f39f710b17483bc83b7f1db106e0e630c2169f8745597f578c458f916241ce25

Analysis

user interaction
yes
max time kernel
900s
max time network
740s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RATS_PACK.rar.html
Size 18KB
Sample260807-sw191age75
SHA256 f39f710b17483bc83b7f1db106e0e630c2169f8745597f578c458f916241ce25
MD5 42fe1a16eb79ae5677c902eded68281d
SHA1 4678a2740c2e38a853f13f9dae057d4dd73a682b
SHA512 5542cee114b403ceff96b2f62167e106e9d057a91285d5a98ca6b59353b564d9d76f4cfa81007f33520ff1ee84c9b9726a86f2acfac45943a9c999856f24fcd8
SSDEEP 384:uQJylIn7xpYwuu504YIeHYwDRzhU3E8+UUKIz40qoFqzQ3Me:uQJCIn7XY20ttDRzh4E8+UUKIz40qoFf
TLSH
T1C182F97114CAD82E8754A0E5E271BEA89DD3789FC7800884E47B68B7F5C5FA0AD211FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\ws2_32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\DLL\kernel32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\msvcp_win.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\msvcp_win.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\advapi32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\sechost.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\sechost.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\msedge.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\kernelbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\combase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\msvcrt.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\ffmpeg.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\ntdll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\DLL\kernel32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\combase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\combase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\bcryptprimitives.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\winmm.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\dbghelp.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_elf.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\msedge_elf.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\advapi32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\winmm.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\exe\msedge.exe.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\oleaut32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\msedge.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\ws2_32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\kernel32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msvcrt.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\DWrite.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\DWrite.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msvcp_win.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\rpcrt4.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\sechost.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ws2_32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\ffmpeg.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ntdll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\winmm.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\oleaut32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\ucrtbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\advapi32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\msedge_elf.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\dbghelp.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\ntdll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\oleaut32.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ucrtbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\bcryptprimitives.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\kernelbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\kernelbase.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\rpcrt4.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\exe\msedge.exe.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\rpcrt4.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\bcryptprimitives.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\msvcrt.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dbghelp.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dll\DWrite.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ffmpeg.dll.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.pdb	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\symbols\dll\ucrtbase.pdb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3956	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305901733007563"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{D856618B-D1F4-4B06-BF72-B8FC98C82E0C}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3220	1812	msedge.exe	83
PID 1812 wrote to memory of 3956	1812	msedge.exe	84
PID 1812 wrote to memory of 784	1812	msedge.exe	85
PID 1812 wrote to memory of 784	1812	msedge.exe	85
PID 1812 wrote to memory of 784	1812	msedge.exe	85
PID 1812 wrote to memory of 3076	1812	msedge.exe	87
PID 1812 wrote to memory of 3076	1812	msedge.exe	87
PID 1812 wrote to memory of 4408	1812	msedge.exe	88
PID 1812 wrote to memory of 1100	1812	msedge.exe	89
PID 1812 wrote to memory of 4408	1812	msedge.exe	88
PID 1812 wrote to memory of 4408	1812	msedge.exe	88
PID 1812 wrote to memory of 1100	1812	msedge.exe	89
PID 1812 wrote to memory of 1100	1812	msedge.exe	89
PID 1812 wrote to memory of 3696	1812	msedge.exe	90
PID 1812 wrote to memory of 3696	1812	msedge.exe	90
PID 1812 wrote to memory of 3696	1812	msedge.exe	90
PID 1812 wrote to memory of 60	1812	msedge.exe	91
PID 1812 wrote to memory of 60	1812	msedge.exe	91
PID 1812 wrote to memory of 60	1812	msedge.exe	91
PID 1812 wrote to memory of 4976	1812	msedge.exe	94
PID 1812 wrote to memory of 4976	1812	msedge.exe	94
PID 1812 wrote to memory of 4976	1812	msedge.exe	94
PID 1812 wrote to memory of 1624	1812	msedge.exe	95
PID 1812 wrote to memory of 1624	1812	msedge.exe	95
PID 1812 wrote to memory of 1624	1812	msedge.exe	95
PID 1812 wrote to memory of 2068	1812	msedge.exe	97
PID 1812 wrote to memory of 2804	1812	msedge.exe	98
PID 1812 wrote to memory of 2068	1812	msedge.exe	97
PID 1812 wrote to memory of 2804	1812	msedge.exe	98
PID 1812 wrote to memory of 4860	1812	msedge.exe	102
PID 1812 wrote to memory of 2848	1812	msedge.exe	112
PID 1812 wrote to memory of 1592	1812	msedge.exe	113
PID 1812 wrote to memory of 3280	1812	msedge.exe	114
PID 1812 wrote to memory of 3024	1812	msedge.exe	116
PID 1812 wrote to memory of 3024	1812	msedge.exe	116
PID 1812 wrote to memory of 2576	1812	msedge.exe	122
PID 1812 wrote to memory of 2576	1812	msedge.exe	122
PID 1812 wrote to memory of 2576	1812	msedge.exe	122
PID 1812 wrote to memory of 3728	1812	msedge.exe	126
PID 1812 wrote to memory of 4472	1812	msedge.exe	127
PID 1812 wrote to memory of 4472	1812	msedge.exe	127
PID 1812 wrote to memory of 4472	1812	msedge.exe	127
PID 1812 wrote to memory of 4388	1812	msedge.exe	128
PID 1812 wrote to memory of 4388	1812	msedge.exe	128
PID 1812 wrote to memory of 4388	1812	msedge.exe	128
PID 1812 wrote to memory of 3488	1812	msedge.exe	129
PID 1812 wrote to memory of 3488	1812	msedge.exe	129
PID 1812 wrote to memory of 4852	1812	msedge.exe	130
PID 1812 wrote to memory of 3104	1812	msedge.exe	131
PID 1812 wrote to memory of 4852	1812	msedge.exe	130
PID 1812 wrote to memory of 3104	1812	msedge.exe	131
PID 1812 wrote to memory of 2984	1812	msedge.exe	132
PID 1812 wrote to memory of 2984	1812	msedge.exe	132
PID 1812 wrote to memory of 952	1812	msedge.exe	133
PID 1812 wrote to memory of 952	1812	msedge.exe	133
PID 1812 wrote to memory of 928	1812	msedge.exe	136
PID 1812 wrote to memory of 928	1812	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\RATS_PACK.rar.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffd39b6c188,0x7ffd39b6c194,0x7ffd39b6c1a0
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,5094991615887622739,12285546784928655145,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,8453319779616769374,4885494411602253147,262144 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,987290014335617747,1770506004602769774,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,6505546164255991275,15472906494216583908,2097152 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,2341639807717820393,16132893062927259707,2097152 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,2616928397385358692,7030782991700141144,2097152 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,1948209113610953650,3377876693856199481,2097152 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4540,i,1381068791235338087,3736847989172774421,2097152 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5200,i,15460956523005909580,9938533727496705206,2097152 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,3039673438987811905,11614108546960421616,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,11401742001512670556,4279341130801700307,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,10984887549397704472,7098720453355332112,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,10984887549397704472,7098720453355332112,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,14362340844405341302,6951831600272514367,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,6917735827346636128,12404410674470824916,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,11679706810628919737,7057892923591740034,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,10812678566465372544,247516301556851203,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6556,i,1620525751995387203,11126679456419141627,2097152 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6200,i,11677407874970375582,5096456655891533366,262144 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=6904,i,17829415960397035624,18017193301152064649,2097152 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7044,i,7024467240050555522,16265856364932309228,2097152 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,16518797635828458620,12806462541417837606,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,2279078246356002813,4887355876879040159,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,3928744399643948413,13267126939932970538,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=768 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,17758163063541877026,17886127771868556440,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,15305187496675768768,2902042911744957252,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,12600576506724443645,5980846609498578249,524288 --field-trial-handle=2352,i,12147683392138754948,4432725728393071315,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:8
  2⤵
  PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2020

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\6eef3426acad4e598e159b3aa4bd9328 /t 3168 /p 1812
1⤵
PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

metadata

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
Size 114B
SHA256 5aa0a49e2405bb185fceab2f408994230baffb121a905b98d9ba9a10ee1d1c51
MD5 4df8b2e3e5fe7ef717403ace2df15568
SHA1 d6f728c76848b2af8f6a28ad571123d5b2589358
SHA512 33e0132838acd9d956c3e322ac1b1a9a7cec2960b1f10a9f5ae2e6636041b7e8b9216e0fda15f0f8998f630ea20c96c7fdb82a785b3e4c6d31331b43b69b26c6
TLSH
T1ECB01207332BA0C5DA0321F228C003007109C631E742174490C32FCF1C100D60CBC23C
MD5 SHA1 SHA512 TLSH

Submit Download

577ac5eb-1c76-42ec-8d3f-25b152ac9aba.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\577ac5eb-1c76-42ec-8d3f-25b152ac9aba.dmp
Size 575KB
SHA256 de714374557ab61c990bd818aae15fb52df3a4d982624007bc811b1c9515ea4f
MD5 3027a7f3c743344ce2a077a59bf550cf
SHA1 c5659c870c5e9943b4958b74e6ad007bd76c6509
SHA512 b054a4071682c2518337081a744e9c624ef76cab08c0fbe963e12350c2c89ef7711e311600ee853bbaf985f5cd03ee43ff8f289297ec5779671951fdc52c526a
SSDEEP 768:CiB+pfFJOelydFE/ZE48kL+aBN6TpCFb7Q:F+pJEdFE/ZyrO7Q
TLSH
T181C4632BBB8709BBE61C073045C7672377F7D4282BAB475F920245396D67388AA31F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5fd0dfd3d3bf3e7005f86201a11a7b14e5b70a804c20d2fab2dc7e18e83479c7
MD5 59dfe5a6038e1ae4c00480b3fa70dfbf
SHA1 d8b171ed62e85a9877f2b32db7bf807cb4576c47
SHA512 0cff21ef0bd37ce3d4f98e7940c908c3201d89cc50406b17dab09361007866bd0951b42f1ffce2eceef6f25882ea83f6afe53c995d82bb88973ce086556c906e
TLSH
T1BBD09730FD10A5A1D22A0071001006001E1404B220A782D1A024181CC9B8040C2EABAA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c9601b75525cdfb5f8b171a4e2aad31b6cf49f9f4aa31f3a4bb6b4215ee16764
MD5 67ae054f1e5632ec1cb32b36841874c2
SHA1 35efd262fd01fc8a7c3b652b691622f659c01cbe
SHA512 9fa6b791d60c2ddc875921e9c584cabdd9f3b77cec6a23e03e90493f00b7bd0a87a666d7a6df28f5998ff4253a71476f70c8a6301d0226375fc8b57e792817ad
TLSH
T15DE078C40DC5C25E760464D79158570CC2C0360BD6C4EA5977008CC57347551B2C3AE4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b05851725907febd9206e71b6bda3b2404777f1fa0108707e37941a06221bc23
MD5 7940274fe37b78858bf0a50284449ee4
SHA1 d27084708f65025c1e2f74147b2ad49a9cae317d
SHA512 8496836fcece90c2c7093335833f7ac07293c85354a8f0af158520d98a8e97bafaf0396cbe5d1de15a4c698e93d72e742e1d3230235fd72daea42c3e33dde1fc
TLSH
T1AAE078D406D7C26D551078C75374770C81D03E4ED6D4EE0B3704C4547147854BAF6BA4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 16KB
SHA256 67ccb2b101fabc6b65f83328685723bd360e0e6340760e5959cbcb72c1a75828
MD5 c4f8d11187a8f9ea1df102cd4ce81e5a
SHA1 614adfccea1e0e8bd9edffa846cd397c197a90cd
SHA512 b71548f3ca9403c8d8d30cd7ccee0a6c6cf613896fc27e8b381a0cab616da8ad29049fd6556731fdfe167378826c7b03ef3b4b45c8aa77b46db7402a6d87097a
SSDEEP 384:LYsA+mGWILRb3Wm7Oiedzq/x3j3GyUQvkJ1XTcvCeuvv7RnbSzR+gEe:LYsA+mQVy6eY3j3GyU0kTAvAhFgEe
TLSH
T1B972C0C2DC3129B3101AB10A591F6A6E967B5D90A33149C01DDB1DCFD9FCC64DABA1B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 60KB
SHA256 973d7c4cd91c428490204d4647f283b60daacc9ff0e8c83bf8c1bf994528602d
MD5 b96f8d90119f9f8307274adc5695da21
SHA1 57e36157b36dbc401c5701d0e27ec2885193a4ae
SHA512 e267cd9d04f6ced28190e549640aa7e08060673a0f616b7ade1ef3aba4f7c8ef52a082266ec362f42ad2bf3982141bb8476e4be4c97ef8c40248a1d9e25efea1
SSDEEP 1536:G3gKQfQWtQJzaGw3WZiWX0K1pFlvnC2c+6LABHgO:G3g94oSZFkulqJ+6LAZ
TLSH
T1895302A1F19608BE6EBA88B35DEC427A99F9F4E653D66D32D54F124021B8821D937C04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 72KB
SHA256 e21ce53d43bd9e404759b9a267e44c63106a423e70263f87d9e13ccfad4f61f3
MD5 1d4e7b902aa7d072fff5861353725adf
SHA1 3ab24c6848aa072854995d7f477604f2474fd6a6
SHA512 4667de5c55d95d200c604614114228180b0bec7b1e2f4bc204de5e28048301dd956ac0105516cc734757da33643cbef9ef42a2a04ca7ec6810200fed1f842d05
SSDEEP 768:U8XRyk5xUzO+ZR6lrxcgNbZcHTnGWRVmcrODcgAhR0C35hYNeJET+KoASRBqFqTE:UKRfo0rxzbcbzfSDccNaAJ0W9nKr+wM
TLSH
T1DD73023BCC97140DC7999B27A829A32EC10892C6A01F7D3B46C4347975233C5B667DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 180f8000f2ed7dd5918f5492a3d66d03b0e32b1618c7f6686ee72d0628de3ded
MD5 8544772f6fd1c4b2fe01eee6ca90e9e6
SHA1 5efdea1300e2dd23f17fdce62a7242f4f6656e28
SHA512 e83f22a143f330f99db62fee703f983d9055771e130108745f20eefaf10249c315dfeda71b77f338bebe9d3500088c815421e997f4c479a4f6846a45423fcfd8
TLSH
T153717E7803010062EBF01171B7E221DAB475A8ECFE679D89306C84F96AB836DD81DD6F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 f427c1d330b1b51c3bd7b1c9f3da57f4b6d7aeb7d7eeaae573f94a0cfe608a77
MD5 394dc9aa63f374bef414d85d614d2a92
SHA1 f706c52494eae4934f735c5fd3a5678c48e1afab
SHA512 92fccc53a3e4a0c94deaff1c0d20c32d1457bd90cd1fc76e108042225d97c9fa01596ebdd486fbc946e2cc7737f24806d34151ecca101d78c598a4a906016a05
SSDEEP 96:81VPEBBuIbmvvzRQxkGvuib/shp32PLIeaY05KGb7CXx:810PbmD2uirshpMRa5B7Ch
TLSH
T12CD131353282C092DFB085B463A328C9717564DFFD170B6B34186DF9A86A79FC90E81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 0dd5afd3874fdf0b3d615bc437eb0dc18e7aa5d826b1dd9651926f621f2276ba
MD5 b61fcd31463935b6696707fa7f4d1868
SHA1 8d0c458d45868b003b20163d2b5cbdbadd003e2c
SHA512 d5a91228c00e34e9b9c896a8815d57dbbcdb9d012afa8a0c760ddb4da46de1ce73909f36349c3fba217f95e96d1f63b1b5c6c4416555e37358e5b00001ae8dee
SSDEEP 96:DWOkJBfpNzOZpQzaqwBGO5ceSvntj6BVbqNBlxxsIF9U/:D1kJBfpNzOZpQuqk75ceSvntj6BpqNBK
TLSH
T143C19CF6C3D5476ED91252F09A25BF1BCE2D055B42683C5689E4AF4B63F24B0E10268F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 141af341863839414aa008434fa0f4d3c117b41dffed80420ff1ce31a0439adc
MD5 c0adba8f3fc1a72c58218ab7b305c3b1
SHA1 29ad290abf2f89467f8c5925664010fcc133a924
SHA512 430447af3a53123bdfe1385c220fcf83a305383dd074dffe6ca32677029ea0561662f21623ebc2cb985ba1823f77fe8c9772f41fd09921a9815e4b3459da30c6
SSDEEP 192:D1kJBfpNzOZpjGuqk75ceSvntjupqNBl7sIF9Uuex:D1ABfpNzOZpjGuqk75cbvntjuINBl7sB
TLSH
T1F8D1ADF6C3D5476ED81252F09A257F1BCE1D055B422C3C5689E4AF4BA3F24B0E10269F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7814f8fa5aec3e59e208bac42a72750194860625141728e9a7d9b01074dbc617
MD5 d7ed9983562af73387644584e4cd1779
SHA1 66fc9136fce23592783cbed43a2cc98fcd79d740
SHA512 db2e382d9daae1bcd0856386f5871037446c90e88bf21eb4ab3a7a7040481fa00549a6977b929bb2e96c3804c0372363f5391a2b9976b476a6dd51243598124d
TLSH
T138617AFAC2D8477ED82252F09A256E1ACE1D055B42283C568DF5BF5B63F24F0E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 000b0b025be9fddefc1e62830e6187ad457d925a812f70c57242456f4cc74df6
MD5 6fa9bb139c7b790e3b2439eb9b6d83af
SHA1 dcd2861d87b1fb46ca3551192acdbd794027b0ca
SHA512 28451af53eef92cf9b3920354be51996c3c12a524a98e5a95dafb80fa751d1774cba9fac81a7ffbf9f1efe487ca15e8837fb917d1261ecf8f0a441b9d46e9461
SSDEEP 192:sxZSROkD/fus8B3VtIdpdfyHW6+WNGYvrN6NUIgrJ:sxZS7D/fus8BEJyHbG9a9
TLSH
T15522A6526E28A93B8CC7D20DBE15BF53D6F95032A1951E98A6FC9A1C04E76DD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d83d8687385aaa8d8824dabb2ef04f0dc63106d91b361b9cb5de2cef4fb48c00
MD5 4faa9f58a34ca1a582332ff3b2de925d
SHA1 22e9da4d927fb0e2df8117a262aac4b92c5b26d3
SHA512 3dbcbba619c963a88e7562fa7291170efa56d1ce75f9f49c6009a9bf9d9557acc68dcb8ff41b12a1b890a19333af2259dc842f6b61c8ac69d81476bf8d389fcb
SSDEEP 192:sxZSROkD/fusXf3VtIdpdfyHW6+WNGYvAX6NUIg5NJ:sxZS7D/fusXfEJyHbGqa1
TLSH
T1BB22B7526E24A97B8CC7D20DBB15BF53E6F9503291911E98A6FC9A1C04E76CD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2f7c5a79ad21de983ea8548ae3bf5c79d332449852d80dee29df5f30bc1f14d6
MD5 f2b97e3c107d0b3dfa9bd6566ad7d97b
SHA1 e59c9c28816008a3946fdd4472526de578ac3ac3
SHA512 905be7cb03c6fda4425ce238da84d36cba3cb6f664ca0f84bf8e761b489f6be246da0e893d9a27dc499badf59b7aa90f89d0fccef0acc0bfae55845883a0eb56
SSDEEP 192:sxZ4QUnmROkD/fusXfOVJdYZq2Zhdp4FZHW6+WNB9BXYvUkQNUIg5NJ:sxZunm7D/fusXfNHfCHbhXta1
TLSH
T13752F7526924583F9CD7D219FE16BB63E6F8502295941F98E6FC9A0C04E76DE230B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a0f3e02a0c86ea128c9dd4f0847a878e65cc324e2e4c973a207010623a4600d6
MD5 1458c50d8647b59ccae9adb565b1301a
SHA1 d9b8eb1ffa6424124a6b65a0b7911714e0fada57
SHA512 bebfc91555f41c066d76e580463f6ed8b69dbb1bd23a6a050665a5f4719a3121b870ff18f6c02ac555a4df091f619b8bdb8e4d331fde7f4d8c3bf7e889caa10c
SSDEEP 192:sxZ4QUnmROWOD/fusXfOVJdYZq2Zhdp4FZHW6+WNB9BXYvUkQNUIg5N6ymAP/2:sxZunmZOD/fusXfNHfCHbhXtauym82
TLSH
T17272D8525920D83B9CC7D518EE367F52E6F95023DD914F9CAAFCC91C04EA6EE221B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 90753089da1fd35f13abbaf0bd11e3ac8cbb527f3be42defdda59f9e56fc0e94
MD5 699867ea718c93c980651dfe2e70a68d
SHA1 c0f4aa008f81ffb730dfd4628b531192bedb6d8e
SHA512 78fa5094ecb45d71eb401e5c750d18876f8241c6bcd3c11edd8f51a86ce6ca40c79a05b6a2013313f299c15bd240a42bcba012a5c24f8472bf62e0883a262690
SSDEEP 192:sxZSROkD/fusXB3VtIdpdfyHW6+WNGYvrN6NUIg5vJ:sxZS7D/fusXBEJyHbG9aD
TLSH
T10222B7526E38A97B8CC7D20DBF15BF53D6F9503291951E98A6FC9A1C04E76CD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7ee8a19a7380357aa31b73fdb76726de471a141ca5a1242bd4e2d93bf9dc7afb
MD5 02f366f54c5686367f22be3e639f5f91
SHA1 0dc97ca5ecd040e82e889233f7119dc2be36f57d
SHA512 24402953baaa58c80e2710925d82943945f35b6d0d47ad17738dc198a0034a9a64728bcf28633506cec02db9825f34b2cb326afd08ada50636cbdbd4dea40787
SSDEEP 192:sxZ4QUnmROWOD/fusXf3VJdYZq2Zhdp4FfyHW6+WNBAW/YvpkQNUIg5NJ:sxZunmZOD/fusXf2HfyyHbb/oa1
TLSH
T13752085269245C3F9CD7D219FE16BB53E2F8502395905F98E6FC9A1C04E76CE230B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9854748c1eed50579f709f5312c1aaa36d4a6d211d0014641d3a0ab4e3119501
MD5 274df1987ec513edae4b0b8bfbe048db
SHA1 a7f417f1d89f2c3bc191054c54c8fee2bfe3c30b
SHA512 6de856661918934c04065ecc5e9daaa7dca5980c271d895200f45928e99b25ffd54c52725659308a1ea2248a3e209bf3d2daaddf334dfcb2c42950f654d2471f
SSDEEP 768:H2ee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pb4ro7:H2ee3rxWvhffnu1jatcL88bD7
TLSH
T125C2FA2B640CCB7E5F800E9DDC5A6F977FA802C767548D4087FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 0f469e75e45b5ec02ef3f666ece5c10c34bc92a02b8c001ab770bc1e77816016
MD5 453e6a8012eb06640fdf0fced8b9a2b9
SHA1 c1f5e06f30abc90a92a4541d6e95783917debcf0
SHA512 7b243760c4519d78db92e08751cda315f6ea4328c8a8f974ae1ee9bd5a712ac5bc9e05288e05129debb18d87ecb2cf5d52d780737bca26aaf944de2e7db5a62f
TLSH
T102A002261381541EC00A17F5659716416223DD6C0381535941B8C44CC9D1687CDB104D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 e0bbd976de926d0bce2bfe5a4bfd4d4a411c6fd2d4e0579576aa45d9179f393d
MD5 d4672bb2792f8c9ce924aaa0e5954bf3
SHA1 5615297bb4178aa69d320ea70268d85c3aaa256a
SHA512 134e38d5dd54b1f9d290e6925ed227d817310aadb3f9e0b8509493b6e1ece7da91394e1737b199e870c1c021e2a2ed694a79da80293fb2335b16f5349b754c7e
TLSH
T100A0021403804515CC2752B2275202451305CA502151D30B41A1414CCC525C98D5514C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\temp-index
Size 912B
SHA256 375fde94d0870218f36b28e92760f33c0dc073c0ecf9c4d96d9507e7837bc4f0
MD5 1063411988f075145eed535580673676
SHA1 ad749caf9d70ef28e0579557603bf869e4d91ced
SHA512 03c2197e3ed80a356a856b8455c54781ae07ee49268a4ad94481afee9bc77e645585f53dc66b7bcf4fb70091c2e8360204db71e9bf22255a373c8ad7b3f85548
TLSH
T17E1128464F95982FE9AC45B710B970F43370C6DC2711A237443D1A3A2C2635A68070C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 3KB
SHA256 1421589bcf30f7fc4e189872cf93d236108f0122e4a3416d928723b7dff801a2
MD5 4907a0590da035836ed864f5ff51e4a8
SHA1 e516f70a0abf94e72b2c0d8cb49e332678d0ac29
SHA512 de5a7bdc5e1376215d6737a927ec4ca46402dd9684fb5a8bd6f600768ef4a1f57d9a57adf71905ff5dbcee56bddc599ee738aba6bfe7a7b7d6c67cef3a9c96cd
TLSH
T12C51C98DCC864A5AED9C11B318FB1481737664DD95C85F0B6ECCA034BCC323E2D5B554
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5975d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5975d2.TMP
Size 912B
SHA256 692d57583779ad8a4c0cc926f7c5e4152c5c3426ca6c825f3cabdedcf122a4eb
MD5 7f78dff7c5c3b4d4fc47c19b9515957a
SHA1 af843454db829056db8d93f23cdf6e14d7e445f1
SHA512 54d16f18325018e75d1f73f6980f9ef57000e11a95bcb56f655034b8bfcae6965ae02ff804c2cd77b6ba87d92f3726a6758aac943df4978a56d12f6f8345a26a
TLSH
T12711028A8BA68D5FF99455BB055A64F87330CD007362F7A3903E263E1C7A39D995B0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b519f3ade10f4ebe666ca08374ccd9bc6288a486f6321373685a06dcdfd484a5
MD5 6742edc767746697b2241feca8ab2202
SHA1 5013c043c68925a120c7e7b49d41fd07790d22d3
SHA512 1d77c141f3354181783f703a024ba10b21f83138c41fac94471177a9189179ce90c15ac28650bb3cddfce0efd7754d3a221572f647e805b1bd0d9e40e81c89e5
TLSH
T1DAE068B62DD32414BDABD3D1203080900A0A74A8E942FC0E941AF6831072315309AC35
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 107b14e04a0af2a57685f6d7473196b4c0c17b2e8374a8e6fd3093f75f263957
MD5 0e755cebff1257b3bef9601071954ab0
SHA1 1744d8b27b672e9e8e013d3e8b6fed3003d9e574
SHA512 168965cc9b19cdd84b2951c5ab844f2c81bb993b7e0baa9c000e415295efd5e39ae5fca8bd0a76ffeabff4e49d6b6487cb3dcaf928ca03b036422b0553673340
TLSH
T180A00274AB4DD08FC4500F7110EB514073514CE936061702889F93A98C91285D2C9103
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cf7b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59cf7b.TMP
Size 48B
SHA256 78f86b639f9ea56d1d1cd77fc957d1e2913ae61ba7bb1280d1a5d7525509041e
MD5 11ab647ddcceecb837d118540db518de
SHA1 8634f393cc5ee658babd6b71b8cb26cb65c6fbb7
SHA512 7cd240987b0d9e69890ae5977b866b1a6763b3a2ad5ef2d8f8a645982428acc4d18da2c0865e0cabafbabe6cfe9d964f8d43689740321f7fdf7a5c0c1c657828
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d0cba177d85e728b7666273a00ae2278bbc5c9b50e557419ffeb3a5f73323259
MD5 9b43282e60f9a22e80146907c967fca3
SHA1 30bab5a69a20ee2288f574e13213031ab170f945
SHA512 a8f7f84708116e9bf67708daf478ce2b039f037a6239135e282387fab7c0a68a81ac9dfc665287b4f9ebd559fbda60e05ac8a32cf87422c7c3e2a013b487cd52
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1Ek:KYHIhKggkXyh+IHKnKIXyxmIHKbaMW
TLSH
T119913316367B0642387E2448B6A795374F4132A77458E8AF7FB850A14E27E212DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f8f1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f8f1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ce958b49cff443e6b35c68e080a1e7ac856f8bdf9e0c6ee7dafbb01110779014
MD5 39c4db9421bb6957067e4511a598a633
SHA1 2fd54880e03db4699d4461b7fb86003a3762a9d0
SHA512 2a715fd0ac9816d0d8b31b5d4fa31a49271b1350d31d027af4eccab620d403da473bc9b38528aaad9991cc3f07de81158f7ab84ac2315229538726d89f96360c
SSDEEP 192:uQLsNJZQGZM7trEQmiU1YhVB4MTwz+FdLD1WSJrf8z1sqm+7:VsNJZry7lUKVu0dbJrkQ+7
TLSH
T112422B72AC745C3B99A3A185F44A37139EF4D07B9AC46F94E6DC6F1D01CA2AC130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 28a4f11f91815dc7b5a8fa03a13f0a8c5e08976f4c77ad6e25534f448c1f4044
MD5 7b913de4a94339cdde54109456551f9d
SHA1 8a29f8287dec643f994a80c5389032f596754b36
SHA512 aff71bd934b956e2f49f3e1f97366dbacf8e33ccbb9d87a7c41340b312ddf4402e33704028c81da4f54287c8c47764f28bc2483a4163281a6f113dce67d3d7a8
SSDEEP 384:NiFiZcIMzsNr8TUNTUlIlAry7lUKVu0dbJrEQlk:EFQwiwgDNnVhEQlk
TLSH
T191824C735C54C93FADF7AA85F84A32138EF49077D5C4AAA0E7DCAE1D019A1AC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e325d435508b0e6e55cc538a187a64be6847186993398c1ea4dcdca467f9348d
MD5 51bd18a4dea694822a50b8a43bf1e38f
SHA1 bf109c21a01b8f52f88267beb40161bc3a81aab5
SHA512 2a65737ed762836e331271fecd82e1f402c1b7274bfc386b03eac3f222fb6e13ab8622d94ed126c506db81baa29e989ae6cabd567f496d9ec3249b6b7a262d51
SSDEEP 192:u/m+xasuheOwQxMGsNJAQGZM7trEQmiU1YhVB4MTwz+FdLD1WSJrf8z1sqmlWYy:hZcIhsNJAry7lUKVu0dbJrkQlk
TLSH
T1C3624BB29C749D3B99E3F185F84A36138EF4D037A6C46B94A6EDAF1D01D9268130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 89e0871a9a1cb116316a4e8c6cc313f79dfddb63a0d44097b6c1e34f613f50bf
MD5 ae21611857532781196d0856d47fb383
SHA1 064e4b6c0e5d20c0cea4de02457206961d9b829e
SHA512 1fdf89ff3ddc7f51bb628b7d09543d676458a9f7965a5b64af438104bd8eaa989d3d23e236b027cb453b350abe8d4c979010bded99f15d939357d37d801ad9b6
SSDEEP 192:QONk6vMhPQmiUyHMghTwz+FdLD1WSJrx80IsqmU/u:QONk6UhRZgndbJrGQU/u
TLSH
T1DF121A72A8649C2BAD93B585F48B36175EF4C13BDAC0AB50EADC7F1C01DE26C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 13066811264554d2338e346c99d415f586281cce4d286f31cfe8be6c91b2ba24
MD5 cf9428d57d5a232e71a0038119821730
SHA1 2e35d3405d2427dc99e6a0a8c09fdce59674a5b9
SHA512 a5ccda69df83038391915bd86af141e9653f0dfbd474d3f2a590b50c133410c831746a12b22956bf302ce116a8b3e0200e89e7bcbeb0e7e71b6bc316833310a7
SSDEEP 192:lONr6vMtPQmiUyfMThTwz+FdLDf847r6U/u:lONr6UtRLTnd/uU/u
TLSH
T11202F935BC786CABDAA3AD45F48A37175FA4517FA5D05B50EAE82F1C00D765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e83d96006d12f45050864ff84fc00e790e988c1900ddf66fd85d09b273cf23c9
MD5 85ecd6d74f93654b86146da74daa9e68
SHA1 449d0b2d5d6d11222e179287416ffed55a5e0121
SHA512 feda5c43d940748d735feea28c1f2b7b2d32766e34cfbd64e212482e7aa7b32e4d00f64c0b921d84988044783528f6ab9c61b18c9f82ca686db19eb3956af628
TLSH
T1CFE00202130000F9D16943310043672416E390B002B103158A1011540C162101E31F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a01d6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a01d6.TMP
Size 392B
SHA256 1fb1b42874ecf46e969429f95b7c96479529527d19fdee4b4f213409d305acff
MD5 8538020b1e39608a821680e3e1b4ddc5
SHA1 e9575f665c36b812c868412b84bc822ec5c14b33
SHA512 8b782f7b8a0ea4fcab8877ff38eebaf5af7db388fa7a76081f2a0e2cb5b1c682eb77a23d0a68529950d2430a82ecc2cd652963ae33b19ab279bbc594ce95ada4
MD5 SHA1 SHA512

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

41a5c649-186f-4d2d-bcec-4da1e1c37fe2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\41a5c649-186f-4d2d-bcec-4da1e1c37fe2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a7a3d659717f0b8b313012f742534cac18cd9a9fd64b4a0313c371d9221b21d5
MD5 923cd1bd5c738fe2c62016af96b69382
SHA1 0968886edaf615c2959165f7e2d7fb8d4c46aed0
SHA512 4eaf122758c5dc3768accf294bb17a00d7e7969d157e8c9d9f459160263b222d865980e1409f7999af01490bc1179b8de3aef2576e0d692ec5c7b4958928a8b9
TLSH
T14C41275DB6E91148B7B77F5AAFF7A86D487BB8672E06945D00010E4F0A62B00DCB1737
MD5 SHA1 SHA512 TLSH

Submit Download