62a962581327c65a48de3659d9892f6061f276fb00be969a3076ca1f6d5ffaf9

Analysis

user interaction
yes
max time kernel
281s
max time network
280s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KRX-Client-19.5-win64-public-v1.36.1.html
Size 5KB
Sample260808-b76v7afp2y
SHA256 62a962581327c65a48de3659d9892f6061f276fb00be969a3076ca1f6d5ffaf9
MD5 43c70784417d9f359d4ca930f884e0f3
SHA1 8d95b4b518a38792d3b417527d6d1ae0ba59ff48
SHA512 f0d4631449b5664f5f7d0cbf2d89f586a6b413940a0c12353f7157ba34ed1a3d881f9a91ed3b5f7aace6e8a7d2d973b24678eb8b5b8603241c78b9a6e0005817
SSDEEP 96:PNyBtoXZzIEb0EaW87vwHbvHUCduYG88SgDN1/IY8PW6nmYzueh8m5mw:PN8tkCBYHbvHUAG8nCXIY8PW6nLykcw
TLSH
T1B8C11BE3A63290271FF65F9D90FFF38D522176867F158090DA914F5C86EAF6B8019250
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2816	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306273378701303"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{AF2619D0-B032-4814-AAE4-36759C721D64}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6124	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6124	taskmgr.exe
Token: SeSystemProfilePrivilege	6124	taskmgr.exe
Token: SeCreateGlobalPrivilege	6124	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6124	taskmgr.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 5312	4544	msedge.exe	89
PID 4544 wrote to memory of 3304	4544	msedge.exe	90
PID 4544 wrote to memory of 2816	4544	msedge.exe	91
PID 4544 wrote to memory of 3304	4544	msedge.exe	90
PID 4544 wrote to memory of 3304	4544	msedge.exe	90
PID 4544 wrote to memory of 3312	4544	msedge.exe	92
PID 4544 wrote to memory of 3312	4544	msedge.exe	92
PID 4544 wrote to memory of 1256	4544	msedge.exe	94
PID 4544 wrote to memory of 1256	4544	msedge.exe	94
PID 4544 wrote to memory of 1256	4544	msedge.exe	94
PID 4544 wrote to memory of 780	4544	msedge.exe	95
PID 4544 wrote to memory of 780	4544	msedge.exe	95
PID 4544 wrote to memory of 780	4544	msedge.exe	95
PID 4544 wrote to memory of 5832	4544	msedge.exe	96
PID 4544 wrote to memory of 5832	4544	msedge.exe	96
PID 4544 wrote to memory of 5832	4544	msedge.exe	96
PID 4544 wrote to memory of 3604	4544	msedge.exe	97
PID 4544 wrote to memory of 3604	4544	msedge.exe	97
PID 4544 wrote to memory of 3604	4544	msedge.exe	97
PID 4544 wrote to memory of 1840	4544	msedge.exe	99
PID 4544 wrote to memory of 1840	4544	msedge.exe	99
PID 4544 wrote to memory of 5484	4544	msedge.exe	100
PID 4544 wrote to memory of 5484	4544	msedge.exe	100
PID 4544 wrote to memory of 1540	4544	msedge.exe	102
PID 4544 wrote to memory of 5892	4544	msedge.exe	106
PID 4544 wrote to memory of 2684	4544	msedge.exe	107
PID 4544 wrote to memory of 5588	4544	msedge.exe	108
PID 4544 wrote to memory of 4800	4544	msedge.exe	109
PID 4544 wrote to memory of 4800	4544	msedge.exe	109
PID 4544 wrote to memory of 1292	4544	msedge.exe	111
PID 4544 wrote to memory of 4660	4544	msedge.exe	113
PID 4544 wrote to memory of 4660	4544	msedge.exe	113
PID 4544 wrote to memory of 1836	4544	msedge.exe	114
PID 4544 wrote to memory of 1836	4544	msedge.exe	114
PID 4544 wrote to memory of 5716	4544	msedge.exe	115
PID 4544 wrote to memory of 5716	4544	msedge.exe	115
PID 4544 wrote to memory of 2324	4544	msedge.exe	117
PID 4544 wrote to memory of 2324	4544	msedge.exe	117
PID 4544 wrote to memory of 2324	4544	msedge.exe	117
PID 4544 wrote to memory of 4300	4544	msedge.exe	118
PID 4544 wrote to memory of 4300	4544	msedge.exe	118
PID 4544 wrote to memory of 4300	4544	msedge.exe	118
PID 4544 wrote to memory of 2040	4544	msedge.exe	119
PID 4544 wrote to memory of 2040	4544	msedge.exe	119
PID 4544 wrote to memory of 2040	4544	msedge.exe	119
PID 4544 wrote to memory of 4736	4544	msedge.exe	120
PID 4544 wrote to memory of 4736	4544	msedge.exe	120
PID 4544 wrote to memory of 4736	4544	msedge.exe	120
PID 4544 wrote to memory of 2592	4544	msedge.exe	121
PID 4544 wrote to memory of 2592	4544	msedge.exe	121
PID 4544 wrote to memory of 2592	4544	msedge.exe	121
PID 4544 wrote to memory of 6000	4544	msedge.exe	122
PID 4544 wrote to memory of 6000	4544	msedge.exe	122
PID 4544 wrote to memory of 6000	4544	msedge.exe	122
PID 4544 wrote to memory of 712	4544	msedge.exe	123
PID 4544 wrote to memory of 712	4544	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\KRX-Client-19.5-win64-public-v1.36.1.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x288,0x7ffc8993c188,0x7ffc8993c194,0x7ffc8993c1a0
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,9747408848688727847,10630599718054168029,262144 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,5959862400078999155,7496950768766026159,524288 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,13847217449793078761,18052818906433230693,524288 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:13
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,14898447484890201238,9542963308909366746,2097152 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,13087833917834329249,2406105263463188423,2097152 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4380,i,7613667683711574800,6589514869642679962,2097152 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4388,i,1002123659813640788,47266665142609554,2097152 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,1370636319110131351,7835638604525854564,524288 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,8134906883573269410,13181936271436932698,524288 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,10635929159195478037,1697860887998023531,524288 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,10635929159195478037,1697860887998023531,524288 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,13782192852490377618,9040198166184448917,524288 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,2362155481545483225,14550259390034193531,524288 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:14
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,15293865704323200053,13652682582214690903,524288 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,16570838118220503216,5695673584124722875,524288 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4568,i,4003924607668668769,9051938464971384156,262144 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,5910469661059055234,10591940653756118955,524288 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:14
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,680051291660484319,15093365033967234474,524288 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,150469063292914234,17556023078850829398,524288 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5460,i,15070550284947580564,1158466413915635405,2097152 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7020,i,10666099820887719185,10132108847524474528,2097152 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5248,i,6557604219947874318,17482986763342970205,2097152 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7092,i,4597138818276670128,5497936794633113616,2097152 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7124,i,14075548632544531052,17522413462024563869,2097152 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7204,i,16701312901227857994,9928498457107834501,2097152 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7448,i,5212504134325263779,10622553273295280064,524288 --field-trial-handle=2204,i,13866296271784324279,6552996117537988906,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:14
  2⤵
  PID:712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1488

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6d00deccfbc266f7a241cccbdad124ff52bd90961e4c1f85a57ff3546db81fe6
MD5 4c4edd0ec3b48c5b9a161c8974c650a6
SHA1 4e13213990fb5a796734a35657f82bd0db3439f3
SHA512 df59a5d34af9ff90e7a2ffcf31fd5cca7eebdb7b720e6a11fa3c03217bd4d5b72f4fb712c2ed0dd153a0d2ba36f0b47e2f830abd9c224eb94764b6663589413e
TLSH
T1CBE0208517C4C23F9547744FA55C4B0CC2C0364B9EC4B9075F08CC497003141A2D3F68
MD5 SHA1 SHA512 TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 60KB
SHA256 973d7c4cd91c428490204d4647f283b60daacc9ff0e8c83bf8c1bf994528602d
MD5 b96f8d90119f9f8307274adc5695da21
SHA1 57e36157b36dbc401c5701d0e27ec2885193a4ae
SHA512 e267cd9d04f6ced28190e549640aa7e08060673a0f616b7ade1ef3aba4f7c8ef52a082266ec362f42ad2bf3982141bb8476e4be4c97ef8c40248a1d9e25efea1
SSDEEP 1536:G3gKQfQWtQJzaGw3WZiWX0K1pFlvnC2c+6LABHgO:G3g94oSZFkulqJ+6LAZ
TLSH
T1895302A1F19608BE6EBA88B35DEC427A99F9F4E653D66D32D54F124021B8821D937C04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 72KB
SHA256 e21ce53d43bd9e404759b9a267e44c63106a423e70263f87d9e13ccfad4f61f3
MD5 1d4e7b902aa7d072fff5861353725adf
SHA1 3ab24c6848aa072854995d7f477604f2474fd6a6
SHA512 4667de5c55d95d200c604614114228180b0bec7b1e2f4bc204de5e28048301dd956ac0105516cc734757da33643cbef9ef42a2a04ca7ec6810200fed1f842d05
SSDEEP 768:U8XRyk5xUzO+ZR6lrxcgNbZcHTnGWRVmcrODcgAhR0C35hYNeJET+KoASRBqFqTE:UKRfo0rxzbcbzfSDccNaAJ0W9nKr+wM
TLSH
T1DD73023BCC97140DC7999B27A829A32EC10892C6A01F7D3B46C4347975233C5B667DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 ce7161b539ed2b10621c356dcadb2cc71b54bbdf07467b2fc7b120bd75215405
MD5 2288ea148d68734a65d8d3e114f41743
SHA1 603b83baba2f2af14773b71a1b7e7783801d0e2d
SHA512 f59c631384501302e036c9846e33fb5d1a70c15a464a48dea4c28aaf8bfc29650ae419e0d275985922d58abe2ab8da0b11d1f8e1d35e7cd990f7c510a7845012
TLSH
T19F51072613B1DAC1F79940B7A3EDBA847FF08659220B2F101C437E359925F2760E0ADB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 2fc3d6b0259ef02ce041c75890de8d42f70929af1c9e8178151eb38cdc071adc
MD5 665a504bf5b44fcbf263d749fdd52d88
SHA1 b1e4ef0bc91e1d4a805e66c481cfbce989043288
SHA512 a5ece7bfee755206e3ed86f2602dd6337b5d155f016aef88b37363a08138d7db550f4041aab90826a7f4bbb346028b8001604fc505e4c532b97407050b486824
SSDEEP 96:i0+4XYSfsLMtVwzvozhVhX62aj/hzVt55tV39ro2oxEWg0wj7l7GjhsM1r1:PjYSfgMtV3bX6RVX5thK60wfl7khTh
TLSH
T132E1960243F1DD83EF1418712BD8A9603FF845DA674F1F1E1A217D3A7882F9A90D999B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a0188.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0188.TMP
Size 2KB
SHA256 46204ee25b0d649fae40a5b76b602c8ce50c7c02fdbe5551ef23d323621fa7cf
MD5 21c21dcfe400d1aa201724c8f755cadc
SHA1 81626a15e484aa367ff5c1d67fc0447430e2ea43
SHA512 3ff2b15c1f18fd21984923775025376095efee8c484efb6cfc633300a932c87157d5089d27b448c6bc80c6aa3ecf26e1dc84dda181b45081e52b659042c7f908
TLSH
T10451F82613B1CAC1F7694477A3EDBA847FF08659220B2F110C437E359925F2760E0ADB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9cda5edd304304ce3bbf1f82b47321f646de7caa249a32369b8f5b680f97aff6
MD5 1ca4910ce06a5ac1d6d4dd3e10cbd233
SHA1 920d947dd7e18a8d3240d71c01be190797fdd1ab
SHA512 9379c316614a468a1a76890408f9cd1f8556ab7c4dcd3140cd73668e281da968c27029e3771b1ea4f09e8d33bafac7a345f6e306aa7331a078df64c496157f01
TLSH
T17921C0F383F4957D8A0182F4AA046F2FCE2D0915431C3D6AC5E4AE1B93E2471E14095F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 168ae06e651ccfc1750d1a167cf924e79d632d46c34ea71547f7adf3cff616aa
MD5 059e33ccd965af4d981553022b38cd5b
SHA1 e221c8084fa09685e21cd1d9a16ed9775ca5c56e
SHA512 986a8b3da687dcab7b4cec9a37042adb5ba73fca52345b70b4700fd60144da158fbc0cd0bf48db6d24d4d41f560cba9f1905b205e4ccc9c76c5378eee8ab2da4
SSDEEP 192:DYCvNoRmQjNa3eaEVyiZVk75cA1P/1i9zgJIsJFDd7sw6Ar4kSo5gvhH5H34YuO:DYCvNoRmQjNa3eaEVyiZVk75cA1P/1in
TLSH
T1BC227CF6C3E9926DDC1151F4AE182F2FCE1D092943683D2AC9D9AF4B93F1471E24168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 6c25a78f84a88ce5e043c296b3f52433a4b7249a7cf325d969c7f3073a1b653a
MD5 2bf1f04f6326e92e43a4d78f9ba715bd
SHA1 a552425b20ccc3535828636d78ecf069127b2bcf
SHA512 4707c6c88aad136957421075eb6d39cb8d753f2f189f411984d8b4413faf60b76341352b8c6f1a516c538c0426926cfc51cc5b90a514e859e93702ff33030934
TLSH
T18ED022A35284B0B5A9BC3ECAA1AEFC8FC32B10638802DDD511D09CAC0B3946C052B280
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7e0d3b2031e03390ebc99b37c6a721fa426ef7eb4e6fe94eb52da259e730c549
MD5 5d7b4a5412dfa07e1b2d27499c79a051
SHA1 b9e57fc86a8b3a29cbd5945b0bc0ebf7e18663e0
SHA512 86f0f7369baf61d0e16a0162afa875ac1e2fc9810f0da3164be73befa92286977d144204534c99cf5efdaf291975b9bba8b46940918ba8c97ead63121955db9c
SSDEEP 192:sxRblrbQ/fGsXIr2HFSa7zoA8p4hy/g6+WNIYbuZ6DGkIgDfJ:sxRblPQ/fGsXIqlSaat/5IH6Rl
TLSH
T1EC32D9166D28A93B9CCBE21DFB56BF53D2F9503261902E48B7FC961C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cb3ee85ad7312f0ff2667bec4bc260b7cd7dfeb34c93c64ecbe3a185102d4333
MD5 aa91f69dec8486d78cc0ab3578cb8769
SHA1 1aae53c9668ec6a4e4460b0b4ac7cc8e0a36631b
SHA512 1fd9ff9fe7018397c788f7579fa80780c96f37245a022d2795caaf097397fc3bb6bcb9cb42468ab7975033b654374f0b46097dbefb2e3c369a07195798ea11d2
SSDEEP 192:sxRbWrbQ/fGsNIJ2HFSa7zoA8p4hy/g6+WNIYbtZ6DGkIgIJ:sxRbWPQ/fGsNIMlSaat/5IK6Rs
TLSH
T1AF32B7166E28A93B8CCBD21DFB56BF53D6F95032A1902E48B7FC961C04EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 87f72e9abd0eb4bf8151723e07aa231fc647ac9ba87f971311d44c356d8dcc89
MD5 996063eb4a6660a4954c410fe7655acb
SHA1 8c72bb73a11e475111ba8e61033a05d398ea91e5
SHA512 0311853c4d5bafeae23b8f1d43e1a08491bc9819fef1b3d8c024daa4bbb2f72d453125292520935b2bc2b138b1d7883188040bb3eab8bc59700462149eba6e5b
SSDEEP 192:sxRblrbQ/fGsXIJ2HFSa7zoA8p4hy/g6+WNIYbtZ6DGkIgD5J:sxRblPQ/fGsXIMlSaat/5IK6Rn
TLSH
T1A632C8166E28A97B4CCBD21DFB56BF53D6F95032A1902E48B7FC961C04EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0efb8d02fd662ca681e965974e235650b97179a9098df3aff5cfabaf9f8519d7
MD5 b5588b2990ac8731b44064cbf13a5d1d
SHA1 90e2639c0d8291a17e30bb50c780cd9f43a51d82
SHA512 16bc4eee97238d4b50e6e74c2ad82ebb6ea3521b7fdf1d0967707bcc4d7b13cca12b3420933bcd9e533a06a019331a71072b19cbb7feb00fab64a5c790b1b3cd
SSDEEP 384:sxRbQnCTm1Q/fGsXIqlSa0pb/5Tw/W6RtSm:sqCTm1Q/fFIqn0l/5uW6DSm
TLSH
T1E072D7569924997B9CC6D619FE36BF22D7F8102398911F4CA7FCDA1C04EE6ED2213807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b3f714503727ea90b29a86c713226b628f706a3bc581a5615a0b12d31d783cb1
MD5 75e0d5675686e7d1b11965c0c125b58f
SHA1 51012652805e79aa152760575450f7ffec66a2de
SHA512 cba40ca9469ae0842dc98a29c6a4f0e73bb454e21e33d1f89d5ed42ff1b5483463d2cde3dcc539e48e083e87846c91a5ca440c71033f16efafcc520a19ea03a5
SSDEEP 384:sxRbQnCTm4Q/fGsXIqlSappn/5Tw/W6RtSm:sqCTm4Q/fFIqnpJ/5uW6DSm
TLSH
T1D172E8569924997B8CC7D618FE36BF22D7F8102398911F5CA6FCDA1C04EE6ED2213807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 26e664f046e6f6180030affdbf00b0b5a68c47387bd5282c66ef7a0b11cba421
MD5 55c5390e966debb1daf21eeb8f75ddb6
SHA1 256056bc063b3b6be20a11f3deac090592fd99bf
SHA512 11c1bb37723e21c6b0fe75afc797bc7cbd4fc653a2e5e2be13d673f9994950bcd243f1bd41391645e560691bd91c7e1aeaea214773879a0604c8830b5dc5c0c6
SSDEEP 384:Flp1pABfCtgisFfq4KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVnz98ERF0roAoM:Fb1pAtWgikfq48F1+UoAYDCx9Tuqh0V3
TLSH
T142B2EB3B600DCB7E5F800A9DEC19AFD76D9802C796588D8047FE994C02C77FA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\730f5b22-bcda-4f66-a324-f5ef4881370f\index-dir\the-real-index
Size 72B
SHA256 0b327e8d2d83e59ea0ddce40454af36c92ba9cca456e5ae2bc6392d2a6aa7509
MD5 f5602d99eed1cff7aefc9fd2aee27e84
SHA1 76b10213a14eaed75125a887a13d463df7fbbf17
SHA512 8768826b3a8f1f2e807b0fe2d0d3c492606aa39d97f16657eb862c7f0f4bc34357e35f7a3ce399aeea19e8f78cbce6d6946fd643097f08b5523ed1a63a253703
TLSH
T145A0021552E12443C45292F02BE6018163114A911303A35ED5E143E4C9505554E5221C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d18f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\730f5b22-bcda-4f66-a324-f5ef4881370f\index-dir\the-real-index~RFe5d18f9.TMP
Size 72B
SHA256 3c1a3a5564798fa0413f9e6bda438f66115eca3e07c3b7c7d072a0a4e8e4cd12
MD5 4d983250bbc0d90d6cacbd6431534817
SHA1 cd3a3ee8b9694d6ef373ef6dc33e30a70d6a32dc
SHA512 d7834e201f66b1566d73d0c865ee02c9cfd51ec9da2bca013853b51263cd84b6258384a3bf100500e519237d1b5753c8ba88d0cc4dfc00f5a9a5a476798abf8e
TLSH
T1FCA0021803D08187C01222B11BD2227112098811F90012264C921348CD50867C58305D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c5e6a5ef-ca84-4807-8cff-eab7e996aaa3\index-dir\the-real-index
Size 144B
SHA256 b3eb8e5780f247cdab283eb944018fabf360911479c0588120bafbfbf7d740d4
MD5 c02036e4b9142f955192752a7a804e12
SHA1 2eca4d3a93661baf467df93f39a92e07f7cf892c
SHA512 49f0f84cf476e9cfc1502f83be73a622960173bdaf83d0b0555daa357a2cf525456dab175b5703c33c3f3fef8aa4759479592d4873dec534c323a88d430c6ed0
TLSH
T17AC01201CC6B8665CB0B76316377356D27330AFF0A66BF1B10DC182AA472A9AC8D7C06
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c5e6a5ef-ca84-4807-8cff-eab7e996aaa3\index-dir\the-real-index
Size 3KB
SHA256 6cdf74e5fd3ea408f8300df60bcc4534cf45daf066fbe3c6a40892a3354ae30a
MD5 4847983336d3c006fdbff8e56b044fd6
SHA1 0e099d38e01779be6b21b55878bc613a73b28aa9
SHA512 5ba95f3effa287477c12125b533b05d212a30102a0d30f6b6afa18d43eb30aedd7e175b5d7b1df0946e39359c46d149a4acba7e6f2c0b69f6a696d433fad5081
TLSH
T1D851FA4E4C076F66DD9D24F318F62852773534FE97855B07999CE8383CC33291C6AA15
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cbffc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c5e6a5ef-ca84-4807-8cff-eab7e996aaa3\index-dir\the-real-index~RFe5cbffc.TMP
Size 144B
SHA256 44ab682bf4b0021abf628be34c9052c1358109fde37c3a4233aceb8b1dc26c5f
MD5 af1fe2ad437a81e43a87ee5924dd1659
SHA1 b1114b236a57940a702138487db3ba7e2e6c6f5d
SHA512 9c3ad1f16614dc5313fc8c62c0bdb9d25cd80714ed420559f1ec7bfe3c28b6893ad7ee26e3d3c92ea56a72ff33fa2cd00e4f5546ad0c40fd47a61ddde16e9ebc
TLSH
T177C01212E562C8B0C70F65701143B61D226B1C250021B62F60ED086F5CB15CCC5C7905
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 dc1f67ee2ee052912aa8d9ef0c715ab3a5e84c30837a866d9d08f8f0003a433e
MD5 0a5c5fa6aa95f80af180dcf3f18e9f54
SHA1 65be1f6ed911b9c42ad5a4ee7859b16f728ff110
SHA512 33922afa80fc484e7b6272301158958dd73f598629dd0eaff0348357202c7786babc27f1e26c08dbd8f723e89eee8fa6344a5d2100186a6f828f348cde086cc8
TLSH
T17AE068BA99EB1C04AD9F83D51432545001417C348D00EC8F5017628350B33617489C61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ca740dc083464cd04bc9043b7a0c6839064f6eead49b420cce7733355302bdd9
MD5 6c35cea9644eff7d504b1244c2a2c841
SHA1 a770e8817469f971d176c054c49e264e24b68a70
SHA512 0e3bb89d0ccbede57690d06a3fe855824a8cd7d80440e4c3f4723f9fe01c306b19b84b1f02f781e1b4b147ff3438596d2f8fbd83d2d2580b6e8242a2abf95f00
TLSH
T1B9A002288F8DD452C5054774146561887F504CD9021A23428C99D8A9BCF729159C5132
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1967.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5d1967.TMP
Size 48B
SHA256 18f173e99dc77ff24617360552ec398cbe22d0906e2bf11bd19f2b924e4d07f7
MD5 110483796a5b1e1057d25905be1ee374
SHA1 78fdac909f1617207e8bb7a1435423c1b0d4b0ed
SHA512 56b8ea473d93dd1e6c96dea53cb6b865629769edbb821fc73b7f5a57b118724a04f7ea7c1852810bc22f26dee55765b9dbe867d9f0e3c1b20450998326ec8007
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\ee5ce876-808d-4b47-b679-d712cb22575a\index-dir\the-real-index
Size 72B
SHA256 542a8b545cbff74935b851d07be455a16a186bc7f2a7ed7b1ebb8a4dc11b47a8
MD5 bc0f95e76d6b6c5f4dcc4e7b063035df
SHA1 b66b6c04255703039b1c4221ef912a6eb35cb95a
SHA512 f155156b1ff509a77834612a5a7526e8ff07e307c7538988428d333fff4fdf07b82e0c7714e769e47b4dc0639d308c8bfcf84b7a1477d7995e279dcba5021b67
TLSH
T15AA002A822701711C4400F7424571261337A4955EA460602C5D22194C9912A6455373C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5db72d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\ee5ce876-808d-4b47-b679-d712cb22575a\index-dir\the-real-index~RFe5db72d.TMP
Size 48B
SHA256 65a8cd8dd84a7c18c7e618ff569ff28338e3685c2b40fb617dd6088c4922630c
MD5 eac65cd325313c1d79f791be14fb4491
SHA1 7c8dcf1746f36a462fcb50e75a3bc18eaf001425
SHA512 a1ad65cdd77a9c8ddd1a7bc06bfa603797a4061f2b7eb03777983b7bdcb8112e18084a4d4c6e88bce3bfcb25ffe2ed7a099b4a7737823e6144228e517947b63d
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 235B
SHA256 806d92c7f76889916507f5aba82cc33ef0ea2fb5c4774ad356976baa2da6603c
MD5 cfe3ea08700e9abb880b2f05cf4c49af
SHA1 add6f9ea646c16bc9355394552c8bc3b0bd35156
SHA512 f760d88d3e6634b69645bd50e8df6a80c4a5d0d670fd6570034371dc1aa046802b6da87e87bfdb8f67ab5e02f9dc131a5f423a081a2bb68942322e2d92ed95fd
TLSH
T128D0A7FB05254A5D1731A685705D755F86065D0D8CC8DC989944F18711B86128845979
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 152B
SHA256 0c7ca9c618ee53f39032c28fce914348cfd199e27e83cc1d3b83ab886039fffc
MD5 322ddc1ade6d56acaff2bea0c95ac7b4
SHA1 6f024aa6f8555d16a0f991b2fddee1fd41ea3a2c
SHA512 7fe878264fb6cc42a8cff66f80e7f245fe15e776e86da8690b97a05eec38c7757b7bd7acf038a44a903dc5a3254440ee68778f1d6afc75146e6d81d6091ffcc1
TLSH
T1D1C08CA7080043AE4F30A5C8305DB22FD90B450C8CC0CCE89408804311B4A230C05978
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 151B
SHA256 4255b95a3e501e7335b6cc38b38c29de8d8198e2313a4c6e96aad6f5c907f372
MD5 87406c39d23c86b1d1d03de230d29fe8
SHA1 d1145694db41a2864e5982e3d13a9016819c5866
SHA512 78cdce4ee690e414591a3b1542de69fde547b1b2ff94ec3b7ba40487335120e67d1ff1ec85783b2e15f6209f023fb910f26c93da86a298253a090a863c92618d
TLSH
T1E1C04CE70814479E5B35A9D97459B62FD90B454D8CD1DCE89548814351B8A234805979
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5d373f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5d373f.TMP
Size 158B
SHA256 fd482baae04cae818c5fec5dd236018bac0f0251dffe1ddf6cc325af50959ea9
MD5 c74af0c4f43aa553b293b279f1fa4468
SHA1 2d04626d7cae8c3d39528790b9f1cb10ba33aeb9
SHA512 e770794b3d960d5f157c213114c703e7833e238182d500ce0d406b83c74ba5354823c6857c2a16553fece5dcb27e02bc67c7fa9d9ed06b676e530c28bca4f928
TLSH
T1CEC08CA70810039E4B3164C57069B61FDA1B8C0D8CC0CCE8A409B04321B4A234806978
MD5 SHA1 SHA512 TLSH

Submit Download

89171984-f19c-466a-aaa6-e90d0d20b6c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\89171984-f19c-466a-aaa6-e90d0d20b6c2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7d0071b2d42ad9f7bfe165d323679650971f2293736d93d560d03a940085b93c
MD5 f4e44ba8cef8e1dfcdc51aaeaf63de57
SHA1 8da88799a6870cf4b93e21eab9c2c22ac0bff2d9
SHA512 1ab5bd2f3c29ffcea5a6e4d5a709571df54b9eda654b0147a83568b3c53c9736625ddd71711119660987307b59e141e119040c50510100578d6666f44e45cd09
SSDEEP 768:rL3OxwSBqobGZWtZu4aWADIidy8Lu6CmU7RRxJ:rL3itZzaNsuVLBCm8RR7
TLSH
T1FDF2BF75FC569A7798FAA140B2833E06AEF9E173D5C81AE458EC5B0E10D74BD0317C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4bfd046b84622d27e61e64042353baa75e750f43108ce8ac63e5b13660bb1c27
MD5 468087777780337ab092745d12b552fe
SHA1 e63e40eca72c63d54a1adbf5876ca3599406b7fa
SHA512 d0e082ce584e4a7d2dc77db43ba72a5c42298b42bb0f5c69dbef179d2dceb9dc37756047cdf002ddbc8dfcfc60ce0bbfda42bf7a3ecea0ee369fae80208863c0
SSDEEP 768:6FWN37wgkgwSBqobGZz5Zu4aWADIidy8Lu6CmU7RRxJ:FN3g5ZzaNsuVLBCm8RR7
TLSH
T1C603AF76EC46CA7BECBAA640F2473A06EEF5A173C5C959E59ADC5A0E10D70BC0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 edeb1f9c87e9bf07238b361b29e7341318d577ffe76fa20a8b1f6a9ecc8c4a76
MD5 136befe92d5e12cb6cfa6e32925100cb
SHA1 08ad927d8b42a1693c2a5a53350362239c139afa
SHA512 7e3433cb48db9f4c56736816b5803f36f18dd9c0395a9117189401d867da08838ab5fa502a4e6540e5592284a7c4302dce852896d9953b8251898ce5c45be001
SSDEEP 768:LL3PxTSBqobGZWtZu4aWADIidy8Lu6CmU7RRxJ:LL3mtZzaNsuVLBCm8RR7
TLSH
T1C5F2BF7AFC569A7798FAA140B2833E06AEF9E173D5C81AE458EC5B0E10D74BD0313C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 43032224f3f2f50925d8cc7a84486d9afe94ebf390046a0325dd05ad8e0a3b63
MD5 7825b5458155133bfb0d35ead63b0433
SHA1 09b6edc1e0e61df0c328c40c7c73d2a0653d1528
SHA512 76175f4fde3f4bae31c2e15703af7cf56187b62e060e82cae284c3d555d440e1eaa9dc10185ea9c6caa49a37ca5b02fa2cbd3d1874217e9e4640e816b8fab3a2
SSDEEP 768:6FHN37wgkgoSBqobGZT5Zu4aWADIidy8Lu6CmU7RRxJ:GN3s5ZzaNsuVLBCm8RR7
TLSH
T1C503AF76EC46CA7BECBA9640F2473A06EEF5A173C5C859E59ADC5A0E10D70BC0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b69d763b9281d4e17be53b1340ac2eac111711917cdf30a572dd7ccc6b904138
MD5 4f874794926dd3aa79a98a23f514555a
SHA1 0bffbfa7f48c929fa1e2adfb6ef90d06e4a24f23
SHA512 e713cfabde4fd655bfcbe84322dc9253f1a21e74ebb5bcbe5aebf98c39821d33674b03fcc9d2f9b7e89bf2f5cdd001b34bfefe5805d836f37c4cf37ac0742c6c
SSDEEP 768:6FQK3pwgQxwSBqobGZXtZu4aWADIidy8Lu6CmU7RRxJ:hK3NtZzaNsuVLBCm8RR7
TLSH
T14603BF76EC46CA7BECFAA640F2473A06EEF5A173C5C959E5A9DC5A0E10970BC0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c8a1a4c35d4e3ab5184f1d8c97602421f45bc032ad7b3f7b1719665c0a5ffdad
MD5 ccb3fd15e1a088d90f691041cef0c247
SHA1 472771a3fba7a053ff95ac455c3852ba5e0fff34
SHA512 a05d9aba2b75b5c6bf5550ab57f7c09fa1449e1ad01125af03769f62825bf2a210015e5ac3435bedfc0e0d2881aeb547680ce68a77252eeadd68fac4d038f7d1
SSDEEP 768:9rv+4UNbdC33P/BqobGnpZu4aWADIidy8Lq9eVH1S1C:9bsbw3opZzaNsuVLKEH1d
TLSH
T1C503BF36FC5ACA779CF79284B1877A077EF8926386880AD088DC1B4E45DB4AD1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4bcce91d94376b888e554de6cdfefe593d09da7fdc0fd9cb98a6c492d6dacdc6
MD5 ccfd7568d95cd7260343f563aec209f9
SHA1 9149c953491c602618a35642a26d36fdb4290e84
SHA512 19ad130ddb022bb11aed14be0c0781fde2f54b395413d7e96ea45799fbcc46e108d1aebd01c859bd0c6150a829040ba5e0beaf25372eab213e9b8a376777bdd0
TLSH
T1C2E00213531004FDD0A503700197173123D3C03512F103169E2001503C173501F30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7eeb69d0001ab4da44773b5b37b202724de7fbafab8d9988bbe833c03a5bf94f
MD5 973fced60d8d02ac55587f00d6744a35
SHA1 6aa4f447d352c5556567bdc76bfb2e7edb670134
SHA512 50281af45c7460bf0b8a20213a3bce7f8bc461dde3a3338e2422b401d12c053000eb906cbeb7b87aec3b632108a806a85cde3d65f429ffa63c09eeecbd76cdd8
TLSH
T12DE00112535004BDD0A9437001971B3223D3C06912F243179A2001542C6B3601E30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5cf360.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5cf360.TMP
Size 392B
SHA256 adbbad3cf6e493c586d2839b89a5a0491fbbcff06bae3dd4a783b6cea1c23107
MD5 7960566a4d7e086c8acf0e448d6d79f1
SHA1 9988bad4274a2696156ae31b3fcfcfceb5b6bef5
SHA512 4f2f3dceb771efd75c9216061b508a2b7849e1d1d71c8d4159acfb8a589121ddb7a54b574b7e35beee211ebad526f84c13ba8e213b4766b348cf18e5b2eaed6a
MD5 SHA1 SHA512

Submit Download

acf9c9b1-f466-4db2-8883-4261f1bef608.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\acf9c9b1-f466-4db2-8883-4261f1bef608.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 3a49a61b3c8b52540e5faffab8c44ee3990ca647ac51e25cc92c45ce58da2ca1
MD5 4d725672f561292bc2a902b2fe7103a5
SHA1 59ac16a8bb04e2e1e85f1ae752238f169a00384e
SHA512 9b359bc9e906c2e04bee4f715cab879899e6787c20464e11736ec6300ef9415472417e0a911f3c2681d2cfea716fcd2e94d26ad9ac157180c2be7908cacd6d50
SSDEEP 192:yBxdOAaJhWxdOA9jnpJ4mBxdOAf3sxdOA59SrxdOABIQ:yLdOAaJhEdOABnX4mLdOAf3SdOA54Ndd
TLSH
T1C922F020ABE64F16F3F3AEF159B36710AF37FD0559148A0D098691090DA3F4099A9F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6124-275-0x00000268647B0000-0x00000268647B1000-memory.dmp

Download

memory/6124-276-0x00000268647B0000-0x00000268647B1000-memory.dmp

Download

memory/6124-274-0x00000268647B0000-0x00000268647B1000-memory.dmp

Download

memory/6124-277-0x00000268647B0000-0x00000268647B1000-memory.dmp

Download

memory/6124-278-0x00000268647B0000-0x00000268647B1000-memory.dmp

Download

memory/6124-273-0x00000268647B0000-0x00000268647B1000-memory.dmp

Download

memory/6124-269-0x00000268647B0000-0x00000268647B1000-memory.dmp

Download

memory/6124-267-0x00000268647B0000-0x00000268647B1000-memory.dmp

Download