hxxps://seha[.]en[.]aptoide[.]com/app?package=com[.]linkdev[.]seha

Resubmissions

27/07/2026, 01:58

260727-cdwc2athmg3

27/07/2026, 01:44

260727-b57dyatzhw3

Analysis

user interaction
yes
max time kernel
504s
max time network
503s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://seha.en.aptoide.com/app?package=com.linkdev.seha
Sample260727-cdwc2athmg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
932	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295911102349873"	msedge.exe

Modifies registry class 58 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{7B0B86B1-7913-4EA0-BAFE-49EFB95DF283}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000cd8e0d151ce3dc0164b921f228e3dc01268c91756b1ddd0114000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1304	4812	msedge.exe	84
PID 4812 wrote to memory of 932	4812	msedge.exe	86
PID 4812 wrote to memory of 5124	4812	msedge.exe	87
PID 4812 wrote to memory of 2136	4812	msedge.exe	88
PID 4812 wrote to memory of 5124	4812	msedge.exe	87
PID 4812 wrote to memory of 5124	4812	msedge.exe	87
PID 4812 wrote to memory of 2136	4812	msedge.exe	88
PID 4812 wrote to memory of 380	4812	msedge.exe	89
PID 4812 wrote to memory of 380	4812	msedge.exe	89
PID 4812 wrote to memory of 380	4812	msedge.exe	89
PID 4812 wrote to memory of 1172	4812	msedge.exe	90
PID 4812 wrote to memory of 1172	4812	msedge.exe	90
PID 4812 wrote to memory of 1172	4812	msedge.exe	90
PID 4812 wrote to memory of 1404	4812	msedge.exe	95
PID 4812 wrote to memory of 1404	4812	msedge.exe	95
PID 4812 wrote to memory of 1404	4812	msedge.exe	95
PID 4812 wrote to memory of 1264	4812	msedge.exe	97
PID 4812 wrote to memory of 1264	4812	msedge.exe	97
PID 4812 wrote to memory of 4884	4812	msedge.exe	98
PID 4812 wrote to memory of 4884	4812	msedge.exe	98
PID 4812 wrote to memory of 1568	4812	msedge.exe	100
PID 4812 wrote to memory of 2164	4812	msedge.exe	102
PID 4812 wrote to memory of 2164	4812	msedge.exe	102
PID 4812 wrote to memory of 4516	4812	msedge.exe	103
PID 4812 wrote to memory of 4516	4812	msedge.exe	103
PID 4812 wrote to memory of 4516	4812	msedge.exe	103
PID 4812 wrote to memory of 3372	4812	msedge.exe	105
PID 4812 wrote to memory of 1756	4812	msedge.exe	106
PID 4812 wrote to memory of 1756	4812	msedge.exe	106
PID 4812 wrote to memory of 1756	4812	msedge.exe	106
PID 4812 wrote to memory of 4104	4812	msedge.exe	107
PID 4812 wrote to memory of 4104	4812	msedge.exe	107
PID 4812 wrote to memory of 4900	4812	msedge.exe	109
PID 4812 wrote to memory of 4900	4812	msedge.exe	109
PID 4812 wrote to memory of 4900	4812	msedge.exe	109
PID 4812 wrote to memory of 4856	4812	msedge.exe	110
PID 4812 wrote to memory of 4856	4812	msedge.exe	110
PID 4812 wrote to memory of 4856	4812	msedge.exe	110
PID 4812 wrote to memory of 1044	4812	msedge.exe	111
PID 4812 wrote to memory of 1044	4812	msedge.exe	111
PID 4812 wrote to memory of 1044	4812	msedge.exe	111
PID 4812 wrote to memory of 1556	4812	msedge.exe	112
PID 4812 wrote to memory of 1556	4812	msedge.exe	112
PID 4812 wrote to memory of 1556	4812	msedge.exe	112
PID 4812 wrote to memory of 5668	4812	msedge.exe	113
PID 4812 wrote to memory of 5668	4812	msedge.exe	113
PID 4812 wrote to memory of 5668	4812	msedge.exe	113
PID 4812 wrote to memory of 4404	4812	msedge.exe	114
PID 4812 wrote to memory of 1832	4812	msedge.exe	122
PID 4812 wrote to memory of 1092	4812	msedge.exe	123
PID 4812 wrote to memory of 2392	4812	msedge.exe	124
PID 4812 wrote to memory of 3392	4812	msedge.exe	131
PID 4812 wrote to memory of 3392	4812	msedge.exe	131
PID 4812 wrote to memory of 1724	4812	msedge.exe	132
PID 4812 wrote to memory of 1724	4812	msedge.exe	132
PID 4812 wrote to memory of 1724	4812	msedge.exe	132
PID 4812 wrote to memory of 2932	4812	msedge.exe	133
PID 4812 wrote to memory of 2932	4812	msedge.exe	133
PID 4812 wrote to memory of 4860	4812	msedge.exe	134
PID 4812 wrote to memory of 1088	4812	msedge.exe	135
PID 4812 wrote to memory of 1088	4812	msedge.exe	135
PID 4812 wrote to memory of 5620	4812	msedge.exe	136
PID 4812 wrote to memory of 5620	4812	msedge.exe	136
PID 4812 wrote to memory of 4580	4812	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://seha.en.aptoide.com/app?package=com.linkdev.seha
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbc85dc188,0x7ffbc85dc194,0x7ffbc85dc1a0
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,17426065493352520945,717950200088398291,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:3
  2⤵
  - System Time Discovery
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,4432854595382047225,11980232884577360937,262144 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:2
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,1240198996144698355,5670008475967893704,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3140,i,10593137337199422946,12673056379130329732,2097152 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3144,i,4170417394239889393,14520244721030470204,2097152 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4884,i,6430367258302454783,13799055230772679956,2097152 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4100,i,10683986862482477711,16178291914395391924,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4104,i,5480158114760994897,5635731705365379210,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,16868124926453380877,12000235934549503813,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,16868124926453380877,12000235934549503813,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,5461651809491597597,6349945501017098740,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6184,i,9036731973619283874,15161632114269690640,2097152 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,5255677583568070467,17247245932352834856,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6088,i,3406570819628358991,15139402482621603084,2097152 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,53410825289874810,9637077778875914845,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6840,i,4325198588330555352,7821441387801237740,2097152 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7328,i,5169172100725732269,17254885090988781769,2097152 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7248,i,2666631715624374873,17916046723057113685,2097152 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7544,i,8367699963125699406,12916679586277001298,2097152 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7480,i,5464027349631327714,3116779798415031120,2097152 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7796,i,15087894487219088412,14478225270385753130,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7796,i,34411330689566584,18229621201221859755,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7792,i,9935139678799363873,2936430809438691655,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7916,i,16376364519321884824,2562809605909804975,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7824,i,5345280702517277407,12190839856448867107,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=2724,i,16424539399767431017,18321374799083809847,2097152 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,2145626274127714680,206677490643571854,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5708,i,2744954609037933290,2437180805780593295,262144 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,16554287897177569525,11168772337979812046,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=1508 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,8473513893361968375,15115185017558085233,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2800,i,4664664671676100109,1351763747946991862,524288 --field-trial-handle=3544,i,144416302097548216,2263879656092111824,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:8
  2⤵
  PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 1a892d8008f5d594be56a0d7760a70f8530ace9429a7946384d2ae3c32336658
MD5 790fc4f0a49fa7dbbbd0d545cf52b693
SHA1 700571556cd2c24a042df620c61629092818fe6d
SHA512 8dea5d6f8501b9d502f4a0ae4a739c01d77d185c372adf3644ea5ca195bdd43397c2f74c1cb35b4eac530597567de1ca9e2433073fe6e16383529283dd0ea895
SSDEEP 192:/jkRa0000PdUUUUUUUUUUUUUUUUUUUUUUUUUUA/h:/jkRa0000PdUUUUUUUUUUUUUUUUUUUUM
TLSH
T18BF1484787D5E39BAF0950CA4EA0A36C10713749EBECF508139CDDED318E49AEDB6690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5dff0c783b5c554445fb0f88458308aa1ca18ed18e7a6faea19f5ce8b4a725e5
MD5 4dcf4a3d0d93dbe1e671aea4f8b702e4
SHA1 e5b2c8e6f7bdbb3514d5636bceac28574e5e8044
SHA512 bef840b3be91cb99a5847f62d684439a2a5973c3fb4bb2eb1cace6f282026a3f1fe4b006a8060ffbcdb79093bdf41370d0e75010002362cc73ad54cecd66063b
TLSH
T1DAE0268D08CAC23E9301A8874678430CD282364F93C8A91A5B588CA830C1080F7A6590
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 60eaed13d10231432ea4e811a3a99252c9c4f81c2d2676f9b3e7f53047689295
MD5 82ed3943e3077633b472f94ae2c3bfa2
SHA1 2a068ec01e3b4f522dbbb05ae5b0ea777b7d946d
SHA512 76c899180c9c02ecc6e9dc9231d48d76332f942285aced7da4029fb5f6bac950c2a5c74a14f2d9a4177f42d950e7433156c3e3f50694f130c62601ef45213704
TLSH
T149E02B66C825EC372CFE076870194B5AE70113173E40599F3A3C82088FB463645C585C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000106

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000106
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 f545b566b4e9a6af191efa2f4acd3e2312a038fa7bdeda0b236cd914f2914a70
MD5 87a736e66944f6869f16cc6e0ba7d2ad
SHA1 52266f43db950232425ee492911d457da77bb565
SHA512 ac8b7e9968ea9addce3c9dd5d431089c40ddb73cac1769a7d530a16b48e0128a7a4d69cd5f11c277a9ab121b060b210274539fdb4b34417fb00ba45c80b33b3b
SSDEEP 192:KtUMhtVOIfxufCrH0zx2MmyNOQScTA+dX7yxrKOMZVpR1:iUwDOIfxufCrHoVzBScA+qrKO+T1
TLSH
T12722B33984D29074FF74043261EF0A0D74B7DAF5FD0F4EF2684C98B4229BB905AA7992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 4631ec294a220f6581df3968654d6091985d962a2d00787b229a652783b59593
MD5 c33b53e98561b16554182103801c4d67
SHA1 b371110b0c2ba4933171ef5a849e90edaf743d0a
SHA512 08a6049d25c36349306b7f07377d0037b887c0d1a8cf4979a4d24b72169f4a20f25482d4944ceafb3a66f9dae64cc634a48cf59e7a6a3f65fa3959c09453aee1
SSDEEP 192:CvtUMhtVOIfxufCrH0zx2MmyNOQScTA4dX7yxrKOMZVpRU:CVUwDOIfxufCrHoVzBScA4qrKO+TU
TLSH
T1AD22B33880D29074FF74043261EF0A0D75B7DAF5FD0F1EF2684C98B4225BB905AA7992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 663dc6e40399b7dc8faa02fdaa706288e16467d0fc906c3165167a38caa0493c
MD5 2ca257787bb4cf4d2e5fd5ed55cd0d0c
SHA1 4a87488a92240a0137f83297d856054c7ffa4fe5
SHA512 ef0ae796e99e54bf8eb95c7ad3e51b5ef30d4f13c2a743832439fe2aa60f167c65ecd1bed25fd5d01bc6623c748163e512bffc4b0748c1e5266f25cfcfe1d677
SSDEEP 192:gttySF1/z0DsuspEneZNpwHx33cXx6oxTm3pEUCPc3K:EyUYDsuspEneZr41sXYoFmZ0P2K
TLSH
T13A12923880D68075FF60003261EF090D75B7D6F5FE0F5EF2685CE879225BB905AA79A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58bef6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bef6.TMP
Size 3KB
SHA256 216a7a2884a5d723df59cd777e8930050de4da715beade72c167efda2cc194e3
MD5 a4450892f08b815a2312beeb28a5ca65
SHA1 9af981b60af603c30a5d1eaf993988e00b48dc66
SHA512 4dfe63b6713d40dacf4a02315a932837df17655328a4cf2d3184593fddaf61aefa0f97a69c529f6240990c3cad1416c6a9c69362dcc6b238aece24e409b937c8
TLSH
T11F81B57549D352A9F360413381DF054CB8B7CDF9FE276E916894A8B1272B3B181ADA21
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 17KB
SHA256 92ce295a4179877a814824f572abf1283bd5bbac2d5acb540fdc5d01f872ff2c
MD5 4fb40d5184602018546b855caf803247
SHA1 fe0ad4f9e117da6d6cf510da4b3ed615565f8b6e
SHA512 36069a49acf8e382112dc24a2265732ffc5ba7b3d12bb5f217331c1b68907f5b47af64f4dbdaf28efc7b3c31cf62633223c82886697fd92d8ca0d813e29d2de8
SSDEEP 384:fBuCLjAPRyayao4CwIVCnIxIKI2IeI2I/IVIeIud3x7bhkMkMA0ix0:JuCLjAPRyayao4CNCCd3x7bhkMkMA0iu
TLSH
T1F5829A21B5F8161AF27B5FBBA4B61BA55C7ABE462D04D81E6860620D4C31F40CD73F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old
Size 345B
SHA256 3c7b0999f7010f2d8cf0eef9015770e039551854a89c1b8fabd7dda331766aa1
MD5 25b858b69713c256077b68eedc2d3a4f
SHA1 50413cc81c151d158597ad2d0f1f40d659f81020
SHA512 6d36d5d315d334d0c077dc88cac9690bcd89cce484f3121c9fc3d2421ec12dba2b55f76509f21bac3ddfcaa6e6d8b2cbf6ac6e2120c01540e0e02f27fa0e337e
TLSH
T1CBE0687988C9C21BA20010D24434FB0E96A7220B97887D850E4CCC547047044FD7E191
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 42b2e4691de053505097b55b2bc54229b39e6d99ce4c66eedd099124508c3ae8
MD5 592110c87bddda8ca25b7e77aa5895ec
SHA1 c9b1232b5c01e88427fe86e651a1b146dd1df656
SHA512 d6790115c23cf206b9ac13ad12eb044d94ca1667410f258a28218d1c76ea23fccd9f8e9ea794149e558f1842da1ff7453a6addfaedca36d1a9729eaac60c6b62
SSDEEP 384:D1WKsRszsDs0or+IbygMvL6fMHDMkaaiGA1sD5sUsDtsXsXspsisFs4sNsTs0shE:8NHYaESBLRE
TLSH
T18E628EF7C7E4862DCC1162F4AB187E1FCE290924536C3D6A85D4AE4BA3E54B2E18174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 55ab685898d175ad3f9b74d43f6eaee4e9a57507a693641b732adecf0927e28a
MD5 bdd05fd739082d813ac5fa77bc7a31fc
SHA1 d0d2f37a39b1ee062a0779d02756cc32b96bda9f
SHA512 0c2c4088080e9afc2c800e1a4a77751d8f89164af38ab653aaa2d443e40a743ef84bc8d3473be28d090d169fa3e7e71c8d3bfb95f2f2e0353b5a4ae39c9a06e8
SSDEEP 384:D1WKsKs7ses1MwMih0A/WrxqhDY1OaaiGA1sD5sUsDNsSsXswsisFsxsNsTs0shc:8eHYnES5BRqP
TLSH
T12942AEF743B0862ED911A2F49F187E1FCE690424536C797A85D4AE47A3F24B2E18178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 11fff7a0364d56d528ba0bf9eb206c09453d91ea13f86799cc1cb023905211a2
MD5 3a75f0432cfb642223f188a2a350c675
SHA1 51e814ecd1bf0531caef767e11a8505e90982e95
SHA512 53a5469a4c41c2bea3d6fbdfb0b40a16c49444581eb40ae56d351971077e8606221972e536075cebefb103d270dcfe886ad32de26fd38d8c72918ff89068e5c4
SSDEEP 384:D1WKsRszsDs0or+IbygMvL6fMHDIaaiGA1sD5sUsDtsXsXspsisFs4sNsTs0shsW:86HYaESyvW
TLSH
T18F528EF7C7E4862DCC1162F4AB147E1FCE290924536C396A85D4EE4BA3E54B2E28174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 dd4346de8657c6335700d6ef88b9c8f91a7b0c8c8e78d2182bd9ae0f78ca74b8
MD5 8b65e0dbf911b5fc12a74c03d200fe21
SHA1 38c31e96e89ba6a537c5fe538c537090a1da92c7
SHA512 b7cfe2a0c7524c964b3f23976eb40f2fc1edd136b99f06dcfef46cf7d98e89069d1b42c03439f12d462da6a517ae89b3a078601057af7295e2f92ffedc74d089
SSDEEP 384:D1WKsKs7ses1MwMih0A/Wrxqh1GbraaiGA1sD5sUsDNsSsXswsisFsxsNsTs0shP:8hHYnES5BiUh
TLSH
T1D842AEF743B0862ED911A2F49F187E1FCE690424536C397A85D4AE47A3F24B2E18078F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 cdd8a35c4efad28bdf97978f210c651328cfea7d4a784fe6dee613ae5305a2aa
MD5 bf020e06fb16c19619321bba767b6ec1
SHA1 c033d3acc4a6a4de6a15ae020b067c05ff6a01d9
SHA512 aa7152a3a00b47496f568d5b9629a744a8eabd30cba0b228fcb649d08fa13960c561f2c2d176e76e37768015598516bd064fb4cb90f8362d7d54a050888cd126
TLSH
T1F3D02223A600F0F6A6FD7E82606AECEFC32B00300802EEE822D098DE0533A6C0547284
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 ea6d7c029533a68528a17fc1dd284388148b91bfee53b00bff5a9bc542f78479
MD5 a37aec196039fb38e4dbee743f01c004
SHA1 a4f766ba99150edc0a2d69202665cb7199383605
SHA512 b2ddc8d5f32d1489d95b97c76f7e7572d125878072fe3bd1f9fd7328766ea0ba111e099df5375ea6c0f8aa5715997c79061534f56269d15a38d6cfa6f0d5508e
SSDEEP 384:sxZxysm4i/fksu3zyh2HbDfpbxq4/wgDxui6w1:sJjm4i/fG3z9HbVcqwKj
TLSH
T1D0A2D7476924997BDCD7C219F961BF52D2B80023DE954E4C9AFCCA0C04EA6FD260386F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 ae0f5cc09a978bebee2648afede4db8a19d1addb299b21571c99b1bb2cb6c093
MD5 0a918c3d4ebc77ac21c2820883eb3bf2
SHA1 38fd358db372c399aa728df3ea2bb83dbbebc420
SHA512 9b22a1b7179f35e2a8541099d7eea07f2caadbfbeaedca7cce72c9d6ce71aad0fb57cea053d1d62cbbe9cd8e5bbf4580a1314a2f219517c3389d9ad9414a1cec
SSDEEP 384:sxZxyqBTm4i/fksu3zwA7uHbDfpbxq4U//H4WJNTgDxui6w1:sJdtm4i/fG3zwvHbVcb/TdKj
TLSH
T118A2E747A524997BDCD7C119B961BF52D2B81023DDD54E88AAFCCA0C04EA6FD260386F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 480f6f2f033bb692e47bf8db50bf02157526694112e50d2f326013b6faa1f6b5
MD5 c10b316a6c191c0237a26e4f7ebcaa35
SHA1 6fa5b8a0e1b12076adee171e91e4ceb353893e85
SHA512 a399e4dbcf5bf47ae95516ffd9a5215f228b66570c9da5541a82a0976e623ed56537495ddbfc16e68fcbc17a33e33695aace8e0308be0297f8b727a272f680dc
SSDEEP 192:sxZ5RhyMqZjK1Ml8M9i/fkssdmaZdkzodpiByHW6+WN7OFBglhW/YvdueGc3IgjY:sxZ5y1i/fkssdmazXzHb7pi/FgjY
TLSH
T10F62E806AA34997BDCDBD219F6457B53D2F81163E2905E44AAFC8B0C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 955ade6ed064f416906d829c7ad4616ba32939e115799856102df784539201f5
MD5 c1b829c031bb1af2c242effc551fb2e6
SHA1 96ed8fc0ea251c85082ffd647e31a9334290e080
SHA512 6f4ec6386b026c45abff29d5c54bd58cc55cd4ef05659b322a2079937f6e66dd9c34c83d6fa6ac8b208f3008337b1ab510db0742c0cf9f5559a788d7a11c2651
SSDEEP 384:sxZoysm4i/fksumazyheHbDfpbxq4/+gD9ui6w1:sQjm4i/fGmaz7HbVcq+Oj
TLSH
T17092D70766248977DCD7C619F961BF52D6F80022DE954E4CAAFCCA0C04EA6FD260386F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 69690d2198cc306427fbb8202494acb3e58ca790c539ab8396a31bbe3545a3a8
MD5 9166f7b9794665be027a1291532d1ec5
SHA1 48981e4fe99bb26e05e00212afb0383a9fc696cd
SHA512 1519e1ca6e5e68d98f9a18776fedd7dababef57a24ac9285707effaf4f10fe9913e2555e74f75ec093c5981b2a824ccf2c42231e4e98c2f38b6983b65a1cb30a
SSDEEP 768:ZYsv8Od/hWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQro9RLG:eY8Od/hWvFvQXu1ja10Lm2Nu/S
TLSH
T1F8E20C3B284CCB7E4F840E9DEC26AFD66DD801CB66984D5447FA884C02C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index
Size 72B
SHA256 1e0fd2a562a181639146ca93713674606fde998251cd1e207d5fd410d805efdd
MD5 4ae3ddf0fec1c2e27fe87e22525352da
SHA1 8b73e9fad584f0ff585fd66598092d6a93f94a71
SHA512 09fcb825b252782d248bfa155c03482c976b773f95baa0f335deec1b2ba3f9bbd20f2390fea52a2d94d606da00f58524561f641212d0ec457b262796ab0f5a98
TLSH
T1D8A0027015B95447C58146B4D25202907795DC960901C30B4C9317558C5125CC502484
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 2KB
SHA256 d538d0ab47cc6f386f7d987b5c520f6b820de6e2dd885e3765975403f6c3e76b
MD5 e86ea6dcdb1b88b3381a43766a661fbd
SHA1 0ede140c63975570389817f985300289f413f2a7
SHA512 0da9de9edf0cb50b83f9c5dd492f8ea01866a0ea9c4fa83a27f4011ea01fc4126d8cc59a9db214accf2ec311b86db93e38614c6117acf39c8598c504b1ea056d
TLSH
T1EC51C70E4C871A17DDAC22F364FB04C437B1A4DD66889E1B74DCA134ECC366E2DAA625
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5890f0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index~RFe5890f0.TMP
Size 2KB
SHA256 83737217d420d7b8765275aed22a41b3096371516df87c2bc28f62601a072b59
MD5 baabd1b7a3c829d528352c71ac091042
SHA1 3bd3f912b04c055d684065730a2c5dfe3f5ffc76
SHA512 1667867e48632b1f4f2a9991128d66f063c870d58744ed22e2c1546ceb43ba4e5f882c4e4da637a8e022309334aeb768b32b3b4a9ef20ee79d80946e2e0ccd1f
TLSH
T19F51869A4D424639E894417709E3A4A4373919008719BF5374FC9632AC927AE3D0E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 066db70e606cdc0a8197fd01b9e80b733cd079d4bd45bba2f2d6c7e668212a96
MD5 398a8de416e976d8b0ee9fae1bf7060f
SHA1 f0c136961862fdadf87105e63c55f93aa3bf6ade
SHA512 5356ab13cd430e0b85b6b17d4e95c1fad748157f737c9125373844143847f20873ecc54cece34cbd01d712b8d97115ca4aa8cbb389607680d9dcf621a2d0f29d
TLSH
T1F8A002500BD04421C04777B02D93594163548D7813052345419B0045C858546426600D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586b67.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index~RFe586b67.TMP
Size 72B
SHA256 c1824b825797f5c51b55b96b99bed753c879261583830b675cee66b8082480a1
MD5 f97ba7e3ee7714ed660c7f4ec33e0dec
SHA1 237f201e3a500bc01d57afa6e2d5503d4a352acd
SHA512 31a355c8eb9b8230c795db0a4088d00bb78a499b1783cf0c753a4cb977902f707b951af1df6e5b72f5b8fe288492de68992a725e39293a52fff19baa1aea6712
TLSH
T1F4A002146B864106D76A22B21652369352009A106A802206409903C4CC55441954500D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\eba1d81a-1bb3-45f0-848e-38f9106cfaea\index-dir\the-real-index
Size 72B
SHA256 55743625d768d5577aa714f522851da4256844bfa7d5be906f129acf1229aa7c
MD5 d30e47f18256e974c974e1c4faec17cc
SHA1 09b3605831a044f6a1bb4d87ddd64c95a5d92c35
SHA512 5bfdff304e5d336a63f506a78f87f71fc609d06324db36a008ae474d8e15120b963527e5d579344c930567e51e25a66911135bb15b82c3053146c55014466ac7
TLSH
T14CA0022D01964605F39543722479C650379189B025E2264B87B310B4C850244C10358D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b512.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\eba1d81a-1bb3-45f0-848e-38f9106cfaea\index-dir\the-real-index~RFe58b512.TMP
Size 48B
SHA256 f0de24eb32bb60ca862911e808541b0e21537764ad8fb08a5961478e47542430
MD5 2e89f63e3826b1c8bc090a6f54405adb
SHA1 8fe4d553fca065df7bf9c76a16bdbf4b0ee9e719
SHA512 d92d121e8966fb0e803ffd6083abc89ce09377c01f0b7d412fd5289daa346bc113f736dfd241b6778767d3e88d28b7088968b9a9f2275e0f8d18bf372a966fae
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 d642953d134f0acb2748753ff9122656fdf9585fc89358578f018a537f87689c
MD5 1292850fbad9786ccd6d95d37ef89bf9
SHA1 806535605cad0323187c007f7e35eb41ca2fd005
SHA512 47d4f70da243141f81d29b68c9eb6a1d37ff6deae809362cea8b87f732ef611ce175a3272cb14d8e41232e0521aa6ea9bb4878259c2b88c872fc01dd9ff34c39
TLSH
T14AF097733FF71818FCABD3C62030586000097D448440DC0F2416B2C760B132D245DCE6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 7a723769db4b1c523e0eacd4d0cadd1fd94d0bb5f44c919b38acbcefcbf8b9eb
MD5 a63d94889381942791c572fe01f198be
SHA1 5b23fa0fd599e3790d40d2273a1b01a5de5b1345
SHA512 a89ee881fab8f99fbe645eeb2dfe5a18af7ebd048a7138c4b75f7b7374bca809ca1edc776e941bf367c35e50875690945e3e657701b74213e3a6c1091c26d308
TLSH
T15BF0E2B36FF71858FCABD3C721305865000A79548454DC1F2416B69765B1329245DCA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 722ad99490fe19dcf576b2565dee09d9884d651a1fefc96274593d312c8a27f0
MD5 511d92cd588b85fcacebf5e673096755
SHA1 b8c01fb9efa66b0bd62fc92ed19666b8a61c4a33
SHA512 38def36bf2c7dd82fb8cd4c16e3f524e390ef0b330371e696edb7159842d134b4caf489f7ddfa38559686db3bdc15c508a6be0c88ab4be236b4b098a96989542
TLSH
T1E8B012004C1D6099C06D037470C240A820286C981709102240AD01A440152240152404
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5893ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5893ee.TMP
Size 72B
SHA256 d69dcf8b9bba0fd483ec2ac3bece09f63cc29f5e2a7602ec26d467c2ad356fbf
MD5 16addad6dbf69c7ba42dbcee0442d10e
SHA1 0c5e5912a84f2de63db5c63191da494002cfb0f8
SHA512 044d645f86b286fac4d6be401e3a814c0a4a42c019b1b78147f30c1ef2d0f1148090605d2121040a410af1ad845a84fd2a3c34fec7cce13a4258ed7cad2fe492
TLSH
T123A00216824A6448C45019F1100F2271D750CA9D23401B0A45E0B09CEC918C455B564D
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ae371928c30049528b5a7277e58af174909baae87fa68b92f77dbacf229768cc
MD5 7a1ea0be17938373b5031d2bc2927494
SHA1 0433de26b37aaaa7a0d96e423ed723264f42f8ac
SHA512 8a9dfeb851bdf7dc4209b2e7e0dc3b9fc345b74157f81a29cc9c95ee0ac388768044b23235ef89b3cb26b10f9869cad448b4c95ba37fec6a8998fb06e92a34d1
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGW:05ppxnY753RNBvRJJdt7p5J9Vlfq
TLSH
T1B4B28B1A713F0212397E2948B39696364F4235A37058E4AF7FB814A54F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f4504129495a7aefc186cbbff1a4f40efa8e5840e8222782cb6cf87a7211dc77
MD5 3d907e12a6d5a8a29dff3003813dd090
SHA1 83b911a982bf5efe9c47fd2faf89903331fa6394
SHA512 52af1ecee78efa758282d16c167bdb824f9cec7715e308aa359e877596dbc3bc301fe55cd6009c3a1deca037190ddc3963aa34c2328e0f0ee822a1ce78086927
SSDEEP 384:npHiFPZcIB3sNj8TUNTUlI4ATXckCraIbphBftGnvQCyZOObjI9G6w7HVty/7IgG:pCFHB3Kwgekg11GvQCyZ29Ml
TLSH
T1E6D25C36EC64D9BBFCE74B95B68A3603AFF04163C6DC5AC4E9D85E0D00971AD430B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 014aef3e5828af95a287cd33177aa7f2546c5be6fa0ed6c47f3930bd755915aa
MD5 abda0aa0aede85da681a9f7ddcd3faa6
SHA1 3e53879192b9296db37ac40a1c5816b709e1cbcc
SHA512 719d06526dd14f5f2c3977c683b0478d2d9d38af6185bbff6b58389e0617aa4b69459650bb3b2fab59ddf60615e4c0f0916eccae9d1d2797307ac232ea5853ea
SSDEEP 384:npNiF9CcmyWCs3sNj8TUNTUlIm2QckCr9lWKphBftGnICTpae4KV8p0mHpty/7Iv:pEFccps3mwgbkUkk1GICcI8p0wd
TLSH
T1A1B25C36DC58C9BBECE74F99BB4A7A03EEE4126786D899D4DAD81D0D10871DC070B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b88af9b7e9b2a443a757f5dcae818c67b3b66636473b0d10381fc365f0668c4b
MD5 dd5baf9c1443c59f691bbe3ccd330315
SHA1 96f91565bb8536385b7fb5298d151341164608ca
SHA512 832b0718db5703b2ceb6fee043b1bf7de927529d63c9a066a08f27838f3bf2fd315d1ddc50c1093a52a0ee65ef0120629c2d236bc3dd20e33444f0e84dcb87ed
SSDEEP 384:nziFPZcInz3sNj8TUNTUlI4ATXckCra6rphBftGnvKjCyZOObjI9G6w7HVty/7ID:eFHz3KwgekCF1GvKjCyZ29Ml
TLSH
T184F2C4F698D78976E8AE4757A77D2D029EFCC123B6885584B7D81D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 294527eff2043bddbe533ab52c8f420e48606b57c3be7868382c242431f9f200
MD5 557d426312b2d8bd5bb33536c2525e93
SHA1 4268610279e03776eb4d29db5c61753641c274d6
SHA512 7eb71c0786e2da577a928b981fee7d43092fe2f34ceb2ac44c3f8515cc1a998f68b2dd5bb51310adaa22db875b5f7db1982c732ea3305bc2a11bd2c6815a7b88
SSDEEP 384:npHiF9CcmyWCI3sNj8TUNTUlI4HQckCrdMvphBftGnvsCyZe4KV8p0mHpty/7Ig1:pCFccpI3KwgUk3h1GvsCyZI8p0ww
TLSH
T1D2C26D36EC68C9BBECD74B99B74A3603DEE0416386CC9AD4DADC1E0D10971ED470B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b69cb5ea91fdaa0f6de184959f7965d62193a4be12bf268cea82e4b86eb42a96
MD5 0ab1959a5f09dd30fff84322a1d140cf
SHA1 494276ba9a250f6c61ac8a040fab53f92a4d4fa7
SHA512 062e91c83531398838f8857da06a44a509a030b87a782f973059e538dd49f0dd29c621164d07f644718c1b1a02821bf006f904abcc3fefb2285124b5c4a6ba8d
SSDEEP 384:npxiF9CcmyWCs3sN38TUNTUlIm2QckCr9wSsphBftGnvACyZe4KV8p0mHpty/7Iv:pYFccps3awgbkUX61GvACyZI8p0wd
TLSH
T1FDC25B36E858C9BBECD34B99B74A3603DEE44227C6CCAAD4DADC1D0D10971ED470B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 db78822c56fd26c6d12b86a30d29974675e5c96fc6cfe02fdcf06d0e0d198922
MD5 86bc83089df577b6cab6ec64c23a0837
SHA1 086f88f6f17642f4c171de382514eae7c0202b52
SHA512 bd6ee1dcb551f5e77d6784f691919b1a2630efad6feec24bf18982a8a7c60b836e1f9f0aac63e8fd7e3976ce17cb3e1a20331ef3b50f2af921c16875a660a585
SSDEEP 384:nMiFPZcIB3sNj8TUNTUlI4ATXckCraRbphBftGnvQCyZOObjI9G6w7HVty/7IgG:3FHB3Kwgekp11GvQCyZ29Ml
TLSH
T1B5D25C36EC64D9BBFCE74B95B68A3603AFF44163CADC5AC4E9D85E0D00971AD430B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c6bfca87da0a24f9c5458aa22938877944d62ed58e4142d0b6c4253e16b20f39
MD5 e14e04b3a175143a13ccd62829634ef5
SHA1 6f4905ddf988085e5d4d33d3936dc7d2bd82ec04
SHA512 38d1332396bb6cdb23b9e93cf699bb819acac882998b9ad5099aae8e4bee687df54ea03fe571164d15e2bc0c0c47b190f96f699d28c5ceddc7c37b97e55d32d8
TLSH
T1D7E04806430140FBC02C033601C30B243EF2842043F301021F31093D2C2A3507E30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c13fd1931cfea346aea1099f749023c09a9313c2339ff23198584c95d95d84a1
MD5 28b1bc367cee148c73f546a3bf8d2046
SHA1 c0e379cfad30b449c4d2f729a3e9efe33f8edcef
SHA512 d0b0576ca655d1687ce21a2eeda10d666106f071073d252a95b6677b8664e90a10a5e0da2e23d200dbed80e58d14df12841ba69c59b32bf420cbbb2ac1c80a4c
TLSH
T10DE04806534290FBC82C073602C30B293FF3886462F306020F3209AE2C3A3507E31F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 09e6345e1472e50e0da381401d98469d9d5c398c4fffc2a1bdbe13d61ce122ab
MD5 3d81b77e14c2a89a26aed88388adf148
SHA1 a07c737f9a97b82eb9549333d27f7ec951422194
SHA512 d9169a72013142d4d05e55ed3ee380e0374bc4aa7eb611914656ec9b4b6cc8ce89fb0678e25c6b2db3a37cd6c6f02836bc7672e241fa39267cc1ff87ea5fea36
TLSH
T155E00106534294FBC86C0B7602C30B293FF2896862B302020B220A7E2C3A3507E31FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7ee13114c06271c5b21aef7dc7af87a70f2834a7445e798c7456f9196b3dcf7c
MD5 075485fe37453f2655dff6639ec5c17d
SHA1 1eb3eaebd33d97875b72625a36e47851f1c7dcdc
SHA512 fba5d384bcdce0237e594006d2c076c5ea79e92d8f6e50176c17f57962170d7fbff28dd21f9490f8b258a28a242b16819e5d1428e5f673f2384de38ee903e599
TLSH
T15EE04807434180FBC02C033600C30B242EE3847042F206421F31096D2C2A3503E30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5e4ff12f67dc3529a783ef5e76ca177f81328948ea207e2f136dbbead9b8cc28
MD5 ba2d9720d3a390d03fea5b34482bba91
SHA1 2c3d47ef1a29973d92b33cd986129ebb0b932567
SHA512 1a37917a70b4d57db583d5041924b5c2f4408b82e1f25cc39023874dba4ad75abadb4cbd1269c09e20af5b089548ab8ba607894f76ad7ddfe01f57cbf761549f
TLSH
T19DE0EA16534144FFC57C0B7511C31B393FB2896856A706561A22157D1C3A3907F21BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c0e7530af4834891ee2c11b295a032fb9cd434ebeb0896018c4909c3b50ff03c
MD5 c1a90e262d9d3e36e1bde9edd805095c
SHA1 4a59b91fdfcd7c12c2df72cfc9ee8568bd5628fe
SHA512 4c40adfbec363e23ae878519e2860582a3e833725df35191425f7cecd2e03a270663337c43f9be508f933c6d50bba76f1fa123f9f952666d52ad429aafad0043
TLSH
T1CDE00216534154FFC46C0B7512C31B393FF2856857B706020B21157D1C3A3507F21B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 978d99fd3041422aee98a49ebd92d715d47553b4a1b1e91129ce128f8fff80bc
MD5 1b810267bb870686f91ad5aaf1db229b
SHA1 293a03080992d6074098d9fcb1e07bf0beff3f9c
SHA512 8be659c35daeb3b12eeb462b60ee3544a44004fc27aadccf560fbfe2cd775512c205750b3657863dfc591fab015bacb8523a882c88d29236ae04b929d3f68769
TLSH
T1D2E00114934680BBC0AD077A41D35F283EE2886096F206565B36197E2C3B7A47E35FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 473deb9b4fb3b9246315df15a8dbe6ef56c68aa4b5c2814de5fb514e26cd6133
MD5 a1a885e751a2cc49899e5ab6e4313144
SHA1 483c31b3d8d8f27a17e5d20ef6356c24b0d79d7d
SHA512 915b17b6bd7cada68ad9b8f48f56c95ce1ed03aae1988c014af518afc686be14ae7db3096ac8fa578532edfaf94a0b33e905d43fbba2307a19fee6e7aa38a40b
TLSH
T1D4E00206130100FAC06D077901931F142FE2C46056F207465F30016E1C3B3207D30FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d94ddb5db91daf574442c5f1803a667be45daf07c8ee6ce680767c941784fb02
MD5 fa122add05c85fe3e5192e3e9b2126e7
SHA1 67d0007241b7f8aed745ceef116bb9a66eee0e8f
SHA512 239697701a3c562448a9793b0d2c76796f09c6d72948133e62d09746941de0b2e6426cb653716e3770e8d4346b615265476b2e8514f95564ce78c5ada6835dc8
TLSH
T17EE09206430140FBC06C033500C30F242EE3842082E301021F31092D2C3A3507E30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 980324b9b34baf8196eff480d77e28be5bf4d69d934fa15da533d320946337f0
MD5 92715b24dcf926c85d95fb3146497233
SHA1 566041ae0f13448500ddaf2fd37263d8b9a8ddb4
SHA512 fc93e296afa17584f9751f2cb978559b6f7570e60e812b069a4bd82be487651db6d9bea930d9800a0e8d5fb4b0326bf742561a7f5dd5b95d146cb5ab0a07e2b3
TLSH
T195E00114530500BAC06D077A41935F243FE2886056E206565B31156E2C3A7607E31ED0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cca80fce411a0a140fcdc7b579731c2b83bfc1058b38f83800c4f8674c7e09a5
MD5 4f636a6410f883e7e40509a7f9fda379
SHA1 e302b31f20837e0a354bc9a1a7089d60c9b46dc8
SHA512 1e6a896a84a2e0d21fe794c60cef6a7772e8fc81b15902670821ec845afff9e1bf706767798432f5bae50eacf4a872f9f23a487b29dda20944d7aacf03dff17a
TLSH
T1D3E0EA16934144FFC57C0B7501D327393FF2896857B706561A26157D2D763907F22BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe583bbc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe583bbc.TMP
Size 392B
SHA256 e279efce9445a596d479e8a2cef5feb0b306b78d15288df40e32b994bb56bf99
MD5 9e22fcc21207152587a65a4ef842f524
SHA1 fb47e44721305e9ff2f660a43fbe967aab5aa5e4
SHA512 f901933906ba56665ec7ea280b90e3c1611a04c3d6839457011f70f4a6a9b07d540112ad01316efbd4b5ad7486356a707be78a7ffbf7a120ee56ed906c20c6d7
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 52cbfb0ed98549a6241b39b19c96f85b247b311b0f1144f02017e507c61e685f
MD5 f6e7ef1d48001913cdf1d5871b2396b1
SHA1 2826be126227dda3512badd9d44d55af6f118c27
SHA512 a8e201ea96b33ce0ff1eafd7e80fa340e611cd117d04bbe2e28097ce3df894a4ccf6196ff4f334b9275785150f832cec253612c98ec182502c4392b8b83ae8c7
TLSH
T1FA411458B6E91248B7B77E5A9BF6A96D487FB8732F06949E00100E4F0A22A00C871733
MD5 SHA1 SHA512 TLSH

Submit Download

seha.apk

Path C:\Users\Admin\Downloads\seha.apk
Size 19.1MB
SHA256 188bbdb899be2da401ac0471ba4d10693612fa1067f2ea0987cc6e1afcfd4374
MD5 2725e9ae81839a4ae69f8f362fc4d7e1
SHA1 81833829fda154b743addf3572889d96f95fec22
SHA512 b0cb4de0115f9df055e03f78e18bb9c7e9e21e8006773caca342a086aa8a1d03a29620bd495d1dce1dc25ad847a061bc9b8cc3d3445937f25bc1491bf61df1df
SSDEEP 393216:nayGdcgSWrwYegLSs1TjD27YnM+kI5k5pY9mV+C+EiR8:nayGdSEwQn1P6YnN5kkmVWm
TLSH
T13717028BF32C942DD4B71572C855213266664E21DB06E79B281C3BECA8B3AF58F4C7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download