hxxps://www[.]tiktok[.]com/link/v2?aid=1988&lzdlang=enFSmPWg&scene=bio_url&target=lx-sagittarius-star-mail[.]qiye[.]163[.]com%2Fapi%2Fj%2Fre%3Fc%3D%2F%2F%79%61%73%68%66%65%65%6E%2E%61%6C%6A%61%6D%61%79%6F%39%39%2E%63%6F%6D%2F%61%6C%6A%69%6D%2F#?bkb=bW1Ab2FrcmlkZ2UtY29ycmlkb3IuY29t

Analysis

user interaction
yes
max time kernel
57s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.tiktok.com/link/v2?aid=1988&lzdlang=enFSmPWg&scene=bio_url&target=lx-sagittarius-star-mail.qiye.163.com%2Fapi%2Fj%2Fre%3Fc%3D%2F%2F%79%61%73%68%66%65%65%6E%2E%61%6C%6A%61%6D%61%79%6F%39%39%2E%63%6F%6D%2F%61%6C%6A%69%6D%2F#?bkb=bW1Ab2FrcmlkZ2UtY29ycmlkb3IuY29t
Sample260716-rcc8dsay61

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
57	5040	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5040	msedge.exe
6112	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286841639268832"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{EE4B40E1-CD7D-414D-A04E-49003B13A8F4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 5888	4580	msedge.exe	85
PID 4580 wrote to memory of 5040	4580	msedge.exe	86
PID 4580 wrote to memory of 1212	4580	msedge.exe	87
PID 4580 wrote to memory of 1212	4580	msedge.exe	87
PID 4580 wrote to memory of 1212	4580	msedge.exe	87
PID 4580 wrote to memory of 4976	4580	msedge.exe	89
PID 4580 wrote to memory of 4976	4580	msedge.exe	89
PID 4580 wrote to memory of 1160	4580	msedge.exe	90
PID 4580 wrote to memory of 6120	4580	msedge.exe	91
PID 4580 wrote to memory of 1160	4580	msedge.exe	90
PID 4580 wrote to memory of 1160	4580	msedge.exe	90
PID 4580 wrote to memory of 6120	4580	msedge.exe	91
PID 4580 wrote to memory of 6120	4580	msedge.exe	91
PID 4580 wrote to memory of 1800	4580	msedge.exe	95
PID 4580 wrote to memory of 1800	4580	msedge.exe	95
PID 4580 wrote to memory of 1800	4580	msedge.exe	95
PID 4580 wrote to memory of 5984	4580	msedge.exe	96
PID 4580 wrote to memory of 5592	4580	msedge.exe	97
PID 4580 wrote to memory of 5984	4580	msedge.exe	96
PID 4580 wrote to memory of 5592	4580	msedge.exe	97
PID 4580 wrote to memory of 3460	4580	msedge.exe	99
PID 4580 wrote to memory of 5796	4580	msedge.exe	106
PID 4580 wrote to memory of 5796	4580	msedge.exe	106
PID 4580 wrote to memory of 5796	4580	msedge.exe	106
PID 4580 wrote to memory of 1260	4580	msedge.exe	110
PID 4580 wrote to memory of 1260	4580	msedge.exe	110
PID 4580 wrote to memory of 2776	4580	msedge.exe	115
PID 4580 wrote to memory of 3904	4580	msedge.exe	116
PID 4580 wrote to memory of 2324	4580	msedge.exe	117
PID 4580 wrote to memory of 1896	4580	msedge.exe	126
PID 1896 wrote to memory of 2788	1896	msedge.exe	127
PID 1896 wrote to memory of 6112	1896	msedge.exe	129
PID 1896 wrote to memory of 1756	1896	msedge.exe	130
PID 1896 wrote to memory of 868	1896	msedge.exe	131
PID 1896 wrote to memory of 1756	1896	msedge.exe	130
PID 1896 wrote to memory of 1756	1896	msedge.exe	130
PID 1896 wrote to memory of 868	1896	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.tiktok.com/link/v2?aid=1988&lzdlang=enFSmPWg&scene=bio_url&target=lx-sagittarius-star-mail.qiye.163.com%2Fapi%2Fj%2Fre%3Fc%3D%2F%2F%79%61%73%68%66%65%65%6E%2E%61%6C%6A%61%6D%61%79%6F%39%39%2E%63%6F%6D%2F%61%6C%6A%69%6D%2F#?bkb=bW1Ab2FrcmlkZ2UtY29ycmlkb3IuY29t
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdd6dfc188,0x7ffdd6dfc194,0x7ffdd6dfc1a0
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,18419806635191506278,7630413383327176690,524288 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,11236566873987516078,6320056234254647957,262144 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,17735074552470569528,2676172622899976970,524288 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,6911327823416699239,17402016400651476666,2097152 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,700444055393774447,10356806768119165870,2097152 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4988,i,17598293742686620450,5190051639682417032,2097152 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,4297863643734779221,16726585931764772522,524288 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4664,i,4746348373177516608,10371160182046982796,524288 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,15556461261274855351,2716543865087600744,524288 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,15556461261274855351,2716543865087600744,524288 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5908,i,8380677212997374648,12092890180926551591,2097152 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,14162326942020930106,8116729194574740212,524288 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,15095085361425693086,15403601567705147696,524288 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,16246524198589520933,8929414698802090315,524288 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,2057728827442856160,10721043898830292117,524288 --field-trial-handle=2256,i,218985898561850708,18060069814120834394,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffdd6dfc188,0x7ffdd6dfc194,0x7ffdd6dfc1a0
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,1602595329280205248,1695350689108624019,524288 --field-trial-handle=3340,i,17544871959362166450,11572221074866076918,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:3
    3⤵
    - System Time Discovery
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,11934522773660416190,15858911944583158239,262144 --field-trial-handle=3340,i,17544871959362166450,11572221074866076918,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:2
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,655896571451541527,14376852929208872579,524288 --field-trial-handle=3340,i,17544871959362166450,11572221074866076918,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:8
    3⤵
    PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,1045723959755168681,15792356738611525216,524288 --field-trial-handle=3340,i,17544871959362166450,11572221074866076918,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,8379056174376478823,5538687069352563504,524288 --field-trial-handle=3340,i,17544871959362166450,11572221074866076918,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,8379056174376478823,5538687069352563504,524288 --field-trial-handle=3340,i,17544871959362166450,11572221074866076918,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,9300171100631287517,15447960044592835530,524288 --field-trial-handle=3340,i,17544871959362166450,11572221074866076918,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,14207236784748662021,11945162193040553817,524288 --field-trial-handle=3340,i,17544871959362166450,11572221074866076918,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,5125862085897843537,12621957149479241226,524288 --field-trial-handle=3340,i,17544871959362166450,11572221074866076918,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,8491537314285249763,13181071849883313143,524288 --field-trial-handle=3340,i,17544871959362166450,11572221074866076918,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,2210112228825751987,14978890305386503207,524288 --field-trial-handle=3340,i,17544871959362166450,11572221074866076918,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,14999417360997716344,6425096302947248718,524288 --field-trial-handle=3340,i,17544871959362166450,11572221074866076918,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
    3⤵
    PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fde3047f99414642a72b9d4ed89de016f2244065578b284bff36caaa54e7d46d
MD5 194705af31fce27cdb98163b9fcf81a8
SHA1 b2d09e4a6c1ad5bef281634eb3202f2d1d615b04
SHA512 05531337ac91cc7988137059be025bb6688b9f5c8b2004da114113106227596c830c353bc1c380126b0c06eb70e2953e1760596d46db5feea15d8211e8b150e5
TLSH
T14FD0A7E8662AB9D1E13D1D32A4208700F66C16932966D305E268440D9C7E09666C66C5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4da7551c4bb0fbf464609e0050a4cee8db61c59491eb6a14aa98bd90017ddf85
MD5 b628ce2a0cac33a4d4ac9b6d2d4d9ab8
SHA1 bc612116bc512bc38034ecd839dc282a8f1f0a1b
SHA512 6da07bd7f5caced45241282e602bab7dfd0b174cdb0d3393e8c3fa505abc49ff289bc7743eef0472f43bf063b8601cee6f428c048ebb9c2af5eabd019905fff1
TLSH
T154D0A7F877693851D22B3D317410C611B7A957912919E311A178400D9C7E0A526CE185
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c3336ef087aefdf57ab44509072039464b3b891f5f68779fc709e6b313487187
MD5 ff5a850e52876ded31bd6c8e1bc365de
SHA1 a972d8c2c7f77a7731f7f86619998fe0e63c409a
SHA512 f704dccf417edf8255bd830d53c40c97df4027ef937bc63346452d3e30af2013ebd17d662125aee8b4bc9acd74b178aab29b5b6774df8513c9afa531ea9855af
TLSH
T18CE022BAC822EC2708FD0718A01D874AEB1113572A40899F3B3CC20D8FB072A46C686C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 b34b95eb79a0f21bf5ff14b0a6b93300bc2ca3aff400a0d8933bdfdc34497afc
MD5 1ccd948e1263e34ada7ea3c231bcfa9b
SHA1 ad0a7ffeeadb580df87adcc2f7490616833aa064
SHA512 8d6f75baba11441776723f54124c80e01418f3fa58446b3047f48f45146bd1ff639a3e5b814fca6d255088b95ccc674e60a013365ed35d7fa7a4dfb99530eba6
SSDEEP 768:OzzTBiEAq9vL1dVxrJxeOWEtUboBNSUvF7:OPTwrqp1dVxtXWdIAUv1
TLSH
T1A513A23D6E960D96DACB537D090B0A32A73CC531F7D1030F336AB516965A34F8A9EE18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 eff4c7cfdedc1e23d92bf9acb2106943a6b525239bb2a4619da857faaf6abf1b
MD5 91b14868ede5f30721bac1cd7b6c65ed
SHA1 a1f5688940a1240f9ba264346644947a86b76fb8
SHA512 d7b194131ee59103951ff1131fc739f7ee7229da24a7e41d208ec66d8dcd55fae758a057aa94ceb8ed170c7c4065bf4b11a3f6255447ad479b71abd6a2e04ea9
SSDEEP 3072:hL/uL/NxeSS2L/PL/XL/yXRAKkdfrT0nOR:hL/uL/jrZL/PL/XL/sRmZG6
TLSH
T17D445DF70951A05ACBA802F5E2133A3ED17B051D3DE1F8E9E5780C952925F32B6BDE84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 255fb533184a30ae7ac31f517cb8d0f934082ad87b5e32d1df7b11891c4fe0af
MD5 07358aa9dcbf1148e630241815f7bdde
SHA1 728733675d4a68aebded1a305781f1dc54993715
SHA512 d7dc44d1629d3dbd1e0f1b453e769513b46b19bdc1f0c91febb3604b70b265bf494bdc90d40bf04bb0925dab0a0856a45bcb81221e8c6c04e5d119cac2bf8152
SSDEEP 6144:1f0v52gKhN3IcG545+xdVZvdhrKAjk68InFkBG+4MIvyO6uaXf41IJYnldhPi8Yx:mgRj3D245kdVZvdEmC
TLSH
T19F253BDECB682C82CB6B8774B4D0D8077E702183B69DD0D3A944C5A857D2BC176F92AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 c240712e04d2af230f66ab46701f6950218e8c4d25ab593e47b4ffe2a0d4a602
MD5 ee03a3f00e1a770f250fb155bb81cc0e
SHA1 2adb851bf6bbf812ca5e7f43ae7e84a36be35e31
SHA512 099c268e4c947fc412c63f99349d3b7a52c90b3a3f19707e5c426d38f6e34ae3b649e6398869a61b86afc7a2efe0eb21e591ac27debfd8ec650513d57d37faed
SSDEEP 49152:gY11mkDLlPTY+Py493sIYDbM67JHz+ZUV:gW5DBPTKRIYDblR
TLSH
T12D867DEDCA6898C3CD639970B0F0E9477C7413C3F595C1D68898C684026B7C5BBAB769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 9143ca158a3d8a542971ca6bcdad50f04a5a9c011280021936e94bfa33aad5f8
MD5 81825f6aeb989078ed469ed38cfcef60
SHA1 795a18c853df3252264c637c2de0508b40667db0
SHA512 7afbe32250db4faf967613c0778cb684f6d1eef3e066dec4f8c2dad02c9f366ca149fe37f2eeb05e250ea880c3491cd512c3de787683c32b14b793dec4464a1c
SSDEEP 48:SmbPDAHjs7Y1BXqI57WzoW9tOgb3YlbTBCXzwmS9tv+yY4hqIen:SmDsMKBX/i2gbolBCXzwmS9tv+ythqRn
TLSH
T17C81083225524DFAD7B1077B89D00926F432C2E9FB131FCB2144A4379535723B2ABB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f131.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f131.TMP
Size 3KB
SHA256 12aebca26d8796b6f187e186498451a5d0c3e03101e777e0be9862bd7432b9e0
MD5 856c4ab90e95fb972a2156df3df199c9
SHA1 a46e54586d2934862122ef90ba6e9ffd1298d892
SHA512 24258e287dea7bb7834cb759dfe6203fe66677468aca2801d33f2ca5ff8c01850b058318a4a304aa2e5b188b3339db68ae00ff241190f1c3a006b8eec7535c29
TLSH
T17981C63625524DF9D7B1037A95D01A26F432C6EAFB275FCF2150A0372931723B25B719
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 02e896a6584323a532e8ed9a6af9c61c3036b34ea5d6bbd9e885328a14d887b4
MD5 73c9ee42cc7995c38715169f7ebdb9d0
SHA1 f384e1d423872621a30fc2ba365044c45932ff5a
SHA512 5c0ec1f0568185473c0eb4916515f150022f123054d97c2a95b9f6cccf58166a907ad41526e62f737f1edd216be9275929243adef76e01b2d5a90702c248bca7
SSDEEP 3:MsEllllkEthXllkl2zEklee:/M/xT02znee
TLSH
T16144040DFFC00407C50010344013C3D01374D510055157C3347D0417FFCD5404C00404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 ed0627d70d52ddb7ae9246a8f99b62fed3602c196f5782dd5f1b7a0e570eb87c
MD5 a930853502fc685ff26fdfe1d6c515cf
SHA1 be488861d42070fe6d05d0b3bd08a59fdd39af6d
SHA512 1cdd44c09c0ff766d3e756e845c99b75d3dce3020f130ec18299147f5096d1bac757dcc6d588c2ad78a633a3a89049d704e2663badc3f4a024eb3b09212f8983
TLSH
T151E020F655CAC27E55D034C391646B4DC2D0B887E687AE473BC4CCE4764E441B7C155A
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 f6af42aa50dcff205c9fc71a00ce612b1429a341ade6a16c2507cfaca6925b86
MD5 4178f115432b8267eae0d2c2bb2d572a
SHA1 ffc5202cdb5ef3ece67580b741a7b395372addf9
SHA512 315c5f33e4855a19518e0178ae71e57cfd9e28f1a3ee1ffae07b810e9670d5e3f6eb100129435d51247005dc93cea727053673b801f7044e16e9cd7bd002eef1
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jnS2W5LUXK5fKFtICt1qYpCS:Tyi+7f+UZD4jJ/BG2WxUXCKFOCt1TpCS
TLSH
T1EFE2054D3F51F511C4FD733DA0C2C5F06EBC696C464DB171523899B68D639A2F09E24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 0a649f138dae8becf15ae902468926b7ac90d3f2f87b432888aef339e749dd60
MD5 a89b60de12b93bce97cbe37d3f2d9e6c
SHA1 789ff3896339271d5eb082cd17acd21461623f8b
SHA512 2179c2989a0f83e036c8efd16b736f9656a8849a052a8160aadeb27fc5d1c1acd9b665a2f5641ae43c06ee894e603a343800a7e35f307d00e0b3227cde5c7483
TLSH
T19AE0204804C9C25DE054A693C275970CD3E03943B2843A01278C8C50610E54673F5159
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 a76f658dd129ee74b920efa25bb9c83663ec784b6a1eaaa9514192b5abb041d8
MD5 2405f2eca8ab24eaff16971c05a1b241
SHA1 05ee67316fa15df5ce9af7f3298e1d5dfcd2525c
SHA512 96b85f16c5c6289611f55fa5096c2f36b48943ca7d29ff230c7c28cd72b4f54bdc484fe857e767abf5eec17e213e3ec7c198c8d67c939947a7d5dacacb0adafc
SSDEEP 192:GaPtJt5m2tfat9wt6t5utLtpJUL+MiwMOF5VPxfbJ74:ZPtJt5ftfat9wt6t5utLtpJA+exHfN8
TLSH
T17EB2F96669313168F7160838353738BACE7B535C0F92F88834C45C229AB4E77F7B6696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 4f189d89486df22bf210eaa294886794727aa59825af6c39ffb9ccb0e630b0b7
MD5 692ff7ed5f73bcd99e1c689f9756bb8d
SHA1 5ae4b99b7893d082030d58e744863dfa8d49999d
SHA512 1d0ea364d32388adc31f03ed5b9757e1c9376ce887b2c427e2d6b82d21a43dd6968fafea3dc00dcb2f74c52faf876ad090132ba50b0c9b532206f78b010e5c61
SSDEEP 384:5tWt5/ta/83uICtTBB/9tDtDt5lVtHt5stnt5h7DXspU3i3:5tWtxtsptTBB/9tDtDt7VtHt+tntSU38
TLSH
T15914951E5F202304DA2B847439B714B75D7EB03E4762B0CAB8911522DFE3B63B12D96E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 e5e85a357c987af85f400cba4805d74a50c9d6a15291c5a754763f37e2a06e86
MD5 a78d5cee7c40a1ee6f519a46dbf6bf96
SHA1 05c8e07f0412f8538861fdbdda274f5bbb9883b1
SHA512 3a8540f7be19591c820d4d1deceb4dce1b5685ffceb2caa8a41178e5ba3cf341fae61484693bb617afe11d2400c26a3b82591559217236ea6daf2f6456a38b66
TLSH
T129E0D8E545DDC19AA34420878224770DC3B03547F68C6F062B4CAC40B00A404ABE11D9
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 d6122090468d9f0718723cc6a739c312612f8e4c9de2c4f0f62d3bc0ed352f2e
MD5 24fd7008f095925ec132ed29c0ba1717
SHA1 9368b3c475d2476320479298c1870a91412a9c14
SHA512 de75217f1a3126a4e71b566869093641683db8bb822fd3b134ce15b86812cc39718d39d7ed3064ffb957cb064b89e084517fb27e9947c71ae7d1dd90bcb6f205
SSDEEP 48:TNLopFMatSaw/auUOt8BXLoRhjfEPGbBd1eug+o/Ww7Mr1KuhDwH:deMatUaAKX+fsGbBdVJiE4uhDA
TLSH
T17E92444E5F302215C0F15B71DDE185A72E7C110ED767269A991820F39DA26ABF117076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1a21bc05431fa64a190b087b4a3c8fcedf5e79059a8fb4333dfc21d9e3cb83af
MD5 5a14ae97ac39ea8098915accdfbbb164
SHA1 5313a07a305e6b8ace8d85ef4ccc0b92274ed79f
SHA512 13802e1be7c252f35efc72427037b0d723dbd3d0e451982a14ed2acab97158d1b386d4dd15ada6e98abf6f20b23b9b253db687f9387cf5dee28120f2190ab639
TLSH
T13351CEF387B5866E8A1295F0AA14AE2FCE2D0515432C7D5A85E46F2BD3E3471E001B4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5c2b4cd45d14c496fb52aebe1ba1da067498b809659ed10568d092b96f95a008
MD5 d2c44963be42cb75392f5bc6cf821029
SHA1 730d348aac4c7dfaa30c144c645eac818631ad91
SHA512 88b2650d2519e9104cb8878f174f462b3d8f4b2175c1cd4ed5e335cb5d35a8a7c4831847960fef0ceb8326d0a2ab47e0eac5b0320756e58e8008ede5180944b3
TLSH
T1A531C0F383E8856E8A1195F0BA18AE2FDE1D0510432C3D9AC5E4AF1B93E2471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 d9222846f14c89134bc90dc14bfe41a6693591a1f1f95e429ac74f65e5ad1caf
MD5 9835971104eb44bca7d27a3b5980d1d5
SHA1 02731fae718e092319dc691625067e9bd69843a0
SHA512 3bee8a5bc63e9f07616c225b948fe7f65cfbb9e5e1f76c37266f45c944ae51bb5cc66641ab092ea67295946fe5edeeb555e198903633082abbe037f430f58388
SSDEEP 96:eIEumQv8m1ccnvS3JH141il2O2xRmRyfHR0JnFL3M50ROq4g:eIEumQv8m1ccnvSN1csQRYLRf
TLSH
T183F20FFB0733610AD99454B0A0016BCFAF16010B47B6B3EC76D457E3F2A21E2B279796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 355B
SHA256 9416996cb5f98dddc026ee3f350c817fab65fd2227d1a7abc2f00b5aef0c4763
MD5 2e42802674fb0e7876a10fcadc3101c6
SHA1 59cbf80d3d51a7e5369096880780f82ee2a6cd93
SHA512 0ec77fc67e0306d9ca51cba476a7896e0c77daf2f097f88f9d78909d26500e823f220cc9cdc64f564f9fbb87d928c97fa25ae2418f19e34f758127a4b3d6e2f8
TLSH
T1EDE0D82385FDF476503C08BB0E45758579B7947951519CE9EAA5A33CA0904FB6B02036
MD5 SHA1 SHA512 TLSH

Submit Download

b4b53cd7-c814-4566-be9f-0dd88055d01d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b4b53cd7-c814-4566-be9f-0dd88055d01d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f51682858cee1000b796219eff574130169609cb3b3693ce92758e9f3dfbbd77
MD5 ad727f95cc1b7e1ded9d710aefad6819
SHA1 5a532dd6214518daec66de4a8516428e553e1457
SHA512 c01cc1bdbe9a2a560dea537dd246560229321acde34dceed8307c46bba690eddb4641eb5133e68d8dcd133b87e7510a7be4012f84891fc74e5cf9c1f4af5d96b
SSDEEP 192:sxZYRIyMqZjK1Ml8Mk9/fwssLJgaZdhzodpe6HW6+WNUbJ/Yvjug/jTIgjHJ:sxZYhM9/fwsstgazKRHbu/wXjp
TLSH
T1E762D9166A389D7B9CD7D219F645BF53D6F91163A2905E44AAFCCA0C00E77EC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 096d79ba159299c6ab3cb225d4497f8d3f14740882dfd028aa173de48d669c2e
MD5 6328b97b6c37fa507231094044bbb2e2
SHA1 05739fb1a534029dc14149b429a6081c0a5a2e13
SHA512 2eaf2b252ebe98e8851963bde68b6da140d367375709d5badbbfb9b77e6401e200311e50109be0d63291a344b726b9d54c9e25731a92805bc02f55dff287a157
SSDEEP 192:sxZYRIyMqZjK1Ml8RCk9/fws/CWpVBlZdlzodpez1HW6+WNbD+W1/bJ/YPoXS/is:sxZYhO9/fws6WvBlzu2HbNl/sgMp
TLSH
T14372D716A9345D7B8DD7D219FA55BF93D6F91063A2905E44AAFCCA0C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 9911beb9a15b9eaad6b75f1691fda53e8c537ca19075e451edabe2c4fda2334c
MD5 5c1f9ca7a7785fa41fca5c57015c5924
SHA1 7aaceec5d01aa8eef3a106b9c9a80dd00383ea87
SHA512 b48da8c28fa44f1b07c30403afc110b01ef43266622933c78bcc6bbdb7b23d71eb55b2d00b8c934dbf52338a77b65046e10ac0f728fba5412dd967d79e07e1bd
TLSH
T129E026D535CAD17E605A20838334A31D82F5790BE2C83E037FC8D8A0625BD04B7D2A80
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 172B
SHA256 11efa571dba06b4a476ba72dc2097819b21b2e772b974d4a46234ca4133eb72f
MD5 22a9b0360f41651b9da65a0d0c23d5f7
SHA1 fad197a7ee41d2af0ba4dd5ea1a3792082d212de
SHA512 58fb80277c88036ea14af33e4acff7ec57933764c3df959b082e8be752c544bd9072383aa8d3ac8261b1fe78563abf5e6c628c0b182705c40b4fcc001fd39bdb
TLSH
T157C02B483380FA06D48D9EB5144403D0D3C0F003D481CA3B4C78EF250E0595D3E92CCC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 3e6310a01df43b35e9f57031b399daa2a558a0c5e5a6b77d07d2bcca8d601ece
MD5 565c03e7d9c660999d5dc930af9550d5
SHA1 f13b4044836ee4b562d2b5602c5177c1d1cef3a3
SHA512 505c55c42fa0ae5874da0dd91b9e5e6fd59f0d828a79ba6be0295396f3b11471cc175ca32772f6b0ce2b6124991fb21a371c3103e872ec214346be11d6ee4219
TLSH
T1E0E04FF436C9D73F6286209BC268E30CC2F27517E6C86A127B4C9590A21F944B7D7A85
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 f780ddba8f60635b484311ea54f090c359e49adc83f12f4bd95c20a88f843fb6
MD5 256bc499a67dafa6fde19a9d20a85e45
SHA1 5e9262e77d78157bfe30e9e1fab980fa2fccde8b
SHA512 f119aa57d73c89b8c6fa8f16c8e67bff3f57e0e5049e2945aac597be3d2bee8c7a52992ea12b311108fd50e8bf3a4cee510e7986b1f8801021a9de4eb9c71343
TLSH
T1CDE026F466C9C63A50496083C264EB0EC2F07907A3C93B02A74C4890A12A900B7E6A80
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 13530db4428a387f2782bed22f5a8934896e661658e864edd5a08c79f62af1a9
MD5 97e4a3f1de2754fda7192fb0de3ccee1
SHA1 715c59ac135f6ea59d07ada734538be951966f86
SHA512 0d02e8782f2ef7430a37a1ed766b3bad3596bd5ed05c8607283ae5bff20368d5bb12acb53d1c06fd4a27c4b7fb2d4a5d18b977c8884b3cce005ee06ade17f201
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9JyzGi0wMBwtO6uBmsRCiN0C5WeTI0eY4HU9IM64U:0LppY93PBZJPtN53t7PPE
TLSH
T17AC2785A713B0212397E2948B39696364F4235A37058E8AF7FF800A54F67E125CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c0173099a316a5c976bd08c630d13ed3c4f50d4b41dc84df1004de0bdca58f7e
MD5 410cb50d74e5126bc58783222b518c6c
SHA1 fbfce51666e6c6a412fa9ac98f51bbaacb5b7f20
SHA512 2e0ed8b044cf957f9e3447fa9b7e6493ca6a22f6aef42476e5ec965bba7474627f82af405bdaf1b86d7e9b99ac7db743d7f19d77bc9f51b533df396ca2775d91
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9JyzGi0wMBwtO6uBmsRCiN0C5WeTI0eY4HU9IM64S:0LppY93PBZJPtN53t7S
TLSH
T1AFB27C5A713F0212397E2948B39696364F4235A37058E4AF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 f5a834aff9a161badccf21731ad93ef8c9de124789099abe2e196826a9bfdfb1
MD5 c07206e39c73348fa30dd6e8f6ea328c
SHA1 46949c0936d65a071345a42171ec3c2c6b220513
SHA512 e4ecdee87c803a71c107f43fe8c8c5e15f2032e105e1063b25a59b5bdcedb4662d9df8676a39650677ef567823f2767d96fe93d19adbf9eca4f1124a16254b23
SSDEEP 192:P+xWXf8WfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxFWfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T10824640A7B747001EDE6D9721CB080771E3C716ECF22A6916DB654694DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 749dd5b417b48ee63ffa5623eb39a0329821a5019007d08ebb0733e1a80ac9e8
MD5 9d3c186e443c481b33fccfc513880a4b
SHA1 7f45a9d2fe89741f93bc49a01393359f31064827
SHA512 af813661e12049773de8b8421810a5782c6fd652cbc420216bd13a35d0fca2db344b6c4a06086f6834f1fda8ce7b271ce785b3e3a8ec862c02a600de8de7ead1
SSDEEP 96:DEtSyGhp22iShmEvSbIAKmEWpSbIY5uZu5TmEImEwjS:DLThtKetWEd5ICTtItwjS
TLSH
T1E0527697F9202205F7834A34757325F7AEB9722D1AD1E08178C129037772A72E33764E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 67c1c217e23ef96c7d6331dab8c9c5399875c741a1fc74069c55ae03167d6681
MD5 c65e39516619cc7e3aced013b8b99024
SHA1 ac438b515f8815dbd97fdadec65bb3d853a24eb4
SHA512 707eaa467c6a454760ae56da942f9a2b6a1c14020d8f23720f1481a5fe1462bbaa5d3c08f45528c840f9fd087209cf50f578032e364243c1a2c8937ec7aa343f
SSDEEP 192:mQOA4AsBDl9HNCsMFP4fll2Q9x1IIIUbUMIMO/YcYn:GAhsBJGsca2Q9x1IIIUbUMIMqBY
TLSH
T15B52732D67057B3BC05E6F76135646589BD5A883027B222D30222C5F9EF3A5B86C52F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 2e18e70b635a2f4ed423b40456a7d64e583b0dd3f25caa77e741493268f8908f
MD5 8e0df6bfebc23837b15b54b659a64c45
SHA1 38123e9e78b12fc1a61dc93adc165b9b3c584639
SHA512 05b0de4c5311eaa72252ef2ede6257576f39dfe9baf3da35b04be2ca1b0c603ba75b04ec8aefd1db2b939c6e87ea5e7fac5faea90892a19550369cc4c677cfc2
TLSH
T151E07D90A8CEC1EFF354E0874128530F83A03B43FAC82E863F8CC448A00B500B7F6199
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9e72a48b3bb2f1ba346703a2f29a6e0cd440630caa078ef9bbe2e36b2bfeb664
MD5 9902aecfb8c02490e757eae2dfc7bc94
SHA1 3431d0b700243264392ea8624dedecf95716c8fb
SHA512 8c5e0431b8f2b63b3cf35aebf7e479cbcc056328c9158472240e7a0ab071eaa332a7ea2e23c15633f96dc78955b28917cd948442d526ba0ebfb82aff117d51b7
TLSH
T1EA219D55F320C159E18E863AA46B9B261378E8129FBCEC0F847D24352D72E045E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 a0142103e21364a8941a758df6a541abc3f82283a0cad5e2ab6361c7940515c3
MD5 8e5471ca17c44c4cf7219ce6237bc650
SHA1 60d19f6c808063456aee5df243509738f8b10f36
SHA512 c231d941bd2f34211d19c0ef095e544791d3c77eecd170495e46b4582b519a39e381444f0d8527e0f09b51b6691bd5fe7896dee8baec9a9e431af12a136ffe64
TLSH
T1A7E0205069CDC1DFE350A0834168934E82A13A43FA842F012F8CCC44510A54177E7155
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 29faf6718612631ffc3a4b9b8ead8d8cbbcf5f3e1bf550a1d2f00260d0d002c6
MD5 098b498c33ab315b17dcd33172c271c3
SHA1 dafb9cea4b0441c330043204c7c8c4f3ea2274ae
SHA512 24b08fe982c32f404a3fe00c38bee1ba2ff4b655277a0825f7c2d30ec3d6d85ab066d33f4390e5c013237165c1d4e30bbb788c35ef8b4d019f533d32bf50095d
SSDEEP 3:MsEllllkEthXllkl2zEelkL0d:/M/xT02zNkA
TLSH
T1894402196BC82406C52810345011C3501360DC1006526B4364A604529CCF5400D00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 168b545d2bd3665ab32c3b60b4938d3fecc9180852839aeff09ee16287dd0682
MD5 cbf54aeedecb0e4986265bfff3a311b4
SHA1 ebc0e9f3a5f1edcbb865964f45352cb108d16a94
SHA512 e2e4f57e601fac9eb9e0df2786d469ee4f0478783c43e7b625725f7b0e19fce2a4e776d303453f4cd501b6380332e16dca6b8ec344b592ac36887497102e3b3d
SSDEEP 768:gFNj+9WXwg0ktroGP/sxgLSh1DCxpk29M/q:99W6Ie1exa2+/q
TLSH
T1C9F24A32D854CEE7A8D2CAC9674AF906AEF00137858C599CE2F87E6D309F5FC8346915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 adb10324b57cd4cf6bafa796a43f91028ffa980106c3cc9a9ea756308b9b0c75
MD5 61ab8c595b54b3e02bdef78de654a898
SHA1 27e8d8bd6d8d9628f58f90c1d53a41de2c28e7b7
SHA512 e8e0736c99d3f89c1b31d560c58dd40b6fcc02c73606166f9a7573f4bf116da18ee9dc10353de9bad62fbe5d0e2080f038d42e62ad930ad08a89f99af44eef4f
SSDEEP 768:gFNj+9WXwg0kiroGP/sxgLSh1DCxpk29M/q:99W6he1exa2+/q
TLSH
T112F24A32D854CEE7A8D2CAC9674AF906AEF00137858C599CE2F87E6D309F5FC8346915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5f9f13c34350934bb3d045bbd07ecdc06afd928e4e9fa3ff2d504e2f696251f3
MD5 ddd0e12feedbb8b8d4b9858fe06a4f7c
SHA1 e91b593033d1de0bedc2823aa6f80feb02e028b7
SHA512 2d87c0daaac71475e5141d739a2d1074c3ea4390e5f9014f62464b77c1e950a0276de2277c98f3c1e695d0c05130eb3f44ad48a0a1f2c3bd2ca27bd975336cb7
SSDEEP 384:nJiF1tNn/s3n9SCsNS8TUNTUlI4NQckCrgbbFphiftGP/sxXLc62OObjI9G6w7/q:gF1j+9lXwg0kJroGP/sxg6229M/q
TLSH
T180D24A32E864DEBBADE74BD9B74A3A43EEF04163858C1AD4D6DC6E4C01D71AC430B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8f26abdcbed70ba253b8f5aa4946ed19874bfef2e9fb0491fff2c8413608e4fc
MD5 404a573880cbf1e0e6f055a987b59622
SHA1 2496fd64c0d005ed68dc4612ac7e53a72a2cb1a8
SHA512 42cfda92681cb43fc429fcf2de939a2ae518e46b7b93fb80614efe4473a137166c0dce6f2cb060cb12d5954a253e95426480e422451e99af792c0d492480989d
SSDEEP 384:npgiF9CcmyWCs3sNF8TUNTUlIm2QckCr9lGKphiftGP/scWpse4KV8p0+Hrty/7j:p7Fccps3owgbkUAkoGP/scHI8p0oK
TLSH
T1B6B25B36EC68DDBBEDE34F99B74E3A03DEE05167859C59E4CAD81E4D00931AC130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 00172ebc7ee1344fd4ab7da943209d4cac84b22226a0d0c92bb8a6182a19bb1c
MD5 7116b517068d7b198ec7edbc69c05f02
SHA1 4812d78e66042bb2663c3d3d9c824b4ba1448903
SHA512 051697cd6585438e2ec73e72229af4387903e69bbcd42c7efa57d3e1b12345436b597f4492430d564b428e1da3af20fd5c5f0076e95fb8ab9eaca97bf9397818
SSDEEP 384:npKiF9CcmyWCs3sNe8TUNTUlIm2QckCr9ySmphiftGP/sxXLf62e4KV8p0+Hrtyf:pBFccps3nwgbkUVYoGP/sxL62I8p0oK
TLSH
T145C25B32E868CDBBECD38B99B74A3903DEE05167858C5AE4DADC1E4C00D71ED530B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c3b3d705832869e512d1f1c669fbd0d278601e2d17d8283a392242a3a948a3db
MD5 ff4a99fa6f70c1282e6a08148f529fc4
SHA1 e41f6a87d844fee88cdb04e94884f9d2160cdaf8
SHA512 f8f99a48cce67920e8aa865c043372b4da7e1d7f846b871707f76580e967687930b889a4acb8b90b040bd5e591e211544fac22657c5c3ac019c1f15955c86ac7
SSDEEP 384:npsiF1tNn/s3n9SO3sNS8TUNTUlI4NQckCr4bFphiftGP/sxXLc62OObjI9G6w7S:pXF1j+9b3Xwg0kTroGP/sxg6229M/q
TLSH
T1D4D24A32E854DEBBADE74BD9B74A3A43EEF04163858C1AD4D6DC6E4C01D71AC430B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 94c6571af976a77d121adee4235836604511677b904f47334a8a4a7b9ccacb47
MD5 f9174d411293d024178ece7bc31ecc01
SHA1 7ebec5b441bac962e4c6c12d2ecc1edd7a5c8aef
SHA512 8797fd6d707b22d7636f1b2598a31dc96b2666a529bb4fdce4e101a79514e551d56dfb6f6fc2e995a3f6753618db11daf49f6b522acd36918a573901663f1fdb
TLSH
T1E9E00211E200109ED03C03710043913513A39034126303094810826039112401B109D0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58a1aa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58a1aa.TMP
Size 392B
SHA256 1f98a67b37e3b9ec6bbb1b6aabecf89b8587d6daad51c0c22fa315122246a3df
MD5 24b61087c560e8f16e5796f05c27f96e
SHA1 cf32941ece9d6d444c959299ef7ce22cd52a6627
SHA512 d13ec797ad7d93f04bdb8c69394bddba33e5c0533de29cbf7e92cbeb401da87df2ee34d316e095611856879db0ddcb3b30615930c2de4531572c278f3ddddb7c
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 3b85c6e36acd4586f5f70afedffe4631e59cf932b74f96de0ce4f42c79e642fc
MD5 11455b9aebdae29d6318270a57819498
SHA1 cc6cc4457ebc687d9b1a512dbac7e9d3e6c0a91c
SHA512 8ccd5af4724b80b18ca95dbdf0ff86d4c04bce689e2a35b503313cce6390d7cc19619231fa428de93d23dd9329358b22ad1704eb99e41d188f6a3799705b6449
SSDEEP 3:MsEllllkEthXllkl2zEelVCNlt:/M/xT02zNI3t
TLSH
T13044040D7FCC5407C5551034D011C3D013F0DD100551574334750533DCCF5C40C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 80335025be0d0ce9c89bd0077e010f29c76aa4feb769400ec0e56bca97ab655c
MD5 d1596ce6ef6ba2dbad567e32ef64fc09
SHA1 a579cf36acbc33d6a628997799fc14a812c0f7c3
SHA512 c7ae1874b619463951d4afdbb5e3be97e3affd8d224c6cec47c33170cb06f31aaf5384f6b26c79c7e90e23ad4a92e5cd2862d66461bd2e771fff58d0e211aa9b
TLSH
T17F412B98B6FD1144F3B7AE569BF2786D487FB9372F06959D00010E4E0662A40D8B2B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 5996472fe47bfc1052ffec1c97765a5750d270ab6588d251d783129fceb9308d
MD5 df1b44b36132dc2d276363100902a447
SHA1 cbbfd83cf83d97160c7761f1feeaeb738ca2708e
SHA512 a8d47d5a16757d35a9992a2477439946bb3dcbf006e9df84bd261c073967b0839f9fe3c5da68117dd4aaa524589c1c32f79e9e31e9b63f80b1821fda4486e93a
TLSH
T1E1512C5CAAF91118B3B7BF1A5BF679AE483FB9333E47945D10510E4F0B22A40886173B
MD5 SHA1 SHA512 TLSH

Submit Download

60e4e757-be74-45fb-b497-9b6782893e9d.tmp

Path C:\Users\Admin\AppData\Local\Temp\60e4e757-be74-45fb-b497-9b6782893e9d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c52b1247-9777-4ada-8741-ce89d954134d.tmp

Path C:\Users\Admin\AppData\Local\Temp\c52b1247-9777-4ada-8741-ce89d954134d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1896_1336611775\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d22b5483-eca0-4208-9613-e3445133f51a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1896_2120452915\d22b5483-eca0-4208-9613-e3445133f51a.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads