c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023

Resubmissions

05/08/2026, 04:34

260805-e7bxlade33

05/08/2026, 04:24

260805-e1t5ladc945

Analysis

user interaction
yes
max time kernel
195s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
Size 12.6MB
Sample260805-e1t5ladc94
SHA256 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023
MD5 77f110a9f1e432ae6a85669ee6e04224
SHA1 398ff0fae1cc7a1b99019c675ba0f42f9d8d333a
SHA512 2f5261cea35e092f04079b9c04811da21320658417fceb4229baafb75bc65bdedaa0701d2cff38da31a93e5d53620b2fac37077fa7b039890e4976480e84b461
SSDEEP 196608:aZCE+RSPD4vjbbcViPLpZ0BYPCqZJZ0NVpzwkpcVSkZD0J92GjLErija9v:aZrtBVur0KP30NEeRoO2WYv
TLSH
T1D5D622D465D4A37DC8818238F5455AEAF0D46C9E1DF9CA1AFF96C4327B70A48C8B1A33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4744	msedge.exe
1032	msedge.exe
5368	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303776737984086"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{AFFDBF01-60F7-46F7-BD9E-F9E3C5B54644}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{51CBF1CF-3CD2-461D-BCA5-89D37EC63585}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 544	4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe	97
PID 544 wrote to memory of 4292	544	msedge.exe	98
PID 544 wrote to memory of 4744	544	msedge.exe	99
PID 544 wrote to memory of 1060	544	msedge.exe	100
PID 544 wrote to memory of 1060	544	msedge.exe	100
PID 544 wrote to memory of 1060	544	msedge.exe	100
PID 544 wrote to memory of 416	544	msedge.exe	101
PID 544 wrote to memory of 416	544	msedge.exe	101
PID 544 wrote to memory of 3148	544	msedge.exe	103
PID 544 wrote to memory of 3148	544	msedge.exe	103
PID 544 wrote to memory of 4092	544	msedge.exe	104
PID 544 wrote to memory of 3148	544	msedge.exe	103
PID 544 wrote to memory of 4092	544	msedge.exe	104
PID 544 wrote to memory of 4092	544	msedge.exe	104
PID 544 wrote to memory of 1296	544	msedge.exe	105
PID 544 wrote to memory of 648	544	msedge.exe	106
PID 544 wrote to memory of 1296	544	msedge.exe	105
PID 544 wrote to memory of 1296	544	msedge.exe	105
PID 544 wrote to memory of 648	544	msedge.exe	106
PID 544 wrote to memory of 648	544	msedge.exe	106
PID 544 wrote to memory of 1132	544	msedge.exe	110
PID 544 wrote to memory of 1132	544	msedge.exe	110
PID 544 wrote to memory of 1132	544	msedge.exe	110
PID 544 wrote to memory of 3876	544	msedge.exe	111
PID 544 wrote to memory of 3876	544	msedge.exe	111
PID 544 wrote to memory of 4784	544	msedge.exe	112
PID 544 wrote to memory of 4784	544	msedge.exe	112
PID 544 wrote to memory of 1292	544	msedge.exe	113
PID 544 wrote to memory of 1292	544	msedge.exe	113
PID 544 wrote to memory of 4888	544	msedge.exe	114
PID 544 wrote to memory of 4888	544	msedge.exe	114
PID 544 wrote to memory of 3156	544	msedge.exe	116
PID 544 wrote to memory of 472	544	msedge.exe	117
PID 544 wrote to memory of 472	544	msedge.exe	117
PID 544 wrote to memory of 4512	544	msedge.exe	118
PID 544 wrote to memory of 4512	544	msedge.exe	118
PID 544 wrote to memory of 4444	544	msedge.exe	119
PID 544 wrote to memory of 3960	544	msedge.exe	120
PID 544 wrote to memory of 4444	544	msedge.exe	119
PID 544 wrote to memory of 3960	544	msedge.exe	120
PID 544 wrote to memory of 1144	544	msedge.exe	121
PID 544 wrote to memory of 1144	544	msedge.exe	121
PID 4928 wrote to memory of 4016	4928	c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe	123
PID 4016 wrote to memory of 1508	4016	msedge.exe	124
PID 4016 wrote to memory of 776	4016	msedge.exe	125
PID 4016 wrote to memory of 1032	4016	msedge.exe	126
PID 4016 wrote to memory of 776	4016	msedge.exe	125
PID 4016 wrote to memory of 776	4016	msedge.exe	125
PID 4016 wrote to memory of 3960	4016	msedge.exe	127
PID 4016 wrote to memory of 3960	4016	msedge.exe	127
PID 4016 wrote to memory of 3592	4016	msedge.exe	128
PID 4016 wrote to memory of 3592	4016	msedge.exe	128
PID 4016 wrote to memory of 3592	4016	msedge.exe	128
PID 4016 wrote to memory of 4708	4016	msedge.exe	129
PID 4016 wrote to memory of 4708	4016	msedge.exe	129
PID 4016 wrote to memory of 4708	4016	msedge.exe	129
PID 4016 wrote to memory of 396	4016	msedge.exe	131
PID 4016 wrote to memory of 396	4016	msedge.exe	131
PID 4016 wrote to memory of 396	4016	msedge.exe	131
PID 4016 wrote to memory of 3748	4016	msedge.exe	132
PID 4016 wrote to memory of 3748	4016	msedge.exe	132
PID 4016 wrote to memory of 2224	4016	msedge.exe	133
PID 4016 wrote to memory of 2224	4016	msedge.exe	133
PID 4016 wrote to memory of 2868	4016	msedge.exe	135

C:\Users\Admin\AppData\Local\Temp\c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
"C:\Users\Admin\AppData\Local\Temp\c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/memesense
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffbf882c188,0x7ffbf882c194,0x7ffbf882c1a0
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,6066629764717865326,2009404299519946272,524288 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,6303521368127443392,4385950558788748614,262144 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,722091066722244426,10066457493932640180,524288 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
    3⤵
    PID:416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,6396362632080124821,3214480881673275368,2097152 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,3086157062349587882,946563252009458581,2097152 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,355408392947400201,16769622617764676149,2097152 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
    3⤵
    PID:1296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,11614631683812781893,14050724617152703989,2097152 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:2
    3⤵
    PID:648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5112,i,15999242068894913593,11915801447484404259,2097152 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,4576045824734586215,4744954691904153072,524288 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,16922097886938944993,321656833555832843,524288 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,12707161930520159334,11006067765925847327,524288 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,11245469137906651604,1106020981552730907,524288 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,11597980466027242212,18219564038596051531,524288 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,11597980466027242212,18219564038596051531,524288 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,3091736521349109543,17624274428660211837,524288 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
    3⤵
    PID:472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,16847267147146751816,14468309839988384454,524288 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,11488420610645516033,14488128141954159472,524288 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,7715165255780284638,2323538133791062992,524288 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,7195339564347630397,10591343337721593993,524288 --field-trial-handle=2164,i,10386166569561356168,14185067968499586226,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
    3⤵
    PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://vk.com/memesense
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x29c,0x7ffbf882c188,0x7ffbf882c194,0x7ffbf882c1a0
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1844,i,16393256003697791215,2443425082688715151,262144 --field-trial-handle=2316,i,12674738003446563402,10709689916697626864,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,4168153420365617306,8981958302779483293,524288 --field-trial-handle=2316,i,12674738003446563402,10709689916697626864,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,7399513020905447481,232418183405861686,524288 --field-trial-handle=2316,i,12674738003446563402,10709689916697626864,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,8374063368549798514,1873477551293490077,2097152 --field-trial-handle=2316,i,12674738003446563402,10709689916697626864,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,12492477702807734023,5947912197037219358,2097152 --field-trial-handle=2316,i,12674738003446563402,10709689916697626864,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4768,i,13761379457113732417,8041829446904384652,2097152 --field-trial-handle=2316,i,12674738003446563402,10709689916697626864,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,8604054518649913247,11931566917718182971,524288 --field-trial-handle=2316,i,12674738003446563402,10709689916697626864,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,7106693816465035566,17806646450001801909,524288 --field-trial-handle=2316,i,12674738003446563402,10709689916697626864,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,473532916294845592,10722108442084248657,524288 --field-trial-handle=2316,i,12674738003446563402,10709689916697626864,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,473532916294845592,10722108442084248657,524288 --field-trial-handle=2316,i,12674738003446563402,10709689916697626864,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x248,0x7ffbf882c188,0x7ffbf882c194,0x7ffbf882c1a0
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,9802255096451154855,13554250826398497670,524288 --field-trial-handle=2292,i,3904217108655602949,15582245988165548726,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
      4⤵
      System Time Discovery
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,2448705867237015937,5729775255183156833,262144 --field-trial-handle=2292,i,3904217108655602949,15582245988165548726,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,6582677879848678996,13005166961610098732,524288 --field-trial-handle=2292,i,3904217108655602949,15582245988165548726,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,16083984831318049390,14413639611535299027,524288 --field-trial-handle=2292,i,3904217108655602949,15582245988165548726,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,16083984831318049390,14413639611535299027,524288 --field-trial-handle=2292,i,3904217108655602949,15582245988165548726,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,15419356749687979111,13748259378352069198,524288 --field-trial-handle=2292,i,3904217108655602949,15582245988165548726,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,14462852021965780284,2745540582702559361,524288 --field-trial-handle=2292,i,3904217108655602949,15582245988165548726,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,8196355674824952789,3534755548977928175,524288 --field-trial-handle=2292,i,3904217108655602949,15582245988165548726,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
      4⤵
      PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 92a908538089a45b7267542a2b86d1a63b5a35a14b876e2973f8c13aad1654fe
MD5 3be5a24efaf87f3baed7f1fe7380e63b
SHA1 bbf3f915abb0c0973886257d8d70206849d13325
SHA512 46f6a5196f27bc42271724c4ec93c2d258ff71f175073a3d6d7f098db60666d7acceae87b6c053d4ce205a6d1ca3e790261390f9a01bf8af4376a0e26832e3fd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T11AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 94f40511ea08a0b6a5296f0532f655edb1ff5b802568267057a10b9a850c3df9
MD5 1d5dfbc6f7dec6803aa8fc7ec805839e
SHA1 301f0013a4f8dff7ba9babad8791aa3ced8c30a0
SHA512 c72b47d1d5b8cbfb51273c5f54f380345f34c6234f6c4cb560c31768cb9b8965c22d1cff5b0f4f68e25ae5facfd1c5b91e33c6d09e6baea7aea919322ffd1514
TLSH
T1D8D023B4B42A75A1D72F00354430F150A26541737277938671554C0DEA7844497FAFFA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4371a57d104cacf01835d7b1e7c57cfe938b72a37ce2255f489f558bff1ddbf1
MD5 dd0698d0915344f95f2ec4407fbaf7b5
SHA1 1e7d9cd9f6b7559e4b1cc2b57458517115c471d4
SHA512 f75310014f771e0f700d554959e2913d57e46b85b378fd9029eb6450fdfa40fc7fe022a0d09c9e5c0fc676da30865f425cc58c6ede7bcc8122942df24aac437f
TLSH
T19DD0A7A4B205AA20C61F40355811F260A6A241317077C6A2A061580D65B841893EE5A9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae1124c9c8979ecaec67c358c8313c06d2bb0d3feb7636968cc9a24483b633fe
MD5 1522558780c86e6c2aae39cee93e748c
SHA1 2d4824cdb48b3424b5a494d7f46c5b21a1a139c1
SHA512 5a5104603caed9348fdb863b4f88e96122b91edc258d791e1cd5b769b7654e22ab0e850f52005f8a60e46ebc025baba93571f612d1f497a9e62c9102f54a1fb0
TLSH
T163D0A7A4B605AA20C61F40355C20F260A6A241717077C6A2A065580D65B841893EE5A9
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1cb152dc7d89cb000b05a4549ec4218f4e2f4c6ab266f7388795a4a1f7d1b8be
MD5 c8de7c964dfc8b3769c95bfdabfd00f2
SHA1 8b0d93906d5d254207dcdcb230f829ac89d29733
SHA512 41cf947467ec021d1446b7ff6c8f9a4f5d222017530014f521445552b28cb6c558e4ff72bc509faca285516458b2783f4fcd201a17cbe7bf0dfae3e2d90abb2a
TLSH
T1747181472E930CE1F3708FB1DFDA1A38307968BA0F8F2F56215254BD2435710595E62E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 65b484eddedb238b3715f1b3afd9b74484274c896c7bc71230cbc47909edf5d4
MD5 0a724d28993281501b73bbacf62fe21c
SHA1 489a1bc7dcfafe70985a3eeea9f5f82c737e3af9
SHA512 640f54e823aee48253df0647181f31331d507b0efd032834f2ff3ca41a296b84db9850f412d0aa4aab952335e5fc67616ff95fe6634f48b23a1ffe4b6d57ad75
SSDEEP 192:mKOh6u8HI+ru4OCvaZkHIu7l8q04d0b3kb26h:e6nu4T7Ndb0wbH
TLSH
T1A822C68F58520899E3B04DFACEC46D64303FAC963E1B2ECD5522687C5034B553AC7B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a3f6c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3f6c.TMP
Size 3KB
SHA256 b8612b9f06b40866aa094574341ca999d0d39ab4f1857887978d4f7f63fc71cb
MD5 2cb3774c5fbf5e97d2accf03e79bc692
SHA1 81f0095f286a26637093fa110f8356d09e3d3178
SHA512 fe74947245af4b6e79f757df47b286c5a43f11cb97a4722805114c34a87adb585d523012b02534a3a62da98afa83368a5cdad78d068a2e8315e5b414666d8fba
TLSH
T1AC6160472E930CE5F3748FB1DFDA1A383074A8A60F4F2F46105294BD25397245E6E52E
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 684B
SHA256 ebf65d839a9c2a53ab503763d44c3a0363d3387faf4f947b5959463833c3b75a
MD5 f93b6a29284b7e38dfd05af480d25ab7
SHA1 cde3c88c5dd5d4e617e8f8157c03d66d730953f1
SHA512 e2148554c1b5c2b97175e5ade1fe82b5a08311ce9d736907ac299f99c3580a99458d7fefc894f4badba5921dfda84f61117e1ae3e57b0063f127aaca6563e099
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 aa34e3a8e254aa72eae9572d4ee5a35684ff443e05c3998ee31cc50b6a5c0686
MD5 cfa92b458baf67774bb6e2ff73b9b954
SHA1 4c86765b54597d3a0ef3e331a3fda3054ef27590
SHA512 3f8069528d3755ebff252265e9bad1746661ff8ea115cb3c1a1a6e7660c2d923ae48bb62e4c6e7d5454912bcaa82dc1278126db8fbba1be29de4c8fd2cff2c07
TLSH
T180E0263429C8C26DD41878E38379E389C2D0341BBA883E82170FC884A301A41AAD6E91
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 b4425d2c9f48d7dac7485805c2f1dde2ad7bae36211f1e4c12f4786ca935ea65
MD5 b0d9b32825cb1c5e771d50d0ae4247ad
SHA1 ebaadf50245bce1d556944a55ebaee0fb4ba5e4a
SHA512 33138862e77ffb68ca8e35ee27b0d0a9c422ead71f8f56ae9f1e42570c1e20cf13a6eebb89e29f85c9c61b5e8b39e385bf843046400e6eedf10b733d30886d69
SSDEEP 48:IzBmw6QU1PzWZVl4lDCL6+GGHRtXyOGemKLCntqez8IENUcG08cqTHKw:UBCxWVSxA6+GGHzCOVVe98BNUoSTHKw
TLSH
T198B21B5B6F783412DB011E3E212F1A728D3BE1AD5F9B6C84382664B19CB4059E0684BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 dd84d50b3b8bf662f34997b84518744b69d4f1764eda6f2ef0de19a2701fb55e
MD5 cdc844e031f6688e1c4e9bb17a8cc4c5
SHA1 411bdf289488791187be8b1a54a146c8405319d6
SHA512 907efaa8fe9e31fb09c4d956833d7109852cdb75be79c4fdb82a1b725b652589fdd715562bf06aab86e11bbd24a449fb1daa50152d80d7546120c6416b483e89
SSDEEP 96:n8NNrYIU+bGz83uy3+u4tgp4DLjGQLBze9z38njBHMsDEuspU0wbtqrOQpPfR4JQ:nZf+G83uy3Ct7XBBKYH7DXspU3iD
TLSH
T15E14211F1F652312CDBD817668E744A35C7DF03F8B5266CA6C6104B0CEE2B52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 a0bcd3e6915fd8c025eb0f7d22d5fea37a07148d866b975fcbbdce6709fb768c
MD5 f1970c354caa8953a8c80171e9016e0c
SHA1 187d592162b8e886ef58cda6fccf71629b553ba6
SHA512 1b0e7031f9023dea64f9b05f9615a26eb8e979b3c1474e29349fb4982f75e1ab4c173154ad5d21ddfa435b46a89113c0a5b66c20c7aadcdceaf838b65291b288
TLSH
T1C9E0D8B068CDC15DA945709B9219770CD3F0341ADA886B816B0DD945F101904E6C2ED2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0aefde5a3e801869fb5b28f78b4afbfcfbf696c78a2d0bf33c1641b921766bdd
MD5 be6fca3fbb5228d06a3ba376528c149f
SHA1 1fe01b6435338f997c49532eba53ec27635a0d33
SHA512 3ea94f73ba37fbd385f28f6f83a84592b1dd47c8a9ebdf3d170ab7b1116b51471206c2dc8831988890516892cb1fc2fcfb5215ba14c492b235afea84e2d41160
TLSH
T17851CBF3C3E9966D890156F0AB146E2BCE5D0A19832C3D5A88E4AF5BD3F3471E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 ecad4ff0b72627e774bdd98a432dcf1f9c261bcc341219696d2fd491883c8ae7
MD5 6c55d6850006158810a887afa337a7be
SHA1 c7beed891d525211d11d1786aae4a83d41bdb870
SHA512 4ca522757fb77bc19cb983e6c9deb366ebaa988a389d5f477031c0e94042af9bddee42427d8c5a385a79ef513420c536171e581ff67233b59d8c4240a7e6392e
SSDEEP 192:DnIE2YAKt6i10QiIWdYLeyJh5yE20F6K0Vyg9NPMVe8I/hqQxOMJYsesmKfhrtwW:DnIE2YAKt6i109IWdYLeyJh5yE20F6KG
TLSH
T1C7327CF2C3F5867DDD1156F4BB192E269E980B2A43983C5684D4BF5B93B28B0F35090E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 56728af977a0a3a9f6480fcf7562f10cc535fec72f294693ce51080ef92711f4
MD5 7615505df101dbe2581c83c3bdf38e05
SHA1 263b9ddf8d3ee4b5ee034e9b93ed01c4a7a11121
SHA512 3099f5899c44a008a0f847c50c133624333acd171f2e84a87b5eec216275fe7dfd361dc892c2687243e0357c92ace4d8583c03a3419822a89597855d8bab0b4d
SSDEEP 96:7UNqUsUfbkUL93UygU6UJUiAUvURQcAURdUNdpUPwcUOUKUtUUUCYIUrUl1UFUh0:7UNqUsUfbkUZ3UZU6UJU1UvUKcAUzUNE
TLSH
T16CC1799FA6BEB82F207D1C67BE58780519BAF434126168F5DF63D12CB0878F75719022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7fb48c7c0f3489f5fbb2b57597d3b308639df593ce74635d31f4e65f6a7c7b61
MD5 fbc1d0422c9927bb4e0d9a5c461d6f8c
SHA1 1f6dcbce2e56e6cc82c9bd3d969a41dd53549447
SHA512 7b246037281f5a1109a7ad8ad7fe70b052247c9916cf140a22e0a28f896d82225d7b3287e586a96008d0e3bc7ccbca6983515d06976db80221963cbac704f3f6
SSDEEP 192:sxZIRsyM/jK1Ml8Miq/fwsNjYNJDVIdpXuHW6+WNcKw/YHDvEoZIg4J:sxZIOqq/fwsNjwDm+Hb+/gc
TLSH
T18F52E8156A38A977CCCBD209B945BF53D6F51472D2900E44AAFCDA1C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 aea87fa9e4709155b7e38974fdfce94d2bde7b101c4f80cb29993716f2653b5c
MD5 23912832fa3b837d2037c1bb09ec7c60
SHA1 7b5d619ed02d5045e335732a5a0725061032d853
SHA512 bfff09fc3a5552f3439b9dfe2aa3c1c8a2d84bfb1bea328c1f23266db927d828348f7ed0e957dc1692f3736af6155c63a2c574ac78b0151c3d96387ba140f2e8
SSDEEP 192:sxZIRsyM/jK1Ml8Tjq/fwsjWpVnjYNJDyIdpXuHW6+WNxDnPXYnmJQaZIgb5J:sxZIOeq/fwsjWvnjwD7+HbhXv/
TLSH
T16662F815AA38997BCCDBD20DFA45BF63D6F51436D2900E4499FC9A1C04E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2bd5f7ae1db47176914b859ff9e56f5f476f0df3a5e9708d1c14118ef0ecb6b4
MD5 cd28337678f28c65ce34317bfbe1bd5b
SHA1 bf977ecd497febe85b76bfbd7e81fd8a24f90827
SHA512 c5ed428b598fd681f8e06f6dfb62be28cf05f7ad04a53e4580352ff51249169b44147236862dc557dcd8b121f98c21787c4aeff701b635fac391676415fa3a96
SSDEEP 192:sxZIRsyM/jK1hl81jq/fwsEWpVdtYNJDe+jzodpXoiHW6+WNxqznPN52XtohnYcY:sxZI/gq/fwsEWvdtwDe9fHby+XXf/
TLSH
T1CF72F915AA34597B8CDBD219F945BB63D6F52436D1900E54AEFCDE1C00E6BED2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a60007b25a7ae09de31bab001d938eb53aa69038816dbfa2ce61edf3e168cc51
MD5 10098977513286fee5ebb43565c9f2b6
SHA1 c862dee610a6a9d5496dd3e83dd555fbb1747133
SHA512 777e0cb9d0e344da9ce4e2bc6b17b18d03784ba623d53f2f361c4d7c7eabdc6d50eabe35f330f5a761936166eb577fcf8fd5bd9683266af2f93a6de2f5e6cbc0
SSDEEP 192:sxZIRsyM/jK1hl8Tjq/fwsEWpVdtYNJDe+ozodpXoiHW6+WNxDnPNYe/tohnSJmb:sxZI/eq/fwsEWvdtwDeefHbhr/gr/
TLSH
T12D720A15AA38597B8CDBD219F945BF63D6F52436D1900E549AFCDA1C00E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 e4c0cf151dff08ea4794697f1b806cff5814cc5ba711c72645bc7bf3274174e8
MD5 5af15cd36c36cad80e023ffa15909c29
SHA1 bc601b6246f0bbd45040c8f4b464d4573d54954b
SHA512 5a4ab415371e65ed7d4a9870abe8d81110ddb40b23cdab72127da3ea4d64951947b6238a740aff5ca6b279fc85319906cd2ffe53f48d98b14918a6f96eb1639a
SSDEEP 768:0jUZYC07pLuLfgMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXbCeLlPZ4Rxrou:0jUZYC4EfgMWvg0Pou1jaybCeLZmRKWP
TLSH
T1D3F20A3B7C0CCB7E4F844E9DED2A7E8A6DE8018B5A98895447EA840C03C76EF11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 846f120ddfd0158cdc9fa9c307c0768d0683c6c19310dfa5a963dbdad71c711f
MD5 6d7cff026a39d4e86122f16af3ab1da3
SHA1 c83867318dc00b5bd7fff2bbe935ad412d58daea
SHA512 695830433b246a7eeb9295d61f0992426fb29161e9c3532491a976405621be48f38eae0f488c44d95039bfb3a85d0d94c3170fb11541723573ca8ac3d68740a8
SSDEEP 768:032ZYC07pLuLfSMWvg0zo8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXbgeLlPZ4VxroO:032ZYC4EfSMWvg0zou1jaybgeLZmVKO
TLSH
T186F20B3B7C0CCB7E4F804E9DED2A6E8A6DE8018B9A9C8D5447F9844C02C76EF51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 bebb4e3081612dd8b2910afb4ddd5a68a314d2e3ec99e7470cd92d057c763493
MD5 2962ad36d417191504fc12d9252207dc
SHA1 50c56545ea68985cb08511ed85b349b423f0554f
SHA512 8f52064974357389fcddae7348f0ac792026159393b64d3d2aa1def0e63f455ed17270f04d42ed7ec9a8f8e1a58cd271c5bd455c27e93fba1e99ce2dad85062f
TLSH
T177E0263419CAC27DA0A6348B13348708D2E9742BDBC83F827F09CE4462C3504B2D2DB0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 50106088a58f8a60c053618b664cd7386f15fa56e65577f13853ba23b2c4d50f
MD5 ac16926cb52fdc2b9bac3485c1174de1
SHA1 bb2385494e768640d4338320b736725f7c17c0d0
SHA512 0b5fa0be5b8a186949181b8b6fe87c9e70d92732c66ae1fc85d67811363e636a120f753df109e00cdfb4e6587191e08fd58fc7f59604cb9c422499dd557515d4
TLSH
T139B022C008A080C3CA00833CE0800CCC303ACC20B3C8322380FC00B08228B0CA20BA00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7d8e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a7d8e.TMP
Size 48B
SHA256 23e7d7cb56bc4dc2a5450444d2349e297468292d146e60aedc3973902074a166
MD5 bac311b86f576aab7cda90ba9b6497c7
SHA1 d8a281728740aae96c9a49f885371764d21e551e
SHA512 0f8fdd3a9e1dfa03ee5c49bb2814152ce8d3dcc69812dd8bf65fc2d7c1bc49d7dd0eef0808f087bd7fabf514ce73abb7a54ae662355025b787435f914b81f57c
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 857B
SHA256 40ac92eeb75228f588cfd362187fe1aea7d4859d8dfaa3d99a12eb8775dbc40f
MD5 e43ce1c9849c2680e3b922ed46e7e2a5
SHA1 546e033e9cc609500c724d2464753d2054475c07
SHA512 b7a6a1e247d038fa05c8e317b6e656c667e664a73b9fa9c1941a5f62535d2b6e691465607c9718cd18b4c4c5ff94a42d2bd745d26aa57bf84e8eab525fbd7598
TLSH
T158112BFB0B089466ED3E82F0145473E09777D1DC8A8988E3CB1DA24728202716E51947
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 01be36a10580bc5c0aed2c739ee62edf706ed3f58a72801424666e229194eb53
MD5 d58490d26c39a1112352e51e4b18a857
SHA1 fb9800e92d7dbd66014b0855c05070dd63495390
SHA512 b4837c97251113195b8f96e86e4b22bfbe3e0bb2d15efa75ada5c82a84f161676b6ad52ad973b941caf35beaf35819a7e91b0678f6e19ea40abf319f6dc06f0f
TLSH
T1CFE026B428C8C3A9D95074AB0225670D82F0341EFB886E42270FC444E301607F3D2DA2
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13430377689765494

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13430377689765494
Size 1KB
SHA256 d2502a4b0e58c8e2ff62c48189ec583e8c3fcb240fa8488c0e864f030ea2b989
MD5 01843e5a04ba8033738ce65a854448d5
SHA1 829c2e97ccc8338d1651816952d817df4df5c3e7
SHA512 a5820f714d267c9999909d8362cf63b61544d783bd6cc4eaa92f8d538e7c9d9b326c69ce3674dce743eefa5088f2a9742122feb1c45a40a523b5629a5ec391e3
TLSH
T16B4129EF26D8453EC17ECD3940BA79BAA62BB9107DD48D0F625573041C62601EF30C95
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 ff21a45438c5647afd87064001fb08050a1c53f1ac4f1094a57d92e4b66bbbe6
MD5 3e165f0a8e920b5b696fc3e122e746be
SHA1 19b83e72b2ae42ef6df36760d1d66cde87187fd7
SHA512 803ebb8f5b41fdca67c4c2879e4e064451deeab545960416ce42e3dda8e82fe02ff042fc3ededb43944304d13ca0f427d1cc27fc70290065d27493730b536b01
TLSH
T14CB01250FB049229C0888F7215585FE06301FC2290C004338D5F7F19CC84AE42E528C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 9cf58a5d6a72332116ae2104048c1bf86da3e1425e1a43d93907cbba5b3ab7cb
MD5 4809b1f480d43554df571e765746acff
SHA1 0cd30f39ce1b2a3bc31faa6f0c6701e8ef22e30b
SHA512 bee8e523287c99a519e89abf539cd7c7d7ba1984e413e73f24de89d702bfe2b695670cd933c2beac6afab6b4209305ad7278c491b4146ea895d2c118b08e2f2f
TLSH
T1A4E0D83029CAC32AA19674CB6324D708C1F37417DBC86A917F0DD54463861407383D70
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 e51e281ffafe1067c2fc7b2767e14d68a9b59394fb684a7c21b7f4910739d00c
MD5 c8996e0ca48035c1d139b253f710ef9f
SHA1 d9731083b55e7921faa5de0453185b919a4c4f53
SHA512 a5d4c45150b04be3c0ab585803799a50a23caf267513a210f5f9749c9e1d15786a2430ab7e89bdde8da5cbbe527a5e117f3b3c962bf5dabe000463227f5b8db9
TLSH
T1BBE086745DCEC339541478C34374970FC2F67D179BC87BC657088848B281264B7E6DA0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0a8cedd09dc4fb8bddde87e101f3f0082ef25203805987552a5cd4d41864a5b8
MD5 159dc170d05e46b2953e25659ca7a186
SHA1 f8c6e990f8902921190844dfd4656df492e33007
SHA512 60d2e58cac5c1d9449c046312f0c77e4d509c455d195ebac30241f99154cee0dd59d5d66b17576e23630f6a32511c06546a8c3e32a6011736e33e902f57ac0b5
SSDEEP 96:KA1eK2A4hqKao060gKdSmnOKAwGyGPKMoo/UxNn2:EMXPoND3/UxNn2
TLSH
T10BD1260231FB16023DBD3A19A2648B2B4742B5533018F52B7BE810B54E6AE345DFF9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 5bfeea271bc433b2e332db2e798682c169b5e6b9e7f921411add3440b872912a
MD5 d79f0396f5a2faec562a79c4a4420e9e
SHA1 cb5095193652d9116bd2ee8901d330c0809d45c5
SHA512 2fb7f705ff02aad073b929498543e685d3a3c93a8276fdfd3e952e1538287609a20a62b075de7cb270b5afe82c6f31d78e46ae92d1ba71347eeba9096058d64f
SSDEEP 192:/+5W6OcRfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:W5zfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1F724620A7B747001EDE6D9725CB080771E3CB16DCF22A6915DB254698EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c440f8a9-e45e-4199-8463-e8da43ac0300.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c440f8a9-e45e-4199-8463-e8da43ac0300.tmp
Size 414B
SHA256 803fcf115920fcf87a1e6b408ec2e875ed71f8183c757bea63ac121a814e46e7
MD5 c87b4b030c19b10c217dea4c83aac23f
SHA1 81b74884ab74abfa10490027058b8fe8fdce7292
SHA512 02d54d1c7633708f32ce3bd1ebded3ce68833e861ac932c0bd5170d120f1701e2e64dbdac5c65ae1efd3ee6e004b2359063f2b81b6cb8fd995aedbddcde4f4d7
TLSH
T14FE061EBC921EC3B08FC1B5954544746D64013672A404C1F7B3C900C8F71A3E4186CBC
MD5 SHA1 SHA512 TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 120KB
SHA256 127c2c9ca46fc0354783790ade7255458e9ff8ad0b2edd4f91970331c3052f7f
MD5 88953dfce6278fb12b337c9b06f655b4
SHA1 ccc6aadf2eae54a6b1f16ef409ffa077a164b3d8
SHA512 e94fc6aa8a3bf5ce9f9f422d5ccd8c633ed90aeb7f731490753bf3d4bbc860b05aa77b1c7a2bb8ca12b1b22d737333b4361fb8993cdc94b5381980520eaa25d3
SSDEEP 768:ePkjWUbApHDkMR+DgICmu0RJHtkTF6/k6Wdba+nxKUfbCBFPk1eJRQttR8/Dq3a6:OkgKFqX7brsDtCGVbR9BbzIcz5RydEid
TLSH
T1B5C34FF76C0E91A6CDCD8178D61BFE44807327218624D9E5AE3C08C37B78A0ABD759C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 ec7188402e5452fcdc3cecee64e3f0333bede4d6a8051f37261d172ea75ffd0e
MD5 c0a81be9575da9b6580e4482f5daa577
SHA1 7a2aaf2f55b4a605f1f20df5ce97317dcf2b682c
SHA512 9ba209fc5a02aa91ba7a66d70283e8cddf2a3c0286b59cde98d84ca93233d3ee92a513f6f60f3a71ffd4cd7742d2a04f24bb620c231b2ed13aae2ae43e1b4697
SSDEEP 192:uQXIIImbGMIMslYcYZ1Onh8AsNlu0Busll:uQXIIImbGMIMuBhhlsnks
TLSH
T10F42A61E9A169FBBC19E5F7A1256C3444AD488824570292C3151AC4F8EF3F978BCD6F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 6a9d7aa9cf1d911d6e471b4c45c29d610d548ccee98afddd6d8900a2155f3d13
MD5 4ede28fe557666a36df8b9b7e1638971
SHA1 de911ce9cd6f0ea3040bba4aa0c5e801dfcfcc8e
SHA512 0c596ac6c9a13af664b1ce7db166a73b7c59c932204ad2b09dbd8e41d0f32a9250fa5ec3fe6a040acd91572bfa12d1b5e2481fc17cc3cdfba02614f7076970b0
TLSH
T1F5E02630BCC8C3EEE62830D71135A389D2C4381BFE882E861F0EC448E301500BAE6D93
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9a63507b737c6a374e931befb28da1ee7f5f1acd29e03e6450c01cd53e3e6477
MD5 71deb09e7c3bc4fbe66e3315e2f032fe
SHA1 f239858d6f1ffd1ae1ca49c756cede1618fea979
SHA512 3b0417307d17f7b9ffd6208829c58248b0346a4e6094126285d687e3d57640992efdcf04e6c62a8cdcf2e8a42b2b6cc4a1fdbd546f2446e1e30781b52f247be5
TLSH
T1CA2147A2F338C159D1894A3A143E9B250738E417DFBCED1F25B920693E76E001D8B2E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 1334a545d373fb66c977f4e08895b7074ac391e87bfcaa9240d2ca3041d8801e
MD5 e5d9894321f2c9e2e0f287d642c196dd
SHA1 5fa4203cbb999d136351432693c09eff37d98bd9
SHA512 0450718fc2c6d6ac8e07d3eced95dd8a766bd7985220ecd839551c54e122c07eaa007c040eb87df061fdde1ad824e2a0f4d1b7ef7575f8d884b9873fdeec071b
TLSH
T185E0D83078C4C3DFB01030D30176E78AC2D5381AEE846F451F0ECD4893015417AC6D52
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5a2e02182c37954dee92919101132a1d1a79b23a3204a3327f29abb64e00baaf
MD5 0f3e97e9cf01082cc76cb6499eb64d68
SHA1 e6de9eac6405bd76cde9847d855de8c4d759d5e3
SHA512 1722506f62e67240b94232b6f1c03cf189555dbfd38bf8f3674d79754fa7f3cace75574d66c7f711ff12ebc381feea61997bd082d49904683be5a8568654224e
SSDEEP 384:n/ZcIhsNwvImW68YzX5od+2OO+ustJrJ/OBeRs9JKgqijURC:XhsmUAOTOOnWhJ/OTjKgqmURC
TLSH
T13A927B316429AC7299EBB541F88737639FF86077D9846FC8D1EC9F0C0456A9C231ED26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 491c99225f5a90876d42a32b700164b00f43d63d36e6b46ad765252954a08fd8
MD5 0d646331f3e49dc1eaaac3b4da57c9f9
SHA1 eed7ae94f845416711b18d4c59f03a5ee564abd0
SHA512 451e069374a3b763893063dab92cda3ba62bfe0626cc189b673c2a66bbe62b9be132743b9a0e80527aedbc2deb57c043b9e3272206cfc46641f029b1b35018a4
SSDEEP 192:yONC61VWQmiUyUjgGX5Obd+j6OuL+7/ar3BcU6:yONC6WRgGX5od+2OO+e1cU6
TLSH
T1DC02D836A9286C77CEF2AE49F48737235F95206BEA946F84D6E81F1C009765C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d5e4643371f097de2b42154eb6da08db10e0b532ac033d1bd0495fd744bac0db
MD5 cbb4e854e684e7f2f0f50900e1f2056d
SHA1 6a7987dd50887448569e745d8a41f4958f630955
SHA512 b161e90f6490a271dec9d17874f833bb76b9db412b8d7cfb5a06130e0720e5106e9409d76849244705f6484d8d9b4a5a0d4df676190192dabfe7fd1c2beb92f0
SSDEEP 192:mONx61iWQmiUyzjoGX5Obd+j6OuL+usySJrSjJ8qp3OU6:mONx6L+oGX5od+2OO+ustJru/OU6
TLSH
T1BB12F7316429EC238DE6A555F48733A39ED930BBE9456FC4D2E81F1C04A779C271AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 ce3825ab41f414af11ca2f235648be2547ea2e62662df67c2eb2d2f03ebdc420
MD5 3480e7fc9c3e0303cb01d1157bf44bd9
SHA1 8d9b6859a6fca6fa260d259dda46af9246e433f7
SHA512 640acc8213f8e88617dac569ecbdcdae489f085ab37111242b40b593a2ebc0c28314dc22d5f15e67ca2494a02d21e82380638120fd3b3077f63973a7abbf4704
SSDEEP 384:nPZcIVsNyUvImWduQYzX5od+2OO+ustJrv1V/BeRs9JKgqijURsHx/7Izg:HVvmIFAOTOOnWhv1V/TjKgqmURE
TLSH
T1C4A26C356828A8B39DE6E946F69B3B176FF5203BD6C42ED4D1EC5F0D004269D130B936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 df471d87c7de94933d482fbb30df8fe180a7839dea746c2010515441a3eaec9d
MD5 effe8cca3f2dfe54afe480de3f4cc983
SHA1 7f8bda85fffa6f6469d41019907ada4343b8c138
SHA512 15d811be115ac3ddda9e1ade4c7d965e123aa968308febcdb32a583c9cb06f9524c64a7d90ee1a1dce99f0b4f693a19cc1eb377dd289f9a867f826267f857292
SSDEEP 768:LVsmWAOTOOnWhJSSDKTF41aM3TjKgqmURC:LVXSXk8qUiigRUI
TLSH
T14CC26B71D4692CF744A5E8C9A582F6136EF46037C6984A8CE2F8BB3C305F9F81316976
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8896adfad91d3a83eec8c43cbb7b2d8c5e4d444e24c095c4f3a9cc5565054891
MD5 77061da250bf71e37dd039be571e43a7
SHA1 edf055de119dcd0642e6164bd67e8d1358d8d09c
SHA512 ee6123e64b8953fc4168121f34d826aad1661039714db1eb0b039197c0cef608e5ea295242a47056aca641e149c0a6ca61fd9c0d29ea6ebbedb62854e4699f92
SSDEEP 768:DVomI9AOTOOnWhvdSDcKmE+fTjKgqmURE:DVbIpXzcKmE+figRU+
TLSH
T18CC26B71D4A45CF748E6E4C8A686F6132EF85037CA88599CD2FC7B3E305F8B8531A865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8d19b37850616942bc83498b7b8f4f2b39d72edc50845877766a019ede3f4f57
MD5 4a3033285e4f80623daac894fdbcee84
SHA1 8a3c7b7969c77afb1d509261398ee6c3b03fdbe0
SHA512 2c40ccd7633811d93cd3072f2544aeaf71e78aa50347187dcce9f188c84b73d711455f2cad10a824a4d1ad4e11ee5c76eb753b0bc59e8d795be260c335422fd5
SSDEEP 768:D+3omI9AOTOOnWhvdSDcKmE+fTjKgqmURE:D+3bIpXzcKmE+figRU+
TLSH
T123C26C71D4945CF748D6E4C9A686F6132EF85037CA885A8CD2FC7B3E305F8B8531A865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a7e0bdbb15d877bf917b05faae04440d010ba5af2bdc0cf2f91e251d257eb5b3
MD5 4ba05bb77cd1e434119ee3ff9e611b88
SHA1 6ac4f8834ffbf3ee5d37d5d7601f95f2101738d5
SHA512 412f48e732ddfcfc16b2f0ec2b05c884d661e1db18b714661870462bc1b7e5f1b734dab967b37858baba43edadeb5db25d12edc780043c84c375a4787c5e91fa
SSDEEP 768:LVsmNAOTOOnWhJSSDKTF41aM3TjKgqmURC:LVX5Xk8qUiigRUI
TLSH
T100C26B71D4692CF744A5E8C9A582F6136EF46037C6984A8CE2F8BB3C305F9F81316976
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 250c8438f2d132825a51e4850b89065c98f7477340e6f039304f51cd8ea38e45
MD5 f5bf08cd416bdbb74ed2a0b62b6f8405
SHA1 4ed78fa3962e7c46eb1259fbadabcdf1b828e086
SHA512 779c28e9e0554eb5ecd3e09c48f2a52428004c45b5c7ddc34284db7568c2eb567c8ca104ebdc48cd5929877a585dae0b764afffe209ccfeef552521aa4e6dea4
TLSH
T154411898A6E90118B3B76E5BABF6686D487BB9772E0AD45E00120E4F0622F40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 634bf483bbb1299115ba15dfd524e7d1c0dfbfd07ca89c0547e86518fe9f86cb
MD5 5882a93ad50dd1b91ac2f702b350fc81
SHA1 e71025f6c934d898a0d4a467edebb6fc76efeebe
SHA512 9e44f794628575e566a5d8c4b9835a2031fd4b7f1f989f809934dd0eccd95bcf2ba7b1f648144f59352f61e06d81b311a1bb4122e58644e1191731587853b753
TLSH
T122514C6CA5F95144F3B7AE5A9FF2B8AE587F79732A06909D10110E4E0662A40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

1d14f358-6688-4e0d-a8af-437f2a850e7c.tmp

Path C:\Users\Admin\AppData\Local\Temp\1d14f358-6688-4e0d-a8af-437f2a850e7c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8480ee61-2da0-4eb6-a040-4ddf87d59a32.tmp

Path C:\Users\Admin\AppData\Local\Temp\8480ee61-2da0-4eb6-a040-4ddf87d59a32.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

89204ca5-7186-458a-a1b4-0950844f768a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir544_1341950487\89204ca5-7186-458a-a1b4-0950844f768a.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir544_822044061\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4928-0-0x0000000140188000-0x0000000140ABB000-memory.dmp

Download

memory/4928-10-0x0000000140000000-0x0000000141760000-memory.dmp

Download

memory/4928-9-0x0000000140000000-0x0000000141760000-memory.dmp

Download

memory/4928-8-0x0000000140188000-0x0000000140ABB000-memory.dmp

Download

memory/4928-7-0x0000000140000000-0x0000000141760000-memory.dmp

Download

memory/4928-6-0x0000000140000000-0x0000000141760000-memory.dmp

Download

memory/4928-1-0x00007FFC153B0000-0x00007FFC153B2000-memory.dmp

Download

memory/4928-2-0x00007FFC153C0000-0x00007FFC153C2000-memory.dmp

Download