a641204
SHA1 185a3ce84bbc816ede819a80c102f8bbae1a1570
SHA512 0e2e52c41e99fc1c5adc8491dc39fcd0bb171ebffca50f850e3b228ff4dba29788a454f1ea6e37eeff28d0731946781b10366d64851cb3cc17a14c550c53bed7
SSDEEP 768:Xj+9B3SY9FCtQz8p8+p3bd66j+4BRv86aLIW1b9Mv:a9B3S0a8+p3Z6n4y3b+v
TLSH
T124F2AE73EC698E378CE1C694B2863783BFF4516792C01E98D9DD6F0E05872AD470682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 de45a9ef84552e567595c753af514b8a8bbf265165823f8a9fa3a11accde38a7
MD5 6b924d3e77c60766ee4c4e34a0b8dde4
SHA1 4bcd60d2fe0fc93af29c4ce158e408888833c66b
SHA512 e093bd2682e33d18eb479aaf5e6e62d93a81edc096d876bcc5678b7587f90be78e6798af07d9d13787e68027bf821829a65acd454a8630ee630275de4915e687
SSDEEP 768:XFsj+9x3fwgP+9FCtQjAp8+p3bd66j+4BRv86aLIWdX9gpb9Mv:59x3JOe8+p3Z6n4yjepb+v
TLSH
T13D137D7ADC588E3F88EDBF48B24E26566EF4017BC5F048A8E7D51B0E817219DF706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d793bf35a2f3ab294f019f2e74dfca0f33dd9b64f19f6c39ba1e1e3053c12fef
MD5 6868227ef60355cb4caa00ec14154efd
SHA1 17a30a0c7f726f26c157869065e97990dbbc72ff
SHA512 1066134c33c70735d497b95e74467c533950f493d94a8e5facdcd68bf62fc5b4288851abcd0c55e9ec15c0d32354d3bd77407de623a9a10317e6642d4a0591a1
SSDEEP 768:Irv+4UNbdD3kcFCtkNp8+p3bd66j+4BRv86aLIix2bwCl1:Ibsbp33L8+p3Z6n4yH0ww
TLSH
T19903BE73F96899339CF6C644B28676837FF851A396C10AC4D5DD2B4E415A29E230BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 330166aacae9e1aa574962117ebe9c677d5b6fb0e45a0533322d5fb0884a18bb
MD5 d580c0d626a18d0028e3ba99a7fec3c4
SHA1 d8ad5de4ae161708e389b09693bb65f1d1f3455a
SHA512 60bcd94350067216c31c33b1b52d9bc54195ad9f9fb997d0340850743a9ee95a322a59033cc2807692e71fdcd5dec781a2b81654ed69b68b54e1862d87215ea9
SSDEEP 3:MsEllllkEthXllkl2zEl5R+/l:/M/xT02z85R+/
TLSH
T1C74404047FC4154DC5001130D053C3500771F41105715747345114137CC55701C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

fcf9b5d6-175b-41c9-98d3-5359a1060de7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fcf9b5d6-175b-41c9-98d3-5359a1060de7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ade9bfab-05a9-4e6c-9e96-96a12e6bde28.tmp

Path C:\Users\Admin\AppData\Local\Temp\ade9bfab-05a9-4e6c-9e96-96a12e6bde28.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2640_59102107\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1616-720-0x000001F8DA160000-0x000001F8DA161000-memory.dmp

Download

memory/1616-718-0x000001F8DA160000-0x000001F8DA161000-memory.dmp

Download

memory/1616-729-0x000001F8DA160000-0x000001F8DA161000-memory.dmp

Download

memory/1616-728-0x000001F8DA160000-0x000001F8DA161000-memory.dmp

Download

memory/1616-727-0x000001F8DA160000-0x000001F8DA161000-memory.dmp

Download

memory/1616-726-0x000001F8DA160000-0x000001F8DA161000-memory.dmp

Download

memory/1616-725-0x000001F8DA160000-0x000001F8DA161000-memory.dmp

Download

memory/1616-724-0x000001F8DA160000-0x000001F8DA161000-memory.dmp

Download