hxxps://discord[.]gg/8vHwU93XY

Analysis

user interaction
yes
max time kernel
127s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://discord.gg/8vHwU93XY
Sample260806-vtsk7awflf

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
31	discord.com
33	discord.com
62	discord.com
19	discord.com
20	discord.com
25	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4136	msedge.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305102604863210"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{4EF96EF5-ED37-4A88-9854-6A0E8D2781EF}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{BB9E042F-E260-422B-B718-C2908094DECF}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3012	WINWORD.EXE
3012	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5432	msedge.exe
5432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3012	WINWORD.EXE
3012	WINWORD.EXE
3012	WINWORD.EXE
3012	WINWORD.EXE
3012	WINWORD.EXE
3012	WINWORD.EXE
3012	WINWORD.EXE

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4804	4768	msedge.exe	90
PID 4768 wrote to memory of 4584	4768	msedge.exe	91
PID 4768 wrote to memory of 4136	4768	msedge.exe	93
PID 4768 wrote to memory of 4584	4768	msedge.exe	91
PID 4768 wrote to memory of 4584	4768	msedge.exe	91
PID 4768 wrote to memory of 4124	4768	msedge.exe	94
PID 4768 wrote to memory of 4124	4768	msedge.exe	94
PID 4768 wrote to memory of 1832	4768	msedge.exe	95
PID 4768 wrote to memory of 1832	4768	msedge.exe	95
PID 4768 wrote to memory of 1832	4768	msedge.exe	95
PID 4768 wrote to memory of 3968	4768	msedge.exe	96
PID 4768 wrote to memory of 3968	4768	msedge.exe	96
PID 4768 wrote to memory of 3968	4768	msedge.exe	96
PID 4768 wrote to memory of 6916	4768	msedge.exe	97
PID 4768 wrote to memory of 6916	4768	msedge.exe	97
PID 4768 wrote to memory of 6916	4768	msedge.exe	97
PID 4768 wrote to memory of 6152	4768	msedge.exe	98
PID 4768 wrote to memory of 2740	4768	msedge.exe	99
PID 4768 wrote to memory of 2740	4768	msedge.exe	99
PID 4768 wrote to memory of 1604	4768	msedge.exe	101
PID 4768 wrote to memory of 5940	4768	msedge.exe	100
PID 4768 wrote to memory of 1604	4768	msedge.exe	101
PID 4768 wrote to memory of 5940	4768	msedge.exe	100
PID 4768 wrote to memory of 4880	4768	msedge.exe	103
PID 4768 wrote to memory of 1172	4768	msedge.exe	107
PID 4768 wrote to memory of 7152	4768	msedge.exe	108
PID 4768 wrote to memory of 2736	4768	msedge.exe	109
PID 4768 wrote to memory of 1580	4768	msedge.exe	112
PID 4768 wrote to memory of 1580	4768	msedge.exe	112
PID 4768 wrote to memory of 1580	4768	msedge.exe	112
PID 4768 wrote to memory of 1312	4768	msedge.exe	113
PID 4768 wrote to memory of 1312	4768	msedge.exe	113
PID 4768 wrote to memory of 3980	4768	msedge.exe	115
PID 4768 wrote to memory of 3980	4768	msedge.exe	115
PID 4768 wrote to memory of 5432	4768	msedge.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://discord.gg/8vHwU93XY
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c4,0x7ffe35d7c188,0x7ffe35d7c194,0x7ffe35d7c1a0
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,6129374256824338338,1637701480156289415,262144 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:2
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,10469048828252998112,15307622321346550945,524288 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,6592191122491136623,3866235591803051070,524288 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:13
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,1102974226440512319,17827196992236081166,2097152 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,7619304624794788517,18078760451784873937,2097152 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5164,i,10117378292570078975,16547032419155586834,2097152 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:6916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,7324885605964978488,15411379527964440695,524288 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
  2⤵
  - Modifies registry class
  PID:6152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,13325145446018149579,13192243784012253006,524288 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:12
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,16448382542987780860,9592849206379290601,524288 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,13865546447011328627,8451539562079601638,524288 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,13559544666710484696,6823304546106648545,524288 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,13559544666710484696,6823304546106648545,524288 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4112,i,17007541656190809634,7185418986070987748,524288 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,11675477189228676349,1968888662438387959,524288 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
  2⤵
  PID:7152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7296,i,14528569318092766846,14685763106585853899,524288 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3044,i,11710487400944175886,12221398251959321168,2097152 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,11216894618710726576,1021816181935196924,524288 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,6802947412142736844,18163120865433609709,524288 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:14
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5984,i,3512655688700294776,4299087335525781661,262144 --field-trial-handle=2632,i,13397616942995275902,17916615946169530006,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6928

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2828

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\ExportPublish.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 63a32fe7ac4d446ccf3073e4b319eae37d9ba8c22d95ae174c1f0d20e68be7f9
MD5 8764fd200fc12d425b5974b76f2bcb75
SHA1 bd0a381474429a01c9e6e44d52da7c58c1ff6a7c
SHA512 9592bb63e9ab132d33349795ba3af6a5785ccbf71aec99bf2b64bb9e64d93df72cdd2847ec2c1aa6d40306e1bd17e5d4ae0fa9ce3d1521fb43573a42f9190457
TLSH
T1FFE0DF160F8AC5ACAE52AFCFA059E31580927689DE88E59D322DB8CC2C8060893558A0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c496f37497039c464f1bf9f82e56cb3e61bf479efa1a18310aee93085b679fd1
MD5 17a2f0f9689c86e3afdd4b2289a8841e
SHA1 39da0c1cae82d696635588ce73376b726c1de637
SHA512 2e18d9449e0de4618bc2f752a323a4d47afee9cab109e45ab220eeb0733fe7b81534f80df5550deabaebdf0f3edc49c8005093d40b4bd090815fed89ab3da539
TLSH
T164E02BA9C920BC271DFC1B1860980B47E750136B3B40994B7B3D822D4FB16374686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 68KB
SHA256 d57595fa250e885e5c20572a24bcfb95db9a488a89cd7c702763b483abd28a66
MD5 c82330869a91007bffdf44b4dc71a7dc
SHA1 7ae45d2c48db838cfbca4be2b503283aa32efb7b
SHA512 f4e75e29e08ec30e596dcae8b195c8ce8aeea3d07a4479c8da06c167c019bb8f07a5da70850fc4c2f5bdcd619dd9d3e621ea7c12202cc79e7d4a4cfa36af0673
SSDEEP 1536:viBhuVtgXan5fzAzOz6iuHdZl6eP+eUViPr1O+sih:vi/XW5Up9SO+eB1Om
TLSH
T1E26302773D91A313B54A09D60B74719C1B386A9F0642BD2C32F6F962317CB8B69F9C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 405KB
SHA256 af11c5d2374cd8fa7cefc5be9c78f97211e0b9c3ae3605c35ce843e2c540240d
MD5 63d15bbba31b8c110f9dc44ceb974fdc
SHA1 f633cdcd45232cc0d5f1fd98b6ae0545069371a4
SHA512 feb6072a99b34ddbce9f9dd1c8c5e1cfaab6d7e4aa61dcfef514aab9534c6f4c0991b3aea447f152d2df72645ed5c7d31692212825a47030c1a039b6a3917db9
SSDEEP 6144:TFSrFg2IHB/y5xSTX6XxgVyVrE/iFJnmHNsXvKihMOeB/5ZqzGa4HO5JY26cYtmf:A8yDSFVytEqekvKiK/ba5JY2eKJ
TLSH
T13394238F54906E3C6B9B0E91A49CF7F2376536C3063DD05EC81AF9C229C9105ED99FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 204KB
SHA256 b1881282fcd472e8b0acea8ee42141c4982db9ba7349cf46efb0aa693668cad8
MD5 a7c6a1c53553270049fd3cb54c792584
SHA1 302c428b6e895e2d577eef6dc829309933c2ba03
SHA512 9d039a73f4f4307f2a1ffb1fe9b629ef630d51ce190d56d1a36f3868ccfebd14092cf508cacfa68884907c6d4c39f231b0b552efd866fdcbf538c3955eed7f47
SSDEEP 3072:rSfKfXTHiBpozSkyTkLaWbB8Bc1TD29oBiqkh6zRZHdsnOim4h4LPnFeJ/zE/RS:rSCfjCgzhyAfbBp9VWqRpi5hgnFw/z3
TLSH
T1B52423F42A93497D81E94668EAA139D595E4161B1CA00DECF850AFDC4E3A31B607ECCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 256KB
SHA256 1a51a39a0181abb211af41600112378aa74b3c924fcb662ebd001a647233107d
MD5 455327b5819e32b79e98198399ec7a18
SHA1 43a90a3d3a2d989910edbf818393af1dcba2fe01
SHA512 f49ff3cce466d2e8a38cde077a149d342839f9531c9b4e801725e06bfe0cc01ba56d2c807cb14f584fa53b905616952a2029945bf808d110cdde5f3ffde80645
SSDEEP 3072:XUEGjRWiiI7+mJEpXj2xJZwVvWqRUXRf2QT3ScwuA63NonSznC3V:kvRb/6p2xJBmUXp2a3fztC3
TLSH
T1AF440250EF046AA2CE124BF4DC692F3359B551DB20D0AD0A8BB9DA107EC6193F70779B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 256KB
SHA256 2d21ac77d43aac526fc8f4f95a4f2ba2c95221f904b0a14b1b6ed77d14874ca9
MD5 0a278f69b6bb8164cdd94a2b8ddb4b06
SHA1 bfa2d69a23529a94d4117b22c0b26be86485d58a
SHA512 4b19cf11c2480df5c75c5cd7c90d1af930821509e7917a0747f7e144871190cfaf646ae4a9c950e9488d7718f5825bcbee34d7e8dd78d7e6f4e4cbae9ddcf871
SSDEEP 6144:qyCY92VsF6NpN+5rIs0mSWOPn/+pWDkyXwgZjBXgUe:1CYSsFI0c7m1uNXpjJgUe
TLSH
T1C54412E6EF02D351CB832FB7E12E2D735F38E4C534D56D2511B96E00A498C25CA07B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 512KB
SHA256 3102bb4085690e0764d87c6d19cf28e7a8ba07534215cd05f3f869cc023bf0ff
MD5 063ce058cf92f6249d441c03c9dcddf1
SHA1 6237aa7a601d9500ac6bf6fb7ff57c64a936f9b0
SHA512 cd8f11170f42188e4a5334ae234c046ae722c3c2f7e3c5c428a04b3cc382fa0cdb160ec992db5a3af7dd968e428fa99475bd7375724bc501e4a86bebbbfa2df0
SSDEEP 12288:JqPcXea7AxraLRORPUdUxYUtrM3GS1fhQBcLLY1bKd:Jq6VQRPMUxBTSACo1G
TLSH
T135B4237717071097D53AB37022CA8BCEB7AF77BA4B01EF7629239744E2C8445F4AA490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 32KB
SHA256 c0ce35b8ada99db22bf42d9b771428bd048de9348743628fbcedcb677123cbbb
MD5 971bfc3fa63af64c3f0a0c21392501a3
SHA1 e1fbd7ba7f4e73d0c49cae8824ff4aae87633cfb
SHA512 ebdf18647a3d815e88864a21b718e852cafb5ac72ad156b000b07d37ab89e79812270b21939f6fea60580e4642e4851d7cf322f229a748603413b0a6987b8866
SSDEEP 384:oujCFeHutM/t0e2lxQdS+BhNGqD/di4zHhpLkExbT+cU9Y:oSCFWuQt08g6BVDhR43Y
TLSH
T1E3E2CF8BEBC6A315C383083DA50F3DBE575C7DC458966A024C6367EAD154F68A0C29FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 72KB
SHA256 2ee450e82bb3e91cb1f98f0dcbd5286846f0d560c09001da28f5f29c00f1b8e7
MD5 c3245e892cab7e4ead00b48327b6e155
SHA1 39b9590213ef742b22456d1d57d7e2bc59d073d5
SHA512 de96cc0c709cd23fe62d317764831a159f1b68d6639c07cf0429a5df43574dd49d2b22d4e1588323f8b679ea42593839e7695997fa52bad1f6dd8258a2b6f458
SSDEEP 1536:ZCIgCoUHcMbCc03Q1Ep5J1L8b7umiVOsuHaoGtQaLDzPjm8NfY:d0U8gy3gEp5x7eaiOb/Y
TLSH
T14E7302A1C412FE652DF10DADFCFA82093624527D256FFAE42A2D67CFDE95130A4C4CA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 d99aebbb6bf8f8f0a89c78d437595edb8b0350da86c049ca9432452bdf5d6539
MD5 4fde97abd4c5735d2a0746a5f6060173
SHA1 ef4bc33afffa8a0d1a86760ff6cdb087ccb74e25
SHA512 5678386022c72d570ee3fc14b20dac8c0918179af9f964685a766b5921e25376b5976386cbe353283afb6729555e6098057d33080a8f0d5f3408bd4bbf64ee18
SSDEEP 192:izoiJllIS4L4ZHL85bTdn+HOOVn0u9WKduUFPtlf0R:EJzIS48ZQ3iOZssyzi
TLSH
T187225F5BE9D042B2EFD4267112A644B732FC15C823075B8A034C5DEA248BE456DDFAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5ad226.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ad226.TMP
Size 3KB
SHA256 2d2931f4690664d645757f0340911f0d712418011b62b17c1f0fcd48445ae508
MD5 96fa18b04c400c4d087a988bc08bffbe
SHA1 c8ca7c7fa196f5aed93ba606718b3f3fcc0e9035
SHA512 6bd86e6cfae1431d67865a2fa081de736627dba569af9ff905aa988a86580f26fc601c7673cd22987966c096d422fd038bb3554df788efa7235aa7f9f843e755
TLSH
T1C2614B9D4B992BE3F72198F290E5448F36F494E9260BBE1D03417EFC9806F1920E18E7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 114ccb9bca484d867e223c0ef4a5ff002f5f4341dc8e6d038507ad405ba3f0ff
MD5 9e00587014543aa9b60d0456aa6adf67
SHA1 2681e6d3d705d396a31a4c22bc7b8922a9fd1f36
SHA512 4e5d4df2777ca4b3eb9b25ffce9f593227d1224c857e5a9cba93cef8ebe593cfb30522c98df20dfae3b3e55b56dd6c4bd0c6ef38ecdc1b39a6b6e5d52b2a805f
SSDEEP 192:DW1864WX9QT3aVcaij6VZ1+rWfYLrk4ratkfruroPeRYGkj75Ig2/tb:DW1864WX9QT3aVcaiGVZ1+rWfYLrk4rA
TLSH
T130F18CF7C7E5822DD91192F49B146E1FCE2C0855436C3C2AC9E4AE5BA3E25B1F18174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 9693644f62758fdd003772c32609636d096403c2d84040350df24401206b3f02
MD5 51b88dfa8a9f8d96f77e6b8895eb0cb0
SHA1 f69aac05cb8e0c0ac1a3e62b4ad823ceb0d5fd54
SHA512 742b46e8dfd08fddb3fd35c53af4db98701692c559af4bba2e453400a57b6a12fb7b2b86c8a582ffbcdfed5efba7dea0a16159d01cb7b041fa0d8412211d05c9
SSDEEP 192:DW1864WX9OaVcaij6VZ1wzrWfYLrk4ratkfrurqGP1Rft5T/jtvx:DW1864WX9OaVcaiGVZ1wzrWfYLrk4raD
TLSH
T17BE18BF787E5822DDA1192F49A146E1FCE2C0865436C3C2AC5E46E5BA3E2571F181A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 a060358c1cabeb9fd92662180a1459cf89645f19c1414e8705a74733aca3fda8
MD5 07cfd196eacbbe570187bf2c66df8331
SHA1 eb91c19937097d97e40f30d042cd25fd3b0815c3
SHA512 2e1e7499168a059b95dca5bcc81a2e56628c6cc621cc8b2c29b2bc4b850cada0656584f0f7f685a7e4db7d5ca0cc143af01e0b57d180a7d7eb1ce2a3f5d84447
SSDEEP 384:sxRURYcOl/fksQUN/SXTn3/51w/WBQsGQ+0m5:sOwl/fYe2r/5cWBQsGQ8
TLSH
T1AA82080AA9245D3B9CDBC219FA45BF63D6F81173A5945F44A6FC8A0C04E6BDD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1b8db8710f5a72bf47ba9e7eccc927ce58d3d884cd8397479eaaf19442f8e398
MD5 c6338ed7e2a6128e6a382634773622b2
SHA1 83765dfad0c3bbb078f5c1c53c8c731ada80b5af
SHA512 7154eb4dbd194ea9999597ae83b55d0317d7b70edba7dfe794b60de2b4033e1d40eb24ed1123f9b487f8885ad3f229a9f26978b615cded20413d7fb9b0a6a861
SSDEEP 192:sxRlR4yMvZjK1Ml8wbl/fksnyNRZgrzoD8pTa/g6+WNp/H/YcCVCwsGQ+2GGIgj5:sxRlYll/fksnyN/gTm/59/WVTsGQ+0j5
TLSH
T18D62E9166A349D7B8CDBD209FA55BF93D2F81173A1905E44AAFC9A0C04E7BED210381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 c956b09a4aa680728bb6a137bd7478a4a78d8ca4ead2e890a1abb1016a12ee4a
MD5 57a04f933e358c20ce8c61fa0c3d3870
SHA1 f2e0241400fa0e726ab64ed5908b22fce73bb4c9
SHA512 0712bc27f3308a725e6e7f2e6cd4c5f82f3e91719ee21591408a55ff38714a85f9c5aae7ca0977cd5e560f32fbb8b315ca2cab052ebc79a70c4d68794e13644d
SSDEEP 384:sxRUsYcOl/fksQUN/SXPzB/518fWlfsGQ+0m5:sXwl/fYe2d/50WlfsGQ8
TLSH
T1F482090AAA244D3B9CDBD219FA45BF63D6F81173A5945F44A6FC8A0C04E6BDD2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f7c48a581582fd102b7e3adbad9b0e848ea4ed6935375ff50ed0c95f7bd82586
MD5 49aed2752de526c353798cff1e116a03
SHA1 516ca844fcf6848153826656a9b083cbb01088ad
SHA512 546d9261a331d6f891dc198ad1d02664bc3e5809ebc41171c65bb16a19372678889cd955b15938fdf6c770002eb7ad0736d4ebc04642bf90383a70bbe18d3459
SSDEEP 768:Ob4YATWg1NfuB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBbDwzrol4j:Ob4YATWg1NfuBu1jasHwAaj
TLSH
T1DDC2EB3B640CCB7E4F844A9DAC29AED76DD801CB9B984D5447EB890C03C67EB521A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\259fedcb-8a98-4c4f-9472-eb3c3e431140\index-dir\temp-index
Size 1KB
SHA256 ded434a3e0f88746adcda9e60a3027c7e85e5b46f8cba60d3030070369ec7d0e
MD5 465844f6621bbe08d9370745a91fd30b
SHA1 e6b5f4380cd3b180fcb26a2019708500fc7b58ed
SHA512 f433c4e70c0c956171c6adbe685f70244602686f3f457dd9198dd8242495290acf18d27f053e59f869ab4f3a29bba0583d9d87e86694bad2c18bcdca67f8d66e
TLSH
T1762194538CE2650FDC3A64B6357E00DD373BE5EC1656DB8B101C7138AE87B289480A48
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\259fedcb-8a98-4c4f-9472-eb3c3e431140\index-dir\the-real-index
Size 3KB
SHA256 ac127867f4050986f32173466015f4dbbb8bc59cc600692848c0e254a00a849b
MD5 990c101c2a2ff73a9205f5a9c3461768
SHA1 1ded63e8e49a6453f7ac26639b09fa1be5180bb3
SHA512 57d2c407b59a200330e41e8ea9aa75a6f28ca61e8a09cfde6880806eb15295b2683c8c7089ee8837b95e0dfbbaeed25c6cc463a80ee9f56671b2ce2de6e54f35
TLSH
T1ED511A0E8D471DEDDC6C14F36DF60492737978EE9685DA0B669D6031BCC333A2E15118
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a011a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\259fedcb-8a98-4c4f-9472-eb3c3e431140\index-dir\the-real-index~RFe5a011a.TMP
Size 1KB
SHA256 6e8873f0977e9b235692a4abd2eee2e7f4a4513ec80176ed6ccce5172502e710
MD5 f5029df77fa764dac22146bad15fb9bc
SHA1 18b60922da89beb5f7618d76271b67e5e1beb27c
SHA512 2d8c7527c593d70ab4a9cbf62e301879495d39c6398af74e867bdc1d25d766df16f1961ed3d089a3d9a9768f7ef1907e98654721b709201496ddc189b70094eb
TLSH
T1EF21676380D2ED07ED3A60B5B20D00DEB73BD8342396D75B216EB8781C56F2889E1945
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2a61cfd8-ab74-4136-aba7-b422dc547654\index-dir\the-real-index
Size 72B
SHA256 4279201a2f35b13408fb723819eb00b9cbcf22466838895a834b5682ba2a4105
MD5 97ac1079a5d834aced660eeb1186cb97
SHA1 a4e4b4c28f38cdc3dc04985c2e36096fdb910963
SHA512 abdd5c84b48514edcf7983adae12b0d7707e9c1ec597c43ea436d0d320352597b58e389fb39423cc35aa1c73e18b4ac38468096d700780d51dd23f621ea56301
TLSH
T185A002BA41A08786D1441778A54367D832D04A5433655A424BF0448CADDA7519253049
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac833.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2a61cfd8-ab74-4136-aba7-b422dc547654\index-dir\the-real-index~RFe5ac833.TMP
Size 48B
SHA256 6c0d551827d95d65c266aeb97577530be6b84c21143c8dead7e0e225bab7c982
MD5 dba7d1d2cc4c8318b1448a41a2cd72f8
SHA1 b4edaeb03b7d847de7cec49373b0a5529ea6dc66
SHA512 ae9dba4ad439729bdc36ac0caac7e748451b7dcbc7b9fee25f67c99def82443cf633ec378a881b7dd3dd0dcc15f07b06fd754c99ab2c458d75b2322842b9b36e
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\aae73acf-cdbd-4384-a1b0-ba33adfd43d5\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\aae73acf-cdbd-4384-a1b0-ba33adfd43d5\index-dir\the-real-index
Size 96B
SHA256 4cd15fac70188166c52f3ad4f2a31eefd16f58bb8554297d0b5238d248ed53d7
MD5 878b983b4753fef9d6c3512ac3ed911b
SHA1 5f0be7b14e350e3bf7923fbd11cca44b172f8389
SHA512 3e6f033ffc49e18b1758dc2ad709003c568906b906ac5272ab227df9dbbdcc0745ab9244d3814bb0f5aa708df8052171b9d16144309a4fbae161d0c6baef72bd
TLSH
T115B0112B288200AEF02202F02082002030A88C28233AB22282A8A0B8E83030283020C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac824.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\aae73acf-cdbd-4384-a1b0-ba33adfd43d5\index-dir\the-real-index~RFe5ac824.TMP
Size 48B
SHA256 fea7f3bed41c8b742304a6fc42168110516cb0d7fb231f0967d3a8ef01f25985
MD5 feb9f0a621e706ded9b0d7b812975aaf
SHA1 9bf0a3953c2734283923d8fd9eec73994a873d80
SHA512 e9041413107a886324759d1525b199031c1f0823cee017ee20c59530e0e44dba03e204338a6a631f1da52d14a4e7fb33df28308d5ecff1015e8e151bdab9d35c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c2f46ceb-3179-4e07-ab6c-7bfdeb7e9fd8\index-dir\the-real-index
Size 72B
SHA256 50612bd5738be9f809a89e3f96978ad05769a28b0cdb9315b945dda779689c3c
MD5 d55e2199d789cabd93e0504231e40b75
SHA1 cd3e621130965ba79ec1affb0f0265603a29a141
SHA512 21e68fefbbce676b6783191fc1a27c7f7eed61998154e0560064115ef2eded6fbc7bd3c19aebd3aeb4b7b865650a0ce1b12922c3e2c3b8b9f47855f2d8eccc63
TLSH
T13BA0026042D81087C0020AB462D609B123145C15A2474305C5D40A56886157C8653087
MD5 SHA1 SHA512 TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fbe35b9c-d47d-4c26-baf4-b0c5f8dee19c\623cd082b6202da0_0
Size 61KB
SHA256 050eb09cf872c397f1ad8b1e3f7ade4350895d33436b8652effbed171f2dd72b
MD5 20f551cdeddcb9886a9cc53c8347f86e
SHA1 12df9ced78e46445155df650225bd18f1b37636c
SHA512 4de45afe685b51290c69533e827ae6ec64877b61fbfafa27fe8d14e98ed76e2aca9cf26a7aeb4d7c069edb93bcefffaa6704cd3dfb6b6fc8b4690d16bd358ecb
SSDEEP 1536:s/j/i4JfCS+ksYyiApR+M0DpbarcjX1wRkjN5HPwqpzG1/P:YO48bC6Rx0DNDjg/P
TLSH
T10F533BA7B26260358BAD21D6A4567F00F11B17461844C9EDF0BD66913B18ECB53B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fbe35b9c-d47d-4c26-baf4-b0c5f8dee19c\index-dir\the-real-index
Size 72B
SHA256 d6032530e3c5a59c6c23fb4bc3dfa01b55d6a5f7ef39659064eff373e398416f
MD5 1a9b42452961a2e455e6c54015a997a7
SHA1 b2f3f23960df0a763ac632c3480620a0354194ef
SHA512 d8e5fd966876cb15623f67ca3c0dea9279c54fc4509f1e39d36bb65568a927d8c3e4670a56b1f66b4ba412eff972de1c09e30a71eb3f0526c9f1d3c38ce32f98
TLSH
T160A0021043C0400BC05615B225D6026252508910B110230B45910244ED61DA05A9300D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fbe35b9c-d47d-4c26-baf4-b0c5f8dee19c\index-dir\the-real-index
Size 72B
SHA256 e7859e81150f377d906d1abaf3b21bb0ab30357312d7a6e91f20ca9012c10bea
MD5 d9ccfda30c5500c6348cca3302af1afc
SHA1 f0365b3b3d8a40376b96b8ef42926c09e7edb0c4
SHA512 a42d7245ffa1d6eab802d5043e67abc5fb90d1c140e4f9545ea1ab5361e61a41a89d267485b1ae47a3981a0b31b89c8755d6b2f9ede54f60945a9d8be14ea3d5
TLSH
T15DA0021417C4C201C11212B03697C14176A04B2443435B0F61D10054C8509DD574350C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 7f8bac67a20e9e0212a09f18cca643f34972377c827441a85ca26409416695d1
MD5 046ec3c670d41353fe05a829a34859fa
SHA1 e59ba31f477f416dc2e7cf7cdd63af09b2ba363e
SHA512 52a22655130ffefd1288f44120027f4e85fb7b7631e956ccf0ea965fea755704c7b130d3e2425573a601dec13edad84afaac1e614bd07dafa49e94e36ce027e2
TLSH
T1DFF059F26EFB1404BD7A8BE2243148B44055BD08CC05FDCE111AB58B68732417029D72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 e8bc6ee6f2f42e7eccbfead5e4c01e54e70b08374d9c03d9948e7c0cfb87782b
MD5 239d9404af8a3dd711234d1e6c9cc488
SHA1 6966b48dc161726703ca47bb64492d3dfacb6d19
SHA512 5c636774c92a7006dbc14a3201a87f1be5d2982790cf59469ffd1e35561ec4021829932e09b8d99913fbdd654a9c0eff2510dc7654d0d5cd8e0d3f4e6b849dfe
TLSH
T175F028B36FFB2844BCBA87E6243558741454BD08C806FD8E151AB58794B3305646DDB1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 57d180877cd102b777edb6f7cf7193e6f58bcc99d20ee71eeac15a59ead2b12b
MD5 3b9e248481a22e0ccdd195a158607837
SHA1 b1d0f2cbe223bc78abd7acf297e2d2fa4e553ec7
SHA512 53c220bc6bd1c56466c4abf2bf4b73eb70922bc54ddcb39fe4cd6705ae7f6d27400ff9f378b9a5f3c88f74b7f48f13cc4d1aea87204192002caed32a81278d16
TLSH
T16EF028B26EFB2444BCBA87F6343148741055F908C915FD8E155AB58694B3205606DDB1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 7f63bb3b47d9649c7e761d350883351759a2fc70efa0c18d57e01b0f4ba5e06b
MD5 a7711fe8965a3472ea61d2d5d289bb3f
SHA1 0d7a4a56e71c3f2f3f43af8b7ea5e8309d56a76e
SHA512 8970772979fd25c6b049a91ca4e0d3156a1a178c2a36722388338eb15d9dc6e0856869a921d67b7f670ea655f9aa1124752ec356c78f44ef51c3546176f34682
TLSH
T150D05E67E41528A2DB7A8A922A2255AD4A216C8C2485C08DA512251E5871ED3D225E9A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 0c6a92e69d5855a382e38a64470579467332038bfafa4547192e0b3e91cf71df
MD5 2921070798d170418a92e59e56004c48
SHA1 d8ca278b4b05eeab49c70c0277737ab2b4b5bd3a
SHA512 0a18e024831615450e62c288d7e7e7dc594f451ebe6844f8fe790478b5b9e800c77858bd1baf1035d92c98f755635aed4491b750fd9c0895579b9b9fd242b5f9
TLSH
T18BD0A767F01919A2EA7BCF912A22157D4B117C8C30D9C08DA512051E9851FD39222F97
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe595421.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe595421.TMP
Size 138B
SHA256 51ef2347208fe3e7417e49e85c9f00912d7a793d98fe9ba21d4f3598af14cbe7
MD5 62e3234530b6e70711a05af3ff5351b1
SHA1 b1d9ed13a817b39cf4dc2fab4530324dbf991c51
SHA512 12045a160bc378935cb34e2e92566896d25d5ff6ffb3a84954e35ed85603fc0a4ecfee44f94c822ca1d50c7861da8b49778a97c8175a051a4aa521db798f4000
TLSH
T1ABC08CA7E1041916C72682620232204D47002C8C38C6C04DA10331282031E636201EE2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 927204c204a821a75615806ea5754ca7bf0d27941a3720f61e87a22dab558077
MD5 7fbbbcb313611e53068562e3e22d5bf8
SHA1 7f76c97ba7078cdedeede16b817a1f6f8d0efc26
SHA512 259ae38a81896870220d24b3d0a709847921288aafdc80cc70201652eb363707d5f4b669a6aac06a2ef6090cbc3a7e1d852cc366f3347911f27f186d5412342f
TLSH
T1D3A00260CA4ED805C59546702AA555707FD09DBB020923114A98D4A99CAA1D061D6101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a595c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a595c.TMP
Size 48B
SHA256 dbf4cb31e3b8c65181ae873db36e60fe8362fd68c991b5138fd4a784f2099f06
MD5 c500d62de22cefdc51cfae4737f0ea18
SHA1 53da2786f6eb15eafcfdc26735a800d22cb536c1
SHA512 79b471f3a5815e49c819b47ba9702bdf1b4c34ea9920a578cbcafa3addc490f171bf80bf9665e3d70a27cd670c871ac64f9d2d71c9d83374413f1ba036f13a79
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 29319d7ee0975bbfe69fd95a41063c66fb9ed617c66e5f221f73fd928119ab0b
MD5 c1b81f852170675d01e074fe9a738b62
SHA1 e275fb42cbb5e92c8399f4ea9fbac0e076d99794
SHA512 c492b8da655933606f3417094456a87fdcc60da2fe30bb7487f3ecc3dec694b271658623357a2e9a9846b63976a44843524193924b082768724dbf0c5fe9c43b
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9R3r:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRE
TLSH
T1E2B25E11713F4290387EA90C91B8981F86C2B4637519F53F7BA802A65F67E139DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 eccc2cc57d617b06803fd4338e4f17678fcd8ff7aeca80d17309f56259d10114
MD5 700e42ea9733cb709109374c56ecdb79
SHA1 643e9689e9000ceb20495a5a870aaef18451952b
SHA512 e3913f7dc6bb70914b6635aea349ad6c9adadb778bc4234558caa15077ca89c401a62ea269f76a32ff869b06f496c7a7fc208d8e35959c0024f8ec107980e3a3
SSDEEP 768:xFQ5QcwgNuS0xGUIWEL9XnewBKZOOWOPt:A5Q2uwLFnevZ1JPt
TLSH
T1C6D25B76DC68C9B3ECEA4F94A70AB646DEE44163D58C9AD8D6DD5E0C00D71DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 849d715748b3367a58167ee05dc15d400068cbab95334484b20671c011052452
MD5 6a3abbaa759f21b9257865b4dac37b33
SHA1 5bafc6f761f2789cffdc2562b243df8fb87fb518
SHA512 cdaaea30e14f345f296688f44b95a009fd68207b939fb382b3627e27a5140cb84c4ea5ef8d79c86bb4eded718c725ffccab25b753961696778f2bf6e96681634
SSDEEP 768:MFQsQcwgku98KWGUIWELMXnewBKZOOWOPt:/sQdu9zLynevZ1JPt
TLSH
T115F2B2F698D78972E8DE4B87933D6D068AFCD153B5884A94B7C95D0CCC861BFC306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d5a70174989f09606f5fdcd92cc1ec9da812c3f40a19818cab1f3b3a4ada037f
MD5 95146f0c1dffbbcd0df74ff42f8867b6
SHA1 fbb0a3894c5c014d1b5224c47d689280e28ae603
SHA512 363f61e1383b0610c71b41925d72f06a19835ba23bc51161ee9665cbd2c7b19fcb4361cea81479a5d1bba01a63869b3b4b5c167bbbb9dad1911c3054fbc986ef
SSDEEP 768:MFIsQcwgku98jWGUIWELMXnewBKZOOWOPt:NsQNu9uLynevZ1JPt
TLSH
T1FEF2C1F698D78972E8DE4B87A33D6D068AFCD153B5884A94B7C95D0CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9c9a887a302ffddeb8d058e78d34e029c2955b16993eca3444496c1d9557f7be
MD5 ddd0a01ee0c3b68f54154f51a6a15949
SHA1 4b3b775c09ee73ac56353433245435402d50c452
SHA512 1253233c515b69cbddef975a586dd958be8771f7ce02e72b37e9a9977ecc6d2f407b7a64b9f6682172f30087a35b2c4808f750fc8aacd40124658b198a5bf35f
SSDEEP 384:nCiF1tNn/s3n9Sn8Ngs8TUNTUlIRiPvuTuKREqfbYGTQR9XQpLFOObjI9G6w7ia6:JF1j+9SXswgUu3UGUaF29Mi
TLSH
T1DFC25A36EC59CEB7ECE64FD8B34A7A5ADEE012A385985AC8DAD85E0C00C719D4307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f4cb142ee80f170b2f46caf9100b5f535870b803a8109d9ba7bc1188875d7fa9
MD5 d8507f3429995faf43c3a0f3bedcd61e
SHA1 cbaccf072fa9f15e9f57b3abe763b9c2d3b0643d
SHA512 b9096ae696314030131187823939f9c7efc42dd439b65bc22ea1ea0d0842b01de8d57e5b56aaf554dd91a8049e3e4ea88851d099b1374a18796ff69095b49a45
SSDEEP 384:nWiFiZcI58NLc8TUNTUlIRfPvuTmE/TEqfbYGTQR9XQjWELaYXnTKwBODNZOC7Wc:9FQ5QcwgNudiGUIWEL9XnewBKZOOWOPt
TLSH
T1F7D25B76DC68C9B3FCEA4F94A70AB646DEE44263D58C9AD8D6DD5E0C00D729D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e9232036b8d0f465eb683455fbdce4980db0f4c5ba2add3bdb8a7bdc5a6cdff6
MD5 d650682e01c6d9ef58b012ebb3e83b57
SHA1 515c65cf0c1585232a1eec6020a4bdf635099d00
SHA512 c2d2f8f281b79b7bd722db376bfa9450312181bb82ae018fa3db78d8c7c604477b60cd4e11b000838df615834b067433ce757a813fa63b9e01f5481c0b4e4f8c
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 28c50f44ac8a6d2f2fae71ba7070c84bbe288aa5ed26c106a7530063484aef71
MD5 5a2a2a8b95bdcf395d65e6f6165cd6d1
SHA1 9f1057e69ff7f6957d6e9f36cd1dfe9c1d30f9dd
SHA512 deef578c9924216fca19d9fae321fd53c6e07f7b1cad1e60f64311fa1a1fcdf5caa7f1f4095b9af0eeb897aae3a04c910c6c3e0f4c0eca24fb06499b61406fad
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a18e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a18e8.TMP
Size 392B
SHA256 494e40e17f0b6f5b2340ee9095e7d32948f2d0584d9e02f74c3e55cf11b0f087
MD5 cb902a94e55280ea42feeb2fa6418ba8
SHA1 fd6cfcf643a293b68213ebba4fee311e6d696d74
SHA512 e729ef98c33d64a483fdb978325983a5b8ead0e6d832074f2695d188b24208f9575f30518b81431dd17342e60ab13b6075f78fd7984313ffc3d980ffa3cfaf62
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/3012-2200-0x00007FFE183C0000-0x00007FFE183D0000-memory.dmp

Download

memory/3012-2202-0x00007FFE183C0000-0x00007FFE183D0000-memory.dmp

Download

memory/3012-2201-0x00007FFE183C0000-0x00007FFE183D0000-memory.dmp

Download

memory/3012-2204-0x00007FFE183C0000-0x00007FFE183D0000-memory.dmp

Download

memory/3012-2203-0x00007FFE183C0000-0x00007FFE183D0000-memory.dmp

Download

memory/3012-2205-0x00007FFE17A50000-0x00007FFE17A60000-memory.dmp

Download

memory/3012-2206-0x00007FFE17A50000-0x00007FFE17A60000-memory.dmp

Download