hxxps://bzzhr[.]to/bmgj6wgdfyw6

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bzzhr.to/bmgj6wgdfyw6
Sample260802-s644mswclf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1736	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301591735512125"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{138C48CB-1686-42C3-B219-48307C072F04}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
916	msedge.exe
916	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 4896	1468	msedge.exe	85
PID 1468 wrote to memory of 1736	1468	msedge.exe	86
PID 1468 wrote to memory of 1576	1468	msedge.exe	87
PID 1468 wrote to memory of 1576	1468	msedge.exe	87
PID 1468 wrote to memory of 1576	1468	msedge.exe	87
PID 1468 wrote to memory of 2732	1468	msedge.exe	88
PID 1468 wrote to memory of 2732	1468	msedge.exe	88
PID 1468 wrote to memory of 2096	1468	msedge.exe	90
PID 1468 wrote to memory of 1316	1468	msedge.exe	91
PID 1468 wrote to memory of 1316	1468	msedge.exe	91
PID 1468 wrote to memory of 1316	1468	msedge.exe	91
PID 1468 wrote to memory of 2096	1468	msedge.exe	90
PID 1468 wrote to memory of 2096	1468	msedge.exe	90
PID 1468 wrote to memory of 3920	1468	msedge.exe	92
PID 1468 wrote to memory of 3920	1468	msedge.exe	92
PID 1468 wrote to memory of 3920	1468	msedge.exe	92
PID 1468 wrote to memory of 1592	1468	msedge.exe	93
PID 1468 wrote to memory of 1592	1468	msedge.exe	93
PID 1468 wrote to memory of 1592	1468	msedge.exe	93
PID 1468 wrote to memory of 4208	1468	msedge.exe	97
PID 1468 wrote to memory of 4208	1468	msedge.exe	97
PID 1468 wrote to memory of 4208	1468	msedge.exe	97
PID 1468 wrote to memory of 4488	1468	msedge.exe	98
PID 1468 wrote to memory of 4488	1468	msedge.exe	98
PID 1468 wrote to memory of 5004	1468	msedge.exe	99
PID 1468 wrote to memory of 5004	1468	msedge.exe	99
PID 1468 wrote to memory of 4884	1468	msedge.exe	102
PID 1468 wrote to memory of 2244	1468	msedge.exe	105
PID 1468 wrote to memory of 4512	1468	msedge.exe	106
PID 1468 wrote to memory of 3432	1468	msedge.exe	107
PID 1468 wrote to memory of 3116	1468	msedge.exe	108
PID 1468 wrote to memory of 3116	1468	msedge.exe	108
PID 1468 wrote to memory of 3116	1468	msedge.exe	108
PID 1468 wrote to memory of 3736	1468	msedge.exe	109
PID 1468 wrote to memory of 3736	1468	msedge.exe	109
PID 1468 wrote to memory of 3736	1468	msedge.exe	109
PID 1468 wrote to memory of 4040	1468	msedge.exe	110
PID 1468 wrote to memory of 4040	1468	msedge.exe	110
PID 1468 wrote to memory of 4040	1468	msedge.exe	110
PID 1468 wrote to memory of 4664	1468	msedge.exe	113
PID 1468 wrote to memory of 4664	1468	msedge.exe	113
PID 1468 wrote to memory of 4664	1468	msedge.exe	113
PID 1468 wrote to memory of 3040	1468	msedge.exe	115
PID 1468 wrote to memory of 3040	1468	msedge.exe	115
PID 1468 wrote to memory of 3040	1468	msedge.exe	115
PID 1468 wrote to memory of 1036	1468	msedge.exe	116
PID 1468 wrote to memory of 1036	1468	msedge.exe	116
PID 1468 wrote to memory of 1036	1468	msedge.exe	116
PID 1468 wrote to memory of 5056	1468	msedge.exe	117
PID 1468 wrote to memory of 5056	1468	msedge.exe	117
PID 1468 wrote to memory of 5056	1468	msedge.exe	117
PID 1468 wrote to memory of 1636	1468	msedge.exe	118
PID 1468 wrote to memory of 1636	1468	msedge.exe	118
PID 1468 wrote to memory of 1636	1468	msedge.exe	118
PID 1468 wrote to memory of 3900	1468	msedge.exe	123
PID 1468 wrote to memory of 3900	1468	msedge.exe	123
PID 1468 wrote to memory of 3240	1468	msedge.exe	125
PID 1468 wrote to memory of 3328	1468	msedge.exe	126
PID 1468 wrote to memory of 3240	1468	msedge.exe	125
PID 1468 wrote to memory of 3328	1468	msedge.exe	126
PID 1468 wrote to memory of 3328	1468	msedge.exe	126
PID 1468 wrote to memory of 5496	1468	msedge.exe	127
PID 1468 wrote to memory of 5496	1468	msedge.exe	127
PID 1468 wrote to memory of 5496	1468	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bzzhr.to/bmgj6wgdfyw6
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffd3431c188,0x7ffd3431c194,0x7ffd3431c1a0
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,3410687482961480532,12804524089567173753,524288 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1792,i,15297489107779506997,9482118175813756590,262144 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,10485562218784217175,5424502104485365734,524288 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,5974357222944976219,4491294236759670399,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,9042927461172213976,1933168479493169827,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,11612735514107946800,13112861861762365142,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,9915288518024306056,2286674795092247803,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:2
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4672,i,15377431247446716845,4742927209624001274,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,16381314769577772338,16432444216527885922,524288 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,3303638599413477477,6389135887361537789,524288 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,1322721175294995921,9221008613049063391,524288 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,1322721175294995921,9221008613049063391,524288 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,11475428527200651851,17165831338799910791,524288 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,15386751775287022016,2403217613421944737,524288 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,14217738069927088254,4579678986794016600,524288 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6256,i,7917106894303586033,4371815476081826250,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6352,i,2066157629934329199,3003396393210662106,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6816,i,16724700215598694032,3509305649355169054,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6888,i,14278745309463940644,7125708975741765032,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6932,i,12915478016493191449,13031854194216514616,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7012,i,7547196180746283347,18048659294370425966,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7136,i,8406836642313362790,16146755431508871068,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6648,i,8219223179681311299,5575362152571235674,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,7065843594072120903,6562488556920597560,524288 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7448,i,4282466125654548965,16867286968902260679,524288 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7452,i,12004035646398437089,15153418507743789258,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7492,i,15034837320767108140,12985250589256881190,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7388,i,1765357849669348247,14854420393384964082,524288 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7892,i,7104372400201416199,3873713119401553807,524288 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4252,i,3987777751230441969,10288681603946186219,262144 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7504,i,3202227182357400333,18085179406304097519,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7584,i,10578808459256771871,5793121405737315599,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7596,i,11955425238479503048,6751927441786734009,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8200,i,3118749839680322565,5574611852819797797,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=8196 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7512,i,12776242877880386705,7765193178489637455,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8428,i,16449527978622547050,11636818481107064145,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=8436 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6528,i,18184874871129953892,9190407066138981537,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8580,i,3859367830419609917,11421584515820196937,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=8592 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=3088,i,15701365754761835964,7674270079157990873,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5376,i,12972778267121873901,6150999439902961967,2097152 --field-trial-handle=2244,i,331175782240003833,13454698443536380494,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:5372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 88b16d3840dc1dc65205285943eab8668887984c4333d1f2b353b948b778ff2c
MD5 42c96a13171d9e6ad6fe7993cbd5bb44
SHA1 cb6a4734a53456b81ac15fea372389c35b8569ad
SHA512 c611a3b3cf2043d2c5ff63619a7e27ff0ef29a0d5d7430320aa5964efbdcdffe8246ee821e2b68aabfd3578561207a1f6e8e32a92f2317dbd2c0c4863d10aed3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
TLSH
T1A7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000109

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000109
Size 16KB
SHA256 5dd1c64a38698ff8aeff573794977443121235af418dd9d2c79a5314189da2aa
MD5 0831783dce7c9f7ae3d19fd7ccad5d46
SHA1 c7f7075a6292462d90154ac8caf8478be15c0f97
SHA512 59f84adfb930ab067495343b59be6767569ffc0279f05465c0a622f6e59212175ca1195e64b7c29a88d1a40bd0c56fd735c7ceec28ed9c897fdeaa11250a8820
SSDEEP 384:velXJoyRu2nLAIAboKufdRAq1+91p2ky36j3NYmG:mKyRf8xbbu1RzMzFy36hYj
TLSH
T14172D0D6272DAA9772F5F44D20AF2A9B12805733DB98843350771A366BC64FCC9607E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00010f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010f
Size 72KB
SHA256 f85f421527528f92927ea93b9979c306ec54682fc95c5e76eee0ea5110f0667d
MD5 2ec5d3df896759ae7d3c27233b722826
SHA1 65b989c57886bc7a6cf7f551a66905a23eaf05dc
SHA512 dfc89a839b52791a8ed8fd4a5933add4605e3eda9ba65574c4242526fd7ed85a760c5754765626cf8969cd4007524ac32c53374d5ce1970b1d8285740a16e73d
SSDEEP 1536:aqqNyol5hICcSYsHPrtqkUB2bqjqs5p9QdwulnOwxd2cBNXVQBLarEKp6qzv9:arvIClYCrtqvgZs5kdwynOwx0Orzrzl
TLSH
T1E573122F4FBA86F8C732856287820A2ED851C85FE9C09AD453ED5CEC87706640C3B5A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000112

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000112
Size 60KB
SHA256 fd394cc3c5cbc059b945afc60e24a873c79e4e9f9ba018e12f0133b74a344cac
MD5 a2b0e8c0eccd89e78e88b3a5f26be72b
SHA1 2e8f79a77fd3b93f4a57adde378cb799535a2e0d
SHA512 97187f5b12ae4639f569d8931a14c913016478e3e3e559f6a1ecd201d8e9f5b8d7a836925d6aafbf28dda5a81777b91bfd6bcab7ff921a4f834c5f4368d79308
SSDEEP 1536:pGs0//BOPTNfTOT3m2axThH+N1XohWskES2cDj0AX73Fpk:DE/BCTN7Ota3sohWxjDj3rFu
TLSH
T15D530299F60C307956EC6B4B1E0DBA87CA2F3A0C3B44CF287676334966CE6B55A4540B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000119

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000119
Size 17KB
SHA256 ce83192a06afab5ecb50741023496477f6242c24201d8f25dffb4e52117f6abc
MD5 cd21fc6dc77cabbda4f5ace875b147e6
SHA1 daace7b6604408c87c51e0b35009694e27348e11
SHA512 37a70397be01e6b45d58124ba1a996422b3843ce3ebf40a1340889189b22af9404a970ccc5655b0f5ac0fd97e206a093c175e452bcb21ea6e991f5d9df6cafd5
SSDEEP 384:979cSNMOuvoEAvky8nmH5+XByEi7k1du32ovQ1:BiSmOuv+l8mH5+Xseru32ovq
TLSH
T13382E1AC730552ED1A829801355B28D0E517D7B50B6C562E6768312E8324F3D6FC6F7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000132

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000132
Size 42KB
SHA256 4f84ecdbeacd9d9c42ef1739b2f40326acfc8c50324b44b0ed0cd261037bed4e
MD5 2dd5b7b236b59c564008bd5be8b7e3ae
SHA1 66fdf692cb10832c0261e5d8c8b580ed9846085d
SHA512 d3c8c0e248de1862651306dbbce11dff74548b5f38559cc488fc0316c39d8492725061628dec076ae7d45863c32f2f924624ec63b1991c329d6b76f8b7ac75f3
SSDEEP 768:FB9CvdhW9sqOlwrIQkuNsXcFR4lA6dwisPkEaXI5EXxkyZ1lQphewdN1sKHK5Dsn:FzCvdhX6nnaeb6GPT1EqyZnQD5kKH6+
TLSH
T15A13F1B4464A400F278C80D7F274B76A13D926726D308A8C54ACA5F5291BFDB1BE2AD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000134

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000134
Size 16KB
SHA256 abf44e4e9928c3c6141c00842746c42192078d699b8e8e65c4f7e630aaab0210
MD5 e6e59b39017f4009a0a3327967431678
SHA1 7c69616071dd68e02e4dd2b6e07281a1b627f706
SHA512 4fd7cdaa93d86fa40ebce2c45f9fca7cfe2293c60c0b2d84ce0cca3cbeebf5fe60aeabaf3568f7d73e1285a088f9e1c0bcd77c2731ee24981e393347e7cffcad
SSDEEP 384:pOibbuO6oghUlywYvxZyNCQvLm0HP5a17dO+:sYbIXJYfvLlHRafO+
TLSH
T1DF72D09752C0858B1C3003AF10ED05C18DAE32265B5B4FC1D08FD6EA96E2EABD52B727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000159

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000159
Size 21KB
SHA256 6f32da94d4f26e98cb6ccd97034d306aa38945322c816f54a93c7d15dc0905b8
MD5 2c20035257a126aec473203c38baf276
SHA1 cea71b90976aab1ed5d2c1324bb4b09be960e15d
SHA512 c94fb11cae0ed5a7870ac53453e1917fa4e09dde68048a48071798b03c395e97efbd55b45a0360775525bbfd2a24e6d81ea0cb9ccf0569716735ea4d02b50465
SSDEEP 384:X7cRxmywBqrZEV4zWI1TdquIrkzoCu6DzCgpGhH7P2kqwV3fofML:X7cRYdMWI11gZC/o72kqwV3fofML
TLSH
T1D0A2D055FBA8B200E768257A25EC85D9C8B83F318599BF0DCA6B40C60D73DBF06CD192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00015a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00015a
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00015b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00015b
Size 22KB
SHA256 9c4f02f38678f2628292d66c4f7a1a6a06af7ffac4d279359b09074e7d0f1fe0
MD5 9e38e04780525a20f28d6c455901b2cf
SHA1 9a8514b5e462d06a2b6a4f31e60b97c48272f58c
SHA512 15efa4e8efdb92442e270606f13948aecbf4902a7ccba2fd186bb0bea52feb59530fc922eb4ab603c70cb8cdd26b5d5b2d8318d0cf61f26a96099df38dc694dd
SSDEEP 384:Wnkgg5ugJYnmChrWRPP8mVjX23owWnt4Powv5/cwR2TkqOOCjc/V:WkgY2mcmVzhwK6AAkwRbpeV
TLSH
T18FA2D0EF49DFF985CA334058F4FF0CB982365178E7AA60EF1194969660888F24432BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00015c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00015c
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00015d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00015d
Size 76KB
SHA256 5ebc9f327466bd6fb0857641eb0de4becc8e530ba795082ba1c3266555b5c84c
MD5 a958692bd6ecbfd4505710979c279e99
SHA1 747bf1e1846452c5561d579c06222936ee70e2ee
SHA512 835a56203debdd4cffd1831f8d456403ccff688be0e8e22988d3735a38010b2aea849ab295e3860a811f8ca35dd68a5d90519cfea5cbeec0708b8490f2e717e5
SSDEEP 1536:NP2s592WtuNCS00BI9SW8k4zhuXX4gUYusrkyBnFYe0jjlc3zkZ5h:N9592yECS00BI9l8JEHfuaFYecK3zkZ7
TLSH
T1FE7312D65275DF8FED64EC4AB5D7E97A30ACB2530C64BC83B08CFA001A522C57B46369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00015e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00015e
Size 41KB
SHA256 1fc6e15965e4f424acf73f54cfc6b6c1c3adb1c2afa7edf9773ecf1b0b4ff243
MD5 bd82513d31ed6618a7f0fbe84eecf009
SHA1 fda0156425ae0cc35b2fb770e4f8694b5ab90a4f
SHA512 b36abc172744b37dcbdcd77389532bd4c9edd526415560485754165b72569dc5518c457e839e2ecc460c19f782f4bb7393918089d92d3ab4445adbfa96fde00a
SSDEEP 768:2rionG8M7R0J+38azJsgd2eoEUdMoF3LuSkzW3vt/VhZ1zxVAUYlVJ:OiCgRa+V/dsEUdLLF31/V1dqVJ
TLSH
T19A1302917C02D2ED6E1F9CA8DDFEA4BB8179C2F925B04AA7500B5F01C4356D21999CE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 198cdbe23d8782913b7c4ccac726f5f56ff98ad863959f87c7a001ba39c5b5c1
MD5 8f586932b04bb2f39e81178b841def0e
SHA1 462ec13de468c06d1f5f0d373ae5d0708ee1ecfc
SHA512 99c5b79499f96e0e82328b2f9d0f926af9bd35f437806aa0574945aa62b1ea1f6f355c9cece7bc87f3add0c86b3d022e25f43e5ec7afd7bfb91d82dbcdb6933a
SSDEEP 48:p4UtLu6rONSdTlGVfvwxDWgMS1Pgl62Dt8Nb9j0+Sb7Y+C+nY8WdCYIy5bGhjIny:FmNuAvwxNFgl6qt+b9j0+Mj3MCtQ8B
TLSH
T1EBB161385D8785A0CF93A0B265C24990387985EFF36ACE76C06D44A0250B39EEF1F63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 a623ba0916718b17159e3fb484b49bc6631085fa3b7f6191b401640c5cca0620
MD5 aab885e59c22c49cb394de3ac300bc58
SHA1 b255c2f5d79dd949b96b3deac84764b1ef7acdf1
SHA512 a129e1aada452f3f1e6cfcb65ffa5c18e9ca5f3b0e201c9c86af0cbfe80f8557f55a5c2afa79206484156f8f6dda4cca77c4a0358bb4b9d76fe7533f94cab854
SSDEEP 384:D7loNPCjEGI3CTGrU3OYuOVJn1R5ghfd4aDZUnke118QzDWFiQGT6ZGVAPRxh3I0:VjN0mh6
TLSH
T1CB428EF7C3F8A66DCD2156F0EA152E1FCE5E0958831C386A89D9AF1753E2471E201B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 9104737bee93f442f73ea44930f57d35e6f028026dace9280eec36d5ba57466a
MD5 4bc7d178d7d07cebc8aa940ebf9aab4b
SHA1 55b0e5c2680b6452c74830e3b20e20f3dfaa3d8e
SHA512 0b22eba381fa935c7630bafc0054a8edf6c4bf8f27800dda39fdc508068bda042b1320437afd2be0098381e66d0f620fd97fd7e3e08d832b85b06d6802e3dad9
TLSH
T1F7D022232241B0F6A6AC7F9AA0AAFD8FC326017A0E82FDD821D0E898253147C1D1F141
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5a3c10.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5a3c10.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9280fc652dbdfaa645bcc103639fc2720644dc692bd80974e0d526bd5b649872
MD5 b7926541e3edbca30eb6be0bcc40681c
SHA1 4252550594e4b78e5a4d5314c4a985a40b6a4525
SHA512 0e6943c342c10d3c9a3673b2fe2257caf6351ecaffeb0bcfbf6b1fa6524546d1d179e76e4f56f5a2bb254f00293a934cd1ff68352bd80e17a1d8a2ee131945ba
SSDEEP 192:sxZyRGyM/jK1Ml8Mk4/fns8PzIdpTZIHW6+WN5WZzFo/YCPpZ3Y3QeIgrJ:sxZyMM4/fns8PsyHb5f/kF9
TLSH
T1C152E911AA38AA77CCDBD209F951BF53D6F50472A2900D5899FC9A1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 232c7570200bfd3dc857e56d068c4513df442ad2ef2231e55b848c54e047ce7b
MD5 ddc788e89bf83271696344025b92acea
SHA1 f81900fdf31e04dad2b661e6e7c73b276035e458
SHA512 08ab45398cae06c67f24ab4776c9b669939517229e9cfc6f24265f648a382f1284596e5edb3e395c0b4ee1166894ee9c228f23315ae89dd2d115b0db23b9abb4
SSDEEP 384:sxZJnPMqvm44/fnszOIjB+bPHbv3w4x6bA0/OFRJp:sBP7vm44/f8OIGPHbvwXEGO1p
TLSH
T15F92E552A5245AB7CCDBC219F921BF63E6F40463D9C44E58AAFCD90C04EA6FD2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2a4ab75c074eb1256292324b35ab3bf1ca2947c277899403377605c3df7d7bcf
MD5 ea67d671e0bf3780a75b209653f45a8a
SHA1 0ad52c93fee98c034b5da57fb5dda679a5745dcb
SHA512 7f44ecb154107bfdda3866b8bf25c231e877efb167d3dad3f06cc44fd7bc18260fbdc7c3d8d196201d47fa3bbefdc1462503f17a1e8041ea5d14e2222ce11281
SSDEEP 192:sxZyRGyM/jK1Ml8M94/fnskIOxIdp+xDdlGryb6RHW6+WNvj/Dq+46WxmZYCFZUl:sxZyM14/fnszO6+KHbvr46bZnFU
TLSH
T12062E852A6386A77CCDBD209F941BB63D6F5147396900E54AAFCDA1C00E6BFD2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0c4d5540c2070f7d3ff019e24ff25f45b2066e9c3749fe1589737e4e41d515a4
MD5 d32456b49db000b06d117987b7251e59
SHA1 cac72c14c5088efa89c29f304a294d2fa0dc7e51
SHA512 49a939331518bb595ae1ff399ee880945f9be22cf92aba8ee1c6248774740cd181097b4f604fca9eef6aafc30981ac9508144a791930b218b131f75f99223fe5
SSDEEP 192:sxZyRGyM/jK1Ml8MWP4/fnskIOhqj9dp+xENdlGryb6RHW6+WNvj/Dq+4qJe6WxY:sxZyMuP4/fnszOwx+9Hbvr4x6bZ0FU
TLSH
T1A172D642A6346A77CCDBD219F901BB63E6F41573D6904E54AAFCD91C04E6BED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3ca76ce9dfc4b330d1a0561621f15133f9dfbe528c8248ee069a70dc595f044b
MD5 956567713a463b790b323fcc2eaa56d4
SHA1 b58772c9f7f4edfd13ee1608c583263927f77627
SHA512 7df16f256a24403345d174b66c34bb6d438d1231ae97ca2b9a2668569c2f781c46c79cd2c6ff264f841acbe8121b8cd510fa08bb802222aa04dc367c2bbb688a
SSDEEP 768:P08bqn+WvSC368F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKV8roD:P08bqn+WvSC36u1jaCZLbWVnD
TLSH
T18FE20A3B280CCB7E4F845E5DDC26AF966ED801CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 30a803f11fb14bbe679145e8d9a96d449d7695418b5ee68542390c492db72dd3
MD5 ad0469934da0f4822367a9017cba50af
SHA1 8f1fe19b532d0b58b6ad8b21cc72dc60e19790d5
SHA512 6cbf7ab7415aac2f28308a036329d4de33383f709c9c2a976653959dcc64e5abafe38f0813e38c116255efa68f9598f78743c85f44d5b26db03830fde9cadb45
TLSH
T17AA0021A0698120DC4D322F025DB9181332ACA1C2306175951928144C8609A54EB114C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 427d7a4c9db8938119638985d35260ae07a5533f5c9334ed3b5ce03372ba2695
MD5 6afcf313066bb0ebd49b85a06ad867cc
SHA1 36e1a50178f2e1c953d2f697f73e4ddf6205dbde
SHA512 2137d88ba8d52c3df269f665426f09a4dc1f3842dd2bea838f499fc9a5e4bf257fb8cf08bfea6f9dfa45dd650733a9a5e1f1db5d05c21486c865744fa0074158
TLSH
T1ECA002509FC40005C06311B5155307811B00C8922913130B41995045CC504805E4648D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 816B
SHA256 1f6638acb76f34fbbe19bce875a689a13fcf6fc62a03390af1447932df201e1f
MD5 d1cff7ac8dbe134dd5a3e15a6435b905
SHA1 68f0e493a5b887fbc9d95ce943984d974f045bfc
SHA512 a7389967df0955135295742f08afa84a02ff195011307b9d5d39bea244dd857c7d3ea5b535d4ec4f31d1f30309396e3852d0ca86125055c170ba45d3b94ff237
TLSH
T1DF0102859EA68D1FDD550AB314B920F47370C9DC6711D217642C32271C3634A65175C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59db91.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe59db91.TMP
Size 816B
SHA256 3e2b2c315b83dac30e4120880030e64f1754b742044a70b336956f6c83e7fee1
MD5 201d7e2b7cbce1099987cd82e28534d2
SHA1 38d077cd98045fc2188f3fbb20d78715da39c763
SHA512 d25b89a2204fe37beada18e67de9ee5ba862cfe9c7b3dc3d933f0b00ea22748a9e0f630fa9c038f2d43718ea9e7dfd26090faba9c96c008ead262883877c6575
TLSH
T18201E1868B964E1FDC9505B6049960F47331C9106322F793907D293E5C7A38969070C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d18cc2ca7a9dbc34f41856e28dd245fd7758011936a21ead1d9b622399813398
MD5 259cc8d51974c2f8f6bc644cbac54531
SHA1 a9385452e69b3af59227ed339486ef64b50465ba
SHA512 47fbfffa965ef782822614b49cb064803f93885b3351e797386f490a6c71a71540b29c5215b198ddb1dfbf1e8c38adcd86ae01e52344f74629ddda15eea5e73c
TLSH
T1DDA002748A4E909AC405067010699180B7644CED31096751589F92A89CA91C0E5CD201
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a38c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a38c4.TMP
Size 48B
SHA256 d28a20d888d1ff173b1ef15971657191b617b39a35c02efd1ec55f3f8fbaa2a0
MD5 cdb471d2384acb7f4484eb5e99ac529e
SHA1 50ed684ed583d6acc0e20474ce1b381d587a0f8f
SHA512 d152d14d18cd6c49749e19ddd3669e7065ca5b7fc67aeaf4e5639f8c28843b1af6e6a8418aced46fb00d12d6b41f0ccef987739bfe2d72e1a5de30ce15a78fde
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 749355f2eb9fcca3d5d75b4a7344d527153f8a982d1816c2a3d71a2a779a8938
MD5 615fc0de6e951e9d34c0f9eb56d9dd5a
SHA1 118a60b0793141570981bb701367c9120a635605
SHA512 d79be26df85264cd576cce909dd7283e74863305a98a9e6643e739a679319f20245fcb8fb8185c67d35836d1f7245b1ba885da08c0b7e1905e8de2bfa33b8bdd
SSDEEP 48:K4/IhKkosty1hI9KaIg6DIJKEAUnyVTIBK8osH:K4/6KkocOh2KaIND2KEAmuT2K8oI
TLSH
T1C5C12346F03B320238FE69089395A5368E5171637819A46F3FB805A25E77E211EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590a76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590a76.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2aafedcd8f52f00dc0473e5f7e2a3bf4160c8663b3b45780382f36f554fdc59c
MD5 de9beb65531e767ddc6092a667a361d8
SHA1 b942dd8695a2b23c99f17e4d8ccbddba34d87f90
SHA512 4810ab57f398442013b4a5e50feafb32dfc373f14a476c61cf4505d83c835aa2786050eb15342a5092821fa8fdb643d366dd760ef31f3059f8959dc5e6afe2aa
SSDEEP 384:yZcIhsNQshkaRKiEa+1OAxdnTKwBODNZOCNKDT:AhkhYJasOAxdnewBKZOuM
TLSH
T1C3927D71683C5D779EE2A544F84731079EF88077E6C92BA4D6EDAF1C00E669C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 6f9d25a5528ab7c6635b3740561eec8b0a4bca422ab4ff4509002c73680f5d46
MD5 bcf7ef478e7ed8f03583c359b0d0f765
SHA1 0561503434dc08f3a6846806b8b43a9148674759
SHA512 7e899e2365e9c5aedeeb397a82b821e51cd91a170836229f0735777103fff909074a90e45c07745e3f307b8e2242d8d6c6bd015d4b4a074c8f3b69a3c8dc5d7d
SSDEEP 384:UiFiZcIOzsNS8TUNTUlIlThkaRAmEa+1OASdnTKwBODNZOCNKDT:vFQO/wgZhi1asOASdnewBKZOuM
TLSH
T10AA26D73586C9D7BAEE6AA44F94A32078EF84077D5C57AA4E3DDAF1C00D619C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1cdf6bce568ec654b42221de99ede0a6ad112e69ed97d75c341f8ed0b3ca5a77
MD5 b9468227d3c0155b03227f14c1cafd87
SHA1 505a0ce12813b9c797d38089779217ebfb626206
SHA512 afebc39d03ec6fd013407594ec6bac83945e45be7997940c0ec408b3ef6430cf54c3beb77f9f2d1fe3414086dcc627e155cbac1a9e68db45e5710a8e06ed4d1b
SSDEEP 384:uZcIhsNKThkaRjD2Ea+1OAxdnTKwBODNZOCNKDT:Mh5hVDlasOAxdnewBKZOuM
TLSH
T13A927D72683C5D769EE2B544F84731079EF88077E6C92BA4D6EDAF1C00E669C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 19403c8ae839163918d16e3988a7f638ef42f5ef0df1900e5628a6094283cb63
MD5 ac4dbe5d40b6355061556819e3d96660
SHA1 29661b074b8d0829881a6d4706c76a0635b7b9c0
SHA512 a7492d3d433044283c4f4096135c1c01642e1833039706a7bc3e9223dce58588d3ddfb00b5826b3be7cd7f872da60af50b93b46117d1af6b650fe2954032aa37
SSDEEP 384:yZcIhsNKThkaRKiEa+1OAxdnTKwBODNZOCNKDT:Ah5hYJasOAxdnewBKZOuM
TLSH
T199926D71683C5D769EE2B544F84731179EF88077E6C92BA4D6EDAF1C00EA69C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 717aa3100b9fcd93427bd325ab62700c42647ab4d12cffa3e7c7193fdb066429
MD5 3de4a4eb2b31588a8a07578f757ec33f
SHA1 a7d2586efaf784562b6644c75d27d828fbfda401
SHA512 11153cd22a72211e66c29ea27d4c0ebbe847c2025aaf4e89632ec089cf658f0aefb35cefad34361580be5edd724ff0f650b1366b77392c6f4c3a600718d36fd6
SSDEEP 96:EqONkeQsjpf1bxX5ih/cIPURHl8h4otop5dnD/BfPgvE5BzatIRdy+ZhOmGsR1oq:vONa6Db6QmiUyRJHBa+jBOmBRGRgOaU6
TLSH
T1F402E935687C6CBB9EA26E48F88737279FD4103BDA966B94D6D81F0C00D765C230B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2b99d78980ff36e94d1de50e4aa2bfe06b09d33efe35d388ce1e138419b73984
MD5 e8a90a19e5c73f77d279410ce23584fd
SHA1 0708afe8f7f19721631f8e511492170d33f11b36
SHA512 0d1eca4256beda44751c036474facdd6fda5436700831c9afa05e2f00a292459cd024b8f614a547e484c98f29f94899483d9494db9a6262d0a9a9e1f5caae57b
SSDEEP 192:4ONR6DbYQmiUydJ+Ba+jBOmBRZWMcNzUq/U6:4ONR6wI+Ba+1OAcdU6
TLSH
T10D12F936B97CAC779EE26554F48732179EE4412BDA8A7B90D5DC2F1C00DB65C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3b90a5e5631a1d14d1a66f6bf680e6f83b3554c1744965b230e5c95c3b1201ab
MD5 30051d3b1e804e8465b28ea432657b7f
SHA1 17506cb99e6abab58079679c9610845691385447
SHA512 004a8792244968e34b5891aa5b2dc89d32d53848d1c8dcfb69194b29cdac87a3406378294eb37ca7a5e11e9bb373839d108f035097d784b93b79c05a38a28b22
TLSH
T173E00403938129BFD0290B3104C7AF606BB7D5A407B347468A70457C2C2B3002EB2EC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 30ffd60c4b988ca6a48a3ba99fd98776d81237fb1b192cd0281f3da09467ca83
MD5 01c215844f83e099cb5054bed8e6a3b9
SHA1 fa654c42fb1ad8e70a18cbd9900b7c7c6c0bc159
SHA512 2d08faeefae5b717e891e1a8b540f4fea00c79c4e1aaef9eea96485fa51b97ab0fb4d860da2774de552b9aa9f44d0ddad42c48e2aa25fc480bc235a076ef0476
TLSH
T1AAE00103534100FFD02D0B3104832F306BA3C4B006F247464F70057C1C263002F72E81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7ff7fae0ab52f7aa085901b413c456076d7fbc3541f24adb744e9d2abc12d8bc
MD5 4f4ea428930657d1f48631443a9c25e8
SHA1 4c3a90db2b0acdd6a1cbd17753775263dd78b6c3
SHA512 1b40b56987374bbfd07fd5a7ec855e2cc23860e572a40834b37b407c867aa1ec2d15656ef85625db637d5eff075b0d01bf37d2911ec819c401ed356d8961e025
TLSH
T141E00903938119FFD0290B3104876F606BB7D5A407B347468E70457C1C2B3002EB2FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 60418c12a5f2451f89ddca172b09fcd1fdade497d06f3583d62e43a7251707dd
MD5 ac9b0dd73087b6a0f5a2aefd5987085b
SHA1 68fc80de6fe6e10909a549f0bee12ec34c4814db
SHA512 a3dcd9205bde3fee536951ef092c4dc08d1f25f1c9420d77cb43a51b270f8f10e39b8411dfe9d99494527c29e26af1bed164eb787edbbbf474e518c652c96efc
TLSH
T129E00413938129BFD02D0B3504D7AF606BA7D5A407F347468E71497C2D2B3012EB2EC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 be8ca6667be317e9972d853242a20b43c75115f6fa01add090349ea0c0d45521
MD5 704fb3ed316b3fc5f2283da13b37d03c
SHA1 ff431068c2ba63c0842d78f82a20074e80fe93ec
SHA512 b280c7affe093835f45fa3bfc936b8f9600e947991eb87ae935a54f994b7ddd5d3566bc1c13f80224f51d4b63505df879f977a3805fd133e5267f9a55cc2f7d4
TLSH
T183E00103134000AED039073100832B306AA3C4A006B246464E2005680C223002F62E81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4a528703087ba622f1309452458d833822c9091cea6d68785458de995fb0a200
MD5 97f3c67aba90bcd8ae18d0eac769667d
SHA1 564c217655620c123133e01494417074097865a7
SHA512 314742e421d2346ba8af8ab32d8069f068ec4c3d1903c1019f99d4835cba78ec9de5035361de0dfe18540106aec1b0cc3ea6b516a8e194030dba15bd013e0ccb
TLSH
T173E002011140003ED039073100832F305E91C48005A246454B30055C0C323003B72EC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58b215.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58b215.TMP
Size 392B
SHA256 c0472b268ff12f8aeaed9cbb1df91d3f60a0106b3ae2301c54718ea7eccbd513
MD5 8a2d846a5da46e95b7b14b090b84de80
SHA1 43d867f1de9b69f48c2f23a9a9590bf1dca664cd
SHA512 1a8b62584c5c61db537a1f58aa0b5fd98adc0817091d334a4f0f80620e625546180c157cea83eb03d682e969a2eb5bf711fb930f7d4d3eaeac999d8e5533b356
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 33da22ff895002f17c7175ec90c9958ff7b4a6d030f7e87643410c95c8af0000
MD5 e9ad15be07c552007b76ff25290f54a6
SHA1 9209a68d0ad92c133782175514c383abfd712f72
SHA512 620a33da47cf7401c93384cb80ef6307ffe97d0b0209f4f1116cc5662b9785c23e03398a331f12b27abb793118da2abb1249e8b1f1f03218e075a533cd03491c
TLSH
T14E41F858BAF91148F3B76F5A9BF6A86E447FBD372E46C49E10110E8E0662B40C871733
MD5 SHA1 SHA512 TLSH

Submit Download