hxxps://discordapp[.]com/channels/@me/1503808043303960658/1535329014602932315

Analysis

user interaction
yes
max time kernel
569s
max time network
566s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://discordapp.com/channels/@me/1503808043303960658/1535329014602932315
Sample260807-vb15lsgh75

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
39	discord.com
43	discord.com
57	discord.com
24	discord.com
25	discord.com
27	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3284	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305949971086631"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{6CE7FCA9-CAFE-49AC-BC0B-F8C2DCB2AC67}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{5FEF2271-F33D-4D43-9CA0-A2A98303CD5B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 5564	4872	msedge.exe	85
PID 4872 wrote to memory of 3284	4872	msedge.exe	86
PID 4872 wrote to memory of 1556	4872	msedge.exe	87
PID 4872 wrote to memory of 1556	4872	msedge.exe	87
PID 4872 wrote to memory of 1556	4872	msedge.exe	87
PID 4872 wrote to memory of 4588	4872	msedge.exe	88
PID 4872 wrote to memory of 4588	4872	msedge.exe	88
PID 4872 wrote to memory of 5840	4872	msedge.exe	90
PID 4872 wrote to memory of 1676	4872	msedge.exe	91
PID 4872 wrote to memory of 5840	4872	msedge.exe	90
PID 4872 wrote to memory of 5840	4872	msedge.exe	90
PID 4872 wrote to memory of 1676	4872	msedge.exe	91
PID 4872 wrote to memory of 1676	4872	msedge.exe	91
PID 4872 wrote to memory of 2036	4872	msedge.exe	94
PID 4872 wrote to memory of 2036	4872	msedge.exe	94
PID 4872 wrote to memory of 2036	4872	msedge.exe	94
PID 4872 wrote to memory of 4000	4872	msedge.exe	96
PID 4872 wrote to memory of 1256	4872	msedge.exe	95
PID 4872 wrote to memory of 4000	4872	msedge.exe	96
PID 4872 wrote to memory of 5920	4872	msedge.exe	97
PID 4872 wrote to memory of 1140	4872	msedge.exe	98
PID 4872 wrote to memory of 5920	4872	msedge.exe	97
PID 4872 wrote to memory of 1140	4872	msedge.exe	98
PID 4872 wrote to memory of 6040	4872	msedge.exe	101
PID 4872 wrote to memory of 1572	4872	msedge.exe	106
PID 4872 wrote to memory of 1572	4872	msedge.exe	106
PID 4872 wrote to memory of 1572	4872	msedge.exe	106
PID 4872 wrote to memory of 5324	4872	msedge.exe	111
PID 4872 wrote to memory of 5324	4872	msedge.exe	111
PID 4872 wrote to memory of 4060	4872	msedge.exe	115
PID 4872 wrote to memory of 6028	4872	msedge.exe	116
PID 4872 wrote to memory of 5500	4872	msedge.exe	117
PID 4872 wrote to memory of 4352	4872	msedge.exe	123
PID 4872 wrote to memory of 4352	4872	msedge.exe	123
PID 4872 wrote to memory of 1236	4872	msedge.exe	125
PID 4872 wrote to memory of 1236	4872	msedge.exe	125
PID 4872 wrote to memory of 1236	4872	msedge.exe	125
PID 4872 wrote to memory of 4092	4872	msedge.exe	126
PID 4872 wrote to memory of 3912	4872	msedge.exe	128
PID 4872 wrote to memory of 5752	4872	msedge.exe	129
PID 4872 wrote to memory of 5752	4872	msedge.exe	129
PID 4872 wrote to memory of 3028	4872	msedge.exe	130
PID 4872 wrote to memory of 3028	4872	msedge.exe	130
PID 4872 wrote to memory of 3028	4872	msedge.exe	130
PID 4872 wrote to memory of 5568	4872	msedge.exe	131
PID 4872 wrote to memory of 5568	4872	msedge.exe	131
PID 4872 wrote to memory of 5568	4872	msedge.exe	131
PID 4872 wrote to memory of 2692	4872	msedge.exe	132
PID 4872 wrote to memory of 2692	4872	msedge.exe	132
PID 4872 wrote to memory of 2692	4872	msedge.exe	132
PID 4872 wrote to memory of 3876	4872	msedge.exe	133
PID 4872 wrote to memory of 3876	4872	msedge.exe	133
PID 4872 wrote to memory of 2072	4872	msedge.exe	134
PID 4872 wrote to memory of 2072	4872	msedge.exe	134
PID 4872 wrote to memory of 1912	4872	msedge.exe	135
PID 4872 wrote to memory of 1912	4872	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://discordapp.com/channels/@me/1503808043303960658/1535329014602932315
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7fffc26dc188,0x7fffc26dc194,0x7fffc26dc1a0
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,6710178094663789303,7229814900569402882,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,5514326313413171864,11363624765663109369,262144 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,15379537856536611606,16678277047298575839,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,4042448752046632297,3007137339869483637,2097152 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,1597987736646952808,2313353100366577494,2097152 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4768,i,2104432982838762218,472046028146078450,2097152 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,9046969276529730615,13549299722817514255,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3056,i,9028463673782833753,12472076810067444165,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,5156106322079458034,779866837505884973,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,9177592536234131973,6591553105674227456,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,3615384232643332464,10109222976326086839,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,3615384232643332464,10109222976326086839,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6616,i,14759607244642727424,9202737620836131950,2097152 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,13308081362293006852,14430350459010948453,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,4462573235435814230,7851662726430062371,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,1447762385344792878,14340036599385016060,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,4145128593636202385,5873318578420233482,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,10250427407802215461,4681837061046900891,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7244,i,1735377773659027014,16838557532706078438,2097152 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5056,i,15253352769094535871,2394280409900056273,262144 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7340,i,16556099445882018092,3115228433442723301,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7340,i,16556099445882018092,3115228433442723301,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,2426615734712725425,3413171364114129528,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4756,i,15858361071636814351,289375749605911561,2097152 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7460,i,4262231863667923502,14489939211838285652,2097152 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4788,i,9888009681309085850,7470335043468068294,2097152 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,17420062168857883022,6914083443225941164,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,7520202125716638139,14138164748219225076,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7528,i,15800155962544420007,17511528464517631836,524288 --field-trial-handle=2272,i,15882348012065383682,14975136816635901864,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:8
  2⤵
  PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 1378abd31857b53e5da040ea8256ac261fc86cfedbb5c7ed87353789fe7d6aef
MD5 f3e0a9c54201008daefc9c5d9825a8f4
SHA1 114f2d98213031d9a726d91a6bbed3f540e6327e
SHA512 6f494e087255192eea52754b22ecee69c21da61f6091e90ad178de426b2c3f95ede547f1d3d1e4f2440fc572ecb93ff2d651d64c45e189923076e41c3173c4c8
SSDEEP 192:JjgZU8888888888QQQQQQQQQQQQQQQQQQQQQQAyh:JjgZU8888888888QQQQQQQQQQQQQQQQL
TLSH
T131F18E0287E4DA9A9F1D50DF49A1636C00F07709EFDCEA08435D9DD9318F8AFE4B5AA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 de3d63da3fef235d7cab5e5a7cf7ad7b8d2a24788f85663ff66923aecea07e3a
MD5 f0813b3ec33588b23c314554a1f9e71f
SHA1 f788ac5b54e9b1465374ea94d6af57f952fcc0df
SHA512 aea61ffcfbf429cec046a47b50907ebfb4ed95ad2fc0d93a02a36373f507401947d386baaa30ca50f092d61eb08e0c27b28739c8163d12b80505184103c8a496
TLSH
T12FE022B6C822FC270CFD0718A0098A96E7012357AA40899F3E3D810C8FB472A85C6C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 16KB
SHA256 dd1b1bc1b12378c3f2d5257e13fce269351f7205c0b1d9a353bb6519020cd4dd
MD5 1828eec30395f0667811a9b55c744f2c
SHA1 62389846e8e32746da94a1cd5874918bc6f61cbc
SHA512 a5baf8d674ec9368cc53cf6074f6734dd5c01a7372bac636df0b064617759485d480b6dbc4036edbfaf5e54da5c44363fd51d76897fad1e959033897b377510c
SSDEEP 384:WBY2ZpX4PZRjQrzKRr39XXU0AoL6RHYnF+CP9JhBI9V6oB:WBV4PZCKV60AoLaYnY294Vv
TLSH
T1E172C0D059E96EF459DA15C4083D61105F23B520ABD3C7829BE24A72EEC27FC16FB490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6
Size 37KB
SHA256 3b2ed8580badeaa0a72cc2435885d89e8e95d14d662a798fdb30daa14f0b39cc
MD5 a3d35c02bc5e98da4319006448bf7a8c
SHA1 0c93016beed5ce6b98a79b6f50d53b6616e3017e
SHA512 6f57027640e34ed172d6f5bad941c7a86ce0015f23e9fae130dc95fb4884bb1980e016871d0ee411cacd87984f2008f3192db0d770a67d65dca543a722bf6243
SSDEEP 768:a0/oxezMrWj8UT7KkM3loDswetvC5XPK1P9ELxPILst7uBvYrXgX/5t:5QxNruDMloDV/CfEjtaBvcEt
TLSH
T1900301F6DC6B045A86377FC030FF82CA6A0F67141A97E080202B899F719DF5657D5A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 3c6547429b50a2f6c762b18a6434264b266be4d5f420626f9b11ecd7ae2300e5
MD5 04cee2622dda5fd5f953a022b50fdba3
SHA1 bafee82bb566b4def949f12722eb911c910fc0df
SHA512 44db6c9a221494331992c1cd77cbf81f58df3ba89fa0ca9cadd1a897ed7eb05eb6531f7f5dacc9d329fd40c2fbbbdb6d0d1f86bb9c10201775f1b214a9b1ff11
SSDEEP 192:DkD5VKb+DynDk5mBBiehlUMG7lSoXP6mNCoVpPp9CF7Ea7UenTF3cF6OZWr8xYUq:S5k3kM6rVpPqiD/WebK
TLSH
T18932ED3389A1475ECF3401738C9A7D963BF15DEAF6264AC20205BCB335B27669E4CB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 4cbfe45d91d751e31fd02182735a6ec96a3b02018f62a30c2b8577b748b95390
MD5 0897edc2c8a14d81d88b9e957e5d1504
SHA1 b9914f39d6c7469e8007a6ed73e041c7b2a94bad
SHA512 0ec8a0bee91cec8f7c83d9a0f1d3e2b1346f310ae10cfbfdbd678cb7bcd8d984c61a2d32a7a71362a453560511d9e36c77cd57ba14233720885edcf39afce4d0
SSDEEP 192:atotN5maSWWLR5mCKi5+6S9GlTjz/ju8WhodcLCr7xLaSUhqW2EFHZ7r17SYU4mK:TtnGR66bXLZZLqDp2Wf
TLSH
T1F73285339AA5875EDF2041738CD639D63BF598DAB53B4EC243097C3124B2BAB924CB04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 fe20e805cf861f79f4cb022822b9e8cb3929baddea3758b3be03eeeb988bc92d
MD5 b0eb1ffcc29260ef06cf2927b3df6234
SHA1 41b650e3748bc1347a3e5296187c91f6220124ef
SHA512 66db34cc0207511f955adfc28693ad971a6395a006d5c0a2db51f8a0e7417bdf0dede45163dec5e6963ce6edc7064990a3bb1238703b7b451a11cfa6277bb756
SSDEEP 192:e0dbrQ3Waxf5eRDtU56U4UILugjHJQ19f4gE/Z8rvOiLlXj4UY/iY64m9wFuIaUC:eQrpE1ZyxV/Wai92Hi
TLSH
T1112295339AA5875EDF2051738CD639DA3BF599DAB5374EC243097C3134B2BAA924CB04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590526.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590526.TMP
Size 2KB
SHA256 3a7f71441b532665c1ae7e124088c4f4866a0a8e5e5f815bf4b0ab3449ea5857
MD5 a045992fc47548a53578729c36556bbf
SHA1 42d12151c727325cdcbe8f8b9c48cdd9f9a0bc2d
SHA512 7a3cd94bbb37d9905560e331dd4b965937397beb3df781dd810add8365f45609ad56ffd6bd1228143344fd1e4dda8e794ff023c2e239af34421e19513e264e10
TLSH
T1CB51F536C30908AFE31146308CDF3169B060B1D8FA075CD08967883AA6F87B3CAADD18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 42KB
SHA256 bcd514fa10a4d1a09b85d6ef4e718403a4e19486974c7df22a4b65f1ea1d4c11
MD5 8bba1df90745b2cfd7ec71765cdc71e6
SHA1 a4f8a6d8f3fb432d8c51fab8468d75f07c47df1f
SHA512 d8a7bd96cdb2a3762afa3790a48939b649b4c9dddcc2017aff0b62553e00337ee8a4dcb62d95a6da77472ec0ef2ad0ad120cf2ab0ded5a34fe40f37a8fcae8ee
SSDEEP 768:JuC1nAPtya2ao4GeQAzx7PBAkMEMA0iFxWpcp/cD7ClMG6Gsh0mzTpx7Wpz:tA1QQxbNWpcdcvzTpx7Wpz
TLSH
T112134652B5F9120AF2BB9E7BE9B617625C7BBE462D04C81D5864620D4C21F40CD73B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 383B
SHA256 b11bd238b2c172399ed9d7c48e618b7271d1d3eaa1ca62faac88a343d924973a
MD5 f30a3d36ec75e41a2a8c13da27665509
SHA1 fbff63017f6d11715d65b529c2141daf9450c26c
SHA512 18f21c9c5e7c56786fb55b95a53488ee5d006074b82ea8e14bf5faca4910c2b6f4a6a61667355fd069d8f14e4329e7751f2a0a3bec6131aa385a7083f62d0aca
TLSH
T1DFE02BB844CEC51FE14C10675234BF0ED2E7B60A9B8CADC51F0DD440B182A50F26A560
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2c4875d51f37cfc96955f7ed49d502d1ab12c7c905a23495e7113133512a830e
MD5 cb45f072f49f061af2d3b30b5d8cf771
SHA1 c7d8a6e20a1f44bfb86bbf85392625131e5abbb2
SHA512 fb82668664cb8d3248eef9ed04724f4161bc5e5b10cc1fc8126ffbce949a415286b9295b4fa390e8c5f403c7e404802237689ed87abd89f52ef2bd6791343332
SSDEEP 192:D1Y/EqMxa7pqgmaaij6Vk1q51zcR433AnTtt/jrFTGj4v:D1Y/EqMxa7pqgmaaiGVk1q51zcR433A9
TLSH
T11BD1CFF383E5866DD91192F0AA147F1FCE2C0855436C3C6E89E0AE5BA7E2571F081B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b3a579a320fec3669210557ed372a967d97c01fa3d09eb7944a3678da96eb1c0
MD5 6171f1215eb8f1116c4439ebc5ee8e54
SHA1 d2160b61e54f30f8298eff91ae462721a87629bf
SHA512 0317e4d748387f461371f31cd62d515b25685b7341d28eb8bab9d5d91f0d7aeb57f9b6844f99f3085e2ad8c615fddd64ca5256ac27b5643e6dbbbcb3ce58516d
SSDEEP 96:D150Oui+Dgqaaij6XkzBu6BXul5GOH2jzoDbGtwBO:D15/T+Dgqaaij6Xk1rXG57WjzoDbGtkO
TLSH
T11CB19AF3C3E5826ED91192F0AA146F1FCE2C0455436C3D5A89E4AF5BA7F24A1E141B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 a7cbbc0f33d9687900bf4e66bdb35d8a5e93bb742a4a8653203e7d9ae957b438
MD5 d35989043f9c0b95ce271899b4a0ef0c
SHA1 fbfad7d2544bcb3066f86c81e85eadff7c0a5e91
SHA512 3b0fed618d9ff16a56ba57fe057826fb376dc1c4633643462bcc09ee6e2f230f187386c56468c69ee30f1d2b8172bc5131996923e16aad04376eab32af0ed08b
SSDEEP 192:D15/T+Dgy7pqgmaaij6Xk1q51z8R43dJAnT55/9H+bx:D15/T+Dgy7pqgmaaiGXk1q51z8R43dJD
TLSH
T1B6E19BF3C3E5866DD91192F0AA147E1FCE2D0855432C3D2AC9E4AF4BA7E2471E181B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 afc11b44fea7998de3ef513d162fb0632b273cfbdd750223046ccfe8086fb829
MD5 fd525697c45d33a2101f344a66fa33ec
SHA1 2611c945159358d5147aebfd522b52b25c0133fe
SHA512 50c8be362fc825de4fbe7fec883d27a16669c94d368969af47bcb45530fc404657e7698507a670f4498032d5c8c9ede2ceeda941b826f00ce03b7510a62a64eb
SSDEEP 384:sxZrnAfuOI/fis1lJzKlUxzoHbA4/2WpvW8:sTAxI/fnlJzKVHbx2Wg8
TLSH
T18C92F842A6248977CCD7C619F926BF52D6F80063DE944E48A9FCC91C04EA6FD2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 a61cecc92356e3536fe1738716c84a236df2cd5a5cbd8aba73122376b844623a
MD5 1f07541a91f0ceac98258ce73c99fbff
SHA1 57903b6d2ee71377247a705ecb853561f2b07584
SHA512 b947e5a55ee604f88c10af9d991917b13682f8376a5f3e54bc2de1ec76e45fdc32486b6b219efd95f515415d496efdbc2e4731c0556fe4200166895a1f465404
SSDEEP 384:sxZonBfMI/fis1lJzKl3SLxzoHbIc/+WpvW8:saBkI/fnlJzKkuHb9+Wg8
TLSH
T1E592F94666248977CDD7C619F926BF52D6F80063DE904E4CA9FCC91C04EA6FD2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 84d315f92df0d6f67843452ca0553dc0b9470ad722565ae5a9166aed2afe4e9f
MD5 a71d51e4ce3089a88be5c2dda7ac7e55
SHA1 32e7e68691c054755af7c1d2f90811a0ea7851db
SHA512 2cd6670785ab40c18abdaf2b0a87554ce3ac13431ad32c9f41be1a3dd7b89a5ca6168f752b1f0d8b7854e3b9abc2461bc0fd1aab904a270ebfb782da17d00c84
SSDEEP 384:sxZrnAYtqSI/fisflJzalUxDNHbo4/2WpvW8:sTAYcSI/fNlJzaKHbZ2Wg8
TLSH
T14292084666248977CCD7C61DFA26BF52D6F850639E904E48A9FCC91C00EA7FD2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 6e5335d7024b4e14dccf65a9548a9b3f05e2f0dd638e51da263d915c00812c8c
MD5 6b0d08a36b6925939fba6aa77837fc66
SHA1 09f56e8b07deb7c445305f9ae9fa486c9cd530fd
SHA512 3fb3ecbf2859b23d20b463b6d315845a5004264599a28b12e8ea4a951007ef5f4adbbd941e79998eca3c66e3a712777a58b283b90e630eb87c73eaa08b7c22d7
SSDEEP 384:sxZonCfuOI/fis1lJzKl3SLxzoHbze/7WpvW8:saCxI/fnlJzKkuHb47Wg8
TLSH
T18B92094666248977CCD7C619FA26BF52D6F80063DD914E4CA9FCC91C04EA6FD2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9cf85c1e9ce82417c26c83e8fdf52e7c2fe15ea249235e65c9d1c7e43e2a3df0
MD5 86850aff36b629d9b150fef3a23dc1be
SHA1 4be0053069cd23e169a159e8d7f646d6c7fce9bd
SHA512 36618997fc959557d3f352d7bb1cf87eede2081014b2ef4d58b8ccad7fbbfd7f48285a544ca646ae57e34ad37c55cd3fba792883f95363c2879154638fd07edb
SSDEEP 192:sxZ7RqyMqZjK1Ml8MkI/fissLUaZdJzodp+8HW6+WNzcD/YvIux/Uj+EIgjtJ:sxZ7fMI/fissLUazijHbs/0Wpj3
TLSH
T14F62F9166A34597B8DDBD209F645BF93D2F91563A2904E44A9FC8E0C04E7BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 69690d2198cc306427fbb8202494acb3e58ca790c539ab8396a31bbe3545a3a8
MD5 9166f7b9794665be027a1291532d1ec5
SHA1 48981e4fe99bb26e05e00212afb0383a9fc696cd
SHA512 1519e1ca6e5e68d98f9a18776fedd7dababef57a24ac9285707effaf4f10fe9913e2555e74f75ec093c5981b2a824ccf2c42231e4e98c2f38b6983b65a1cb30a
SSDEEP 768:ZYsv8Od/hWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQro9RLG:eY8Od/hWvFvQXu1ja10Lm2Nu/S
TLSH
T1F8E20C3B284CCB7E4F840E9DEC26AFD66DD801CB66984D5447FA884C02C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ada28ac5-45c0-4dd8-b8c3-f9d0d90ad841\index-dir\the-real-index
Size 72B
SHA256 cf51bde4e7477027eafad05dc66ef42b2e660e7a2ee5112e439e1c3eaf635732
MD5 cb218727dc65cb08db2a9b659ae986dd
SHA1 f62dc7a9bfd1bc99cbfc4220463fea07b49143c5
SHA512 f0ecf10102bf95572067c8d940bf15f94fd8f4e5ed4d5e5bdb7fe0bf96171cd0c4d0057cf3b4dca4291f9471d3942d14f86c7868673482132023e583fa720a7c
TLSH
T121A0022D01500271D0C023F3514705B036D09E2B2302131396B1B274DD5279471C540A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f99d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ada28ac5-45c0-4dd8-b8c3-f9d0d90ad841\index-dir\the-real-index~RFe58f99d.TMP
Size 72B
SHA256 504eb78d7c364ff647fbc0ae558e89de3305967d59cd8861bff0bf94d1a91b4d
MD5 8eb4b7f8697c63200655e12c63121cd3
SHA1 99b7c9bed2f76bdc5d9f87f66babd06d19f78c9c
SHA512 2f750d974fa8ccfe31ae81e877f243a9498080694610c25bccb72c5f6288e593f05d9aa8da14a58fd5225c7ee6cf061b636b9c0f411f75979fe4fd709071ed7a
TLSH
T1ECA0023253940859D424457310290AF5A344AC1530144AD352D0508CDDF104147D6507
MD5 SHA1 SHA512 TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\4f2277ea2139c475_0
Size 62KB
SHA256 434f48baaf5082455f95f261347ae0582797b48a4bd9b3b4a1968ac63aaa3ec7
MD5 ba93db4a1218ddc606ffdbfaeedbc02f
SHA1 ac08c3a360129d5740cb291b5c40c46f8a4347c8
SHA512 5a2d923e16eac82cd39065be9bce74287b10b12ba367d4b263c4026408547ca948a9d2166341cc133591e18f48a5414f425b02b76f12eb5e86c7b1a54b5f6432
SSDEEP 1536:chUUsJp7T4JfCS+ksYyiApR+M0DpbarcjuIx+Cx5Z5HPwqpzGk/r:cG/48bC6Rx0DNDbd/r
TLSH
T1845339A7B222603587AD21D6A09A7F01F11B17561844C9ECF0BD6A513F18ECB57B3BBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index
Size 72B
SHA256 fb6501821534d949a825fdd26e89e8ff97d96d63e4f0c49e570c3b858629654e
MD5 c96fe1fc20c3528368de8a8ebfa84c5e
SHA1 634f1eb8de8be4074ed74bc7d4df0b285ab2202d
SHA512 d5a3cc2d0e230d905a057272b7db73bb107266d37e8b4b2185569bc73179158d59dc5f0b6fd95fea95c3f365907f1745b2051a20c83ff8fb1f40f64a09fbd6ec
TLSH
T1EAA0023701940049D48157F15142216027AAEC5E6242432944909495AC923985D6148D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f306.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index~RFe58f306.TMP
Size 72B
SHA256 0314db93e6bb740a4e01cdb7af2bb112b595379f9f7d5fdfc23d9bd1c6431eca
MD5 85ff737306f9908f89e289059fd9cd86
SHA1 c9e809ea3a486f18c2ae4bac9d41ae4e8d21084d
SHA512 3154006976484cfa0e12406b4d1e6071e365aa016fe4155c56a394c96be41204ff8df35fa86b796423174e2f4108ec73ffe08ac2720818548d994a4b91a029cc
TLSH
T1C5A00274537A8286C00817705A9A06513305DC1A35825387449034D58CA58984E06440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 66003599937ed9d34000ad8155179766f806625e202d0fd74f6f364be5193f9e
MD5 9c0d3e48e88fde73add5ecd04cf90132
SHA1 202da31ff043c4eb52cadf0d8bb2940cc206b525
SHA512 8454293dc423cf138c47b99a104b5c54f53947c14fe58b7c34440f550ddb0a9a85d515fc5cfe54c556207732705f0b75925c6471c9d9f0b63b8592caf9e2d1e0
TLSH
T19551C90E4C821A17EC9C12B328FB049077F5A4DD71899E1BA4DCA034FCC367E6D6A165
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 0d25ef890b9f4e60a55b37ac6a683df06d0e60c7a55c88676295d1dabdb5d1e6
MD5 fce4242d582970bea52eaefb52e97e11
SHA1 2b8de72a9f0638400ec1fd0d7144e9f6ed1e6e8d
SHA512 639cbbdf752fe8dfd34ac3df8d125b63bc2d8a7d0b63dd5e5be71df24f59631e48f53da5233ad55c012ede19ed8bc9e02cfcd0aebad6c44668c7441ec1efa111
TLSH
T1A6A002696AC4831BC91316B16EA2C251739098A41206231DA5D241C4E864DC0469150C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f131.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index~RFe58f131.TMP
Size 72B
SHA256 1e85d47a649b41ffbded5f370e92ac5cde3962513e74e30871af27e249ee67f3
MD5 2f41f7dca6222a2e5c51441778ec431e
SHA1 4dd2c86f3c07e5d50f62e4d310b6e03cc7218436
SHA512 b90da9e053e6d4867b836a579d8317ce7adb0b2640060a5eb97e403ebf59a54b53ba05d6222f85ed1ae498c09457cbb2e3facd8ae6cfd13dec5981a0d99adf34
TLSH
T169A0021403C40117C51B13B115DA12617700CD102101679784913055CD915448E8155C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 c4b68d1c5ce32c8303eda0b4a34ba2996d9a144740798bfbfb231489a62591de
MD5 3df4d74c5bd434826b310f7545506c5b
SHA1 3daba4a0a3bf19720844228974a070f59a0a761d
SHA512 8b4c3f8cc1803ed9cb730904e8ea7198086c5b617fafb73b4f3aeaa5eac61a88a8c2137c9cd574d7fb164ec710acd33c1269498f8efa36e5c487160380d282f4
TLSH
T124F05CB33FFB1C68FCABD7E6213158A4054D79549890DC5F2416F2E355B232C205DCA6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 69882b15e8bdac1eb49af086f5873517463d34af071c54e121ed7f5afb3ce83b
MD5 cac0aca3cdc9b5e5cb1d5c4ffdd989ff
SHA1 f1a5dc379d214b29848af2754d5d9cd70d4188ca
SHA512 8282ff18ee8511b9256ea21bde851fe96e93cb35bab85e2930b3f5fc71eb77bbe5dbd2eade416bcf778739185ab8121944f69197a687f7ca84fab199d96a1598
TLSH
T195D097A3D4100894DB6E86C006221C4787283C8C188180CC9503312E68B4786FA20FE3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 ca14c6158ddd98f6065549a0a3a48339938030e94e2abbce9f7f940fa6210794
MD5 56b0965563c6194f0be248c83741938d
SHA1 6725aa177778d79853ad70adc336427d01dd816d
SHA512 0beffb1ee6094302beecf88ad3b1e8bf5ab58f355979cd47793c385f52657679c016906694fa4516b3a3ad414369932c546adb317029fd52ddcec3b6e01ee319
TLSH
T1B6D09763D0040894DAAECBC00613181783283C8C188580CCA503012E6894786F921FE3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe584b7b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe584b7b.TMP
Size 138B
SHA256 69647e20bb68b2a2dbd83b6192e4784b81047d2b8849922d576fde48a05841b0
MD5 3673a7bb59c4fbfb40c3c9b3bc05bbb8
SHA1 cdf5c049dba19c8448cc82faf988ff037e7636ce
SHA512 de3aeddcd93edfcf9d8e13546eb68a9875ef230fb9592d1d83b9b8538fbf91ddc5a2279bb7f215061327264fc3535e1bb55c48b6e411b30f604d4e09f097b113
TLSH
T1D0C02BB3E0010808CB19D2D00332180E831D6CCC5C8680CDA013309810B0F377201FF2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a7ac3b05eacaae6abe93b77dfe1c5c7d6284ec685ada072c554941c158074292
MD5 ad8e4c5ea5952fc1fa0a8a2286a15930
SHA1 26be1935e6b3f9eafef216abc8cf7571e86ac903
SHA512 14eb6449095226468ed6d338fc62d337881d1287e2d3d4de8a32f48ba4bddef286dda59b6571e31512a71d13a397c53ab72020e77ae3c08fe62e97b895919737
TLSH
T1CBA002719D4D928FC400177110E75584379159D931055347489FA2989DF12D051C950E
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 503b0851221f7c74a7c27b6e33e5b6b18c1046283ebe7ff7aefffc4073c569b8
MD5 26f058aa1651b45d353afc0484dbf9c5
SHA1 d5e57780513e7a2ac48a6b4837f64531fdc4e807
SHA512 4b16e98aca6a962f744f23877b12b52dd17841c533af32ea399a5554957bf2f3d561aebc31648d365a9da85e744f3bd9cf5f31af5907e33f8e9f8dfbe0b59d9d
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG4:05ppxnY753RNBvRJJdt7p5J95Jnk
TLSH
T1D2B26B5A703A0211397E2988B39696364F4135A37158F4AF7FB814A14F6BE224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 91B
SHA256 b5ac12376878718d3accc7ed17f9d3350bcd6e6924328ed81d69eb1b250f83a7
MD5 471b1d93ed8d51f89e63ed5fb3908826
SHA1 7eb6ceead5c1abf3c63bd654f1021303916cf35e
SHA512 435ceaa9bc23e45012e6c72d0c3437862945f0a2a4cddd2458b12a7a04a6d63ac30fcc7e7f470d0c0ec7dc6c38796f7adec849b6ecd006fccb61f12f0b656825
TLSH
T168B002BB504259D55F7534F7014731DDC56633CC9C85DE8D9472205C321457F2001D65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5964cb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5964cb.TMP
Size 178B
SHA256 45c831a9ba19df719399c4d9a563d788fcb1a49917ff9b928e59cdb45e74759b
MD5 038a83f944db3446ab6eca17a2341a5e
SHA1 1390e8adc1f813473d828ab7576463f1b1a8e135
SHA512 54691cc7ff3473c799124157a8317e3390b5a098e86207f5adcfb8d0f7e3135b52f4af0f6fb249881672f64e46845eacdcd7a9f5af256a039796578df4b0b9ad
TLSH
T1BBC012B7008187D13A3554EB510631E9C9373FDD5CC4954C44E230482234C2B5940924
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 2ed6faed9feb2a11c17357a01648443b4200a6fff6819c70c3d38d9f5f9971a0
MD5 fae49e3528622d9830fbe961de9ac614
SHA1 5b53ff875d85fa93816068a7bc57babbf3779084
SHA512 d4e9976b5df10b9eb304f2560ca29a7de79acdfe338be6e7b7a5a00b5253260980a976b32d9fd14a164a2b53d3309a78ece547375a67e8bf8cb1c0e4a2bbd6f7
SSDEEP 384:n6iFiZcIMu3sNU8TUNTUlI4ATNckCrfGFj2phifGGJf4KqPL7WCb1f5UrzuKD7tG:xFQ73hwgQkSOjoFGPqPnWCb1Sut
TLSH
T13AF2D4F198D78977E8AE8B8B673D2D029AFCC123B5885594B7D85D1CCC960BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 00bfec89531af5af858e0429b311f2a9f1a8859ec6888c901e2da8b3aeec7b6a
MD5 7520fbf1bd3b733ddb1fccae3d0bcd42
SHA1 96bca8bbf3c456621b5a7020ac85f7bc883482c9
SHA512 3e4d33bbf837ed5a021be5c0a06c0c52e99c2b1e99f95309eee12d7d680945ce8630c9553355b89864e139f1918f038affe3f728b91d23ff060518b918f64a87
SSDEEP 384:npkiF9CcmyWCs3sNX8TUNTUlIm2QckCr9lzKphifGGJf4Kqhwpwe4KV8p0vHdtyN:p/Fccps3WwgbkUdkFGPqhBI8p0vzC
TLSH
T1C5B25B32EC58DEFBECE74F99B74A7A07DEE01223859C9AD4DAD85D0D009719C530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2e970017d079ba656c1efe01fd49d9abf44e25d10f81179ea1b2c74c4bd4bc26
MD5 4db8e8a944decf576e4e3afda53cae43
SHA1 ee8c0d09b439aac348feb2a5285b1d240d5f6877
SHA512 892da9d113583cbfd5b131a71778db1c651f9e1821bb32b1e2ab9dca81643ec1a8ba2a43ba9cf94a5387248bd787a8d685b894c420324d0af25ff0b05b84b07c
SSDEEP 768:piFccps3xwgbkUH9FGPqPnWjb1I8p0vzC:Ms3rbdPnWlI8p0G
TLSH
T1D3C25C32EC58D9EBECD64F99B74A3507DEE4922386CC9AE4DAD85D0D00DB1EC530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 adfe95b12cd2df9ada4bf294b3810839e5f9b0d5558ceafde5f5a399a0f2deab
MD5 643ebc8d28eececd16ae9635b387a5f2
SHA1 f3d26af81e7b3887d8cf7746f53991925750794b
SHA512 9a843a1276a258d22ec1e7f2670db907b4622512f0aacc8f456b50f3d983c91ce70bd6e28b0cc5cbfc79c5887ec460c36cc366a8ecf90287521a16c79fba20eb
SSDEEP 384:npLiFiZcIE3sNU8TUNTUlI44QckCr/4CphifGGJf4KqPL7WVb1f5UrzuKD7ty/7T:pmFQE3hwgbklMFGPqPnWVb1Sut
TLSH
T1BAD25B72DC64D9BBFCE78FC9AA5A3607DEF4426386CC66D8DAD85D1D009B0AD0307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a242ed4536c7c2c0498425f53d6a4053839c6d4228ba7db4b7f3bea0e3b779e0
MD5 4388e46d8886bd453c46894fd741d10a
SHA1 c0fb88b4d650f44978f8e607f986f1c7dc46544a
SHA512 76f5a7112ab7120bb8816a940938a337110a92d7b6fdcf86468ca7a513a5012708f5bd94e6331e80c60f384b7a2ef2f9ea699db360d124981b4099eb37d094e3
SSDEEP 384:n5iFiZcIE3sNU8TUNTUlI4ATNckCrfGXj2phifGGJf4KqPL7WVb1f5UrzuKD7tyH:QFQE3hwgQkSYjoFGPqPnWVb1Sut
TLSH
T185D25A71DC64D9BBFCE78FC9AA4A3607DEF4826386CC56D8D9D85D1D009B0AC030B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 dda9e990f35fc5f38e5612ab4f6e2c4f6027027e6bece7d4dae472578c09401c
MD5 93aa64c29250ed0e7860e67fcbf79fb2
SHA1 c49d1f35d5762f1248a7c55fadd2333b8120a106
SHA512 42ac9a2c0a5b19d8e0e1bb46d7bd6543dc26b54eb558134d85bd20dcc53c3913f6eed5f2d14e925f51fbf99074d2d91bba0a092f4d218494f963df7823654051
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d7541c1c65d241fb8734b8244a3a698d1525eccefdeaec95103666971a005ad2
MD5 1e90a36a043d31febb07eefacdc0dd21
SHA1 4132581b020844d8245a13d6e8172c85cb90e90c
SHA512 cb75cc343fb1f20ecb7009a357ec5cf11b224a296d5eaa9dd9cdb01f22ba4b8990261f3344c5511e909587430efe5fd107f06ea622f260f132a5ba2a2819df1d
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58ad81.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58ad81.TMP
Size 392B
SHA256 87a6603a1a101c3de7ef64c20829775da2f7d47a3434509af76672ca7f86636e
MD5 268aeb8b4ff89b6001b0cbc4074f7e05
SHA1 c5382c15ce01aabe92d3ceb53452f66491f81c41
SHA512 ac70e9163b1f743335a191256a73a594ad2b4d1621f24219f19c05aa2efafec0c6543d0f1a45d9ad28a22ddfe82ed851b33cb29d9687f2b1104564dbe7e6cce2
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ea26befc816c5130c08a179e6ad178a40b1ab6e4d6de3b01d4bc0d67b340846c
MD5 0941079717d73b9e0c68002eaeae6094
SHA1 d398a2a9045cb8df46582f78ec664fba360c8161
SHA512 f8245f21bdf11650c58fc51068ed1b39716711c66497219c41004f3ea4fe74a180f0fee0d8847424492ac807329b7468f1588550b6cb189a5ede314d1f897342
TLSH
T10941395CB6EA1148B3776E5A9FF6A86D487E7D372E0A905E00100E4E4667B40C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3912-2220-0x00000170C52E0000-0x00000170C62E0000-memory.dmp

Download

memory/6040-827-0x0000022800000000-0x0000022801000000-memory.dmp

Download